nereida — a local multi-cluster Kubernetes client I built because on-call kept beating me

Sun, 09 Aug 2026 18:21:08 +0000

It's 2am, an alert fires, and I'm three kubectl config use-context commands deep trying to remember which cluster the broken pod is actually in. My AWS session from an hour ago has expired, so first I have to re-run saml2aws, wait for the browser SSO round-trip, and then start looking for the pod. By the time I've found it, tailed its logs, and confirmed it's not the same one that OOMKilled twenty minutes ago, I've burned five minutes on tooling instead of the incident.

I'm a backend dev who does on-call, not a platform engineer, and I got tired of this specific flavor of friction. I'd used k9s before and liked the idea — one place for everything — but mid-incident I don't want to be recalling which keybinding does what on top of the actual incident. I wanted something just as simple, minus the command-memorizing, that also logged me into AWS/EKS without a separate saml2aws dance, and let me point an LLM at the mess in read-only mode so it could help me reason through what's broken without any risk of it accidentally deleting, scaling, or draining something. So I built nereida: all of that, in one window, with tables and buttons instead of a command palette to memorize.

What it actually does

No commands to memorize. Everything's a table, a click, or a confirmation dialog — cluster switching, log tailing, exec, restarts, all of it. If you've used k9s and liked the "one place for everything" idea but never quite internalized its keybindings, this is the same idea as a GUI instead of a TUI.

One view across clusters. Pick any set of kubeconfig contexts and see Pods, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, Services, Ingresses, ConfigMaps, PVCs, HPAs, Events, Nodes, and Secrets in unified tables — every row tagged by cluster, so you're not tabbing between windows to figure out where something lives.

One log stream for a workload. Merge logs from every pod behind a Deployment, StatefulSet/DaemonSet, or label selector — with follow, tail/since, timestamps, and previous/init/ephemeral container support. No more opening five terminal tabs to watch five replicas.

Crash context where you need it. Recovered pods show their previous termination right beside the restart count — 3 · OOMKilled (5m ago) — instead of making you dig for it. Nodes surface active memory, disk, and PID pressure.

AWS/EKS SSO without the CLI dance. Native Keycloak SAML SSO login discovers every AWS role your SAML assertion grants and the clusters reachable from each, then writes credentials and kubeconfig entries directly — connect clusters under different roles side by side without one role switch affecting clusters already connected under another. No saml2aws, no AWS CLI. I could have just fixed my saml2aws config instead, but that still leaves you re-running a separate CLI step before you can even open the tool you actually need — this way logging in is opening the tool.

The rest of the toolbox: exec into a container with a real terminal, port-forward with a panel of open tunnels, lifecycle actions (scale, rollout restart/pause/resume, rollback, delete, CronJob trigger/suspend/resume, node cordon/uncordon/drain — each with a confirmation and pinned to the resource UID so a stale name can't hit the wrong object), per-resource YAML editing behind a diff confirmation, and view/context/namespace selections that survive restarts.

Back to that 2am page: this is what it looks like now. One table shows which of the two clusters the pod is actually in, its previous termination already reads OOMKilled instead of me digging for it, and the AWS session is already valid because logging in happened inside the app, not as a prerequisite CLI step before I could even start looking.

The other hook: a read-only AI assistant and MCP server

Separate from the core client, nereida ships an optional AI assistant for diagnosing clusters, plus a standalone read-only MCP server you can point any MCP client at. Bring your own engine — Anthropic API key, your existing Claude Code or Codex CLI login, or any OpenAI-compatible endpoint, including local models via Ollama/vLLM/LM Studio.

The important part: both are read-only by construction. They only register fetch/list/log-streaming tools — there's no scale, delete, drain, edit, or exec tool for a model to call, so there's no path for an AI assistant to change cluster state, however it's prompted.

No accounts, no telemetry, no hosted backend

nereida runs entirely on your machine using client-go — the same library kubectl uses — against your existing kubeconfig, credentials, and RBAC. There's no nereida server in between, no telemetry, no account to create. Secret values stay redacted in the YAML view until you explicitly hit Reveal, and AI tools only ever see redacted values.

The one exception: if you turn on the AI assistant, that turn's prompt and whatever its read-only tools fetch (resource lists, redacted YAML, events, log excerpts) go to whichever model endpoint you configured. Point it at a local model and nothing leaves your machine. Nothing is sent unless you use the AI features — full details in SECURITY.md.

Where it's rough

I'd rather undersell this than oversell it: nereida is early-stage. It's macOS-first (Apple Silicon and Intel, built and used daily there) — Linux x86-64 is best-effort and hasn't had real-world mileage from anyone but me yet, and Windows currently compiles but isn't packaged. The macOS builds are also unsigned for now (no Apple Developer Program cert yet), so first launch needs one workaround — see below.

Installing it

Prebuilt macOS and Linux builds are attached to each release. Since the macOS build is unsigned, first launch needs:

xattr -cr /path/to/nereida.app

(Right-click → Open no longer bypasses this on macOS Sequoia+. If you'd rather skip Terminal: open the app once to trigger the block, then go to System Settings → Privacy & Security, find where it says "nereida" was blocked..., and click Open Anyway.)

To build from source (needed for Windows, or the standalone MCP server): Go 1.26+, Node 20.19+/22.12+, and the Wails CLI.

go install github.com/wailsapp/wails/v2/cmd/wails@v2.12.0
wails build   # app bundle ends up in build/bin/

Why "nereida"?

Nereids are sea nymphs from Greek mythology who protected sailors and calmed storms. Kubernetes means "helmsman" in Greek — the name felt fitting for something meant to make incidents calmer.

It's Apache-2.0 and on GitHub. I built it to solve my own on-call friction, but if it saves you a few minutes mid-incident too, I'd love to hear about it — and if it's useful, a star helps other people find it.