Inspect Kubernetes and K3s clusters without write access
Browse contexts, namespaces and resources from a kubeconfig, inspect Pods, UID-scoped events and bounded log snapshots, read-only and over SSH.
What it is
The Kubernetes explorer treats a cluster like any other connection in DevOpsPad. Pick a kubeconfig and a context, choose a namespace, and run short queries such as get pods default in a tab. Results land in the same grid as SQL results; open any row to see its details, events and logs.
It works the same for Kubernetes and K3s, directly or through an SSH tunnel to a private API server.
How it works
- Contexts and namespaces. DevOpsPad lists the contexts in your kubeconfig and their clusters without returning credentials or running plugins. Selecting a context fills in its default namespace. An empty namespace or
*lists across namespaces. If you can’t list namespaces, you can still query the namespace saved on the connection. - Queries.
get <resource> [namespace], for exampleget deployments team-aorget nodes. Each tab remembers the context and namespace it was opened with. - Resource details. Double-click a row. Overview shows metadata, labels and container state with restart counts; JSON shows the definition with managed fields omitted.
- Events. Matched by the resource’s UID, not just its name, so events from an older Pod with the same name don’t mix in. Up to 200 events or 1 MiB.
- Logs. Choose an application, init or ephemeral container, set the tail length, look at the previous container instance after a crash, refresh and copy. Snapshots are bounded to 2,000 lines or 256 KiB with a 20-second timeout. Log output is not stored or sent to AI.
Permissions stay with your cluster
DevOpsPad never widens access. Resource details need get, events need list on events, and logs need get on pods and pods/log. A permission error on events or logs stays inside that section instead of failing the whole view. See RBAC permissions for a minimal read-only role.
Limits
- Cluster lists are capped at 500 items and 8 MiB per query.
- Exec-based kubeconfig authentication is not supported.
- No live log streaming,
execor port-forwarding. - To release, scale or restart Deployments, use the Infra console.
Help articles
Connect to a cluster with a kubeconfig context
Add a Kubernetes or K3s connection from a kubeconfig file, pick a context and default namespace, and see which authentication methods are supported.
List Kubernetes resources with get
Use the get <resource> [namespace] query to list Pods, Deployments, Services, ConfigMaps, events, nodes and namespaces in DevOpsPad, read-only.
Inspect a Kubernetes resource
Open a Pod, Deployment, Service or node in the resource inspector to see its status, labels, containers, restarts and the read-only JSON definition.
View events for a Kubernetes resource
See the Kubernetes events for one Pod, Deployment or node, matched by UID rather than name, with the 200-event and 1 MiB preview limits explained.
Read Pod logs, including a crashed container
Read a log snapshot for any application, init or ephemeral container in a Pod, choose how many lines to tail and see the previous instance after a crash.
Kubernetes permissions DevOpsPad needs
The Kubernetes RBAC verbs each DevOpsPad view needs, from testing a connection to reading Pod logs, plus a minimal read-only Role you can grant.
Frequently asked questions
Which kubeconfig authentication methods work?
Token and client-certificate authentication. Exec-based authentication plugins, such as cloud provider login helpers, are rejected in this version.
Can I follow Pod logs live?
Not yet. Logs are bounded snapshots of up to 2,000 lines or 256 KiB that you can refresh. Live streaming and exec are not implemented.
Can the Kubernetes explorer change my cluster?
No. The query adapter exposes no mutations. Reviewed releases, scaling and restarts live in the separate Infra console.