DevOpsPadDownload

Help Center

Install DevOpsPad, connect to databases and Kubernetes, set up SSH tunnels, run read-only queries, release to K3s and configure the AI assistant.

Start here

Getting started

Install DevOpsPad on macOS, add your first database or cluster connection, learn the workspace layout and keyboard shortcuts, and keep the app updated.

  • What is DevOpsPad?

    DevOpsPad is a desktop app for read-only database and Kubernetes access plus reviewed K3s releases. What it does, what it does not do, and who it is for.

  • Install DevOpsPad on macOS

    Download the signed and notarized DevOpsPad DMG for Apple silicon Macs, move the app to Applications and open it. Includes the optional devopspadctl CLI.

  • Add your first connection

    Create a DevOpsPad connection - pick an engine, enter the host and credentials or a kubeconfig, run Test connection, save it and start browsing.

  • A tour of the DevOpsPad workspace

    Learn the DevOpsPad layout - the navigation rail, the 中间件 and Infra workspaces, the Explorer tree, query tabs, editor, results grid and the AI assistant panel.

  • DevOpsPad keyboard shortcuts

    The keyboard shortcuts DevOpsPad supports today - run a query, jump to a connection and create a new connection - and where each one works.

  • Update DevOpsPad to a new version

    How DevOpsPad checks GitHub for new releases, what the update prompt offers, and how to install a new version without losing connections or project settings.

  • Build DevOpsPad from source

    Build and run DevOpsPad from source with Go, Node.js and Wails v2 on macOS, Windows or Linux, including the browser-only UI preview and the test suite.

Connections

Create, test, label, edit and delete connection profiles for all seven engines, configure TLS, and find where profiles and secrets are stored.

  • Connection profiles for seven engines

    What a DevOpsPad connection profile contains for MySQL, Redis, MongoDB, Kafka, ClickHouse, Kubernetes and K3s, and how to see each engine's capabilities.

  • Label connections by environment

    Tag each DevOpsPad connection as Development, Staging, Production or a custom name, and use the label to group cluster connections in Infra.

  • Use TLS with database connections

    How the Use TLS with certificate verification option works for MySQL, ClickHouse, MongoDB, Redis and Kafka in DevOpsPad, and what TLS setups are not supported.

  • Test a connection before saving

    What Test connection checks for each engine in DevOpsPad, how long it waits, what the result means and how to read the most common error messages.

  • Edit or delete a connection

    Change a saved DevOpsPad connection, keep or replace its keychain password, switch SSH methods, or delete it along with its secrets and open tabs.

  • Where DevOpsPad stores connections

    DevOpsPad keeps connection metadata in a local workspace.json and secrets in the OS keychain. File locations, permissions, the backup copy and recovery.

SSH tunnels

Reach private databases and clusters through a single-hop SSH tunnel using a private key, password or SSH agent, with verified host keys.

  • Connect through an SSH tunnel

    Reach private MySQL, Redis, MongoDB, Kafka, ClickHouse and Kubernetes endpoints through a bastion with DevOpsPad's built-in single-hop SSH tunnel.

  • SSH private key authentication

    Use an SSH private key, including passphrase-protected keys, for DevOpsPad SSH tunnels. Supported paths, where the passphrase is stored, and common errors.

  • SSH password authentication

    Authenticate a DevOpsPad SSH tunnel with a password. Where the SSH password is stored, how to change it, and what to check when the server rejects it.

  • Use the SSH Agent for tunnels

    Authenticate DevOpsPad SSH tunnels through the agent at SSH_AUTH_SOCK so keys stay in the agent. macOS setup, and why the agent may be missing.

  • Verify SSH host keys

    DevOpsPad only trusts SSH servers listed in known_hosts or matching a SHA256 fingerprint you provide. How to set up each option and fix verification errors.

  • Troubleshoot SSH tunnel errors

    Fix DevOpsPad SSH tunnel errors - unreachable bastions, failed authentication, forwarding, Kafka advertised listeners, TLS names and unsupported setups.

Databases

Connect to MySQL, ClickHouse, MongoDB, Redis and Kafka, browse schemas and keys, and run read-only queries, find commands and SCANs safely.

  • Connect to MySQL

    Add a MySQL connection in DevOpsPad with host, port, credentials, optional default database, TLS and SSH, then test it before you save it.

