Your own control plane

A Space starts on a control plane we share between many customers. That is what makes it cheap, and it is also the ceiling: no CRDs of your own, no admission webhooks, no cluster-admin. Your own control plane removes the ceiling. kubehz runs a dedicated Kubernetes control plane for you, on your own registered nodes, with its state on our HA database.

Your machines run it; we keep it alive.

What you get

• cluster-admin on your own cluster: a real, downloadable kubeconfig.
• Any CRDs, any operators, any admission webhooks. The cluster is yours.
• Your own Kubernetes version. You pin it; we perform the upgrade when you change the pin.
• No API neighbors. Nobody else’s load on your API server.
• State, backups and certificates are our problem. The cluster’s data lives on our replicated PostgreSQL with continuous backups. Certificate rotation is one API call; the certificate authority (your cluster’s identity) never changes.
• The same stable endpoint your Space always had: https://<your-space>.k8s.kubehz.cloud. After you enable the control plane, it serves YOUR cluster, with your cluster’s own certificate.
• High availability as one number. Set replicas to 2 or 3 and the control plane spreads across your nodes.
• Curated addons. Pick from the platform catalog; we apply them into your cluster and keep them converged.

The honest trade

The control plane runs on your machines. If your nodes go down, your API goes down with them: your workloads keep running, and your data stays safe with us, but kubectl waits until a node is back. The shared control plane does not have this trade; it also does not give you cluster-admin.

Price

€2/month per control plane, metered hourly like everything else on kubehz. Disable it and the meter stops; your cluster’s identity and data survive, and a re-enable brings back the SAME cluster.

How the meter works. kubehz bills every started hour in full. Billing starts when you enable the control plane. kubehz bills it while it exists, in any state, also when your nodes are down; only disabling it stops the charge. The hourly charges never go above the €2 monthly price, also in a 31-day month, because the monthly price is a cap. Every other unit in the Space (the Space itself, each namespace, each node) is billed the same way and separately. See Pricing.

Enable it

Via the API (a dashboard switch is coming):

# turn it on
curl -X PATCH https://api.kubehz.cloud/api/spaces/"<id>"/control-plane \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"enabled": true, "replicas": 1}'

# download your admin kubeconfig (requires a recent sign-in)
curl https://api.kubehz.cloud/api/spaces/"<id>"/control-plane/kubeconfig \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Step-Up-Assertion: $ID_TOKEN" > kubeconfig.yaml

kubectl --kubeconfig kubeconfig.yaml get namespaces

The control plane needs at least one registered node in your Space; see Join nodes. It is ready when the kubeconfig download succeeds and kubectl version answers.

Knobs

field	values	what it does
enabled	true / false	the whole feature; disable keeps identity + data
replicas	1–3	HA across your nodes
version	e.g. v1.36.1	your Kubernetes version pin; change it to upgrade
addons	catalog names	applied into your cluster, kept converged

Limits

• Control-plane state is capped at 5Gi per Space: everything your API server stores (Secrets, ConfigMaps, CRDs, the lot) on our HA database. For scale: etcd, the datastore Kubernetes ships with, defaults to 2Gi, and most production clusters stay well under 1Gi. If you approach the cap we contact you before anything changes.
• Nodes you registered in the Space carry the control plane. One node is enough; HA needs the replica count and benefits from more nodes.
• Removing an addon from the list stops us converging it: it is not deleted from your cluster. Deleting inside your cluster is your call.
• Certificate rotation re-issues the working certificates under the same authority: existing kubeconfigs keep verifying, but the downloaded admin credential changes; download it again after a rotation.