iscreambyte

Aksimuth

Your AKS fleet, on your desktop, on your terms.

A local-first desktop console for AKS and Kubernetes. It works through the credentials you already have — your Azure CLI session and your kubeconfigs — and never sends anything anywhere else.

DownloadHow it handles credentials

Early release, actively developed.

The Aksimuth console: fleet overview, resource browser, and live pod logs.

Built to be trusted with cluster access.

For people who read the security section first. Here it is.

  • Your credentials stay yours

    No telemetry, no Aksimuth cloud backend, no credential storage. Credentials stay in your Azure CLI and kubeconfig, where they already live.

  • User credentials only

    Aksimuth connects to clusters with your user credentials — never --admin. The kubeconfig it fetches is held in memory and never written to disk.

  • Secrets are always masked

    Secret values are masked in every view. Helm release visibility covers status, chart, and version only — release values are never decoded.

  • Permission pre-checks

    Before a mutation is offered, Aksimuth checks what you're actually allowed to do via SelfSubjectAccessReview.

Find every cluster you can reach.

  • AKS fleet discovery

    One Azure Resource Graph query finds AKS clusters across all your subscriptions, using your own Azure CLI session. If Resource Graph isn't available, it falls back to per-subscription listing.

  • Kubeconfig discovery

    Existing kubeconfigs are discovered too, including KUBECONFIG multi-file merges — so non-AKS clusters are first-class citizens.

  • Auth readiness per context

    Each context shows whether it's ready to connect, and flags missing exec helpers such as kubelogin before you hit a cryptic auth error.

Everything you reach for during an incident.

  • Browse every resource type

    API discovery surfaces every listable resource type, grouped sensibly: workloads, config, network, storage, access, GitOps (including Argo CD and Flux), and CRDs.

  • Typed views for the hot paths

    Pods and deployments get dedicated, typed views rather than generic object dumps.

  • Logs, exec, port-forward

    Bounded log fetches and live follow with automatic reconnect, an interactive exec terminal, and pod port-forwarding.

  • Metrics and relationships

    Resource metrics via metrics-server, and a relationship graph that shows how resources connect to each other.

  • Helm release visibility

    See which Helm releases are installed, their status, chart, and version. Values are never decoded.

  • Safe mutations, by construction

    Every change goes through a server-side dry-run with a unified diff preview and an explicit one-time confirmation. Deleting a resource requires typing its name.

An extra pair of eyes. Only when you ask.

Aksimuth can drive a coding assistant you already have installed locally — Claude Code or GitHub Copilot CLI, using their own sign-in — to help reason through an incident. It is entirely optional and off unless you invoke it.

When you do use it, evidence is redacted before anything leaves the app: keys, tokens, emails, IP addresses, and JWTs are stripped. You review and approve the exact outbound prompt before anything is sent. Nothing goes anywhere without your explicit approval.

Platforms and prerequisites.

Platforms
Windows, macOS, and Linux. Aksimuth is a desktop app built with Wails.
Azure CLI
Needed for AKS fleet discovery. Optional if you only connect through existing kubeconfigs.
kubelogin
Required for clusters with Microsoft Entra ID authentication enabled.
Status
Early release, actively developed.

Download.

All builds are published on the GitHub releases page, alongside achecksums.txt for verification.

All artifacts live on thelatest release page: a Windows installer (.exe), a Windows portable build (.zip), a macOS universal build (.zip), a Linux archive (.tar.gz), andchecksums.txt.

Verify your download

Compare the SHA-256 checksum of the file you downloaded against the matching line inchecksums.txt from the same release.

macOS / Linux

shasum -a 256 <downloaded-file>

Windows

certutil -hashfile <downloaded-file> SHA256

The output must match the corresponding entry in checksums.txt exactly. If it doesn't, delete the file and download it again from the releases page.

On the roadmap.

Planned, not shipped — so you know where things are headed.

  • Service port-forwarding
  • Resource watches
  • Helm release lifecycle (install, upgrade, rollback)
  • Prometheus integration