K9s See Deployments
To make k9s see deployments, open the terminal UI and switch to the deployment resource view. The tool then queries the Kubernetes API server and lists active workloads in your namespace. Engineering teams use this view to check pod rollouts and fix broken apps fast. Still, teams often hand out broad cluster roles so everyone can load these resource views. Broad roles let users change live workloads or read secret values from their laptops. How the k9s see deployments workflow operates K9s is
See Deployments: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To make k9s see deployments, open the terminal UI and switch to the deployment resource view. The tool then queries the Kubernetes API server and lists active workloads in your namespace. Engineering teams use this view to check pod rollouts and fix broken apps fast. Still, teams often hand out broad cluster roles so everyone can load these resource views. Broad roles let users change live workloads or read secret values from their laptops.
How the k9s see deployments workflow operates
K9s is a terminal app that helps engineers inspect and manage Kubernetes clusters. When a user launches the tool, it reads the local cluster config file on their machine. That file holds the cluster network address and the user identity token. K9s uses those details to talk directly to the Kubernetes API server over the network.
When you switch views to make k9s see deployments, the tool sends a list request. It asks the API server for all deployment objects inside the chosen namespace. After the first list loads, the tool opens a watch stream with the API server. This stream pushes live updates to the terminal screen whenever pod counts or statuses change.
For this workflow to succeed, the user role must hold specific Kubernetes permissions. The cluster role needs get, list, and watch verbs on deployment objects. Many teams also add permissions for replica sets, pods, and log streams. That way, an engineer can drill down from a deployment straight into a failing container.
How namespace filters affect deployment visibility
Sometimes an engineer opens the deployment view and sees an empty screen. This happens most often when the active namespace does not match the target workload. By default, the terminal UI starts in the namespace saved in the local cluster config. If your apps run in a different namespace, the initial screen shows nothing.
Users can switch namespaces inside the tool or view all namespaces at once. Viewing all namespaces requires a cluster role binding rather than a single namespace role binding. If the user lacks cluster-wide list rights, the API server blocks the request. The terminal screen then stays blank or shows an access denied message.
Label filters can also hide workloads from the main screen. If a user sets a label filter, the tool only fetches matching deployment objects. Clearing the active filter restores the full list of workloads for that namespace.
See Deployments: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native cluster roles solve and what they leave open
Native Kubernetes role-based rules control which API endpoints a user or group can call. You can build a read-only role that only lets k9s see deployments and pods. This setup stops engineers from deleting workloads or editing container images by mistake. It works well for basic separation between viewers and cluster admins.
Still, static cluster roles only decide who logs in and which resource types they can reach. They do not inspect what individual commands or requests do in flight during a session. In real life, engineers often need more than read-only views to fix a broken rollout. They need to restart a deployment, scale replicas, or open a shell inside a pod.
Giving permanent write roles for these tasks creates a huge security gap. An engineer with edit rights can also read sensitive config maps or run any container command. Standard cluster logs rarely link those raw terminal actions back to a specific approval ticket. Also, local config files often keep long-lived keys sitting on user laptops.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Why does my deployment view show zero items in the terminal?
You are likely looking at the wrong namespace or have an active filter set. Switch to the namespace where your app runs, or check that your role allows listing deployments.
What permissions are required to view deployments in Kubernetes?
Your Kubernetes role needs the get, list, and watch verbs for the deployments resource type. To drill down into running containers, you also need those same verbs for pods and replica sets.
Can I restrict users so they can view deployments without editing them?
Yes, you can bind users to the built-in view role inside Kubernetes. This role lets users inspect deployments and pods while blocking edit, patch, or delete requests.