Sextant is a Kubernetes client for iPhone and iPad — native, fast, and
designed for the way you actually use your phone: standing in the
kitchen, on the train, walking the dog and getting paged. No cloud,
no account, no proxy. Sextant talks directly from your device to your
cluster's API server. The credentials never leave your phone.
WHAT YOU CAN DO
• Browse every Kubernetes resource — pods, deployments, services,
nodes, jobs, configmaps, ingresses, secrets, events, and any CRD
your cluster exposes.
• Tail logs from any container, with timestamps and following.
• Exec into a pod and run a shell.
• Manage Helm releases — values, manifests, NOTES.txt, full revision
history.
• Open port-forwards to pods and services. The forward runs locally
on the phone; tap "Open in Safari" and you're on the internal
endpoint.
• Switch between clusters and namespaces from the sidebar.
• Built for iPad: permanent sidebar in landscape, drawer in portrait,
full Liquid Glass on iOS 26.
PRIVATE BY DESIGN
There is no Sextant backend. Your phone IS the kubectl. The HTTPS
request your cluster sees comes from your device's IP — Sextant never
sees it. Credentials (tokens, kubeconfig passwords, client
certificates) live exclusively in the iOS Keychain. No analytics, no
crash reporters, no telemetry of any kind. The full source code is
public so you can verify all of this yourself.
WORKS WITH
GKE, EKS, AKS, OpenShift, k3s, kind, microk8s, Rancher, on-prem
clusters — anything that speaks the Kubernetes API. Authenticate with
bearer tokens, basic auth, client certificates, or any kubeconfig you
can paste in. Custom CA bundles supported.
TRY BEFORE YOU CONNECT
Open the built-in demo cluster — a fully-functional Kubernetes
environment running entirely on your device — and play with every
feature before adding your real cluster.
OPEN SOURCE
Source published at github.com/boringapps-net/sextant (FSL-1.1-MIT). Read
the code, audit the network calls, verify the privacy claims. Issues
and pull requests welcome.