  • Run read-only MySQL queries

    How DevOpsPad runs MySQL queries inside server-side read-only transactions, which statements fail, and why you should still use a read-only MySQL account.

  • View MySQL table structure and DDL

    Inspect a MySQL table's columns, indexes and CREATE TABLE statement in DevOpsPad, switch databases per tab and copy the DDL without running any query by hand.

  • Connect to ClickHouse over HTTP

    Connect DevOpsPad to self-hosted ClickHouse or ClickHouse Cloud through the HTTP interface on port 8123, or 8443 with TLS, and test the connection.

  • Run read-only ClickHouse queries

    Run SQL against ClickHouse in DevOpsPad with readonly=1, a 500-row cap and a 15-second execution limit, and inspect columns, skipping indexes and DDL.

  • Connect to MongoDB

    Add a MongoDB connection in DevOpsPad with host, port, database and authentication database (authSource), plus optional TLS and SSH tunneling.

  • Write MongoDB find queries

    The JSON find format DevOpsPad uses for MongoDB, with collection, filter, projection, sort, skip and limit fields, defaults, validation rules and limits.

  • Use Extended JSON in MongoDB filters

    Filter MongoDB by ObjectId, date, Long and Decimal128 in DevOpsPad with Extended JSON, and read the canonical Extended JSON that results come back in.

  • Page through MongoDB results in batches

    How Previous batch and Next batch page through MongoDB results in DevOpsPad, why _id is added to the sort, and when to switch to range filters.

  • Connect to Redis

    Add a Redis connection in DevOpsPad with host, port, database index, optional ACL user, TLS and SSH tunnel, then test it with PING before saving.

  • Browse Redis keys with SCAN

    How DevOpsPad lists Redis keys with cursor-based SCAN and MATCH patterns, why batches can be empty or repeat keys, and how Load more keys works.

  • Run read-only Redis commands

    The Redis commands DevOpsPad allows in the query editor, how to quote keys with spaces using a JSON array, and the 8 MiB response limit.

  • Connect to Redis with ACL users and TLS

    Use a Redis 6+ ACL user, TLS or an SSH tunnel with DevOpsPad, what happens to certificate verification, and a minimal read-only ACL rule.

  • Inspect Kafka topics and partitions

    Connect DevOpsPad to Kafka with optional SASL/PLAIN and TLS, list topics and see each partition's leader, replica count and in-sync replica count.

Kubernetes & K3s

Open a kubeconfig, switch contexts and namespaces, list resources, read details and events, and fetch Pod logs with the RBAC each view needs.

  • Connect to a cluster with a kubeconfig context

    Add a Kubernetes or K3s connection from a kubeconfig file, pick a context and default namespace, and see which authentication methods are supported.

  • Choose a Kubernetes namespace

    Pick the namespace a Kubernetes or K3s tab queries, list across all namespaces with *, and keep working when you are not allowed to list namespaces.

  • List Kubernetes resources with get

    Use the get <resource> [namespace] query to list Pods, Deployments, Services, ConfigMaps, events, nodes and namespaces in DevOpsPad, read-only.

  • Inspect a Kubernetes resource

    Open a Pod, Deployment, Service or node in the resource inspector to see its status, labels, containers, restarts and the read-only JSON definition.

  • View events for a Kubernetes resource

    See the Kubernetes events for one Pod, Deployment or node, matched by UID rather than name, with the 200-event and 1 MiB preview limits explained.

  • Read Pod logs, including a crashed container

    Read a log snapshot for any application, init or ephemeral container in a Pod, choose how many lines to tail and see the previous instance after a crash.

  • Kubernetes permissions DevOpsPad needs

    The Kubernetes RBAC verbs each DevOpsPad view needs, from testing a connection to reading Pod logs, plus a minimal read-only Role you can grant.

  • Why exec-based kubeconfig auth fails

    DevOpsPad does not run kubeconfig exec plugins such as cloud CLI token helpers yet. See which contexts are affected and how to connect with a token instead.

Query workbench

Work with query tabs, run and cancel queries, filter and sort results, export CSV, save queries, restore drafts and understand result limits.

  • Work with query tabs

    Open several query tabs per connection, each with its own database, context or namespace scope, and keep them open while you switch between workspaces.

  • Run and cancel a query

    Run a query with Cmd or Ctrl+Enter, cancel it while it runs and understand the 20-second timeout and what cancelling does on the database server.

