Your own control plane

A Space starts on a control plane that we share between many customers. That makes it cheap, and it also sets a limit: no CRDs of your own, no admission webhooks, no cluster-admin. Your own control plane removes that limit. kubehz runs a dedicated Kubernetes control plane for you, on your own registered nodes, and keeps its state on our HA database.

Your machines run it. We keep it alive.

What you get

• cluster-admin on your own cluster, with a real kubeconfig that you can download.
• Any CRDs, operators and admission webhooks. The cluster is yours.
• Your own Kubernetes version. You pin it. When you change the pin, we do the upgrade.
• No API neighbors. No other customer puts load on your API server.
• State, backups and certificates are our problem. The cluster’s data lives on our replicated PostgreSQL with continuous backups. One API call rotates the certificates. The certificate authority (your cluster’s identity) never changes.
• The same stable endpoint that your Space always had: https://<your-space>.k8s.kubehz.cloud. After you enable the control plane, it serves YOUR cluster, with your cluster’s own certificate.
• High availability as one number. Set replicas to 2 or 3, and the control plane spreads across your nodes.
• Curated addons. Pick them from the platform catalog. We apply them to your cluster and keep them converged.

The honest trade

The control plane runs on your machines. If your nodes go down, your API goes down with them. Your workloads keep running and your data stays safe with us, but kubectl waits until a node is back. The shared control plane does not have this trade, but it also does not give you cluster-admin.

Price

€0.004/h, at most €2.92 a month per control plane, excl. VAT. kubehz meters it by the hour, like everything else. When you disable it, the meter stops. Your cluster’s identity and data stay, and when you enable it again, you get the SAME cluster back.

How the meter works. kubehz bills every started hour in full. Billing starts when you enable the control plane. kubehz bills it while it exists, in any state, also when your nodes are down. Only disabling it stops the charge.

The hourly charges never go above the €2.92 monthly price, also in a 31-day month, because the monthly price is a cap. The other units in the Space (the Space itself, each namespace, each node) follow the same rules, and kubehz bills each of them separately. See Pricing.

Enable it

Use the API (a dashboard switch is coming):

# turn it on
curl -X PATCH https://api.kubehz.cloud/api/spaces/"<id>"/control-plane \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"enabled": true, "replicas": 1}'

# download your admin kubeconfig (requires a recent sign-in)
curl https://api.kubehz.cloud/api/spaces/"<id>"/control-plane/kubeconfig \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Step-Up-Assertion: $ID_TOKEN" > kubeconfig.yaml

kubectl --kubeconfig kubeconfig.yaml get namespaces

The control plane needs at least one registered node in your Space (see Join nodes). It is ready when the kubeconfig download works and kubectl version answers.

Knobs

field	values	what it does
enabled	true / false	turns the whole feature on or off; disabling keeps identity and data
replicas	1–3	HA across your nodes
version	e.g. v1.36.1	your Kubernetes version pin: change it to upgrade
addons	catalog names	applied to your cluster and kept converged

Limits

• We cap the control-plane state at 5Gi per Space. That is everything your API server stores (Secrets, ConfigMaps, CRDs, the lot) on our HA database. For scale: etcd, the datastore that Kubernetes ships with, defaults to 2Gi, and most production clusters stay well under 1Gi. If you get close to the cap, we contact you before anything changes.
• The nodes that you registered in the Space carry the control plane. One node is enough. HA needs the replica count, and more nodes help, up to the node number that you set on the Space (see Limits).
• When you remove an addon from the list, we stop converging it. We do not delete it from your cluster. Deleting it inside your cluster is your call.
• Certificate rotation issues new working certificates under the same authority. Existing kubeconfigs keep verifying, but the downloaded admin credential changes. Download it again after a rotation.