KubeGlass compared with other Kubernetes tools

These pages compare KubeGlass with the tools people most often weigh it against. Every claim about another tool comes from that tool’s own documentation, release notes or source code, linked in the notes below the table and on each tool’s page. We checked them on 5 October 2026, and those about Radar, Kite, Aptakube, Portainer 3.0, Headlamp’s sign-in, Helm and plugins, and Lens’s logs and extensions on 7 October 2026. If something has changed since, open an issue and we will correct the page.

In the table, Yes means built in, Plugin means a plugin or extension you install (the note says whose), Paid means a paid plan, and Partial says what is there. Not documented means we found nothing either way.

Features

Feature	KubeGlass	Headlamp	k9s	Lens	Freelens	Radar	Kubernetes Dashboard
License	AGPL-3.0	Apache-2.0¹	Apache-2.0²	Proprietary³	MIT⁴	Apache-2.0⁵	Apache-2.0⁶
Free, with no account	Yes	Yes⁷	Yes²	Partial (paid above $10M revenue; Lens ID required)⁸	Yes⁴	Yes⁹	Yes
Maintained	Yes	Yes	Yes	Yes	Yes	Yes	No (archived on 21 January 2026)¹⁰
Runs as	Local binary with a browser UI, or in a cluster	Desktop app, or in a cluster¹¹	Terminal UI	Desktop app¹²	Desktop app	Local binary with a browser UI, desktop app, or in a cluster⁵	In a cluster
Shared install with per-user sign-in	Yes (built-in OIDC, token or auth proxy)¹³	Yes (OIDC, token or auth proxy)¹⁴	No	No¹⁵	No	Yes (OIDC or auth proxy; reads checked per namespace)¹⁶	Yes (bearer token)¹⁷
Several clusters	Yes (from a kubeconfig)¹⁸	Yes¹⁹	Partial (one at a time)²⁰	Yes²¹	Yes	Partial (one at a time)²²	No (one per install)²³
Live updates (watches)	Yes	Yes²⁴	Yes²⁵	Yes²⁶	Yes	Yes⁵	No (polls every 10 s)²⁷
Logs of a workload’s pods in one view	Yes	Yes²⁸	Yes²⁹	Yes (a Deployment’s pods in one stream)³⁰	Plugin (third-party)³¹	Yes³²	No (one container at a time)³³
Shell in a container	Yes	Yes	Yes	Yes	Yes	Yes³⁴	Yes³⁵
Port forward	Partial (when it runs on your computer)³⁶	Partial (desktop app only)³⁷	Yes	Yes³⁸	Yes	Partial (when it runs on your computer)³⁴	No
Edit YAML	Yes, with dry run and diff	Yes, with dry run and diff³⁹	Yes (in your editor)²	Yes (diff view Paid)⁴⁰	Yes	Yes (server-side apply)³²	Yes
Helm releases	Yes	Plugin (bundled with the desktop app; off by default in a cluster)⁴¹	Partial (no install or upgrade)⁴²	Yes⁴³	Yes⁴⁴	Partial (no install)⁴⁵	No
Argo CD and Flux	Yes	Plugin (Argo CD in alpha)⁴⁶	Plugin (community)⁴⁷	Paid⁴⁸	Plugin (Argo CD third-party)⁴⁹	Yes⁵⁰	No
Custom resources	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Who can do what	Yes (access matrix, who can)	No (role and binding lists)⁵¹	Partial (one subject’s rules)⁵²	No (role and binding lists)⁵¹	No (role and binding lists)⁵¹	Partial (a ServiceAccount’s rules, your own)⁵³	No (role and binding lists)⁵¹
Prometheus metrics	Yes	Plugin (bundled with the desktop app and the image)⁴⁶	No⁵⁴	Yes⁵⁵	Yes⁵⁶	Yes⁵	No (metrics-server only)⁵⁷
Plugins or extensions	Partial (actions, keys, panels, columns, k9s import)⁵⁸	Yes⁵⁹	Yes (commands bound to keys)⁴⁷	Paid (Plus, Pro or Enterprise)⁶⁰	Yes⁴⁹	Not documented	No
Keyboard-driven	Yes (k9s keys, command palette)	Partial (search, a few shortcuts)⁶¹	Yes	Partial (command palette, shortcuts)⁶²	Partial (command palette, shortcuts)	Yes (list keys, command palette)⁵	No
Relationship map	Yes (Map view)⁶³	Yes (Map view)⁶⁴	Partial (XRay tree)²⁵	Not documented	Plugin⁴⁹	Yes (Topology)⁵	Partial (related objects on detail pages)³³
Change history with undo	Yes⁶⁵	No⁶⁶	No⁶⁶	No⁶⁶	No⁶⁶	Partial (changes with diffs, no undo)⁶⁷	No⁶⁶
AI	Partial (read-only MCP server)⁶⁸	Plugin (alpha)⁴⁶	Plugin (community)⁴⁷	Paid (Ask AI, MCP server)⁴⁸	Plugin⁴⁹	Yes (MCP server that can also make changes)⁶⁹	No
Vulnerability reports	Partial (from the Trivy Operator)⁷⁰	Plugin (third-party)⁴⁶	Yes (opt-in image scans)⁷¹	Paid (needs the Trivy Operator)⁴⁸	Not documented	Partial (from the Trivy Operator)⁷²	No

