Every container, in its place.
Bayplan is a lightweight, self-hosted panel to observe and operate all your Kubernetes clusters from one place. One binary, your infrastructure, scoped permissions and an audit trail of everything.
Everything you can do
This is the panel itself, in miniature. Pick anything in the sidebar to see what it does, or walk through with the arrow keys.
production-eu ▾
shop, payments ▾
Ctrl KBP
Light or dark, in your language, and every view is a link you can share.
Running in a minute
Containers only: a single container with its own database and HTTPS, a Helm chart, Docker or Podman Compose, or Podman Quadlet. Postgres is the only dependency, and the single container brings it along.
To try it, or on a single host. Data, the encryption key and the self-signed CA live in the volume.
$ docker run -d --name bayplan --restart=always -p 8443:8443 -v bayplan-data:/data ghcr.io/agmzacd/bayplan $ docker logs bayplan 2>&1 | grep -A3 "First startup" # one-time /setup token, then open https://<host>:8443
The cluster it is installed in shows up as local; the rest are added from the UI with an agent.
$ helm upgrade --install bayplan oci://ghcr.io/agmzacd/charts/bayplan -n bayplan --create-namespace \ --set ingress.enabled=true --set ingress.host=bayplan.example.com --set ingress.tls.enabled=true $ kubectl -n bayplan get secret bayplan-bootstrap -o go-template='{{.data.bootstrapPassword|base64decode}}{{"\n"}}'
Postgres as its own container. Put a TLS proxy in front.
$ curl -fsSLO https://raw.githubusercontent.com/agmzacd/bayplan/main/deploy/compose/docker-compose.yml $ curl -fsSLo bayplan.env https://raw.githubusercontent.com/agmzacd/bayplan/main/deploy/env.example # edit bayplan.env: DATABASE_URL (password), ENCRYPTION_KEY_V1 (openssl rand -base64 32), PUBLIC_URL $ POSTGRES_PASSWORD=<the one in DATABASE_URL> docker compose up -d
Let's Encrypt, Podman Quadlet, Argo CD, air-gapped installs, backups of Bayplan itself, key rotation and upgrades are in the deployment guide. Apache-2.0, images for amd64 and arm64 signed with cosign.