Lightweight Go service that monitors multiple Kubernetes clusters by proxying their /livez endpoints — a single binary, configured entirely via environment variables.
A lightweight Kubernetes liveness aggregator — monitor the API availability of any number of clusters through one unified set of HTTP endpoints, no kubeconfig sharing required.
Centralized Kubernetes health dashboards usually need a way to check cluster API availability without giving the dashboard direct kubeconfig access to every cluster, or wiring up a full monitoring stack just to answer one question: is this cluster's API server alive? kubernetes-status solves exactly that — a single Go binary that proxies the /livez endpoint of any number of clusters and exposes them as simple, uniform HTTP routes.
The entire service is configured through environment variables — no config files, no YAML to maintain. Each cluster is registered with one {ENV}_{NAME}=URL variable, and authentication is resolved independently per cluster, supporting bearer tokens, TLS client certificates (inline base64, file paths, or a directory), or a standard kubeconfig file.
Convention-based cluster discovery
On startup, the service scans the environment for variables matching PROD_, DEV_, STAGING_, TEST_, or SANDBOX_ prefixes and registers each one as a cluster, deriving its route (/live/{env}/{id}) and auth lookup key from the variable name alone — no explicit registration step required.
Five authentication strategies
Each cluster independently resolves its credentials in priority order: bearer token, base64-encoded client cert/key pair, cert/key file paths, a directory containing cert.*/key.* files, or a full kubeconfig (parsed for client-certificate-data or token). This covers everything from quick local clusters to production setups with mounted secrets.
Per-cluster TLS clients
Every cluster gets its own http.Client with an independent tls.Config — self-signed certs are tolerated by default (InsecureSkipVerify), but supplying a ROOTCA_{ENV}_{ID} path switches that cluster to strict verification without affecting any other.
Fail-fast startup, fail-soft runtime
Misconfigured auth (e.g. a cert set without its key) causes the service to exit immediately at boot with a clear error, while runtime connection failures to a cluster are caught per-request and surfaced as 503 DEGRADED / DEAD responses rather than crashing the whole proxy.
Multi-arch Docker image
A multi-stage Dockerfile cross-compiles the Go binary natively for the target platform (no QEMU emulation needed), producing a minimal Alpine-based image that runs on both amd64 and arm64 — including Raspberry Pi clusters.
| Layer | Technology |
|---|---|
| Language | Go 1.23 |
| TLS / Auth | crypto/tls, x509, Bearer tokens, kubeconfig (YAML) |
| HTTP | net/http (stdlib only, no framework) |
| Infrastructure | Docker (multi-arch), GitLab CI/CD |
MIT License · Marceli Racis