tern-kube

Tern Kube reads kubectl output in Tern as native views: sortable, filterable tables you can click into, with the original output one click away (Raw).

Stable since 1.0.0. See Features for what it covers.

• Click a column to sort. Ages, quantities, ratios and restarts sort by value, not text.
• Click a row for an inline inspector; Inspect shows every field, the source line and, with -o json, the object tree.
• Filter chips by status, namespace and kind, plus Problems (failing, not ready, restarting).
• Copy the name, a qualified id, or a ready describe, logs or get -o yaml command for the same context and namespace.
• describe renders as cards with an events timeline, -o yaml as a document list, and apply / delete / scale / rollout restart as a result summary (a result, never a preview).
• Secret values are masked in the native view.
• kubectl logs renders as records: level, source, time and parsed JSON, klog or logfmt fields, level and source chips, First error, a row inspector with copy chips, and variants (other container, --previous) run in a split. kubectl events and get events link each row to its object.
• logs -f and event watches show raw while they run and turn native when they stop; other watches, -o jsonpath and very large tables stay raw.

It claims kubectl and kubecolor running get, describe, top, logs, events, apply, delete, rollout restart and scale, also after global flags (kubectl --context prod -n web get pods), and takes over from Tern's built-in kubectl get and kubectl logs lenses. Pipelines and redirected output are never lensed.

get all	describe

Explore live on a row, or Tern Kube: Explore in the palette, opens a live block beside the pane. It pins the context it queries, shows where that context came from, and only refreshes when you ask.

In logs (L): ] [ next/previous error, x level floor, a container, o previous instance, w wrap, / search, enter inspector. In events (v V): x Warnings only, ] [ next/previous Warning, / filter, enter opens the object. In Helm views (H): h history, v values (again: next mode), M manifest, N notes, K hooks, R resources, = revision diff, space marks a revision to diff against, ctrl+r rollback, ctrl+g drift of the detected chart. Secret values stay masked.

Compare (x) reads the object or list from other contexts of the same kubeconfig (one, all, or a configured set), each run pinned with --context, and shows where each side came from and when. One object gives a diff; a list gives one row per object and one column per context (present, same, changed, missing, extra). There [ ] pick the other context, f filters, enter opens an object's diff and r refetches every side; nothing refreshes on its own. Compare views are read-only (c switches context first), and Secret values stay masked.

One object across contexts	A list across contexts

Inside the GitOps views (drift, export, git), a view's own keys take precedence: there t, X, e, p and P keep their view meaning.

Shell, logs and port-forward are also chips in the lens inspector (two clicks from any row). They open beside the pane by default; see configuration.

Delete, rollout restart/undo/pause/resume, scale, patch, label, annotate, cordon, uncordon, drain, debug, CronJob run-now (Explore keys or inspector chips) and Tern Kube: Apply file or directory open an approval block first: server dry run, kubectl diff or a before/after object diff per resource, then a confirmation scaled to the risk. Edit (e or the Edit chip) opens kubectl edit in a split; after you save, the approval block shows the diff before kubectl applies it. Deletes and other broad changes need the target typed. Helm rollback (ctrl+r on a release or revision) shows the recorded change between the two revisions and the live kubectl diff, then needs the release name typed. Nothing runs if the preview fails or the inputs or target change before you confirm.

Typed commands can get the same preview with the opt-in shell guard for zsh, bash and fish: kubectl apply, delete, scale, patch, label, annotate, cordon, uncordon, drain, rollout restart|undo|pause|resume and edit (after you save) wait for your approval in Tern; everything else runs untouched. It is a seatbelt, not a policy: command kubectl and scripts bypass it. Setup: shell/README.md.

Explore knows the git repository you ran the command in: m opens an object's manifest at its line, = diffs it against the live object, ctrl+g reports drift for a directory, Kustomization, Helm chart or a locally checked out Argo CD / Flux app (changed, missing, unmanaged), and E exports live objects as clean manifests, optionally onto a new branch and commit. Chart directories are matched to deployed releases on their own and rendered with the deployed values or a values file next to them. Push and pull requests are off unless you turn them on. x on a drift report compares the same source against several clusters at once, one column per context.

Outside Tern, bin/tern-kube-drift produces the same report for CI, also for several contexts at once (example workflow). Details: docs/gitops.md.

tern plugin install github.com/contrafy/tern-kube

Installing copies the whole repository (about 6 MB); Tern loads only plugin.toml and plugin/.

Requires Tern 0.9 or later (tested on 0.9.8) with shell integration and native command output on (command_lenses, the default), and kubectl installed. Started from the Dock or Finder, Tern has a minimal PATH; tern-kube reads yours from your login shell (Programs and PATH). Tested on macOS (window and panes) and on Debian 13 remote hosts with fish, bash and zsh login shells.

The shell guard, tern-kube-drift and the bash/fish alias helper live outside the plugin; clone the repository for those:

git clone https://github.com/contrafy/tern-kube
tern-kube/scripts/tern-kube-aliases add k   # bash/fish only; zsh expands aliases itself

Settings: Tern Kube: Settings in the palette, or edit ~/.config/tern-kube/config.json, created on first load with a $schema line so editors complete and check every key (configuration).

To remove: tern plugin remove tern-kube.

Panes on a host added with tern remote setup user@host run that host's kubectl and kubeconfig, so the host half must be installed there too. In a pane on the host:

"$TERN_EXE" plugin install github.com/contrafy/tern-kube

Keep the local install: the window half (quick actions, links, block placement) runs on your machine. Install the same tern-kube version on both. Limits and troubleshooting: remote hosts.

Everything below is in 1.0. Release history: CHANGELOG.md.

-: not applicable or outside v1.0. partial: Nodes, ConfigMaps and Secrets appear only as relations of Pods; custom resources show owners only; Helm releases diff and drift but do not export. Node shell is a debug pod.

make bootstrap   # pinned tools into .tools/
make check       # format, lint, typecheck, unit tests, benchmark
make e2e         # drives an isolated Tern window; needs Docker
tern plugin link .   # load the checkout in place; reloads on save

make e2e runs against a disposable kind cluster (scripts/cluster.sh create) and refuses any other context.

More: architecture, security model, testing, SDK capability matrix, performance, contributing.

MIT