Add guarded workload scaling

Author: rootsec1

README.md

@@ -27,7 +27,7 @@ The product moat is the interface: a simple native control-plane lens, macOS gla
 - Live Kubernetes resource inventory with namespace, status, label, search, sorting, and pressure signals.
 - Persistent pinned resources for fast returns to active incidents.
 - Grouped drilldowns from namespaces, services, workloads, and pods.
-- Pod debugging workspace with status, containers, mounted dependencies, events, searchable source- and level-filtered logs, exec and port-forward handoff, guarded restart, and guarded delete.
+- Pod debugging workspace with status, containers, mounted dependencies, events, searchable source- and level-filtered logs, exec and port-forward handoff, guarded restart/scale, and guarded delete.
 - Local-first architecture with no cluster-side agent.
 - Guarded write model for risky Kubernetes actions.
 

dev/kubeSnapshot.ts

@@ -427,6 +427,25 @@ export async function runPodAction(input: {
         .then((output) => podActionResult(action, "executed", "Action completed.", output, command))
         .catch((error) => podActionResult(action, "failed", errorMessage(error), "", command));
     }
+    if (actionName === "scale" && isScalableWorkloadKind(target.kind)) {
+      const replicas = requestedReplicasForScaleAction(action);
+      if (replicas === null) {
+        return podActionResult(action, "blocked", "Scale replicas must be a whole number.");
+      }
+      if (!isLocalContext(target.cluster)) {
+        return podActionResult(action, "blocked", `${target.cluster} is not recognized as a local context.`);
+      }
+
+      const args = scaleArgs(target.kind, target.name, target.namespace, replicas);
+      const command = displayKubectlCommand(args, target.cluster);
+      if (!input.confirmed) {
+        return podActionResult(action, "blocked", `Confirm to scale ${target.namespace}/${target.name} to ${replicas} replicas.`, "", command, true);
+      }
+
+      return kubectlText(args, target.cluster)
+        .then((output) => podActionResult(action, "executed", "Scale completed.", output, command))
+        .catch((error) => podActionResult(action, "failed", errorMessage(error), "", command));
+    }
 
     return podActionResult(action, "blocked", "This action only runs against pods.");
   }
@@ -524,6 +543,21 @@ function requestedContainerForExecAction(action: string) {
   return container ? container : null;
 }
 
+function requestedReplicasForScaleAction(action: string) {
+  const delimiter = action.indexOf(":");
+  if (delimiter === -1) {
+    return null;
+  }
+
+  const value = action.slice(delimiter + 1);
+  if (!/^\d+$/.test(value)) {
+    return null;
+  }
+
+  const replicas = Number(value);
+  return Number.isInteger(replicas) && replicas >= 0 ? replicas : null;
+}
+
 function execOpenedMessage(container: string | undefined) {
   return container
     ? `Opened Terminal with an interactive shell in container ${container}.`
@@ -1334,10 +1368,18 @@ function isRestartableWorkloadKind(kind: string) {
   return ["Deployment", "StatefulSet", "DaemonSet"].includes(kind);
 }
 
+function isScalableWorkloadKind(kind: string) {
+  return ["Deployment", "StatefulSet", "ReplicaSet"].includes(kind);
+}
+
 function rolloutRestartArgs(kind: string, name: string, namespace: string) {
   return ["rollout", "restart", `${kind.toLowerCase()}/${name}`, "-n", namespace];
 }
 
+function scaleArgs(kind: string, name: string, namespace: string, replicas: number) {
+  return ["scale", `${kind.toLowerCase()}/${name}`, `--replicas=${replicas}`, "-n", namespace];
+}
+
 async function firstPodPort(target: { name: string; namespace: string; cluster: string }) {
   const pod = await kubectlJson<KubeItem>(["get", "pod", target.name, "-n", target.namespace, "-o", "json"], target.cluster);
   const ports = [

docs/spec.md

@@ -5,7 +5,7 @@ Kite is a native Kubernetes GUI focused on interface quality, speed, and local-f
 ## What
 
