UI guide

The KDBL Context Lake (K-Lake) web console is your day-to-day surface for managing sources, browsing indexed files, and administering users and tokens.

Signing in

Open the URL your administrator provided. You can authenticate with:

• Personal access token — paste a PAT into the login form
• Single sign-on (OIDC) — click the SSO button if your tenant is configured for it

A successful login lands you on the dashboard. A Docs link in the top bar opens this documentation site at any time.

Dashboard

Top-level view of your tenant's indexing health.

• Queue depth — pending, running, completed, failed
• Per-source rollup — file count, bytes indexed, last crawl time
• Alerts for sources reporting errors
• Capacity & cost — the storage split across the base, lexical, and hybrid stacks, chunk and embedding counts, and per-mode query latency, so you can see what hybrid search is costing (see Capacity & cost)

Use the dashboard as your starting point for "is everything OK right now?"

Fleet

The Fleet page is the "what is running, and is it healthy?" view for the whole deployment. It was called Extractors in earlier releases; it grew to cover every component, so the name followed.

It leads with Components — one row per running service (API, worker, extractors, enrichment, and the rest) showing the version and build each pod is on, how long it has been up, and whether it is healthy. Uptime is the column that distinguishes a pod that has been stable for a fortnight from one that has restarted six times this hour, which is usually the question.

The most common thing this catches is a partial roll: every pod of a consistent deployment reports the same version, so a row that disagrees means an upgrade did not finish.

Below Components are:

• Enrichment — the entity-enrichment fleet and its coverage. See Knowledge graph.
• Extractors — one row per extractor pod and the engine it runs (klex, kdoc, kvision or kmedia — see Sources), with concurrency, last heartbeat and health. Use it to confirm the right engines are deployed and the fleet is up before (or during) a large crawl.

Cluster admins see more. A cluster-admin token adds per-pod operational signals to the Components table — memory pressure and OOM history, a mount that has stopped responding, recent error volume, and configuration drift between pods of the same component. These come from each pod's own self-report and are withheld from tenant-admin tokens entirely.

Discover (data estate)

Tenant admins get a Discover tab — a data-estate overview that answers "what data do we have?": estate totals, how much is searchable, composition breakdowns (file type, content type, language, size, age, owner, storage tier, source), and a governance view of exposure signals. See Discover.

Entity Explorer

The Entity Explorer browses the knowledge graph — the people, organisations, locations and agreements K-Lake found in your documents, and the relations between them.

It offers three views over the same data — Orbit (one entity and its neighbours), Network (structure across many entities), and Documents (the evidence for why two entities are associated) — each paired with a table of the same result, so any answer can be copied into a ticket. Duplicate entities can be merged here, and merges are reversible.

Everything is access-trimmed the same way search is: you see documents you already have access to.

Sources

The sources page lists every source in your tenant. From here you can:

• Add a source — opens the new-source form. Pick a protocol (S3, Azure Blob, SMB, SMBFS, NFS, OneDrive/SharePoint), fill in connection details, supply credentials. See Sources for protocol details.
• Open a source — click a row to see its detail page.
• Sort and filter — by protocol, last crawl, file count, status.

Source detail

Each source's detail page brings together everything you can do with it:

• Overview — protocol, connection settings, current file count, bytes, last crawl
• Crawl — trigger a crawl, optionally narrowed to a path prefix
• Files — paginated browser of every file K-Lake has indexed for the source. Click a row for full metadata.
• Enrichment — choose which optional metadata caps to gather (tags, ACLs, xattrs) and queue a backfill if you turn one on after the fact
• Smart Actions — the per-source pipeline that runs after each crawl: content extraction (with extension/size/path filters and live progress), redaction, webhooks, and more. Add, reorder, enable, and configure steps as a top-to-bottom list. See Smart Actions
• Crawl & extract progress — per-worker live progress panels while a crawl or extraction is running; extraction throughput is shown in pages per second (a truer measure than files/second)
• Per-file security trimming — set the trim mode (per_file / source_only / open) and the fail-closed toggle (see security trimming)
• Settings — enable / disable, toggle bulk-ingest mode, adjust subtree concurrency, SMB3 multi-channel; schedule recurring crawls/backfills
• History — recent crawl runs with outcomes, errors, and timings
• Access grants — the card that controls who can see this source: add a principal (user: / group:) with a role (viewer / editor / owner), or revoke one. Fully in step with the CLI (kdbl-control acl) and the REST API — see Sources → Access grants

File detail

Opens for any file row. Shows path, size, timestamps, content hash (when available), and protocol-specific metadata such as S3 tags or NTFS / NFSv4 ACLs.

When the server has signed downloads enabled, the header carries Open original (inline preview) and Download buttons. K-Lake doesn't store original bytes — clicking re-fetches the file from its source on demand (permissions re-checked, audited). The buttons are hidden when the feature is off.

Content search

Search over extracted content — across every source you can see by default, or scoped to a single source. Each hit shows the matched file, an in-document locator (page / char / timestamp), and a highlighted snippet. When signed downloads are enabled, each hit also offers an Open original link so you can open the source file and verify the grounding behind a result.

Tokens

Found under your name in the top bar.

• List — every PAT you've minted, with name and last-used time
• New token — mint a fresh PAT. The raw value is shown once on creation; copy it immediately.
• Revoke — invalidate a PAT. Effective immediately.

Tenant administration (admins only)

Tenant administrators see additional pages.

Users — list of users in the tenant. Create new users, edit roles, deactivate accounts.

MCP — the live view of your MCP server: a real-time access-flow graph, active connections, token revocation, and per-source exposure control. See MCP monitoring & access control.

Tenants — only visible to cluster administrators. Manage all tenants, set OIDC configuration, configure retention overrides, and the Directory correlation card to set a tenant's Entra Graph / AD-LDAP / declared-mapping config (the encrypted secrets stay CLI-only — the card shows a "secret stored / secret pending" badge per block). See directory enrichment.

Settings — tenant-level preferences, with the source panels grouped by intent so related settings sit together rather than in one long form.

Diagnostics — generate a diagnostic pack for a support ticket. The page shows a consent screen first, listing exactly what the pack will contain at the chosen redaction level and what it excludes, before anything is collected. Packs generated here cover K-Lake's own data; the cluster half needs the CLI, which uses your own Kubernetes credentials.

Accessibility and browser support

The console targets recent Chrome, Firefox, Safari, and Edge releases. Keyboard navigation is supported throughout; the file browser uses standard table semantics.