Mini K8s dashboard where the AI inherits your permissions, not root

What it does

k8m is a Go-based Kubernetes dashboard built on Baidu’s AMIS frontend. It bundles multi-cluster management, pod file browsing, Helm chart handling, CRD trees, and event forwarding into a single executable. The backend uses the kom client to talk to clusters, and it can run fully offline with its baked-in Qwen model or dial out to Ollama, DeepSeek, and OpenAI backends.

The interesting bit

The project treats AI integration as a production security problem, not just a chat window. It ships 49 built-in MCP tools for cluster operations and ties every LLM tool call to the actual end-user’s RBAC permissions—so the AI agent can only delete a pod if the human asking the question already could. That is a rare bit of operational sanity in the current rush to give LLMs shell access.

Key highlights

• Single static binary (Go backend + embedded AMIS frontend) supporting x86 and ARM on Linux, macOS, and Windows.
• Built-in AI diagnostics: log analysis, YAML translation, describe decoding, and k8s-gpt integration with Chinese localization.
• Visual MCP server management: exposes cluster operations as tools, records call logs, and integrates with mcp.so services.
• RBAC-aware AI: multi-cluster permissions (read-only, exec, admin) map directly to MCP tool execution, preventing privilege escalation by the LLM.
• Plugin architecture for features like leader election, cluster inspections via Lua rules, and webhook alerts to DingTalk, WeChat, or Feishu.

Caveats

• The README warns that default login credentials are k8m/k8m and expects operators to change them before production use; 2FA is supported but not enforced out of the box.
• Because the Go binary embeds the AMIS frontend distribution, a missing dist directory will break local development builds.

Verdict

Worth a look if you run multiple Kubernetes clusters and want an AI assistant that respects your existing RBAC boundaries. Skip it if you are already happy with kubectl and a separate observability stack, or if you consider any LLM-driven cluster mutation too risky regardless of permission scoping.