K9s Show Services
To run a k9s show services view, open the terminal tool and enter the service command. This action queries the cluster API and lists active network routes for your pods. Most teams set up this tool by handing out local cluster files to engineers. That setup makes debugging fast when an app goes down. Still, teams often grant broad cluster roles so every view in the tool works. Broad roles mean anyone viewing services can also edit routes or open shells into pods. How k9s show services works in
Show Services: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To run a k9s show services view, open the terminal tool and enter the service command. This action queries the cluster API and lists active network routes for your pods. Most teams set up this tool by handing out local cluster files to engineers. That setup makes debugging fast when an app goes down. Still, teams often grant broad cluster roles so every view in the tool works. Broad roles mean anyone viewing services can also edit routes or open shells into pods.
How k9s show services works in your cluster
When an engineer opens the service view, the local client reads their local config file. The client then sends a list request to the cluster control plane. Next, the API server checks if the user role allows reading service objects. If the role allows it, the server sends back the current service data. The terminal screen then updates on a set timer to show live changes. Users can filter the list by namespace or search for a specific app name.
From the service list, an engineer can select a single line to inspect its pods. The tool reads the label selectors on that service and finds matching pod objects. It also lets the user forward local network ports right to that remote service. Each action inside the terminal triggers a standard API call behind the scenes. The terminal tool does not store cluster state on the user machine. Instead, it acts as a live window into the control plane API.
Why native roles fall short for service views
Native cluster roles let you limit who can read or change service objects. You can bind a read-only role to a group of developers for safe viewing. This setup stops users from deleting routes or changing load balancer settings by mistake. It also keeps basic network checks simple during an outage.
Yet daily incidents rarely stop at viewing a list of services. When a service fails, an engineer needs to test the route or check pod logs. Giving out static config files for these tasks creates a huge security gap. Static files sit on laptops and often hold long-lived keys with broad rights. Once a user logs in, native roles only check the broad resource type. Native roles cannot pause a risky delete action for a quick peer check. They also fail to log the exact terminal output or mask emails and card numbers.
Show Services: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Scoping cluster roles for daily debugging
To reduce risk, teams should split viewing rights from change rights in the cluster. Start by mapping out which namespaces each team owns and runs. Create a base role that only allows listing and watching core network objects. Bind this base role to your standard developer group for daily checks.
Keep port forwarding and pod shell actions out of the default user role. When someone needs to run a deeper check, require a separate approval step. You should also review your cluster audit logs every week for unusual API calls. Look for users who list secrets or forward ports to sensitive data stores. Removing local static keys from laptops is the best way to keep clusters safe.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
How do I switch namespaces when viewing services in K9s?
You can select a namespace from the top menu bar or type the namespace command. The service list will refresh at once to show only routes in that scope. You can also view services across all namespaces at the same time if your role allows it.
What cluster permissions are needed to list services in K9s?
Your user role needs get, list, and watch rights on the core service resource. If you want to jump from a service to its pods, you also need pod read rights. Port forwarding from a service requires an extra subresource permission on the backing pods.
Why is my service list empty in the K9s terminal?
An empty list usually means you are looking at the wrong namespace in your view. It can also happen when your cluster role lacks permission to read service objects. Check your active namespace filter first, then ask an admin to verify your role bindings.