- Category
- Developer Tools
- Rank
- No. 2742Tools index
Previous survey · No. 2127 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Deployment & Operations
- Interfaces
- Web
- Builder
- @ant_oss
- GitHub
- 1.7k stars
- Latest release
- v0.6.4
- Date
About
Karpor is a Kubernetes visualization tool from KusionStack, built for developer and platform engineering teams that need a readable view of what is running across their clusters instead of raw kubectl output. The repository is written primarily in Go with a bundled web UI, and is published under the Apache-2.0 license.
What it does
Karpor runs inside a Kubernetes cluster as its own API server and keeps a searchable copy of resources pulled from every cluster you register by pasting or uploading a kubeconfig. Rules decide which resource types get copied and how much of each object is kept; the copies land in Elasticsearch. A browser dashboard, compiled into the same binary, sits on top: search by keyword syntax or SQL, compliance audits with per-resource scores, relationship maps between resources, and optional AI buttons that explain YAML, events, logs and scanner findings through an OpenAI or Hugging Face model you configure.
Why it's ranked here
The case is architectural. Rather than a dashboard that queries clusters live, Karpor is built on the official Kubernetes API server libraries, with standard RBAC authorization by default, and a controller that starts and stops syncing per cluster as registrations change. That means searches hit one local index instead of every cluster, and keeps the tool inside familiar Kubernetes access control. Apache 2.0 licensed and installable with one Helm chart. Against that, the README calls the project early stage, lists cost optimization as coming soon, and pins Kubernetes client libraries at 1.26. A credible multi-cluster search and audit layer, not yet a finished platform.
What's good
The default sync rule is conservative: eleven common resource types, including Secrets, are stored as metadata only, so a search index never holds secret values unless you widen the rule. Removing a cluster also deletes everything indexed for it. The search design is documented, with boolean operators, regular expressions and field filters on cluster, kind, namespace, labels and annotations, plus an SQL form over a single resources table. The HTTP API is described route by route, and event and log views stream live to the browser. Compliance checks build on a fork of the kubeaudit library rather than homegrown rules.
Tradeoffs
You run and size an Elasticsearch backend alongside it, and the default index is one shard with no replicas, so production use means tuning that yourself. Turning RBAC off switches authorization to allow everything and strips incoming credentials, and cross-origin requests are accepted from any origin by default, so exposure needs care. The source still carries open to-do notes in the sync controller, including wildcard deduplication and a disabled unhealthy-cluster check. AI features require you to supply a model endpoint and token. The default rule still references the older v1beta1 disruption budget API.
How to use it well
Fits a platform team running several clusters that wants one place to find resources, see how they relate and spot misconfigurations, without granting everyone direct cluster access. Start with the quick start: a local kind cluster, the Helm chart, then a port-forward to the dashboard on port 7443. Keep the metadata-only default until you know which kinds need full content indexed. Leave RBAC on outside a sandbox. It is a read and insight layer: it does not deploy, change or remediate workloads, and cost reporting is not there yet.
Technical notes+
cmd/karpor/app/server.go builds a k8s.io/apiserver generic server (etcd prefix /registry/karpor, RBAC authorization mode, CorsAllowedOriginList [".*"], self-signed certs for localhost); with EnableRBAC false it sets ModeAlwaysAllow and wraps the chain in removeAuthorizationHeader. pkg/server/server.go installs cluster, search and rbac REST storage providers, mounts a chi router for the core API, and serves the dashboard from the embedded ui build directory falling back to the dashboard index page when no other route applies. pkg/syncer/reconciler.go is a controller-runtime reconciler on Cluster objects watching SyncRegistry; wildcard resources are deferred until the per-cluster manager exists, and stopCluster calls DeleteAllResources before stopping the manager kept by pkg/syncer/multi_clusters_sync_manager.go. pkg/infra/search/storage/elasticsearch/index.go defines the resources and resource_group_rules indices (1 shard, 0 replicas, max_result_window 1000000, flattened labels and annotations, text content). config/default-sync-strategy.yaml applies the only-metadata TransformRule to all eleven defaults. go.mod: Go 1.22, k8s.io v0.26.1, controller-runtime v0.14.6, go-elasticsearch v8, sqlparser, kubeaudit, go-openai, go-huggingface. docs/api.md lists the SSE diagnosis and interpret endpoints.
Observed
- License
- Apache License 2.0
- Language
- Go (module targets Go 1.22)
- Install
- Helm chart (helm v3.5+), kusionstack chart repository
- Interfaces
- Web dashboard embedded in the server binary; REST API with Server-Sent Events streams; Kubernetes-style API groups
- Search backend
- Elasticsearch (go-elasticsearch v8 client)
- Query languages
- Keyword DSL with AND/OR/NOT and regex; SQL over a resources table
- Default sync scope
- Eleven resource types, all stored as metadata only
- AI providers
- OpenAI and Hugging Face client libraries in dependencies; optional
- Kubernetes libraries
- k8s.io client and apiserver v0.26.1, controller-runtime v0.14.6
Read from README.md, go.mod, LICENSE, docs/quick-start.md, docs/design_docs/core-workflow.md, docs/design_docs/search_language.md, cmd/karpor/app/server.go, pkg/server/server.go, pkg/syncer/multi_clusters_sync_manager.go, pkg/syncer/reconciler.go, pkg/infra/search/storage/elasticsearch/index.go, config/default-sync-strategy.yaml, docs/api.md.
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.