Rancher and Portainer aren’t in the table because they do a different job: Rancher creates and manages clusters, and Portainer manages Docker and Kubernetes environments, as well as showing them. Octant isn’t either: it was archived in 2023. Each has a page of its own.

Desktop app, terminal or web UI

The tools run in three ways, and that decides more than any feature:

A desktop app (Lens, Freelens, and the desktop builds of Headlamp and Radar) installs on each person’s computer and reads their kubeconfig. Port forwards open on that computer. Each person installs and updates their own copy.
A terminal UI (k9s) runs wherever you have a shell, including over SSH, with nothing else to run.
A web UI in a cluster (KubeGlass, Headlamp, Radar, Kubernetes Dashboard) is one install a team shares: people open an address, sign in, and the cluster’s RBAC decides what each of them sees.

KubeGlass also runs on your own computer as one binary that opens in your browser, so you get your kubeconfig, every cluster in it and port forwards, as with a desktop app, and browser tabs and links you can send to someone, as with a web UI. Radar runs the same way.

Large clusters

Headlamp 0.44.0 says it works on clusters beyond 30,000 pods, and Radar that it is tested on tens of thousands. We haven’t tested KubeGlass at that size. Performance has what we measured, and on what.

The tools

Headlamp

Headlamp is a Kubernetes UI from Kubernetes SIG UI that runs as a desktop app or in a cluster, with a plugin system and a map of the cluster. It is ahead of KubeGlass on plugins, the desktop app and languages; KubeGlass has Helm, GitOps, access reviews and a change history built in.

k9s

k9s is a terminal UI, one program per person, with plugins that run commands. KubeGlass uses the same keys in a browser and adds a team deployment, several clusters at once, history and access reviews; k9s needs no server or browser at all.

Lens and Freelens

Lens is a desktop app from Mirantis that needs a Lens ID and, for organizations above $10 million in revenue or funding, a paid plan; its GitOps, AI and security features and its extensions are paid. OpenLens, the free builds of its open-source core, stopped in 2023. Freelens is the MIT-licensed fork of that core, free and with extensions.

Radar

Radar, from Skyhook, works most like KubeGlass: one Go binary with a browser UI, on your computer or in a cluster, under Apache-2.0, and a desktop app too. It is ahead of KubeGlass on costs, live traffic between services, the desktop app and an MCP server that can make changes. KubeGlass shows several clusters at once, reads the cluster as each signed-in person, has history from before it started and can undo a recorded change, and reviews access with a matrix. Radar Cloud, a hosted service with paid plans, puts several clusters under one address.

