app/api/
Thin FastAPI routers — parse, call, envelope. Logic lives below this layer, never in it.
k8boss-admin browses every resource a cluster serves, and changes them through a path
that checks the permission first, dry-runs the write, shows you the diff, waits for a
confirmation, and records what happened — including what failed. It's the web UI for
the work you'd otherwise do with kubectl across several clusters, built on
the assumption that the dangerous part was never reading.
The safety model
Scale, restart, suspend, rollback, cordon, drain, create, replace, delete — every mutation in the console, no exceptions, in this order:
SelfSubjectAccessReview for the exact verb, group, resource, namespace and name. A denial names the missing permission — never a bare "forbidden".dryRun=All on the same call. The projection comes from the API server's own admission chain — webhooks, defaulting, quota — not a simulation this console wrote.applied: true appears only when the write actually reached the cluster. A successful dry run is applied: false — always.unavailable[] + partial: true
a number never derived is null, never 0
PUT carries the resourceVersion you were looking at
drain plans before it acts — evict / skip / blocked, per pod
Product tour
Four moments from the console, redrawn here to show the shape of the interaction — not a chart, a permission check that names itself.
create pods/exec reads every Secret mounted into a pod. edit
hands over the namespace's credentials without a rule that mentions Secrets at all.
Under the read/write split
A sample of the screens that exist because the obvious version of them would have been confidently wrong.
Quotes the scheduler's own event, with the age of the attempt behind it, and a node table that only ever rules a node out — never claims one fits.
policyTypes: [Ingress] with no egress section restricts nothing. The page says that outright instead of echoing YAML people misread.
Expiry, and whether the SANs actually cover the hostname — a green row everywhere else in Kubernetes and a browser that refuses to connect.
Counts live coverage from the pods it actually selects. 0 pods is a finding, not a blank.
Does the ResourceQuota arithmetic before you submit, and names the one bound that's tight — including the compulsory-resource rule a 403 never mentions.
Leader leases, APIService availability, CRD establishment, webhook backends, kubelet skew — no single verdict, because a rollup that could not read one signal should not report the others as healthy.
Decodes the PKCS#10 request and shows what it asks to become — an org of system:masters reads as cluster-admin, not as a routine renewal.
Reads every namespaced kind first: claims that get destroyed, addresses that stop answering, webhooks left without a backend. The diff shows the wrong object on purpose.
NoExecute names the pods it deletes before you confirm — and says plainly that a PodDisruptionBudget does not stop it, unlike a drain.
Refuses an arithmetic shrink before sending anything, and separates "the request changed" from "the volume grew" — often two different moments.
Per cluster, per session: the API server checks permissions and writes its own audit log as the actual person — closing the gap ADR-0007 spent a document being honest about.
Same manifest editor for every kind, including your CRDs — with a warning, not a block, when a scalar reads differently than kubectl would send it.
What it ships, precisely
k8boss-admin is not a deployment engine — with two stated exceptions, and they are different acts. Both go through the same write funnel as everything else: no reconcile loop, no desired state, no watch. Both are off by default.
An exposure written into a cluster with no controller is an object that routes nothing while looking created. Eight objects, one write funnel, live status like every other page.
ADMIN_ROUTER_MANAGE_ENABLEDVendored byte-for-byte from upstream's release and pinned by SHA-256. Twenty-six writes in two phases, because §16's operator portal on a cluster with no OLM is empty, correct and useless.
ADMIN_OLM_INSTALL_ENABLEDapplied: true there
means one Subscription exists, and never that an operator is running.
Shape of the thing
Every write is written once, in one place, and everything else calls it.
Thin FastAPI routers — parse, call, envelope. Logic lives below this layer, never in it.
Discovery, generic read/YAML, and the typed read models — workload rows, scheduling, network correlation, TLS coverage, quota arithmetic.
Every write. The single funnel — gate → preflight → apply → diff → audit — plus every feature's apply_fn.
Append-only, hash-chained trail: record(), query(), verify(), export.