OSS
Browse OpenForge documentation
← All OSS projects
ClusterDeck · OSS Project

ClusterDeck

A macOS desktop tool that discovers frequently recreated VM/Kubernetes environments and automates SSH and kubeconfig access around stable Profiles

macOSTauriRustReactTypeScriptSSHKuberneteskubeconfigProxyJump
RepositoryGitHub ↗
Documentation3 sections
Updated2026-08-28T00:00:00.000Z
ECOSYSTEM ROLE
Workstation Access Layer

Treats frequently recreated VM and Kubernetes environments as stable Profiles rather than IP addresses, automating SSH, Bastion/ProxyJump and kubeconfig access from the workstation.

Profile-oriented accessSSH & ProxyJumpkubeconfig normalization
PROJECT CONFORMANCE

Repository evidence checklist

1 present · 8 missing

Present means an explicit repository or site artifact was observed. Missing means this audit did not observe that artifact; it does not prove the underlying practice does not exist. Tracked links point to the closest existing backlog owner and do not create issues automatically.

LICENSE
Missing
Tracked · Narwhal #162 ↗
CONTRIBUTING
Missing
Tracked · Narwhal #162 ↗
CODE_OF_CONDUCT
Missing
Tracked · Narwhal #162 ↗
SECURITY.md
Missing
Tracked · Narwhal #162 ↗
SBOM evidence
Missing
Tracked · Narwhal #162 ↗
Provenance / attestation
Missing
Tracked · Narwhal #162 ↗
GitHub Release
Missing
Tracked · Narwhal #162 ↗
Project detail docs
Present
3 sections
Evidence observed
Community contributor signal
Missing
1 or fewer contributors reported
Tracked · Narwhal #169 ↗
repository audit not indexed
Problem

Frequently recreated VM and Kubernetes labs change IP addresses, forcing users to rebuild SSH aliases, bastion/ProxyJump paths, remote kubeconfigs, and local contexts by hand

Approach

Keep a stable Profile identity while automating host discovery → SSH bootstrap → alias/ProxyJump → kubeconfig fetch/normalization → Kubernetes connectivity verification in one macOS desktop workflow

ENGINEERING EVIDENCE

Show reviewable engineering evidence instead of relying on headline numbers.

User model
Profile-first

Keeps a stable environment identity while VM or cluster IP addresses change.

Access path
SSH + Bastion

Orchestrates connectivity, public-key bootstrap, aliases, and ProxyJump with native OpenSSH behavior.

Kubernetes
kubeconfig sync

Fetches remote kubeconfig, normalizes endpoint/context names, and stores per-Profile local configuration.

Verification
3 layers

Separates SSH, kubeconfig, and Kubernetes API connectivity so failures are visible at the correct boundary.

START HERE

You do not need to read the README from top to bottom.

UNDERSTAND
Architecture →

Start with the Tauri UI → Rust core → OpenSSH/kubectl/filesystem boundary.

START
Getting Started →

Set up the macOS development environment and Profile-based SSH/kubeconfig workflow.

SCOPE
Overview →

Understand the product boundary as a workstation access layer rather than a Kubernetes console.

ENGINEERING PRINCIPLES
Source-driven

Keep project explanations grounded in repository source, architecture, tests, releases, and operating records.

Independently useful

Even inside one ecosystem, keep boundaries independently installable, verifiable, and releasable whenever possible.

Evidence over claims

Prefer reproducible verification, incident knowledge, upgrade gates, and operating evidence over feature-count claims.

Overview

ClusterDeck is a macOS-first desktop tool for keeping local access to frequently recreated VM and Kubernetes environments stable.

It is not a general Kubernetes management console. Its boundary is the workstation access layer: discover a remote environment, make SSH access usable, fetch and normalize kubeconfig, then verify Kubernetes connectivity.

IP / Host Discovery
      ↓
SSH Connectivity
      ↓
SSH Bootstrap (optional)
      ↓
SSH Alias / ProxyJump
      ↓
Remote kubeconfig Fetch
      ↓
kubeconfig Normalization
      ↓
Local Profile
      ↓
Kubernetes Connectivity Check

Design

  • Tauri 2 + Rust for filesystem, process execution, SSH orchestration, and kubeconfig handling.
  • React + TypeScript for a compact Profile/Host/Connect/Status UX.
  • Native OpenSSH first instead of reimplementing SSH behavior.
  • Profile-oriented identity so users think in environments rather than changing IP addresses.
  • ClusterDeck-owned configuration under ~/.clusterdeck/ without rewriting unrelated user SSH/Kubernetes configuration.

Security boundary

Bootstrap passwords are one-time inputs and should not be stored or logged. Generated kubeconfigs use restrictive permissions, destructive merges should be reversible, and persistent credentials should use a secure local store such as macOS Keychain.

MVP

  1. Profile CRUD
  2. Multi-host discovery and SSH bootstrap
  3. SSH alias generation
  4. Bastion / ProxyJump
  5. Remote kubeconfig fetch and normalization
  6. Per-Profile kubeconfig storage
  7. Kubernetes connectivity verification
  8. Minimal-click macOS UI

Cross-platform and provider-specific discovery remain later phases.

Development

pnpm install
pnpm tauri dev
pnpm build
cargo check --manifest-path src-tauri/Cargo.toml

Documentation

TopicPage
OverviewOverview
ArchitectureArchitecture
Getting StartedGetting Started