Try Kubius
⌘K

Working with resources

Configuration (ConfigMaps & Secrets)

ConfigMaps

The Configuration page has a tabbed list - ConfigMaps and Secrets. The System Objects toggle filters by namespace: when it’s off, ConfigMaps and Secrets that live in system namespaces (kube-system, kube-public, etc.) are hidden; turn it on to see them alongside everything in your selected namespaces. ConfigMaps in your own namespaces - including the per-namespace kube-root-ca.crt that Kubernetes injects into every namespace - always show, since they belong to that namespace.

ConfigMap detail

Four tabs:

  • Overview - metadata + labels + annotations
  • Data - key/value table with a filter bar; click a key to reveal the value in a side panel
  • Consumers - every Deployment / StatefulSet / DaemonSet / ReplicaSet / Pod in the namespace that mounts the ConfigMap as a volume or references it via env / envFrom
  • YAML

Base64 decode

When a value in the Data tab looks like base64, a Base64 Decode toggle appears next to the value panel. Useful for ConfigMaps that hold things like inline certs or binary blobs.

Export

The ConfigMap detail header has an Export menu with three formats:

  • .env - KEY=VALUE lines, with quoting for values containing newlines, quotes, or backslashes
  • .csv - proper CSV escaping
  • .xlsx - Excel format (uses macOS’s built-in zip to produce a valid .xlsx)

Deleting

The ConfigMap and Secret detail headers have an Actions ▾ menu with Delete (graceful) and Force Delete. You can also right-click a row in either list → Delete X for a graceful delete with confirmation.

Secrets

Same layout as ConfigMaps but with safety controls.

Reveal flow

By default the Data tab shows •••••••• for every value. Tap Reveal Values in the toolbar to decode (base64) and show them. By default this requires Touch ID - your fingerprint or Apple Watch tap authorises a 15-minute reveal session. After that the values lock again until you re-authenticate.

You can disable the Touch ID requirement in Preferences → Secrets, but the lock/reveal toggle stays so it’s still hidden by default. Reveal is all-or-nothing - the toggle decodes every value at once; tap Lock Values (or wait out the 15-minute session) to hide them again.

Export

Same three formats as ConfigMaps (.env / .csv / .xlsx). Every export requires fresh Touch ID regardless of the 15-minute reveal session - Kubius re-prompts on every export so an unattended Mac with a revealed Secrets panel can’t be used to dump secrets to disk.

Consumers tab

Same as ConfigMaps - every workload in the namespace that mounts the Secret or references it via env / envFrom.

Resource Quotas

The Resource Quota detail view shows each quota line with a usage bar - blue under 70%, orange 70-90%, red above 90%.

Limit Ranges

Simple list view; the YAML tab has full structural detail.