Security model

The listener

• Local mode binds loopback only, rejects a non-local Host or Origin, and exits when the last client disconnects.
• Cluster mode listens on the configured address and accepts browser requests only from its public URL.

Authentication

Local mode authenticates every route and both WebSockets with the token minted for that run. Cluster mode uses OIDC or an authenticated proxy and maps groups to viewer, editor and admin roles. Anonymous administration is available only through an explicit unsafe opt-in.

Cluster access

Local mode references kubeconfigs in place and never merges them into a file it manages. Cluster mode runs from its service account and impersonates the signed-in account, so Kubernetes RBAC decides what that person may do.

Shared tables and search are scoped to namespaces the account may list. Views that need a whole-cluster answer require whole-cluster read access.

Outbound traffic

• The apiserver, chart repositories and OCI registries you configured.
• In cluster mode, the identity provider you configured.
• In local mode, one optional update check per run. Cluster mode makes no update check.

The artifacts

Archives, desktop apps, the container image, Helm chart and SBOMs carry build provenance. The local installers verify checksums before they write anything.