Add-ons
Your hosted control plane starts from a plan (dev, starter, pro) and you layer add-ons on top. This page is the practical companion to Pricing: what each add-on actually gives you, how to consume it, and — where it applies — a command you can paste.
You choose add-ons in the dashboard, on the cluster's detail page. The kubehz operator translates your choice into the matching Kubermatic (KKP) settings on your control plane; you never edit KKP directly.
What's included vs. what's an add-on
Two things people expect as add-ons are not — because they are built in:
- etcd backups — scheduled snapshots are included in every paid plan, default-on. See etcd backups below for what that means.
- High availability — HA is the pro plan itself (3× API server), not a separate line item. Pick pro and you have it.
Add-ons at a glance (list prices — see Pricing):
| Add-on | Price | Minimum plan |
|---|---|---|
| Cluster web dashboard (Headlamp) | €0.50/mo | any (on by default from starter) |
| OPA / Gatekeeper | free | any |
| etcd backups | included | every paid plan |
| Audit logging | €0.50/mo | starter |
| Monitoring | €5/mo | starter (included in pro) |
| Logging | €4/mo | pro |
| Dedicated nodes | €9/mo | pro |
Cluster web dashboard (Headlamp)
What it enables. A hosted Headlamp web dashboard for your cluster, run by kubehz next to your control plane and published at an instant public URL:
https://dash-<cluster-id>.kubehz.cloudOpen it from the cluster's detail page in the kubehz dashboard (the Open dashboard button). You sign in with your kubehz account — the same SSO login as the platform — and what you can see and do follows your Kubernetes RBAC: Headlamp forwards your own identity token to the API server and holds no admin credentials of its own. No kubeconfig, no proxy, no second password.
It is on by default from the starter plan up; on dev it is off (a real saving) and can be added for €0.50/mo. Headlamp replaced the deprecated upstream kubernetes-dashboard behind this add-on (2026-07) — same option, same price, a strictly better access path.
Prefer a local app? Headlamp desktop opens the same cluster from your downloaded kubeconfig — no add-on required, and it is the dashboard story for self-hosted clusters too.
Fallback: kubectl proxy. A cluster still running the legacy in-cluster kubernetes-dashboard can keep reaching it through the API server's service proxy, authenticated with your own kubeconfig:
Download the cluster's kubeconfig from the kubehz dashboard (the cluster detail page).
Start a local proxy to the API server:
bashkubectl --kubeconfig ./kubeconfig proxyOpen the service-proxy URL for the dashboard in your browser:
texthttp://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/
The proxy inherits your kubeconfig, so the dashboard sees precisely what you would see with kubectl — nothing more.
OPA / Gatekeeper
What it enables. OPA Gatekeeper policy enforcement in your cluster: admission-time validation of resources against policies you author as ConstraintTemplate + Constraint objects. It is free and available on every plan (dev and up). The operator maps this to KKP's opaIntegration.enabled; the Gatekeeper components run inside your cluster.
How to consume it. Once the add-on is on, apply a ConstraintTemplate (defines a reusable rule) and then a Constraint (applies it to specific kinds). The classic starter is "every namespace must carry an owner label":
# 1. The template: a reusable "required labels" rule.
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8srequiredlabels
spec:
crd:
spec:
names:
kind: K8sRequiredLabels
validation:
openAPIV3Schema:
type: object
properties:
labels:
type: array
items:
type: string
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequiredlabels
violation[{"msg": msg}] {
provided := {label | input.review.object.metadata.labels[label]}
required := {label | label := input.parameters.labels[_]}
missing := required - provided
count(missing) > 0
msg := sprintf("you must provide labels: %v", [missing])
}
---
# 2. The constraint: require an `owner` label on every Namespace.
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
name: ns-must-have-owner
spec:
match:
kinds:
- apiGroups: [""]
kinds: ["Namespace"]
parameters:
labels: ["owner"]kubectl apply -f required-labels.yamlWhat enforcement looks like. After that, a namespace without an owner label is rejected at admission:
$ kubectl create namespace demo
Error from server (Forbidden): admission webhook "validation.gatekeeper.sh" denied
the request: [ns-must-have-owner] you must provide labels: {"owner"}Create the namespace with the label instead, and it is admitted:
kubectl apply -f - <<EOF
apiVersion: v1
kind: Namespace
metadata:
name: demo
labels:
owner: <you>
EOFetcd backups
What it enables. Scheduled snapshots of your control plane's etcd — the datastore behind every object in your cluster (Deployments, Secrets, CRDs, the lot). This is included in every paid plan, default-on; there is nothing to buy or turn on. The operator provisions a KKP EtcdBackupConfig for your cluster.
