Milestones
List view
Agent-native — Periscope as an MCP-style tool host with an in-app chat surface. **Headline themes:** - **LLM provider abstraction** — Anthropic / OpenAI / Bedrock / Ollama behind one interface. Helm values pick the backend per-deployment. - **MCP-style tool registry** — wraps the wire shapes shipped in v1.1 (Cluster Access + AWS Access + sensitive catalog + reverse lookup), v1.2 (GPU map, idle finder, DCGM reconciler), and v1.3 (effective access engine + CloudTrail + cluster audit + related-resources graph). ~15 read-only K8s/Helm/audit/EKS tool wrappers. - **In-app chat surface** — bottom-right ChatWidget (bubble, drag-resize, tool-call cards) + SearchPalette `/ask` mode + permission UI (inline allow + destructive-action modal). - **Cost + safety** — per-call / per-session / per-user / per-day token limits; prompt-injection mitigations (tool-output framing, sanitization, per-turn tool restriction); new `agent_tool_call` audit verb so every agent action is rowable. Why this is v1.4 and not v1.3: the agent's value is proportional to the wire-shape depth underneath. Letting v1.2 + v1.3 ship and stabilize their APIs means the agent ships against mature, documented, audit-instrumented endpoints — not freshly-baked ones. Target: ~3 months after v1.3 ships.
No due date•0/12 issues closedAWS depth + observability + relationships — closes the loops v1.1 named, ingests every-identity audit, generalizes pod-relationship code into one centralized index. **Headline themes:** - **IAM effective-access engine** — conditions evaluated (`aws:RequestTag` / `aws:PrincipalTag` / `aws:SourceVpc` / `aws:SourceArn`), SCPs + permission boundaries applied to the AWS Access tab + reverse lookup, cross-account `sts:AssumeRole` chain walking with recursion guard, fleet-wide reverse lookup across every registered cluster, CloudTrail-driven cache invalidation so policy changes show up in seconds instead of the v1.1 5-minute TTL. - **AWS compliance lens** — CloudTrail pod-correlation table joining the cluster's audit feed with CloudTrail's `userIdentity.sessionContext.sessionIssuer` ARN, so operators can answer "what did this pod do to AWS?" without bouncing between two logs. - **Cluster-wide kube-apiserver audit ingestion** — visibility into every identity (ServiceAccounts, controllers, automation), not just users acting through Periscope. Same audit-feed view, one filter pivot. - **Related-resources graph (RFC 0005 Phases 1+2)** — ref-by-name extractors for the 9 most-used kinds (Pod volumes / envFrom / SA, Ingress, HPA, PVC) + selector resolution (Service / NetworkPolicy / PDB / EndpointSlice). After this every detail pane has a Related tab. Phase 0 lands in v1.2. - **Security polish** — CronJob CVE-ownership chain (Pod → Job → CronJob walk), per-NodeGroup CVE chip rollup on the Nodes page. Target: ~3 months after v1.2 ships. Out of scope (v1.4): MCP / agent layer (waits for the v1.3 wire shapes to stabilize).
No due date•0/5 issues closedOperator daily-driver layer — fill the everyday-pane features still missing after v1.1, with GPU + AI workload visibility as the headline. **Headline themes:** - **GPU + AI workload visibility** — Pod ↔ GPU mapping layer joining kubelet PodResources gRPC, NVIDIA device plugin allocation, DCGM exporter metrics, DRA (`ResourceClaim` / `ResourceSlice` / `DeviceClass` — GA in K8s 1.34), and AWS instance pricing. Three views ship on the spine: **Pod ↔ GPU map** (cluster → node → GPU → MIG/slice → bound pods, with filters + sparklines), **Idle GPU finder** (sort by $-burned-per-%-util, namespace-owner attribution), and **DCGM reconciler** (side-by-side raw vs. reconciled, label-gap auto-fix, confidence indicators — addresses dcgm-exporter #411 / #353 / #544). NVIDIA-only for v1.2. - **In-browser cluster shell (#104)** — per-user OIDC impersonation, single-log audit (every shell-issued K8s API call lands in the existing structured audit alongside UI-driven actions), Monaco-style terminal in the existing detail-pane drawer. - **SSM shell into EKS nodes (#105)** — AWS Systems Manager session manager into managed nodegroup / Karpenter NodeClaim hosts, with per-user impersonation flowing through to the SSM `StartSession` API call. Cousin of #104; ships together. - **Helm private OCI auth via Pod Identity / IRSA (#121)** — deferred from v1.0.4's chart-fetch work. Lets operators pull from private ECR / GHCR / Artifact Registry without static creds. - **Related-Resources Graph Phase 0 (RFC 0005)** — RelationshipIndex skeleton + Pod ownerReferences extractor + `<RelatedList>` on the pod detail pane. Target: ~3-4 months after v1.1 lock. GPU work starts week 1. Out of scope (v1.3): IAM effective-access engine, AWS compliance lens (CloudTrail pod-correlation), cluster-wide kube-apiserver audit ingestion, RFC 0005 Phases 1+2, CronJob CVE-ownership chain, per-NodeGroup CVE rollup. Out of scope (v1.4): MCP / agent layer (#151 — moved to its own coherent release).
No due date•3/13 issues closed