 - Tauri 2 desktop app with Rust backend and React frontend.
-- Multi-cluster Kubernetes cockpit with kubeconfig context switching, scoped resource exploration, pinned resources, keyboard-operable windowed sortable signal-aware inventory with selected-pod log jump actions, inline pod and service backend diagnostics, namespace ResourceQuota and LimitRange constraint visibility, HPA scale-target links, pod ServiceAccount identity links, ConfigMap/Secret/PVC/ServiceAccount consumer links, PriorityClass and RuntimeClass placement links, PodDisruptionBudget availability links, NetworkPolicy-to-pod visibility, exact Ingress/HTTPRoute-to-service topology links, CRD group/scope/version inspection, pod-to-node and node-to-pod debugging jumps, node condition/capacity inspection, pod-level status diagnostics, pod placement constraints, pod condition diagnostics, newest-first warning-prioritized pod events, exec and port-forward handoff, guarded pod actions, guarded workload rollout restart, searchable log workflows, YAML/diff inspection, and a simple visual control-plane map.
+- Multi-cluster Kubernetes cockpit with kubeconfig context switching, scoped resource exploration, pinned resources, keyboard-operable windowed sortable signal-aware inventory with selected-pod log jump actions, inline pod and service backend diagnostics, namespace ResourceQuota and LimitRange constraint visibility, HPA scale-target links, pod ServiceAccount identity links, ConfigMap/Secret/PVC/ServiceAccount consumer links, PriorityClass and RuntimeClass placement links, PodDisruptionBudget availability links, NetworkPolicy-to-pod visibility, exact Ingress/HTTPRoute-to-service topology links, CRD group/scope/version inspection, pod-to-node and node-to-pod debugging jumps, node condition/capacity inspection, pod-level status diagnostics, pod placement constraints, pod condition diagnostics, newest-first warning-prioritized pod events, exec and port-forward handoff, guarded pod actions, guarded workload rollout restart and scaling, searchable log workflows, YAML/diff inspection, and a simple visual control-plane map.
 - UI-first design system inspired by Endex's dense enterprise sections: dark green-black glass, thin grid lines, pale telemetry surfaces, emerald accents, and precise motion.
 
 ## Why

src-tauri/src/kube_commands.rs

@@ -353,6 +353,16 @@ pub async fn pod_action(action: String, target: ActionTarget, confirmed: bool) -
             let is_local = is_local_context(&target.cluster);
             return guarded_workload_restart(normalized, target, confirmed, is_local).await;
         }
+        if action_name == "scale" && is_scalable_workload_kind(&target.kind) {
+            let replicas = match requested_replicas_for_scale_action(&normalized) {
+                Ok(replicas) => replicas,
+                Err(error) => {
+                    return pod_action_result(normalized, PodActionStatus::Blocked, error, String::new(), String::new(), false);
+                }
+            };
+            let is_local = is_local_context(&target.cluster);
+            return guarded_workload_scale(normalized, target, replicas, confirmed, is_local).await;
+        }
         if action_name == "trigger-cronjob" && target.kind == "CronJob" {
             let is_local = is_local_context(&target.cluster);
             return guarded_cronjob_trigger(normalized, target, confirmed, is_local).await;
@@ -473,6 +483,19 @@ fn requested_port_for_action(action: &str) -> Result<Option<u16>, String> {
         .ok_or_else(|| format!("Invalid pod port for {action}."))
 }
 
+fn requested_replicas_for_scale_action(action: &str) -> Result<u32, String> {
+    let Some((name, replicas)) = action.split_once(':') else {
+        return Err("Scale requires a target replica count.".to_string());
+    };
+    if name != "scale" {
+        return Err("Scale requires a target replica count.".to_string());
+    }
+
+    replicas
+        .parse::<u32>()
+        .map_err(|_| "Scale replicas must be a whole number.".to_string())
+}
+
 fn requested_container_for_exec_action(action: &str) -> Result<Option<String>, String> {
     let Some((name, container)) = action.split_once(':') else {
         return Ok(None);
@@ -1093,7 +1116,8 @@ fn resource_quantity(value: &serde_json::Value) -> Option<String> {
 }
 
 fn classify_action(action: &str) -> ActionRisk {
-    match action {
+    let action_name = action.split_once(':').map(|(name, _)| name).unwrap_or(action);
+    match action_name {
         "delete" | "apply" | "edit" | "scale" | "set-image" | "rollback" => ActionRisk::High,
         "restart" | "debug" | "exec" | "node-shell" | "port-forward" | "trigger-cronjob" => ActionRisk::Medium,
         _ => ActionRisk::Low,
@@ -1179,6 +1203,38 @@ async fn guarded_workload_restart(action: String, target: ActionTarget, confirme
     }
 }
 
