Frequently Asked Questions
General
A Kubernetes platform for Hetzner. Today you self-host your cluster on your own Hetzner account and kubehz gives you a read-only dashboard. The managed tier (Supporter subscriptions and up) adds management features on top, and a fully hosted control plane is in early access.
The open-source CLI that powers kubehz. You can use lok8s without kubehz — it handles provisioning and cluster management on Hetzner. kubehz is an opt-in platform layer on top.
lok8s (the CLI) is open source. kubehz (the platform — dashboard, API) is a service built on top. lok8s works fully without it, so you are never locked in.
Self-hosted clusters with access: registered — the in-cluster heartbeat agent reports read-only health to the dashboard. Plus the dashboard itself (clusters, claiming, team, settings) and account security (password, 2FA, sessions). The hosted control plane is in early access (we're onboarding gradually); the managed tier is live and requires a Supporter subscription or higher.
Self-Hosted & your data
You provision and run your own Kubernetes cluster on your Hetzner account. kubehz provides a dashboard for visibility — nothing of yours runs on our infrastructure.
With access: none — nothing. With access: registered — only read-only health: Kubernetes version, nodes & status, control-plane component health, and certificate expiry. The managed tier additionally sends the management data behind its features (healing policies, capacity watches, desired-state management); it requires a Supporter subscription or higher.
Only the data the feature you turned on needs — health for registered, and nothing else. No telemetry, no analytics, no workload contents, no secrets, no logs. The agent is outbound-only: kubehz never connects into your cluster and holds no inbound credentials to it.
No. For read-only registered visibility, kubehz needs no Hetzner token at all. See How it works for the full trust boundary.
Yes. Run "lo kubehz deregister" and delete the kubehz-system namespace to remove all kubehz components. Your cluster continues to work independently.
Hosted (early access) & the managed tier
Hosted is in early access: control planes and worker pools are technically live for clusters created after 2026-07-10 with a connected Hetzner token; we're onboarding gradually while billing comes online.
kubehz runs your control plane (etcd, apiserver, scheduler, controller-manager) on our infrastructure in Hetzner FSN1, and you run only worker nodes on your own Hetzner account. You delegate the control plane, so a Hetzner token is required for that path.
That is the managed tier (access: managed), and it is live — it requires a Supporter subscription or higher (hosted and enterprise tenants have it included). kubehz records desired state and your cluster does the work: the in-cluster agent pulls the desired state and applies it with the cluster's own credentials, so for a self-hosted managed cluster kubehz needs no Hetzner token and never holds inbound access. Individual acting features (like the one-click upgrade flow) roll out behind per-feature switches.
Account & team
In your kubehz account at auth.kubehz.cloud/account — kubehz's own branded UI. You can change your password, enroll or remove a TOTP authenticator (2FA), and view or revoke active sessions.
Yes. The dashboard has a Team area to invite members and assign roles. You can also federate your own external OIDC identity provider (SSO) so your team signs in with your existing identities.
Transactional email is not live yet (no mail provider connected), so email-dependent flows are coming rather than available today.
Pricing
Not yet — billing is built but not switched on (no payment provider is connected). Self-hosted visibility is free to use right now. Paid options and the Supporter contribution will open at launch.
Transparent and pay-what-you-want with a minimum. kubehz issues its own EU-compliant invoices, and you keep your own billing history and VAT profile. Prices come from measured costs on our own fleet, and we explain every price.
We believe in building trust. The free self-hosted tier has no catch — no tracking, no ads, no data selling. When paid options open, we trust you to pay what you can afford above the minimum.
The hosted control-plane prices (€8 dev / €12 starter / €24 pro) are calculated from measured costs on our pilot fleet — not placeholders. Add-on prices may still adjust before billing goes live; we'll give notice.
Technical
We follow the Kubernetes release cycle. Currently: v1.33 through v1.35.
Yes, for self-hosted clusters.
Not yet. Hetzner only for now. AWS support is planned.
Legal
For the kubehz account and dashboard, in Hetzner datacenters in Germany (FSN1/NBG1). EU jurisdiction. Your self-hosted cluster and its workloads stay on your own account.
Yes. We process minimal personal data (email, cluster metadata). See our privacy policy for details.
Only essential cookies (authentication, theme preference). No tracking cookies. No third-party analytics.
Still have questions? Ask in GitHub Discussions or write to contact@kubehz.io.