Skip to content

KubeManta

Sovereign, in-cluster AI SRE for Kubernetes. Secure by default. AI optional.

KubeManta runs entirely as pods inside your Kubernetes cluster and gives you real-time workload visibility, a graph-grounded AI copilot, AI-driven diagnosis, and SRE automation — without your cluster data ever leaving your infrastructure. Your license key authenticates image pulls and unlocks features; the AI is wired through your own API key (or a local model for zero egress).

What it is

KubeManta is a self-hosted dashboard and agent that runs entirely inside your own cluster. There is no SaaS control plane, no cluster data forwarded to a third party, and no agent phoning home — only a periodic license heartbeat to verify entitlement.

Secure by default. A vanilla install is read-only: no cluster-admin, no stored LLM keys, no egress for observability data. Writes and cluster-admin are explicit opt-ins.

AI is optional. You can run KubeManta as pure read-only observability without ever providing an LLM key — and when you do use AI, point it at a local Ollama for full data residency. Every AI-powered control in the UI is marked with a sparkle badge, so it is always clear which actions invoke the AI; dismissible page guides (toggleable in Admin → System) explain each page's flow.

Features

Feature Tier
Overview: namespace health, top crashers, warnings Free
Workloads: pods, deployments, statefulsets, jobs, and more Free
Network topology (Ingress → Service → Pod DAG) Free
Mobula — live cluster map + structural API Free
Failure Cascade Visualizer + resource relationships Free
Container scanning: read reports, posture grade + trend Free
IP access control, idle timeout, service-only exposure Free
Activity feed + tamper-evident audit trail Free
Metrics: live CPU/mem + built-in trends + bandwidth (no Prometheus needed) Free
PTY terminal with kubectl, k9s, helm, Claude Code pre-installed Free
Expert mode + workload write ops (opt-in safety toggles, not license-gated) Free
AI Context — curated docs the AI can search Free
AI diagnosis and triage · AI Copilot (unlimited) Pro
Scheduled AI SRE reports (wall-clock schedules, PDF export, delivery via alert integrations) Pro
Alert Rules Engine (10 condition types) + integrations Pro
Runbooks and Quick Fix Pro
Helm write operations + Resource Builder Apply Pro
MCP server (expose K8s tools to external AI agents) Pro
Multi-cloud network topology (AWS VPC / GCP VNet / Azure VNet) Pro
Container self-scan + observability connector (Prometheus history) Pro
Enterprise SSO (SAML 2.0 / OIDC / LDAP) Enterprise
Login white-labeling Enterprise
AI governance (configurable egress allowlist) Enterprise

See Free vs Pro vs Enterprise for the full matrix and pricing.

Key design decisions

In-cluster only. KubeManta makes K8s API calls from inside your cluster using a ServiceAccount — no kubectl proxy, no external egress for observability data.

Read-only by default. The default install cannot modify your cluster. Write features (pod restart/delete, deployment scale, exec) require rbac.allowWrites=true and are always gated behind user approval.

Bring your own LLM. You provide the API key per request — it is never stored or logged. Supported providers: Anthropic, OpenAI, Google Gemini, Azure OpenAI, Groq, Ollama, and any OpenAI-compatible custom endpoint. Use Ollama for full data residency.

License-as-pull. Your license key is the registry password. helm install --set license.key=YOUR_KEY is all you need — no separate pull secret to manage.