A read-only Kubernetes explorer that respects your RBAC

Your kubeconfig, in a window

Point a connection at a kubeconfig file and DevOpsPad lists its contexts with their cluster names. It reads the file to show you the choices but never returns credentials to the UI and never runs credential plugins. Pick a context, and its default namespace is filled in. Empty or * means all namespaces.

The editor takes a small, predictable command:

get pods
get deployments team-a
get nodes

Supported resource types are pods, deployments, services, namespaces, nodes, configmaps and events. Lists stop at 500 items and 8 MiB, and managed fields are left out of previews.

From a list to the cause

Double-click a row, or use the arrow beside its name, to open the inspector:

• Overview shows metadata, labels and each container’s type, state, readiness and restart count.
• Events lists events whose involved object has the same UID, so a Pod that was deleted and recreated with the same name does not mix in old events. Up to 200 events or 1 MiB.
• Logs fetches a snapshot for the container you choose, with tail lines, timestamps and an option for the previous instance, which is what you need after a crash. Up to 2,000 lines or 256 KiB.
• JSON shows the read-only definition.

The inspector keeps the context, namespace and UID of the row you opened, even if you change the editor or the sidebar afterwards.

RBAC stays in charge

DevOpsPad uses your credentials and nothing else. Details need get, events need list events, logs need get pods/log. If a namespace list is forbidden, the namespace from the connection settings still works. Errors stay local to the section that failed. See the RBAC permissions guide.

Clusters behind a bastion

Enable an SSH tunnel and the API server address from the kubeconfig is dialed from the SSH host, while TLS still uses the kubeconfig’s CA, client certificate and server name. Running a small cluster? The K3s connector covers the same features plus the Infra release workflow.