How it works

kubehz is built around one question: how much do you want to hand over, and what are you willing to share to get it? Two independent axes answer that — and a firm privacy boundary makes the answer safe.

Two axes

You choose these separately in cluster.lok8s.yaml under spec.kubehz:

spec:
  kubehz:
    hosting: self          # self | hosted
    access: registered     # none | registered | managed
    apiUrl: https://api.kubehz.cloud

Hosting — who runs the control plane

Value	Meaning	Status
self	You provision and own the control plane on your own Hetzner account. The normal lok8s flow.	Available
hosted	kubehz runs the control plane (etcd, apiserver, scheduler) on its infrastructure; you run only workers.	Early access

Access — how much kubehz sees and does

Value	kubehz sees	kubehz does	Status
none	Nothing — no platform contact at all.	Nothing.	Available
registered	Read-only health: Kubernetes version, nodes & status, control-plane component health, certificate expiry.	Shows it in the dashboard.	Available
managed	Management data for healing policies, capacity watches, desired state.	Records desired state; your cluster pulls and applies it.	Available (Supporter+)

The everyday combination is hosting: self + access: registered: your cluster on your account, kubehz as a read-only dashboard. access: managed is live on top of that — it adds kubehz's management features (healing policies, capacity watches, desired-state management driven from the dashboard) and requires a Supporter subscription or higher. A managed cluster registers and is claimed exactly like a registered one; the subscription gate applies when you drive management features.

The trust boundary — who needs your Hetzner token

This is the part that matters, so it is worth stating exactly:

• registered (self-hosted): no Hetzner token. kubehz gets read-only health and nothing else. It cannot change anything on your account or in your cluster.
• managed on your own self-hosted cluster: token optional. kubehz records the desired state (e.g. "upgrade to v1.35"); the in-cluster agent pulls it from the platform and applies it locally with the credentials your cluster already holds — kubehz never pushes in and holds no inbound credential. kubehz needs no token for core self-heal / scale / upgrade. A Hetzner token is only ever needed to show you account-specific pricing — never to run the cluster.
• hosted control plane: token required. Here you are genuinely delegating — kubehz provisions infrastructure for you, so it needs access to do so.

registered and managed are live today and hosted is in early access; the managed boundary above is exactly how the tier works — pull-based and outbound-only. The escalation is deliberate: you never grant more than the thing you asked for requires.

Your data — a firm promise (self-hosted)

For self-hosted clusters this is a guarantee, not a nicety:

• Only the data the feature you turned on needs ever leaves your cluster.registered sends health; managed sends management data. That is the whole list.
• No telemetry. No analytics. Nothing else. We do not collect usage data, workload contents, secrets, logs, or metrics you did not opt into.
• Outbound-only. The in-cluster heartbeat agentpushes a status snapshot on a schedule. kubehz never connects into your cluster and holds no inbound credentials to it.
• Opt-out is one step. lo kubehz deregister plus deleting the kubehz-system namespace removes everything; your cluster keeps running.

Because the agent only pushes what a feature needs, turning a feature off turns its data off.

Ownership — registering and claiming

A cluster becomes yours on the platform in two conceptual moves:

1. Register — provisioning announces the cluster to kubehz (or run lo kubehz register). It shows up as pending.
2. Claim — in the dashboard you claim the pending cluster to prove ownership and link it to your account. Once claimed, it is owned by you.

That is the whole model: register → claim → owned. (The precise claim handshake is being reworked, so we keep it at this level here.)

Principles

• Open source first. lok8s, the CLI that provisions everything, is open source and works without kubehz. You are never locked in.
• Honest pricing. Prices come from measured costs on our own fleet, and we explain our pricing.
• EU data sovereignty. Infrastructure in Germany; no US cloud dependencies.

Next steps

• Registration — turn on read-only visibility today
• Dashboard & account — what you get once claimed
• Hosted control plane — the delegated path (early access)