The Controller
Studio never talks to a cluster directly. One service — the kubernetes-controller — holds the credentials, streams the live state, and gates every operation. It's how the console stays fast, live, and safe.
The broker
Every list, watch, apply, and delete flows through the kubernetes-controller. It stores each cluster's kubeconfig encrypted, decrypts it in memory only when it makes a call, and keeps a warm client per cluster — dropped the moment a credential rotates. Because it's the single door to your clusters, it's also the single place for connection pooling and access control.
Live streaming
The controller holds a persistent connection open to the browser. A pod's logs ride a Kubernetes watch and arrive as it writes them; pod metrics and cluster capacity are sampled on a live interval — metrics have no watch to ride — and pushed the same way. Streams open when you land on a page and close when you leave; switch clusters and they follow, reconnecting if a connection blips.
Security model
Every operation against a cluster — read, write, or stream — is gated to a Bosca administrator, checked on the server before the request ever reaches the controller, then checked again there. Even a live stream re-checks that you're still an admin while it stays open. And the kubeconfig never leaves the server: it's encrypted at rest and decrypted only in the controller's memory.
Keep exploring
A multi-cluster console, built into the platform.
Register clusters, watch nodes, events, and namespaces.
Scale, restart, delete, and stream live pod logs.
Networking, config, storage, operators, and RBAC.
A live chart catalog, dry-run installs, and every release.