Built for the way real teams operate infrastructure.
This page describes what Ark8 actually does today. Nothing here is roadmap or aspirational — if it's on this page, it ships.
Terminal & SSH
First-class SSH inventory.
Group hosts by environment (LOCAL / DEV / STAGING / PROD), tag them, drop them into folders, and connect using your local SSH configuration.
Native SSH sessions
Full-featured terminals per session with your ~/.ssh/config, keys, and ssh-agent. No password persistence — ever.
Environment grouping
Hosts organized by environment and sub-folder — the mental model your team already uses.
Instant search
Find a host by name, tag, or hostname across every environment in one keystroke.
SFTP + files
Browse and edit remote files through the same session, without re-entering credentials.
Kubernetes
A kubectl-parity inspector.
Read your kubeconfig, browse clusters, workloads, events, and logs. The inspector uses the same auth as kubectl — no cloud credentials leave the device.
Multi-cluster view
Every context in your kubeconfig, in the same sidebar as your SSH hosts.
Workloads & events
Pods, deployments, services, ingresses, plus a live events feed per namespace.
Cloud provider auth
Works with gke-gcloud-auth-plugin, aws, and kubelogin from your PATH.
Exec-into-pod
Attach a terminal to a running container without leaving the workspace.
Tunnels
A unified port-forwarding lifecycle.
SSH port-forwards and Kubernetes port-forwards live in one manager with a shared lifecycle model. See what's active, why, and to which target.
Local / remote / dynamic
SSH -L, -R, and -D tunnels, all configured through a single wizard and managed side-by-side.
K8s port-forwards
kubectl port-forward equivalent with visual lifecycle state (starting / active / reconnecting / stopped).
Never persists secrets
SSH passwords for tunnels stay in the macOS Keychain, keyed per tunnel id — same discipline as sessions.
Web-tab passthrough
When a tunnel targets an HTTP port, open it as a Ark8 web tab — no browser context switch.
Team sharing
Explicit, per-item, reversible.
Publish a host, cluster, or tunnel to your organization with one click. Teammates see the descriptor and connect using their own local credentials.
- name
- hostname
- port
- username
- tags
- passwords
- private keys
- kubeconfig
- tokens
Owner-controlled
Only the item's owner can share or un-share. Sharing state is per-item, not org-wide.
Admin / Owner see
Members and Viewers never see other users' shared items unless the org's admin explicitly grants access.
Read-only for peers
Shared items are display-only on the receiver's side — Ark8 never fabricates credentials.
Descriptor-only wire
Only name, host, port, username, and tags travel to Supabase. Secrets stay on-device.
Identity & RBAC
Enterprise from day one.
Supabase Auth for sign-in. Postgres RLS for authorization. A four-tier RBAC model that enforces itself at the database, not the UI.
Google + Microsoft
OIDC sign-in via Google Workspace and Microsoft Entra ID. PKCE-only; no client secrets in the app.
Four roles
Owner, Admin, Member, Viewer — with owner-transfer protected by a database trigger.
Append-only audit
Every membership change, share, sign-in, and admin action is logged and secret-redacted at insert time.
Row-Level Security
Cross-tenant isolation is enforced by Postgres, not client filtering. Verified by 60+ integration tests.
Ready to try?
Free during public preview. Download the macOS app; sign in only when you're ready to share with your team.