Sextant

Sextant is a Kubernetes client for iPhone and iPad — native, fast, and designed for the way you actually use your phone: standing in the kitchen, on the train, walking the dog and getting paged. No cloud, no account, no proxy. Sextant talks directly from your device to your cluster's API server. The credentials never leave your phone. WHAT YOU CAN DO • Browse every Kubernetes resource — pods, deployments, services, nodes, jobs, configmaps, ingresses, secrets, events, and any CRD your cluster exposes. • Tail logs from any container, with timestamps and following. • Exec into a pod and run a shell. • Manage Helm releases — values, manifests, NOTES.txt, full revision history. • Open port-forwards to pods and services. The forward runs locally on the phone; tap "Open in Safari" and you're on the internal endpoint. • Switch between clusters and namespaces from the sidebar. • Built for iPad: permanent sidebar in landscape, drawer in portrait, full Liquid Glass on iOS 26. PRIVATE BY DESIGN There is no Sextant backend. Your phone IS the kubectl. The HTTPS request your cluster sees comes from your device's IP — Sextant never sees it. Credentials (tokens, kubeconfig passwords, client certificates) live exclusively in the iOS Keychain. No analytics, no crash reporters, no telemetry of any kind. The full source code is public so you can verify all of this yourself. WORKS WITH GKE, EKS, AKS, OpenShift, k3s, kind, microk8s, Rancher, on-prem clusters — anything that speaks the Kubernetes API. Authenticate with bearer tokens, basic auth, client certificates, or any kubeconfig you can paste in. Custom CA bundles supported. TRY BEFORE YOU CONNECT Open the built-in demo cluster — a fully-functional Kubernetes environment running entirely on your device — and play with every feature before adding your real cluster. OPEN SOURCE Source published at github.com/boringapps-net/sextant (FSL-1.1-MIT). Read the code, audit the network calls, verify the privacy claims. Issues and pull requests welcome.