Sources

Sources is where every connection that isn't a Kubernetes cluster lives: Bitbucket workspaces, Cloudflare accounts, Redfish servers, SNMP devices, Ceph clusters, and the rest. Each one is contributed by an extension, and they all share the same table, the same dialogs, and the same keyboard shortcuts. This page describes that shared behaviour once; the individual extension pages cover what is specific to each.

Open it from the left navigation bar, or press ⌘⇧C / Ctrl+Shift+C. Keys are shown macOS-first; on Windows/Linux replace ⌘ with Ctrl and ⇧ with Shift.

Choosing a Source

The selector at the top of the left sidebar (press W) lists everything available on this page. Clusters and Metrics Endpoints come first, then everything else alphabetically, separated by a divider.

Three of the entries are not extension connections and behave differently:

• Clusters - your Kubernetes clusters. See Connecting to Clusters.
• Cloud Providers - browse cloud provider accounts and download kubeconfigs. The pane ships with Kunobi, but its data comes from the Cloud Providers extension; without it the pane reads "Cloud Providers extension required". See Cloud Providers.
• Metrics Endpoints - Prometheus-compatible endpoints Kunobi queries for metrics.

Everything else is an extension-contributed connection source, and the rest of this page is about those. An extension only appears here once it is installed and running - see Extensions.

The Connections Table

Columns, in order:

Column	What it shows
The source's own noun	Workspace, Server, Device, Account, and so on. Two lines: the connection's label above the thing it points at (a hostname, a workspace slug, an account id).
Status	The connection's own status value, shown exactly as the extension reports it - connected, online, health_ok, error. Green for a healthy value, grey for a neutral one such as disconnected, connecting, untested or unknown, and red for anything else.
Monitoring	Only on sources that poll in the background (Redfish, SNMP). Reads Active or Not active.
Source-specific columns	Some extensions add their own: Redfish shows Model and Power, SNMP shows System name, Version and Last poll, Ceph shows FSID.
Last check	The result of a Test you just ran (Testing, then OK or Failed with the reason on hover), or how long ago the last background poll ran. A dash when neither applies.

Search the table with ⌘F / Ctrl+F. It searches the two identity columns only. While a source is loading the table reads "Loading servers..." (with that source's noun), and an empty one reads "No servers configured."

Adding a Connection

Press Add (n). The dialog is titled Add followed by the source's noun, and described "Configure the connection and credentials."

The fields come from the extension, so they differ per source, but the mechanics do not:

• A red asterisk marks a required field. An information icon next to a label explains what the field is for.
• Some fields appear only when another field is set to a particular value, and some become required or read-only the same way.
• Fields the backend fills in for you can be left blank.
• Some fields only appear when editing an existing connection, not when adding one.

Authentication appears as its own control only when the source offers a choice. Sources with a single method render its inputs directly:

Method	Inputs
Basic	Username and Password
Bearer	Token
Custom header	Header name and the value, labelled by the source
None	nothing

Test Connection probes the values in the form without saving anything, and reports "Connection succeeded" or the reason it failed. Press the Add button to save.

Adding is not the same as connecting. Most sources connect the new connection immediately, and the dialog closes once the connection is saved even if that first connect fails - the connection exists either way, and the failure shows in its Status. Fix it with Edit rather than by adding it again; sources reject a duplicate.

Editing a Connection

Edit (e) opens the same form, titled Edit followed by the noun, with Save to apply.

Secrets are never read back into the form. A password, token or header value left blank keeps the stored one - each shows "Leave blank to keep current" - so you can change a hostname without retyping a token, or rotate a token without touching anything else. The same applies to the username on sources that use Basic authentication.

Some fields are fixed once a connection exists and render read-only on edit. Saving re-establishes the connection with the current credentials, and closes the dialog even if that re-connect fails.

Testing a Connection

Test (t) probes the selected connection with its stored credentials and puts the result in Last check: Testing while it runs, then OK or Failed with the reason in a tooltip.

This is a different control from the Test Connection button inside the Add and Edit dialogs, which probes what is typed into the form. On Edit, a field left blank is probed with its stored value, so what you test is what Save would keep.

