pgToolBox shows the real state of your CloudNativePG clusters to the people who run them, one team console per namespace, and lets those who hold the right RBAC act on them. A small operator adds a managed pgAdmin per team and a read-only cross-check of the backup repository.
Kubernetes decides, not the console
The console signs people in, then asks the API server with a SelfSubjectAccessReview, sent with the person's own token, what they may see and do. Writes carry the person's own token, so the API server's audit log names them. No level, role or group is stored anywhere in the product.
One console per team, never cluster-wide
A console is a Deployment in a team namespace with Roles in the few namespaces it watches and no Secret verb. The reach of a compromised console is the namespaces it watches, not the whole Kubernetes cluster.
A small operator for what must persist
PgAdmin, one pgAdmin per team registered against many clusters; EvidenceAgent, a read-only reader of a backup repository; PgToolBoxConsole, a console declared as an object; PgAccessRequest, access that is approved and expires; PgAdminAccess, a namespace owner's grant to a pgAdmin. The operator never holds a database password.
Honest status, including its blind spots
Each fact says where it came from. A cluster the console cannot verify is shown as not verifiable, a source it cannot read is named, and a diagnostic that could not run never counts as clear.
Scope. pgToolBox provisions access and shows status. It never runs SQL for you: a person's own PostgreSQL role is a CloudNativePG DatabaseRole created with their token, CloudNativePG owns the cluster, and Kubernetes RBAC decides what a person may see and do.