Skip to content

KubeManta

Sovereign, in-cluster AI SRE for Kubernetes. Secure by default. AI optional.

KubeManta runs entirely as pods inside your Kubernetes cluster and gives you real-time workload visibility, a graph-grounded AI copilot, AI-driven diagnosis, and SRE automation — without your cluster data ever leaving your infrastructure. Your license key authenticates image pulls and unlocks features; the AI is wired through your own API key (or a local model for zero egress).

What it is

KubeManta is a self-hosted dashboard and agent that runs entirely inside your own cluster. There is no SaaS control plane, no cluster data forwarded to a third party, and no agent phoning home — only a periodic license heartbeat to verify entitlement.

Secure by default. A vanilla install cannot change your workloads: no write verb on anything you run, no cluster-admin, no egress for observability data. Writes and cluster-admin are explicit opt-ins. An AI provider key, if you configure one, is stored encrypted server-side and never returned to a browser — or use a local Ollama and KubeManta holds no key at all.

The deepest reference ships inside the product

These pages introduce what KubeManta does and how to install and configure it. The Documentation tab inside KubeManta is the technical reference an operator works from — API paths, environment variables, RBAC verbs, failure modes and exact --set flags — and it is served by the version you are actually running, so it cannot drift from your install the way a website can. Its full text is readable on every licence: a tier badge marks what is Pro or Enterprise, but nothing is hidden from you, whatever you have paid. It is also searchable from anywhere in the app.

AI is optional. You can run KubeManta as pure read-only observability without ever providing an LLM key — and when you do use AI, point it at a local Ollama for full data residency. Every AI-powered control in the UI is marked with a sparkle badge, so it is always clear which actions invoke the AI; dismissible page guides (toggleable in Admin → System) explain each page's flow.

Features

Feature Tier
Overview: namespace health, top crashers, warnings Free
Workloads: pods, deployments, statefulsets, jobs, and more Free
Network topology (Ingress → Service → Pod DAG) Free
Mobula — live cluster map + structural API Free
Failure Cascade Visualizer + resource relationships Free
Container scanning: read reports, posture grade + trend Free
IP access control, idle timeout, service-only exposure Free
Activity feed + tamper-evident audit trail Free
Metrics: live CPU/mem + built-in trends + bandwidth (no Prometheus needed) Free
PTY terminal with kubectl, k9s and helm pre-installed (Claude Code is a one-command opt-in) Free
Expert mode + workload write ops (opt-in safety toggles, not license-gated) Free
AI Context — curated docs the AI can search Free
AI diagnosis and triage · AI Copilot (unlimited) Pro
Scheduled AI SRE reports (wall-clock schedules, PDF export, delivery via alert integrations) Pro
Alerting — unlimited rules to Slack / Telegram / email Free
Alerting — PagerDuty + webhooks, firing history, auto-investigation Pro
Runbooks and Quick Fix Pro
Helm write operations + Resource Builder Apply Pro
MCP server (expose K8s tools to external AI agents) Free
Multi-cloud network topology (AWS VPC / GCP VNet / Azure VNet) Pro
Container self-scan + observability connector (Prometheus history) Pro
Enterprise SSO (SAML 2.0 / OIDC / LDAP) Enterprise
Login white-labeling Enterprise
AI governance (configurable egress allowlist) Enterprise

See Free vs Pro vs Enterprise for the full matrix and pricing.

Key design decisions

In-cluster only. KubeManta makes K8s API calls from inside your cluster using a ServiceAccount — no kubectl proxy, no external egress for observability data.

No writes to your workloads by default. The default install holds no create, update, patch or delete verb on anything you run; it writes only inside its own namespace, to manage its own session and encryption material. Write features (pod restart/delete, deployment scale, exec) require rbac.allowWrites=true and are always gated behind user approval.

Bring your own LLM. You provide the API key per request — it is never stored or logged. Supported providers: Anthropic, OpenAI, Google Gemini, Azure OpenAI, Groq, Ollama, and any OpenAI-compatible custom endpoint. Use Ollama for full data residency.

License-as-pull. Your license key is the registry password. helm install --set license.key=YOUR_KEY is all you need — no separate pull secret to manage.