Frequently Asked Questions ​

The open-source CLI that powers kubehz. You can use lok8s without kubehz: it handles provisioning and cluster management on Hetzner. kubehz is an opt-in platform layer on top.

lok8s (the CLI) is open source. kubehz (the platform: dashboard, API) is a service built on top. lok8s works fully without it, so you are never locked in.

You provision and run your own Kubernetes cluster on your Hetzner account. kubehz provides a dashboard for visibility: nothing of yours runs on our infrastructure.

With access: none, kubehz sees nothing. With access: registered, it sees only read-only health: Kubernetes version, nodes & status, control-plane component health, and certificate expiry. The managed tier additionally sends the management data behind its features (healing policies, capacity watches, desired-state management); it requires a Supporter subscription or higher.

Only the data the feature you turned on needs: health for registered, and nothing else. No telemetry, no analytics, no workload contents, no secrets, no logs. The agent is outbound-only: kubehz never connects into your cluster and holds no inbound credentials to it.

No. For read-only registered visibility, kubehz needs no Hetzner token at all. See How it works for the full trust boundary.

Yes. Run “lo kubehz deregister” and delete the kubehz-system namespace to remove all kubehz components. Your cluster continues to work independently.

Hosted is available now: control planes and worker pools are technically live for clusters created after 2026-07-10 with a connected Hetzner token. There is no waiting list. Nothing is charged before 1 November 2026, and you get 10 days’ notice first.

kubehz runs your control plane (etcd, apiserver, scheduler, controller-manager) on our infrastructure in Hetzner FSN1, and you run only worker nodes on your own Hetzner account. A Hetzner token is optional: the control plane itself needs none. A Read & Write token is what unlocks worker pools, and it must be connected when the cluster is created, because the provisioning mode is fixed at creation.

That is the managed tier (access: managed), and it is live. It requires a Supporter subscription or higher (the Enterprise mode includes it). kubehz records desired state and your cluster does the work: the in-cluster agent pulls the desired state and applies it with the cluster’s own credentials, so for a self-hosted managed cluster kubehz needs no Hetzner token and never holds inbound access. Individual acting features (like the one-click upgrade flow) roll out behind per-feature switches.

In your kubehz account at auth.kubehz.cloud/account, kubehz’s own branded UI. You can change your password, enroll or remove a TOTP authenticator (2FA), and view or revoke active sessions.

Yes. The dashboard has an Access area to invite members and assign roles. You can also federate your own external OIDC identity provider (SSO) so your team signs in with your existing identities.

Yes. Transactional email is live: kubehz sends through its own relay from noreply@kubehz.io, so verification, invitations, invoice notices and the billing-start notice all work.

Nothing is charged before 1 November 2026: that is the date billing starts. Self-hosted visibility is free to use right now and stays free after it; the Supporter contribution and the hosted control plane begin billing on 1 November 2026.

Transparent and pay-what-you-want with a minimum. kubehz issues its own EU-compliant invoices, and you keep your own billing history and VAT profile. Prices come from measured costs on our own fleet, and we explain every price.

We believe in building trust. The free self-hosted tier has no catch: no tracking, no ads, no data selling. On the paid options we trust you to pay what you can afford above the minimum.

There are no plans. A hosted control plane is metered per hour: €0.016/h for the control plane, €0.008/h for each API server beyond the first, €0.0005/h per GB of state above the included 2 GB. Each unit is capped at its monthly price, so the control plane costs at most €11.68 a month. The rates are calculated from measured costs on our pilot fleet, not placeholders. Add-on prices may still adjust before billing goes live; we’ll give notice.

We offer a curated list of Kubernetes versions, each pinned to a patch release, and withdraw one as soon as upstream stops patching its minor. Today you can create 1.34 (v1.34.8) or 1.35 (v1.35.5, the default). The platform serves that list to the wizard and to lo, so what you are offered is always the current one.

Yes, for self-hosted clusters.

No. kubehz runs on Hetzner only.

For the kubehz account and dashboard, in Hetzner datacenters in Germany (FSN1/NBG1). EU jurisdiction. Your self-hosted cluster and its workloads stay on your own account.

Yes. We process minimal personal data (email, cluster metadata). See our privacy policy for details.

Only essential cookies (authentication, theme preference). No tracking cookies. No third-party analytics.