Kite and Aptakube

Kite is an Apache-2.0 web dashboard you run in a cluster or with Docker. It has its own accounts and roles, several clusters, Helm, an AI assistant, and a history of the changes made through Kite, with a YAML diff and rollback.
Aptakube is a commercial desktop app for macOS, Windows and Linux that shows several clusters in one view. It is free on clusters of up to five nodes and a subscription above that.

Kubernetes Dashboard

Kubernetes Dashboard was archived on 21 January 2026 and is no longer maintained. The Kubernetes project suggests Headlamp instead; KubeGlass is another way to replace it. Moving from Kubernetes Dashboard has the steps.

Octant

Octant was VMware’s web UI that ran on your computer, with a graph of how objects relate and plugins. VMware archived it in January 2023; its last release is from February 2022. KubeGlass runs on your computer the same way.

Portainer

Portainer manages Docker, Swarm, Podman and Kubernetes environments from one server, with forms to deploy applications. Its Business Edition, free up to three nodes, adds YAML editing, scaling, custom resources and role-based access control for Kubernetes. Portainer has announced 3.0, a Kubernetes-first release with no Community Edition.

Rancher

Rancher creates clusters, signs people in and deploys with Fleet across many clusters. KubeGlass works with clusters you already have and can read the kubeconfig Rancher gives you.

KubeGlass vs Headlamp

KubeGlass vs k9s

KubeGlass vs Lens, OpenLens and Freelens

KubeGlass vs Radar

KubeGlass vs Kubernetes Dashboard

Moving from Kubernetes Dashboard

KubeGlass vs Octant

KubeGlass vs Portainer

KubeGlass vs Rancher

Sources for the table, checked on 5 October 2026; Radar, and the notes on Headlamp’s sign-in, Helm and plugins and on Lens’s logs and extensions, on 7 October 2026:

