OBSERVE & CONNECT

Selected-container embedded shell

On pods, x, :shell or :exec opens the container table. Enter on a pod also opens that table, including single-container pods. Choose a regular/init container with arrows or j/k, then press s or x to launch its configured shell. Enter/l still opens logs. Pod s continues to change the sort column.

KubeRich opens a full-screen embedded terminal inside Textual. Its frame keeps context, namespace/pod and container visible while an owned PTY runs kubectl exec. The actual shell prompt, ANSI colors, cursor movement and alternate-screen programs are rendered by an emulator. Textual stays active throughout the session.

• exit or Ctrl+D returns to the retained container selection.
• Ctrl+] closes the owned exec session and returns to containers.
• Ctrl+C reaches the shell/program; it does not quit KubeRich here.
• Ctrl+Q quits KubeRich and cleans up the exec process.
• Escape, Tab, arrows, q, : and / reach the remote program while the terminal is live.
• After returning, Escape goes from containers to the retained pod table.

The frame consumes two columns and six rows; resizing a 80×25 terminal gives the remote PTY 78×19 cells. Target lines are literal, redacted and clipped in compact windows. A failed exec returns to safe, scrollable feedback. SIGTERM cleans up and exits the CLI with 143 after terminal restoration.

Review output without sending shell commands

Click History, or press Alt+PageUp / Shift+PageUp, to review a frozen copy of normal-screen output. The remote program keeps running and receiving its actual PTY size; its latest output and cursor stay in the live emulator. Full-screen alternate buffers, such as an editor, do not enter normal-screen history.

• Up/Down or j/k, PageUp/PageDown and Home/End or g/G move through the capture. The mouse wheel scrolls only during review; clicking selects a row.
• / or Ctrl+F starts literal, case-insensitive Unicode search. Enter finds a match; n/N finds the next/previous match with wraparound. Escape cancels search.
• v or Space starts/ends a range; move to its other end. Shift-click also selects a range. y or Ctrl+Y explicitly copies the selected whole rows.
• Enter, Escape or q, or clicking Live, returns to the current remote screen. Search, selection, navigation and paste stay local during review. Ctrl+] still closes the session and Ctrl+Q still quits KubeRich.

At most 1,000 scrolled rows are retained. The footer reports discarded live history; a frozen capture retains its own rows while the live ring advances. Resizing crops the capture to the new viewport without reflowing or modifying its captured rows. Search accepts 256 characters and copy accepts at most 64 KiB after control escaping. Copy redacts the recognized credential patterns used elsewhere in KubeRich; it cannot identify arbitrary secrets printed by a program. Copy uses the host clipboard mechanism, whose availability depends on the outer terminal. Remote OSC52 clipboard requests remain inert. Nothing copies automatically. Closing, stale-target cancellation and repeated sessions release the capture, history and session-owned cell cache. See history evidence.

Requirements and preferences

Install kubectl on PATH, using a client version supported by your cluster. Use trusted Kubernetes configuration and credentials; configured exec-auth helpers remain trusted local programs. The selected account needs pod reads and pods/exec permission; the Kubernetes server makes the authorization decision. Read-only mode blocks shells before file preparation or executable lookup.

The default image command is sh. To choose another shell, edit KubeRich preferences and restart:

schema_version: 1
shell: ["/bin/bash", "-l"]

This is an argument list, with 1–32 nonempty strings. It is passed literally after kubectl's --, without shell interpolation. The image must contain that program. config check validates the preference; it does not connect or execute anything. Initial --command shell is unavailable because launching a shell requires a selected pod and container. The interactive aliases take no command arguments.

Captured scope and return

The action captures the owned client/session, context, namespace, pod name/UID, container, shell argv, environment and working directory before awaiting work. A GET verifies that the pod still has the captured UID and container, and that it is not deleting or completed. Scope invalidation blocks launch. A replacement between that check and kubectl's server request remains a Kubernetes race: exec-by-name has no atomic pod-UID precondition. KubeRich does not claim otherwise.

Kubectl uses a private snapshot of the prepared session's endpoint, TLS material and credential mechanism, with explicit context/namespace/pod/container flags. Changing the original kubeconfig after connection cannot redirect this action. The snapshot is mode 0600 inside the owned mode-0700 SDK directory and is deleted after return or cancellation. Certificate files live until their client closes. The original kubeconfig and current-context are never rewritten.

Missing local kubectl, denied pod reads, deleted/replaced pods, unavailable containers and nonzero exec exits produce safe feedback. Exit 126/127 suggests an unavailable image shell. Other kubectl failures name the exit code and permission/state/shell checks; raw stderr appears only in the deliberately opened embedded terminal and is not retained in UI diagnostics. Exec is never retried automatically. An image without a shell requires a suitable image or the later ephemeral-debug workflow, not an invented SSH connection.