+async fn guarded_workload_scale(action: String, target: ActionTarget, replicas: u32, confirmed: bool, is_local: bool) -> PodActionResult {
+    if !is_local {
+        return pod_action_result(
+            action,
+            PodActionStatus::Blocked,
+            format!("{} is blocked because {} is not recognized as a local context.", target.name, target.cluster),
+            String::new(),
+            String::new(),
+            false,
+        );
+    }
+
+    let command = scale_args(&target.kind, &target.name, &target.namespace, replicas);
+    let display_command = display_kubectl_command(&target, &command);
+
+    if !confirmed {
+        return pod_action_result(
+            action,
+            PodActionStatus::Blocked,
+            format!("Confirm to scale {}/{} to {replicas} replicas on {}.", target.namespace, target.name, target.cluster),
+            String::new(),
+            display_command,
+            true,
+        );
+    }
+
+    match kubectl(kubectl_target_args(&target, command)).await {
+        Ok(output) => pod_action_result(action, PodActionStatus::Executed, "Scale completed.".to_string(), output, display_command, false),
+        Err(error) => pod_action_result(action, PodActionStatus::Failed, error, String::new(), display_command, false),
+    }
+}
+
 async fn guarded_cronjob_trigger(action: String, target: ActionTarget, confirmed: bool, is_local: bool) -> PodActionResult {
     if !is_local {
         return pod_action_result(
@@ -1282,6 +1338,10 @@ fn is_restartable_workload_kind(kind: &str) -> bool {
     matches!(kind, "Deployment" | "StatefulSet" | "DaemonSet")
 }
 
+fn is_scalable_workload_kind(kind: &str) -> bool {
+    matches!(kind, "Deployment" | "StatefulSet" | "ReplicaSet")
+}
+
 fn rollout_restart_args_for_owner(owner: &OwnerRef, namespace: &str) -> Result<Vec<String>, String> {
     if matches!(owner.kind.as_str(), "Deployment" | "StatefulSet" | "DaemonSet") {
         return Ok(rollout_restart_args(&owner.kind, &owner.name, namespace));
@@ -1300,6 +1360,16 @@ fn rollout_restart_args(kind: &str, name: &str, namespace: &str) -> Vec<String>
     ]
 }
 
+fn scale_args(kind: &str, name: &str, namespace: &str, replicas: u32) -> Vec<String> {
+    vec![
+        "scale".to_string(),
+        format!("{}/{}", kind.to_lowercase(), name),
+        format!("--replicas={replicas}"),
+        "-n".to_string(),
+        namespace.to_string(),
+    ]
+}
+
 fn cronjob_trigger_args(name: &str, namespace: &str, timestamp_seconds: u64) -> Vec<String> {
     let job_name = cronjob_manual_job_name(name, timestamp_seconds);
     vec![
@@ -4889,6 +4959,14 @@ mod tests {
         assert!(requested_port_for_action("port-forward:http").is_err());
     }
 
+    #[test]
+    fn requested_replicas_for_scale_action_reads_replica_count() {
+        assert_eq!(requested_replicas_for_scale_action("scale:3"), Ok(3));
+        assert_eq!(requested_replicas_for_scale_action("scale:0"), Ok(0));
+        assert!(requested_replicas_for_scale_action("scale").is_err());
+        assert!(requested_replicas_for_scale_action("scale:two").is_err());
+    }
+
     #[test]
     fn requested_container_for_exec_action_reads_container_name() {
         assert_eq!(requested_container_for_exec_action("exec:sidecar"), Ok(Some("sidecar".to_string())));
@@ -4939,6 +5017,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn scale_args_support_scalable_workloads() {
+        assert!(is_scalable_workload_kind("Deployment"));
+        assert!(is_scalable_workload_kind("StatefulSet"));
+        assert!(is_scalable_workload_kind("ReplicaSet"));
+        assert!(!is_scalable_workload_kind("DaemonSet"));
+
+        assert_eq!(
+            scale_args("Deployment", "api", "default", 4),
+            vec![
+                "scale".to_string(),
+                "deployment/api".to_string(),
+                "--replicas=4".to_string(),
+                "-n".to_string(),
+                "default".to_string(),
+            ]
+        );
+    }
+
     #[test]
     fn cronjob_trigger_args_create_timestamped_manual_job() {
         assert_eq!(

