periscope
Self-hosted multi-cluster Kubernetes console for EKS with keyless access, OIDC auth, human impersonation, structured audit logs, live SSE views, schema-aware editor, Helm + Karpenter integration.
Ficha actualizada 23 sept 2026, 8:33 · upstream 23 sept 2026, 8:06 · release v1.1.6
Qué es periscope
Descripción editorial construida a partir del repositorio, su documentación y sus señales de mantenimiento.
Periscope is a self-hosted, multi-cluster Kubernetes console built specifically for EKS environments. It authenticates to clusters using Pod Identity or IRSA without requiring static AWS credentials on the console pod. Users authenticate via OIDC (Auth0 or Okta), and each user's identity is impersonated on every API call, ensuring that cluster audit logs record the actual human operator rather than a shared bot account.
The platform runs as a single stateless binary with no persistent secrets stored locally. It provides a complete console experience including multi-cluster fleet management, live resource browsing over SSE streams, schema-aware YAML editing, full Helm lifecycle management (install/upgrade/rollback/diff), and comprehensive EKS-specific features such as IAM access analysis, Amazon Inspector v2 CVE surfacing grouped by package, and managed node group upgrade readiness.
Key differentiators include keyless cluster access through IRSA/Pod Identity, a real human identity in every audit trail row, an intelligent dashboard that surfaces problems at a glance across clusters, and a complete toolchain from configuration to deployment with full observability.
- Multi-cluster fleet management: Monitor multiple EKS clusters simultaneously with a single console interface
- Security compliance auditing: Track all cluster actions through human-impersonated audit trails for regulatory reporting
- Cost optimization: Identify unused workloads and underutilized GPU instances across the fleet
- DevOps automation: Automate cluster provisioning, Helm upgrades, and add-on deployments via CLI or API
- Incident response: Rapidly access cluster resources and logs during production incidents with full context
- Developer productivity: Schema-aware YAML editing and live SSE views reduce manual configuration time
- Keyless on EKS: Cluster access is obtained dynamically via Pod Identity or IRSA, eliminating the need for static AWS credentials on the console pod
- Human-impersonated audit trail: Every API call carries the actual user's OIDC identity, ensuring cluster logs show real operators rather than shared bot accounts
- EKS-native features: Built-in IAM access analysis, Amazon Inspector v2 CVE surfacing grouped by package, and managed node group upgrade readiness checks
- Complete console experience: Includes multi-cluster fleet views, live SSE resource browsing, schema-aware YAML editing with server-side apply support, full Helm lifecycle management, and in-browser cluster shell
- Single binary architecture: The entire application runs as one stateless Go binary with no persistent secrets or static configurations
- No native multi-cluster agent support beyond the documented periscope-agent tunnel (requires manual registration)
- OIDC integration is limited to Auth0 and Okta; other identity providers require custom implementation
- Audit log persistence requires external storage configuration via Helm audit block, not built-in
- Watch streams are subscription-based with no guaranteed real-time delivery for all resources
- No native support for cluster-wide secrets management beyond the documented agent tunnel approach
Perfil de infraestructura
Estimación inicial derivada del repositorio y de los servicios detectados.
Despliegue detectado
Qué señales reales de instalación hemos encontrado.
Deploy using the official Helm chart from oci://ghcr.io/gnana997/charts/periscope. Pin to a specific version or use the latest stable tag via GitHub API. Configure OIDC identity provider credentials in examples/config/auth.yaml.auth0 or auth.yaml.okta. For multi-cluster, deploy per-isolated namespaces and register clusters via the agent tunnel. Enable audit persistence with an external storage backend (S3, etc.) using Helm's audit block. Use watchStreams configuration to enable SSE streams for live resource monitoring.
Stack y dependencias
Componentes inferidos a partir de manifests, configuración y documentación.
Puede sustituir a
Relaciones detectadas por el análisis del repositorio y su categoría.
Experiencia real de la comunidad
Ayuda a contrastar la estimación automática con instalaciones reales.
Todavía no hay datos comunitarios para este proyecto.