Connecting and Activating

This is the one place sources genuinely differ, and the difference decides which keys do what.

Connection sources - Bitbucket, GitHub, GitLab, Cloudflare, Ceph, NATS - are chosen per tab. Each tab reads one connection, and you pick which:

• Connect (c) when the selected connection is not already connected or connecting.
• Disconnect (d) when it is.

Disconnecting is app-wide even though the choice is per tab: the underlying connection is shared, so disconnecting removes it from every tab at once.

Polled sources - Redfish, SNMP - have no per-tab selection. Every connection is polled on its own schedule, and activating one only decides which the app points at:

• Activate (c) when the selected connection is not the active one.
• Deactivate (d) when it is.

The Monitoring column shows which are active. Both pairs are mutually exclusive, so only one of c and d ever applies to the selected row.

A successful Connect, Disconnect, Activate or Deactivate deliberately leaves Last check alone, because Status and Monitoring already show the result. Only failures land there.

Removing a Connection

Remove (Backspace) asks to confirm, with a dialog titled Remove followed by the lowercased noun. The body names the connection and warns that this "permanently removes" it and "deletes its stored credential", and cannot be undone. Some sources add a warning line above that about what else the removal affects.

Removing deletes the connection, its stored credential, and its entry in the extension's configuration file, and clears it from every tab that had it selected.

Connection Details

Select a row and press o or y for the Overview and YAML tabs in the right sidebar. Pressing the key for the tab already showing collapses the sidebar again.

Overview is a Details list built from whatever the connection record carries, so its rows differ per source: identifiers, hostnames, the account or workspace it points at, its probed state, when it was last polled. Empty values read as -, and booleans as Yes or No. YAML is the same record in full, and is read-only - there is no cluster to write it back to.

Some sources add their own tabs here. Agent Gateway proxies get a Connect tab (u), and its MCP proxies additionally get Tool Access (r).

Switching Connections While You Work

You do not have to come back to this page to change which connection a view reads. The connection indicator in the status bar (⌘0 / Ctrl+0) opens a Connections dialog with one tab per source.

For a per-tab source, each row carries a Connect or Disconnect button, and picking a row binds it to the current tab. For a polled source, rows carry Activate and Deactivate under a Monitoring column, the indicator shows how many are active, and a marker on the tab notes that the choice is shared across tabs rather than per tab.

With nothing chosen the indicator reads "No connection".

Pro Sources

Most connection sources are Pro features. Without a Pro license the table is replaced by an upgrade pane titled with the source's noun followed by "sources", reading "Upgrade to Kunobi Pro to connect and manage" that source, with an Upgrade button. Saved connections are not listed while a source is locked, and its actions and their shortcuts are inert. See Plans & Pro.

Where Credentials Are Stored

Passwords, tokens and API keys go to your operating system's credential store:

• macOS: Keychain
• Windows: Credential Manager
• Linux: kernel keyring and the D-Bus Secret Service

Each extension uses its own service name, so a Bitbucket token and a Cloudflare token never collide, and non-production builds get their own namespace so a development build cannot read or overwrite a released install's secrets. Removing a connection deletes its stored secret.

Everything that is not secret - identifiers, hostnames, ports, poll intervals, and the usernames that pair with a stored password - is kept in the extension's own configuration file, in plain text. Each extension page gives its path.

SNMP is the exception. It stores no secrets in the credential store at all: v2c community strings, and v3 authentication and privacy passwords, live in its configuration file in plain text. See SNMP.

Troubleshooting

A connection sits at error or an unhealthy status - select it and press Test (t); the reason appears in Last check on hover. Credentials are corrected with Edit (e), not by re-adding.

Adding is rejected as a duplicate - a connection to that same target already exists. Edit the existing one instead.

"This requires a Pro license." - the source is installed and running but not entitled on your license. See Plans & Pro.

A source is missing from the selector - its extension is not installed or not running. See Extensions.

Last check reads a dash and never updates - not every source polls in the background. For those, Last check only fills in after you run Test.