Read-only Kubernetes traffic topology debugger. Pick a host and see its configured path from the load balancer and ingress controller through Ingress or Gateway API routes, Services, and endpoints to Pods.
- Search hosts, paths, and Services across namespaces; switch between Simple and Expanded views.
- Ingress, Gateway API, and F5 CIS resources, discovered when their APIs are installed.
- Diagnostics for missing Services, wrong backend ports, unready Pods or endpoints, and stale watches.
- Read-only RBAC, built-in sign-in, and Kubernetes 1.20 or newer.
NorthScope reads Kubernetes configuration only. It does not capture traffic or probe connectivity.
Requirements: Kubernetes 1.20+, Helm 3, and an ingress controller.
The chart exposes NorthScope through an Ingress by default. Set the host in a values file:
# values.yaml
ingress:
hosts:
- host: northscope.your-domain.com
# Recommended: a TLS Secret from cert-manager or your own certificate.
tls:
- secretName: northscope-tls
hosts:
- northscope.your-domain.comhelm repo add northscope https://emircanagac.github.io/northscope
helm repo update
helm upgrade --install northscope northscope/northscope \
--namespace northscope --create-namespace -f values.yamlOpen the host in a browser and sign in as admin with the generated password:
kubectl -n northscope get secret northscope-auth -o jsonpath='{.data.password}' | base64 -d; echoSet ingress.className if the cluster has no default IngressClass. Without an ingress controller, set ingress.enabled=false and run kubectl -n northscope port-forward svc/northscope 18080:80.
See the chart values and production access guide for your own password, GitOps with auth.existingSecret, SSO at the edge, NetworkPolicy, and namespace-scoped installs.
Load sample healthy and broken routes into a test cluster after installing NorthScope:
kubectl apply -f https://raw.githubusercontent.com/emircanagac/northscope/main/examples/demo-topology.yamlNorthScope only uses get, list, and watch, and never reads Secrets or Pod logs through the Kubernetes API. The UI requires a sign-in by default because topology data includes internal hostnames and IPs. Report vulnerabilities as described in the security policy.
NorthScope is an early preview. Real-cluster feedback and bug reports are welcome.