Security

What it talks to

• Your Kubernetes API servers, through the proxy that applies to each one — see proxies and certificates.
• GitHub, for the update feed and the update downloads from the app’s own releases.
• The chart repositories and OCI registries you add in Settings › Charts, when you add or refresh one, when Helm › Charts is opened on a repository whose index was never read, and when a chart is fetched to be installed. With none added, there are none to reach.

That is the list. Links such as Report a bug, What’s new or Help › Kubermeister on GitHub open in your own browser, not in the app.

There is no backend, no account, no telemetry service and no analytics.

What it uses to get in

Your kubeconfig, read-only. Switching context or namespace changes the app’s memory and its own settings, never the file. The app has exactly your permissions — it authenticates as you and your RBAC applies unchanged.

What it installs in your cluster

Nothing of its own. No deployment, no service, no agent, no service account, no CRD. A chart you install or a release you upgrade is written as you reviewed it, under your own permissions.

What it runs on your machine

Nothing, except helm template when you install a chart or upgrade a release, using the helm you installed. It runs with an environment of its own: an empty kubeconfig, a throwaway Helm home and none of your proxy or Helm variables, so it cannot reach a cluster, your repositories or your plugins. Its output is read, never executed, and Kubermeister writes the objects itself.

What it deliberately cannot do

• It attaches no debug container.
• It runs no privileged pod on a node.
• It carries no files across the exec channel.

kubectl debug and kubectl cp are where those belong. The app is not a way around your RBAC.

A kubermeister:// link is somebody else’s input, so it can only open a page. It never writes to the cluster, opens a shell, forwards a port or downloads anything, and it switches context only after you have said yes. See links.

Secrets

A Secret’s values never cross into the interface as a map:

A reveal asks for the single key it needs; the value re-masks itself on a timer.

• The entries call returns key names with a fixed mask.
• A reveal or a copy asks for the single key it needs.
• A revealed value is held on its own, never in the query cache. It re-masks itself after 30 seconds and goes when you leave the page.
• A copy never renders the value at all — it goes to the clipboard without appearing on screen.

The Manifest tab is the exception: it shows the Secret’s data as the API returns it, base64-encoded, because editing the object requires it.

Renderer hardening

The window is hardened and that is never relaxed:

• sandbox on, contextIsolation on, nodeIntegration off.
• A Content-Security-Policy that loads scripts only from the app itself: default-src 'self'; script-src 'self', with no inline scripts.
• Window-open and navigation handlers route only http: and https: URLs to your OS browser and deny everything else. The window never navigates to any document but the app’s own, so a file dropped on it before the app has finished loading is not opened in the app’s place.
• The preload bridge imports exactly one file, which imports nothing, because a sandboxed preload cannot require anything but Electron built-ins. A build-time check fails the build if the preload bundle ever requires anything else.
• Every request channel is declared with schemas, and its input and output are validated; so are the pushes from the main process and the messages that start, feed and stop a stream.
• A file only enters the app through the OS — a native dialog, or a real drag-and-drop. A path the interface named would be a file it chose to have read. The same holds for the kubeconfig and the CA bundle, which the interface can never set by path.

Credentials the app stores

Only one kind: the username and password of a chart repository, if you give one. It is sealed with the OS secret store — Keychain on macOS, libsecret on Linux, DPAPI on Windows — and written as ciphertext to chart-credentials.json in the app’s user-data directory, readable by your user only. A system with no secret store is refused the password rather than having it written in the clear. The password is never sent over plaintext http: not to a repository, and not to the token server an OCI registry points at. Kubernetes credentials stay in your kubeconfig and your credential plugins.

Build hardening

Electron fuses are flipped in the binary at package time and read before any JavaScript runs:

• runAsNode, NODE_OPTIONS and the inspect arguments are off, so the app cannot be started as a plain Node binary or have a script preloaded into it;
• onlyLoadAppFromAsar and the embedded ASAR integrity check are on, and cookie encryption is on.

Signing and checksums

The macOS build is Developer ID signed and notarised. The Windows and Linux installers are unsigned, so the checksum is how you check them: every release carries a SHA256SUMS file, and the release is made public only after it is attached. See verifying a download.

Installers carry their version in the file name, so a new build never overwrites the files a live update feed points at. Each asset is uploaded on its own and read back to verify its size and checksum before the feed is written, and any failure leaves the previous release complete.

Reporting a problem

If you believe you have found a security issue, please report it through the repository’s security advisories rather than a public issue.