Schedule and retention. Backups run every 6 hours (cron 0 */6 * * *) and the most recent 20 snapshots are kept; older ones are pruned automatically. Snapshots are written to kubehz-managed object storage in the EU — you do not manage a bucket.
Restore. Restoring from a snapshot is an operator-assisted, KKP EtcdRestore operation against your control plane — not yet a self-service button. If you need a restore, contact support with the cluster and the point in time you want; self-service restore is a managed-tier feature that is still rolling out. (Backups exist precisely so this path is available when you need it.)
Audit logging
What it enables. Kubernetes API audit logging on your control plane — a record of who did what against the API server (requests, subjects, verbs, resources). €0.50/mo on the starter plan and up. The operator maps this to KKP's auditLogging with a fixed policy preset.
What preset is applied. kubehz enables the recommended audit policy preset — a balanced level that captures the security-relevant operations without the volume of a full request/response firehose. (The preset is fixed; there is no per-cluster policy editor.)
Where events go. Audit events are emitted by the API server on your control plane. To actually browse and search them comfortably, pair this with Logging — audit logging produces the events; the logging add-on is what gives you a place to read them at scale. Without logging, the events are still produced, but there is no aggregated UI over them yet.
Monitoring
What it enables. Per-cluster metrics collected from your cluster and shipped to the kubehz platform. €5/mo on the starter plan and up, and included in the pro plan at no extra charge. You toggle it in the kubehz dashboard — at create time in the wizard's add-on options, or later on the cluster page's add-ons card. A Prometheus runs in your cluster and feeds the platform; you do not run or scale it.
What the fee covers. The platform side: multi-tenant metrics storage with 15-day retention, the dashboard query path and alerting — run and operated by kubehz. On your side only a light collector runs on your own workers; the fee pays for our backend and storage, not your compute.
What's collected. Cluster and node health, control-plane and workload resource usage — the standard Kubernetes/cAdvisor/kube-state signals — so you get CPU, memory, pod and node metrics over time without standing up your own Prometheus.
Where to see it. Metrics surface in the kubehz dashboard's Monitoring section. This view is rolling out — the collection is live; the in-dashboard charts are being brought online cluster by cluster. Until it reaches your cluster, the add-on is provisioning data in the background.
Logging
What it enables. Per-cluster log aggregation, Loki-backed, via the same platform stack. €4/mo on the pro plan and up. Like monitoring, you toggle it in the kubehz dashboard — in the wizard's add-on options at create time, or later on the cluster page's add-ons card. A promtail-style collector runs in your cluster and ships pod logs to the platform's Loki; you do not run Loki yourself.
What the fee covers. The platform-side ingest, the 7-day log storage and the query path behind the dashboard's log browser — run and operated by kubehz. The collector on your nodes is yours and marginal; the fee pays for our backend and storage.
Retention. The add-on includes 7-day log retention — the last week of logs is queryable, older data ages out.
Where to see it. Logs surface in the kubehz dashboard alongside monitoring. Like the Monitoring view, the in-dashboard log browser is rolling out; the collection and 7-day retention are what the add-on provisions today, and this is also the natural companion to Audit logging for reading audit events.
Dedicated nodes
What it enables. Places your control plane on dedicated bare-metal capacity in the kubehz fleet instead of shared cloud VMs — steadier, isolated performance for the control plane. €9/mo, pro plan only. The operator steers your control plane onto metal-class nodes (a placement change, not a resize).
Live migration on toggle. Dedicated is reversible: turning it on (or off) triggers a live migration of the control plane onto (or off) the metal pool — the operator moves the workload; you don't rebuild the cluster.
Capacity gating — the honest bit. Bare metal is a scarce, deliberately limited pool. Because of that, dedicated is capacity-gated at provisioning time: if the metal pool is at its floor, the option can be temporarily unavailable to order even on a pro cluster. This is intentional (metal is added as demand justifies it) and pro-only so throwaway clusters don't churn the scarce capacity — if it's unavailable when you try, it will open as capacity is added.
Next steps
- Pricing — the full add-on price list.
- Hosted control plane — plans and the hosted path overall.
- Worker Pools — pools, scaling and autoscaling on your cluster.
- Dashboard & account — where you toggle add-ons and download the kubeconfig.
Doc status
| Aspect | Detail |
|---|---|
| State | add-ons live; in-dashboard monitoring/logging views rolling out |
| Last reviewed | 2026-07-11 |