Frequently Asked Questions ​

The open-source CLI that powers kubehz. lok8s provisions and manages clusters on Hetzner, and it works without kubehz. kubehz is an opt-in platform layer on top of it.

lok8s (the CLI) is open source. kubehz (the platform: dashboard, API) is a service on top of lok8s. lok8s works fully without kubehz, so kubehz cannot lock you in.

You provision and run your own Kubernetes cluster on your Hetzner account. kubehz gives you a dashboard that shows the cluster. Nothing of yours runs on our infrastructure.

With access: none, kubehz sees nothing. With access: registered, it sees only read-only health: Kubernetes version, nodes and their status, control-plane component health, and certificate expiry. The managed tier also sends the data that its management features need (healing policies, capacity watches, desired-state management). The managed tier requires a Supporter subscription or higher.

Only the data that the feature you turned on needs. For registered, that is health data and nothing else. No telemetry, no analytics, no workload contents, no secrets, no logs. The agent only sends outbound requests. kubehz never connects into your cluster and holds no inbound credentials to it.

No. For read-only registered visibility, kubehz needs no Hetzner token at all. How it works describes the full trust boundary.

Yes. Run “lo kubehz deregister” and delete the kubehz-system namespace. This removes all kubehz components. Your cluster continues to work on its own.

Hosted is available now. Control planes and worker pools are technically live for clusters created after 2026-07-10 with a connected Hetzner token. Sign-up is open for the first 25 accounts. After that, sign-up is by invite only, and every account gets 2 invite codes. kubehz charges nothing before 1 December 2026, and you get 10 days’ notice first.

kubehz runs your control plane (etcd, apiserver, scheduler, controller-manager) on our infrastructure in Hetzner FSN1. You run only the worker nodes, on your own Hetzner account. A Hetzner token is optional: the control plane itself needs none. A Read & Write token turns on worker pools. Connect it before you create the cluster, because kubehz fixes the provisioning mode at creation.

Yes: the managed tier (access: managed) is live. It requires a Supporter subscription or higher (the Enterprise mode includes it). kubehz records the desired state, and your cluster does the work. The agent in the cluster pulls the desired state and applies it with the cluster’s own credentials. So for a self-hosted managed cluster, kubehz needs no Hetzner token and never holds inbound access. kubehz releases each acting feature (like the one-click upgrade flow) behind its own feature switch.

In your kubehz account at auth.kubehz.cloud/account, kubehz’s own branded UI. There you change your password, add or remove a TOTP authenticator (2FA), and see or revoke active sessions.

Yes. In the Access area of the dashboard, you invite members and give them roles. You can also federate your own external OIDC identity provider (SSO). Then your team signs in with the identities it already has.

Yes. Transactional email is live. kubehz sends it through its own relay from noreply@kubehz.io. Verification, invitations, invoice notices and the billing-start notice all work.

Everything is free until 1 December 2026. kubehz bills the usage from 1 December monthly, so the first invoice comes in early January 2027. Self-hosted visibility is free now and stays free after that date. kubehz bills the Supporter contribution and the hosted control plane from 1 December 2026.

Transparent and metered. kubehz meters the hosted control plane, its add-ons and Spaces by the hour, and caps each one by the month. There are no plans to choose from. Only the Supporter mode is pay-what-you-want, with a minimum. kubehz issues its own EU-compliant invoices. You keep your own billing history and VAT profile. Our prices come from measured costs on our own fleet, and we explain every price.

We want to build trust. The free self-hosted tier has no catch: no tracking, no ads, no data selling. In the Supporter mode, we trust you to pay what you can afford above the minimum. kubehz meters hosted resources: they are not pay-what-you-want.

Add-on prices can still change before billing starts. We will tell you before they change. The control-plane rates are not placeholders: they come from measured costs on our pilot fleet. kubehz sells hosted resources by the hour, not in plans. A hosted control plane costs €0.016/h. Each API server beyond the first adds €0.008/h. Each GB of state above the included 2 GB adds €0.0005/h. These rates are excl. VAT. Each unit has a monthly cap. So the control plane costs at most €11.68 a month excl. VAT, or €14.25 incl. 22% VAT. At checkout, the VAT rate of your country applies.

kubehz offers a curated list of Kubernetes versions, each pinned to a patch release. We withdraw a version as soon as upstream stops patching its minor. The list changes, so this answer names no patch release. The API serves the current list at api.kubehz.cloud/api/versions, with no sign-in. The create wizard and lo read the same list. On 30 October 2026, the list held the 1.35 line.

Yes, for self-hosted clusters.

No. kubehz runs on Hetzner only.

kubehz stores the data of your kubehz account and the dashboard in Hetzner datacenters in Germany (FSN1/NBG1). EU jurisdiction applies. Your self-hosted cluster and its workloads stay on your own account.

Yes. We process only minimal personal data (email, cluster metadata). See our privacy policy for details.

Only essential cookies (authentication, theme preference). No tracking cookies. No third-party analytics.