How it works

kubehz is built around one question: how much do you want to hand over, and what are you willing to share to get it? Two independent axes answer that, and a firm privacy boundary makes the answer safe.

Two axes

You choose these separately in cluster.lok8s.yaml under spec.kubehz:

spec:
  kubehz:
    hosting: self          # self | hosted
    access: registered     # none | registered | managed
    apiUrl: https://api.kubehz.cloud

Hosting — who runs the control plane

Value	Meaning	Status
self	You provision and own the control plane on your own Hetzner account. The normal lok8s flow.	Available
hosted	kubehz runs the control plane (etcd, apiserver, scheduler) on its infrastructure; you run only workers.	Available

Access — how much kubehz sees and does

Value	kubehz sees	kubehz does	Status
none	Nothing: no platform contact at all.	Nothing.	Available
registered	Read-only health: Kubernetes version, nodes & status, control-plane component health, certificate expiry.	Shows it in the dashboard.	Available
managed	Management data for healing policies, capacity watches, desired state.	Records desired state; your cluster pulls it and applies the actions that are switched on.	Available (Supporter+)

The everyday combination is hosting: self + access: registered: your cluster on your account, kubehz as a read-only dashboard. access: managed is live on top of that: it adds kubehz’s management features (healing policies, capacity watches, desired-state management driven from the dashboard) and requires a Supporter subscription or higher. A managed cluster registers and is claimed exactly like a registered one; the subscription gate applies when you drive management features.

The trust boundary — who needs your Hetzner token

This is the part that matters, so it is worth stating exactly:

• registered (self-hosted): no Hetzner token. kubehz gets read-only health and nothing else. It cannot change anything on your account or in your cluster.
• managed on your own self-hosted cluster: token optional. kubehz records the desired state (e.g. “upgrade to v1.35”); the in-cluster agent pulls it from the platform and applies it locally with the credentials your cluster already holds. kubehz never pushes in and holds no inbound credential. Self-heal, scale and upgrade therefore need no token at all: they run inside your cluster, each behind its own execution switch. A Hetzner token is only ever needed to show you account-specific pricing, never to run the cluster.
• hosted control plane: token required. Here you are genuinely delegating: kubehz provisions infrastructure for you, so it needs access to do so.

registered, managed and hosted are all live today; the managed boundary above is exactly how the tier works: pull-based and outbound-only. The escalation is deliberate: you grant each capability only the access it needs, nothing more.

Your data — a firm promise (self-hosted)

For self-hosted clusters this is a guarantee, not a nicety:

• Only the data the feature you turned on needs ever leaves your cluster. registered sends health; managed sends management data. That is the whole list.
• No telemetry. No analytics. Nothing else. We do not collect usage data, workload contents, secrets, logs, or metrics you did not opt into.
• Outbound-only. The in-cluster heartbeat agent pushes a status snapshot on a schedule. kubehz never connects into your cluster and holds no inbound credentials to it.
• Opt-out is one step. lo kubehz deregister plus deleting the kubehz-system namespace removes everything; your cluster keeps running.

Because the agent only pushes what a feature needs, turning a feature off turns its data off.

Ownership — registering and claiming

A cluster becomes yours on the platform in two conceptual moves:

1. Register: provisioning announces the cluster to kubehz (or run lo kubehz register). It shows up as pending.
2. Claim: in the dashboard you claim the pending cluster to prove ownership and link it to your account. Once claimed, it is owned by you.

That is the whole model: register → claim → owned. Claiming documents both handshakes in full: a one-time claim code, or an SSH fingerprint verified against your Hetzner account.

Principles

• Open source first. lok8s, the CLI that provisions everything, is open source and works without kubehz. You are never locked in.
• Honest pricing. Prices come from measured costs on our own fleet, and we explain our pricing.
• EU data sovereignty. Infrastructure in Germany; no US cloud dependencies.

Next steps

• Registration: turn on read-only visibility today
• Dashboard & account: what you get once claimed
• Hosted control plane: the delegated path

Doc status

Aspect	Detail
State	Live: self-hosted, managed and hosted all available; free until 1 December 2026, then billed monthly
Last reviewed	14 August 2026