Dashboard & account

The kubehz dashboard (app.kubehz.cloud) is where you see your clusters, prove ownership, and manage who has access. Your login and personal security settings live in your kubehz account at auth.kubehz.cloud/account.

Signing in

No account yet? Creating one is free and takes about a minute. Open app.kubehz.cloud, choose Create an account, and sign up with an email address, Google or GitHub. The free tier covers up to two registered clusters and needs no payment details.

Sign-up is open for the first 25 accounts. After that, you need an invite code from an existing account (see Invite codes). kubehz’s own internal and test accounts do not count toward the 25.

Open app.kubehz.cloud and sign in with your kubehz account. Authentication runs through kubehz’s own identity service at auth.kubehz.cloud.

Invite codes

Every account gets 2 invite codes. The account owner finds them under Settings → Account, in the Your invites section. Each code shows its state: Unused, Used, Expired or Revoked.

• A code creates one account. It works once.
• An unused code expires 30 days after kubehz issues it.
• The new person enters the code under Invite code when they sign up. Upper or lower case is fine, and the dashes are optional.

The numbers (25 accounts, 2 codes, 30 days) can change.

Clusters

List

After you sign in, your clusters are listed on the main page, each showing its name, status, and last heartbeat, so you can tell at a glance what is connected.

Detail

Open a cluster to see the health reported by the in-cluster heartbeat agent for a registered cluster:

• Kubernetes version: the version the cluster is running
• Nodes & status: each node’s name, role, and readiness
• Control-plane component health: apiserver, etcd, scheduler, controller-manager
• Certificate expiry: when cluster certificates are due to renew

This is exactly the data the agent sends, nothing more. See How it works: your data.

The managed tier adds more

Management features (healing policies, capacity watches, and desired-state management with upgrade/scaling flows) belong to the managed tier (access: managed), which is live and requires a Supporter subscription or higher. Individual acting features roll out deliberately behind per-feature switches. For a registered cluster the dashboard shows the read-only health above.

Claiming a cluster

A newly registered cluster carries the status Creating until it is claimed. The Claim page links it to your account and proves ownership; once claimed, the cluster is owned by you. The flow is conceptually register → claim → owned; see Registration.

Access

From Access you invite members, give each an access tier, define custom roles (a permissions matrix, optionally scoped to namespaces), choose which hosted clusters each member’s access applies to, and optionally federate your own SSO. On a hosted cluster, all of this maps straight to Kubernetes access.

See Access & roles for the full model.

Under Access → Agent keys you create keys for AI agents and pipelines: see Agent keys.

Settings

The dashboard’s Settings page has these tabs:

• Account: your identity, your account’s tier and your role. The account owner also finds the invite codes here.
• Tenant: the active tenant’s name and your account’s API rate limits.
• GitHub: connect a GitHub repository, so kubehz can show declared-vs-live drift and open bootstrap pull requests.
• AI apps: see which AI apps, such as Claude or ChatGPT, can act for you.
• Notifications: choose which email notifications kubehz sends you.
• Privacy: export the data kubehz holds about you, or delete your account.
• Withdraw: the account owner sees this tab while a consumer can still withdraw from the contract (14 days).

Each cluster also has its own Settings tab. Project assigns the cluster to a project, Shape changes a hosted cluster’s API servers, state limit and add-ons, and Cluster holds the history setting and the delete button.

Your account (security)

Manage your personal login at auth.kubehz.cloud/account, kubehz’s own branded account UI:

• Change your password
• Two-factor authentication: enroll or remove a TOTP authenticator
• Sessions: view active sessions and revoke any you do not recognize

Troubleshooting

If a cluster does not appear, check the heartbeat agent is present and firing:

# Is the CronJob there and not suspended?
kubectl -n kubehz-system get cronjob kubehz-heartbeat

# Read the last run's logs
kubectl -n kubehz-system logs -l app=kubehz-heartbeat

A 4xx in those logs usually means the cluster is not registered (or was deregistered). Re-run lo kubehz register.

Next steps

• Registration: connect a self-hosted cluster
• How it works: the model and your data
• Hosted control plane: the delegated path

---

Doc status

Aspect	Detail
Last reviewed	30 October 2026