pgConsole
A per-cluster operational console for one CloudNativePG cluster, read-only by default. It renders what the operator and Kubernetes report — status, pods, events, backups, and a bounded log tail — attributed to its origin and honest about staleness, without giving anyone kubectl access or a database connection.
The console authenticates nobody: a trusted proxy asserts the user's level, and the console shows the routes that level admits. Its entire authority is the RBAC on its ServiceAccount.