pgToolBox

One declarative access stack per CloudNativePG cluster.

Pre-alpha, not public yet

pgToolBox is a Kubernetes and OpenShift operator. For each PgConsole you declare, it composes a dedicated pod next to one CloudNativePG cluster: an authentication proxy, pgConsole, an embedded pgAdmin, and optionally pgObjectStoreViewer.

  • One console per cluster, never shared. Dedicated proxy, dedicated pgAdmin, dedicated credentials: isolation wins over resource sharing.
  • Users are Kubernetes objects. A PgToolBoxUser binds an identity to view, poweruser or dba. A PgToolBoxAccessRequest lets an unknown user ask a dba for access from the proxy’s 403 page.
  • Any mix of sign-in methods. OIDC, OpenShift OAuth and local accounts at once, so a local account still works when the identity provider is down.
  • Every exposure type. OpenShift Route, Ingress, Gateway API HTTPRoute or ClusterIP, behind a generated default-deny NetworkPolicy.

It will ship as a Helm chart and an OLM bundle once it leaves pre-alpha.

All projects