kubernetes-sigs/headlamp ↩
License, key bindings and e to edit in your editor: derailed/k9s. The README says “K9s will always remain OSS and therefore free”. ↩ ↩² ↩³
Built on Open Lens (MIT), but the app itself may not be modified or reverse engineered: Lens Desktop additional terms ↩
freelensapp/freelens. Installing it takes no account. ↩ ↩²
License, the binary, desktop app and Helm chart, live updates over server-sent events, Topology, workload metrics from Prometheus and keyboard shortcuts: skyhook-io/radar ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶
kubernetes-retired/dashboard ↩
“Headlamp is a 100% open source project … available at no charge”, and it can switch between several clusters: Headlamp FAQ ↩
The Personal plan is free for “students, hobbyists, and engineers at small organizations”; “organizations with over $10 million in annual revenue or funding” need Plus, Pro or Enterprise: Lens pricing. Activation needs a Lens ID: Lens subscription FAQ ↩
Radar needs no account. Radar Cloud, a hosted service on top of it, has a free tier for three clusters and paid plans: OSS vs Cloud ↩
“This project is now archived and no longer maintained”; GitHub shows it archived on 21 January 2026 (checked on 6 October 2026): kubernetes-retired/dashboard. SIG UI decided to discontinue it in December 2025: SIG UI annual report 2025 ↩
Linux, macOS and Windows desktop apps, and a Helm chart for a cluster: Headlamp installation ↩
Lens download ↩
In oidc mode KubeGlass’s sign-in page sends people to your identity provider; in token mode they paste a Kubernetes token; in impersonation mode a proxy such as OAuth2 Proxy or Pomerium signs them in. In oidc and impersonation modes KubeGlass impersonates the person, so the API server doesn’t have to trust the identity provider. An install in a cluster shows only that cluster. See Sign-in and Running for a team. ↩
A Sign in button for OIDC, which passes the person’s token to the API server, so the API server has to trust the same provider (Headlamp OIDC), or a pasted token. Since release v0.43.0 Headlamp can sit behind an identity-aware proxy such as OAuth2 Proxy; it then calls the API server as its own ServiceAccount unless the proxy passes on a token the API server accepts (identity-aware proxy). Impersonating each person is pull request 7646, not merged. ↩
There is no web version. Teamwork, on the Pro and Enterprise plans, gives remote access to clusters from each person’s app: Lens cluster connect ↩
OIDC or an auth proxy. Changes run as the person through impersonation; reads come from a cache Radar fills as itself, filtered by the namespaces the person may access, with Secrets and cluster-wide kinds checked kind by kind: Radar authentication ↩
A bearer token on the login page, or an Authorization header from a proxy: Dashboard access control ↩
Every context in the kubeconfig KubeGlass reads. Installed in a cluster, KubeGlass shows only that cluster. See Clusters. ↩
Every kubeconfig context on the desktop; in a cluster, extra clusters from mounted kubeconfig files: Headlamp in-cluster ↩
:ctx switches context; :pod @ctx1 “Switches out your current k9s context”: k9s commands ↩
Adding clusters to Lens ↩
One kubeconfig context at a time; several at once is issue 199, still open. Radar Cloud shows several clusters under one address: OSS vs Cloud ↩
“Kubernetes Dashboard was designed to work with one cluster at a time”: From Kubernetes Dashboard to Headlamp ↩
Headlamp architecture ↩
Real-time tracking and XRay: k9scli.io. XRay covers Pods, Services, Deployments, ReplicaSets, StatefulSets and DaemonSets. ↩ ↩²
“All the built-in Lens views utilize the Kube Watch API”: Lens cluster performance ↩
Resources refresh every 10 seconds by default: settings.go ↩
Logs of all pods of a Deployment, ReplicaSet and similar in one dialog: release v0.29.0 ↩
Logs for Deployments, DaemonSets, StatefulSets, Jobs and Services pick their pods by label: logs_extender.go at v0.51.0 ↩
Lens can “aggregate all pod logs and container logs for deployments into a single stream” since release 2023.8.31525, and its log options include “Show resource names”. A pod’s log has drop-down lists to switch between pods and containers: Lens logs ↩
Freelens opens a workload’s logs on its first pod (source); the third-party Multi Pod Logs extension merges them (Freelens extensions list). ↩
Logs merged across a workload’s pods, and YAML edits applied with server-side apply: Resource browser ↩ ↩²
Deploy and Access the Kubernetes Dashboard ↩ ↩²
Pod exec and debug containers, and port forwards only when Radar runs on your computer: Exec and port-forward ↩ ↩²
shell component ↩
A forwarded port opens on the computer KubeGlass runs on, so KubeGlass offers port forwards only when it runs outside a cluster (authz_handlers.go). ↩
Release v0.15.0 (“desktop only”), still the case in PortForward.tsx at v0.45.0 ↩
Lens port forwarding ↩
The Review changes diff in release v0.42.0 and Dry Run in release v0.43.0 ↩
The side-by-side diff is part of the Advanced editor, a premium feature: Lens advanced editor ↩
