1kcsd/devops-tools repository overview

⁠DevOps Tools

A self-service portal for Kubernetes. Developers read logs and metrics, restart workloads, edit secrets and manage Helm releases — in the namespaces their role allows, without being given access to the cluster.

Metrics and log history are optional; leave them unconfigured and those sections do not appear.

⁠Install

helm install devops-tools oci://registry-1.docker.io/1kcsd/devops-tools \
  --version 0.27.3 --namespace devops-tools --create-namespace \
  --set config.auth.bootstrapAdmins.passwordLogin.password='choose-one'

The chart is published beside the image, in this same repository — --version is the chart's, and it moves independently of the image tag. helm show values oci://registry-1.docker.io/1kcsd/devops-tools --version 0.27.3 prints every setting with its documentation.

That password is the only thing an install has to decide. It belongs to admin — the administrator account, which always has full access whatever the portal's own model says. Use it for the first sign-in, and on the day the identity provider is unreachable. Nothing ships with a default password: the install fails rather than starting a portal anyone could walk into.

Then reach it and sign in as admin:

kubectl -n devops-tools port-forward svc/devops-tools 8080:80

⁠Who may do what

The identity provider — local accounts, ldap (Active Directory, OpenLDAP) or oidc (Keycloak, Dex, Okta, Authentik) — establishes only who someone is. Roles are assigned inside the portal:

developer:
  namespaces:
    - namespace: payments-dev
      operations: [logs, describe, metrics, pod-restart, secret-list]

Roles are read on every request rather than carried in the session token, so revoking one takes effect immediately. Everyone signing in for the first time arrives with no access at all.

⁠Configuration

Settings come from application.yaml in /config — the chart renders it from your values. Credentials come from the environment, never from that file:

The chart sets all of these for you, from values or from Secrets you name.

⁠Image

Distroless: a static Go binary with the web interface built into it — no separate frontend, reverse proxy or database. Around 60 MB.

Tags follow the chart's appVersion. There is no latest: which version a cluster runs should be written down, not whatever was pushed last.