  • Filter, sort and inspect results

    Filter fetched rows by text, sort any column, page through 50 rows at a time and open a row in the inspector to read long values or copy it as JSON.

  • Export query results to CSV

    Save the current query result as a CSV file from DevOpsPad, with every field quoted, spreadsheet formula injection guarded and file permissions limited to you.

  • Saved queries and query history

    Save reusable queries on your device, reopen any of your last 100 queries from this session and jump to a connection with the Cmd or Ctrl+K palette.

  • Restore query drafts after restart

    Turn on Restore query drafts on startup to bring back your open tabs, query text and scopes after a restart, without saving results or running anything.

  • Why results stop at 500 rows

    DevOpsPad caps previews at 500 rows or documents and 8 MiB, with a 20-second timeout. See the limit for each engine and how to page through larger data.

Infra console

Map K3s workloads to environments, register image artifacts, release, scale, restart and roll back Deployments, and record AI runs with devopspadctl.

  • What is the Infra console?

    The Infra console organizes K3s and Kubernetes apps by environment, with nodes, artifacts, releases, Pods, logs, metrics, events and config on one screen.

  • Connect K3s workloads to the Infra console

    Use the Connect K3s wizard to read workloads from a namespace and map them to an environment and application. Only a local mapping is saved.

  • Map environments and apps in project.yaml

    project.yaml maps each environment to a saved cluster connection and namespace and each application to a Pod label selector. Format, rules and examples.

  • See every node in a K3s cluster

    The Nodes page lists every node of the selected environment's cluster with Ready status, roles, internal and external IPs, CPU, memory, OS and version.

  • Register an image as an artifact

    Register an existing image by its immutable sha256 digest so you can release it. DevOpsPad does not build, push or verify images in your registry.

  • Release a new image to a Deployment

    Release a registered image to one container of an existing Deployment. DevOpsPad runs a server-side dry-run, takes a Lease and waits for the rollout.

  • Scale or restart a Deployment

    Change a Deployment's replicas between 0 and 1,000 or trigger a rolling restart from the Infra console, after reviewing a dry-run plan.

  • Roll back to a previous image version

    Roll a Deployment container back to the image digest of an earlier successful release. A new plan is checked against the current state first.

  • View and edit an app's ConfigMaps

    See the environment variables, mounts and ConfigMaps an app actually uses, edit ConfigMap text with conflict checks, and edit host Nginx config over SSH.

  • Check Pod CPU and memory usage

    The Monitoring page shows current CPU (mCPU) and memory (MiB) for an app's Pods from metrics-server, with the sample time. There is no history.

  • Use the devopspadctl command-line tool

    devopspadctl validates release specs, lists fleets, inspects and attaches cluster workloads, and records AI build and release runs in a local project.

  • Record AI builds and releases in DevOpsPad

    Let an AI agent report build and release steps with devopspadctl runs record. Successful builds become artifacts; records are idempotent and validated.

AI assistant

Configure an OpenAI-compatible or local model provider, control exactly what is sent with each prompt, and insert suggestions into the editor.

  • Configure an AI provider

    Connect the DevOpsPad AI assistant to any OpenAI-compatible Chat Completions endpoint by setting the API base URL, model ID and an optional API key.

  • Use a local AI model

    Run the DevOpsPad AI assistant against a model on your own machine, such as Ollama, over loopback HTTP so prompts never leave your laptop.

  • What DevOpsPad sends to the AI provider

    Exactly what each AI assistant request contains, when resource names are included, and why credentials, query results and logs are never sent.

  • Insert an AI suggestion into the editor

    Move a query from the DevOpsPad AI assistant into the editor with one click, review it and run it yourself. Suggestions never execute automatically.

Security & privacy

How DevOpsPad stores credentials in the OS keychain, what its read-only modes do and do not block, and how to set up least-privilege accounts.

  • How DevOpsPad stores passwords and keys

    Database passwords, SSH secrets and AI API keys live in the OS keychain. Connection metadata is a local JSON file with owner-only permissions.

  • What is read-only in DevOpsPad

    How each engine keeps DevOpsPad queries read-only, where the protection has gaps such as MySQL DDL, and which Infra console actions are allowed to write.

  • Create least-privilege accounts

    Create read-only accounts for MySQL, ClickHouse, MongoDB, Redis, Kafka and Kubernetes so DevOpsPad can browse everything it needs and change nothing.