Skip to main content
Once you’ve connected a cloud account, Nuphos discovers the Kubernetes clusters in it and lets you browse and operate them directly, or hand the work to the agent. Every one of them lands in the same browser with the same pages — the provider only decides how the credential is obtained.

​
On-prem clusters

A cluster whose API server has no address routable from Nuphos is reached through the relay: you install a small agent inside the cluster, and it dials out to Nuphos. Nothing needs to be opened inbound. Enrolment is deliberately tunnel-first — you install the agent and watch it connect before handing over any credential.

​
Connecting to a cluster

Open a cluster from its account and Nuphos provisions access for you — no manual kubeconfig wrangling. Cloud access follows the connected identity; cluster tokens and kubeconfigs have their own lifetimes and RBAC permissions. A cloud IAM grant is not always an in-cluster grant. See IAM trust model.

​
What you can browse

  • Workloads — Deployments, Pods, ReplicaSets, StatefulSets, DaemonSets, Jobs, CronJobs, and Helm releases.
  • Networking — Services, Ingresses, Endpoint Slices, Network Policies.
  • Config & storage — ConfigMaps, Secrets, Storage Classes, Persistent Volumes and Claims.
  • Access control — Roles, Role Bindings, Cluster Roles, Cluster Role Bindings, Service Accounts.
  • Custom resources — CRDs and their instances.
You also get the cluster’s events, an overview of health, and per-node status and utilization.

​
Working inside a cluster

  • Pod exec — open an interactive terminal inside a pod to debug.
  • Logs — stream and search container logs.
  • Bulk actions — select multiple resources to act on them at once.
Prefer asking the agent: “why is the checkout deployment crash-looping?” It will read events, logs, and config across the cluster and walk you to the cause.

​
Connect private or self-managed clusters

Follow On-prem Kubernetes for the relay wizard, cluster credential and RBAC checks. It also applies to self-managed clusters on cloud VMs. Validate read access to the intended namespace before changing a workload. Remove the relay and unneeded RBAC deliberately when retiring access.