src/components/ResourceDetail.tsx

@@ -37,6 +37,7 @@ type ResourceDetailProps = {
 };
 type CopyStatus = "idle" | "copied" | "failed";
 const restartableWorkloadKinds = new Set(["Deployment", "StatefulSet", "DaemonSet"]);
+const scalableWorkloadKinds = new Set(["Deployment", "StatefulSet", "ReplicaSet"]);
 
 export function ResourceDetail({
   allResources,
@@ -59,6 +60,8 @@ export function ResourceDetail({
   const forwardedPorts = useMemo(() => podPorts(details), [details]);
   const terminalRef = useRef<HTMLElement>(null);
   const [terminalRequest, setTerminalRequest] = useState({ id: 0, mode: "current" as LogMode, source: "" });
+  const [replicaInput, setReplicaInput] = useState("");
+  const replicaCount = parseReplicaInput(replicaInput);
 
   useEffect(() => {
     if (!isPod) {
@@ -108,6 +111,10 @@ export function ResourceDetail({
     scrollToTerminal();
   }, [initialFocus, isPod, resource.id]);
 
+  useEffect(() => {
+    setReplicaInput(defaultReplicaInput(resource));
+  }, [resource.id]);
+
   return (
     <section className="detail-workspace">
       <header className="detail-hero">
@@ -198,12 +205,26 @@ export function ResourceDetail({
         </>
       ) : null}
 
-      {!isPod && restartableWorkloadKinds.has(resource.kind) ? (
-        <div className="pod-actions" aria-label={`${resource.kind} actions`}>
-          <button type="button" onClick={() => onRunPodAction("restart")}>
-            <RotateCw size={15} />
-            Restart
-          </button>
+      {!isPod && (restartableWorkloadKinds.has(resource.kind) || scalableWorkloadKinds.has(resource.kind)) ? (
+        <div className="pod-actions workload-actions" aria-label={`${resource.kind} actions`}>
+          {restartableWorkloadKinds.has(resource.kind) ? (
+            <button type="button" onClick={() => onRunPodAction("restart")}>
+              <RotateCw size={15} />
+              Restart
+            </button>
+          ) : null}
+          {scalableWorkloadKinds.has(resource.kind) ? (
+            <ScaleControl
+              replicaCount={replicaCount}
+              value={replicaInput}
+              onChange={setReplicaInput}
+              onScale={() => {
+                if (replicaCount !== null) {
+                  onRunPodAction(`scale:${replicaCount}`);
+                }
+              }}
+            />
+          ) : null}
         </div>
       ) : null}
 
@@ -673,6 +694,54 @@ function resourceName(name: string) {
   return name.includes("/") ? name.split("/").pop() ?? name : name;
 }
 
+function ScaleControl({
+  onChange,
+  onScale,
+  replicaCount,
+  value,
+}: {
+  onChange: (value: string) => void;
+  onScale: () => void;
+  replicaCount: number | null;
+  value: string;
+}) {
+  return (
+    <span className="scale-control">
+      <Gauge size={15} />
+      <input
+        aria-label="Target replicas"
+        inputMode="numeric"
+        min={0}
+        pattern="[0-9]*"
+        placeholder="replicas"
+        type="number"
+        value={value}
+        onChange={(event) => onChange(event.target.value)}
+      />
+      <button disabled={replicaCount === null} type="button" onClick={onScale}>
+        Scale
+      </button>
+    </span>
+  );
+}
+
+function parseReplicaInput(value: string) {
+  if (!/^\d+$/.test(value.trim())) {
+    return null;
+  }
+
+  const replicas = Number(value);
+  return Number.isSafeInteger(replicas) ? replicas : null;
+}
+
+function defaultReplicaInput(resource: ResourceRow) {
+  if (!scalableWorkloadKinds.has(resource.kind)) {
+    return "";
+  }
+
+  return resource.diagnostic.match(/^\d+\/(\d+) ready$/)?.[1] ?? "";
+}
+
 function ContainerStateFact({
   hint,
   label,
@@ -803,7 +872,7 @@ function actionMessage(result: PodActionResult) {
 
 function actionRisk(action: string) {
   const [base] = action.split(":", 1);
-  if (base === "delete" || base === "kill") {
+  if (base === "delete" || base === "kill" || base === "scale") {
     return "high";
   }
   if (base === "restart" || base === "exec" || base === "port-forward" || base === "trigger-cronjob") {