The App Catalog plugin, shipped with the desktop app. Helm in a cluster came in release v0.37.0 behind --enable-helm, which the chart’s config.enableHelm sets and which is off by default (chart README); the container image doesn’t include the plugin (container/build-manifest.json). See also Headlamp in 2025. ↩
:helm lists releases (release notes v0.19.3), with values, history, rollback (helm_history.go) and uninstall. ↩
Lens Helm releases ↩
release-menu.tsx ↩
Upgrade, rollback and uninstall; installing a chart isn’t documented: Helm management ↩
Headlamp’s plugins: App Catalog for Helm and Prometheus, both shipped with the desktop app, Flux, Argo CD (0.1.0-alpha) and AI Assistant (alpha), plus third-party plugins such as Trivy and Kubescape. The container image ships Prometheus alone (container/build-manifest.json), and the chart’s config.staticPlugins.enabled turns it off (release v0.44.0). ↩ ↩² ↩³ ↩⁴
Community plugins for Argo CD, Flux, Argo Rollouts and HolmesGPT: k9s plugins folder. Plugins bind commands to keys: k9s plugins ↩ ↩² ↩³
Flux, Argo CD, the MCP server and Security Center are premium features: Lens premium features, Lens pricing ↩ ↩² ↩³
Freelens extensions: Flux, resource map and AI from the Freelens project; Argo CD from a third party (Freelens extensions list). ↩ ↩² ↩³ ↩⁴
GitOps workspace ↩
These tools list Roles, ClusterRoles and their bindings. Headlamp’s ServiceAccount page also lists the bindings that name it (release v0.44.0), and Lens’s paid Security Center reports risky roles (Lens premium features). None of them documents a view of who may do something. ↩ ↩² ↩³ ↩⁴
:can u:<user>, g:<group> or s:<serviceaccount> shows that subject’s rules: command.go at v0.51.0 ↩
What a ServiceAccount may do, who is bound to a role, and your own permissions in a namespace; a matrix and “can I” queries are listed as later work: Access control ↩
CPU and memory come from metrics-server (k9s RBAC); the docs don’t mention Prometheus. ↩
Lens Metrics or your own Prometheus: Lens cluster metrics ↩
Freelens Prometheus providers ↩
Dashboard integrations ↩
Actions on objects (links to open, and commands that run in a local terminal tab when KubeGlass is started with --local-shell, after a dialog, or are copied otherwise), keys and hotkeys, sidebar links, panels such as Grafana’s on objects’ pages, extra list columns and command palette names, in one YAML file; k9s plugins, hotkeys and aliases can be imported into it. There is no plugin API for code of your own. See Extensions. ↩
Plugins in JavaScript or TypeScript: Headlamp plugins ↩
Extensions are npm packages, which Lens creates and can open in your AI coding tool, installed from its marketplace. Installing and running them needs a Plus, Pro or Enterprise plan: Lens extensions, marketplace ↩
Global search and configurable shortcuts: release v0.40.0 ↩
Lens shortcuts and command palette ↩
Applications › Map draws a namespace, application or project from Ingresses to the claims pods use, and marks the chain that leads to a broken object. Each object’s page also has a tree of related objects. See Map. ↩
Release v0.26.0 ↩
Changes to Deployments, StatefulSets, DaemonSets, CronJobs, Services, Ingresses, ConfigMaps, Secrets and autoscalers, made with any tool, recorded while KubeGlass runs, with revert after a dry run. From the first launch it also lists what the cluster’s own records hold from before: rollouts from ReplicaSets and ControllerRevisions (the newest can be reverted), Helm release revisions, and when ConfigMaps and Secrets were last written. Recording and reading those records both use KubeGlass’s own credentials, and Secrets for Helm: in every namespace with the chart’s role, or in up to 25 namespaces with credentials that allow only some. See Timeline. ↩
None of these tools documents a record of past changes to objects that can be undone. Headlamp can roll Deployments, DaemonSets and StatefulSets back to an earlier revision (release v0.41.0), and k9s, Lens and Freelens can roll a Helm release back; both use the history Kubernetes and Helm keep themselves, which KubeGlass also reads into its own. Outside the table, Kite keeps a history of the changes made through Kite, with a diff and rollback (Kite resource history); KubeGlass records changes made with any tool, kubectl and controllers included. ↩ ↩² ↩³ ↩⁴ ↩⁵
Events and every change Radar sees while it runs, with a diff, kept in memory by default or in SQLite or PostgreSQL. Reverting a change from it isn’t documented: Event timeline ↩
An MCP server with 41 tools that only read, for AI clients such as VS Code or Claude Desktop. There is no assistant in the UI. See MCP server. ↩
Tools that inspect, and tools that restart, scale, apply and roll back after the AI client asks: Kubernetes MCP server ↩
KubeGlass shows the VulnerabilityReports the Trivy Operator writes; it doesn’t scan images itself. Instead of showing zero, it says Not scanned without the operator, that you can’t read the scan reports when you may not list them, that it couldn’t read them when the API server didn’t answer, and that there are no reports yet before the first scan. See Security and monitoring. ↩
imageScans in k9s configuration; marked experimental in release notes v0.29.0 ↩
Trivy integration ↩