Skip to content

Extension governance#

Lens Enterprise subscription feature. See details on Lens Pricing.

Lens Enterprise only

Extension governance is part of Hardened Lens K8S IDE and is available only with a Lens Enterprise subscription. Organizations on other plans cannot set an extension policy.

Extension governance is part of Hardened Lens K8S IDE, the centralized controls a Lens Business ID administrator uses to standardize and secure Lens K8S IDE across the organization. It lets a Lens Enterprise organization decide which extensions run in Lens K8S IDE for its users. The Lens Business ID administrator sets one extension policy for the organization, and Lens K8S IDE enforces it on every seat the organization assigns. Users see why an extension is not available, and nothing they do in Lens gets around it.

What the administrator controls#

  • Allow extensions. Let users install any extension, or only the extensions the administrator lists.
  • Block extensions. Keep specific extensions, or specific versions of them, out of Lens.
  • Set a minimum version. Require a version of an extension or later, so users cannot run older, unapproved versions.
  • Install extensions for everyone. Push extensions to every user. Lens installs them, keeps them on, and updates them, and users cannot disable or uninstall them.
  • Allow or forbid local extensions. Decide whether engineers can create, clone, and install extensions from their own filesystem.
  • Allow or forbid publishing. Decide whether users can publish the extensions they build to npm.
  • Choose the catalog. Decide which npm keywords make up the catalog users browse in the Extension Marketplace. The default is lens-extension.

The administrator names extensions one by one, by npm scope such as @your-company/*, or with a version range such as production-cluster-mark@>=1.4.0. When rules overlap, an extension installed for everyone wins over a block, and a block wins over an allow.

Policy changes reach users the next time their Lens K8S IDE checks in with Lens ID. Every change is recorded in the audit log of the Lens Business ID.

What users see#

In Lens K8S IDE, users see the policy wherever it applies:

Situation What Lens shows
An extension the organization does not allow Install is turned off, with the reason, such as "Your organization does not allow this extension."
An installed extension that is no longer allowed The Held back state: the extension stays installed but does not run, and a notification says "1 extension was held back by your organization." It runs again once the organization allows it.
An installed version below the minimum "Your organization does not allow <VERSION>", with Switch to the newest version it does. With automatic updates on, Lens switches by itself.
An extension installed for everyone The PUSHED badge, and "Installed by your organization." in place of Disable and Uninstall.
Local extensions forbidden Create new, Clone, and Install from File System are turned off: "Your organization does not allow local extensions." Existing local extensions are held back.
Publishing forbidden Publish is turned off: "Your organization does not allow publishing extensions."