Free vs Pro vs Enterprise¶
KubeManta is 3-tier: Free (read-only observability plus one admin), Pro ($49 per admin seat / month), and Enterprise (SSO + governance). Pricing is per paid admin seat — viewers are free and unlimited on every tier, and nothing is priced per node. The tier of every gateable capability is defined once in the product's feature registry — the table below mirrors it exactly.
Tiers at a glance¶
| Feature | Free | Pro | Enterprise |
|---|---|---|---|
Core monitoring & read-only ops (core) — Overview, Workloads, Metrics, Network topology, Mobula, Log Workspace, Helm release viewing, Deploy view, browser Terminal. Stays available after a licence expires. |
✅ | ✅ | ✅ |
| Workloads: pods, deployments, statefulsets, daemonsets, jobs, configmaps, and more | ✅ | ✅ | ✅ |
| Network topology (Ingress → Service → Pod DAG) | ✅ | ✅ | ✅ |
| Mobula — live cluster containment map | ✅ | ✅ | ✅ |
Failure Cascade Visualizer + resource relationships (rule-based, no AI) (cascade) |
✅ | ✅ | ✅ |
Mobula — structural /graph/* surface |
✅ | ✅ | ✅ |
| Helm release viewer (list, values, history, manifest, diff) | ✅ | ✅ | ✅ |
| Resource Builder — author/edit YAML, PLAN (dry-run) | ✅ | ✅ | ✅ |
| Container Scanning — read trivy-operator reports, posture grade + trend | ✅ | ✅ | ✅ |
| Container Scanning — pick scanner source, remove KubeManta scanner | ✅ | ✅ | ✅ |
| Risk exclusion — exclude a finding with a reason (no expiry) | ✅ (admin) | ✅ | ✅ |
| Observability connector — configure sources + Alertmanager receiver | ✅ | ✅ | ✅ |
| Metrics — live CPU/mem, built-in ~7-day trends, bandwidth via the kubelet scrape (on by default), metrics-source picker | ✅ | ✅ | ✅ |
| PTY terminal with kubectl, k9s and helm (Claude Code CLI is a one-command opt-in) | ✅ | ✅ | ✅ |
| Log workspace · Activity feed · unified audit + hash-chain | ✅ | ✅ | ✅ |
| IP access control · idle timeout · service-only exposure | ✅ | ✅ | ✅ |
Expert mode (expert) — opt-in safety toggle (expertMode.enabled + runtime toggle), not license-gated |
✅ | ✅ | ✅ |
Workload ops — restart/scale/delete (workload_ops; rbac.allowWrites + admin role) |
✅ | ✅ | ✅ |
| AI Context — curated docs the AI searches (admin CRUD) | ✅ | ✅ | ✅ |
| AI Copilot chat (grounded in Mobula) | teaser quota | ✅ unlimited | ✅ unlimited |
SLOs & error budgets — availability from pod readiness, burn rates and two-window burn-rate alerting (slo). SLOs measured from your own Prometheus are part of Observability (Pro). |
✅ | ✅ | ✅ |
AI diagnosis & triage (ai) |
❌ | ✅ | ✅ |
Scheduled AI SRE reports (wall-clock schedules, PDF export, delivery via alert integrations) (ai) |
❌ | ✅ | ✅ |
Alerting — unlimited rules, delivered to Slack / Telegram / email (alerts_basic) |
✅ | ✅ | ✅ |
Alerting — PagerDuty + webhooks, firing history, auto-investigation (alerts) |
❌ | ✅ | ✅ |
ChatOps — Slack inbound: ask KubeManta from Slack and approve from a notification, bound to a verified workspace identity. Sending alerts out to Slack stays Free. (chatops_inbound) |
❌ | ✅ | ✅ |
Runbooks & Quick Fix (runbooks) |
❌ | ✅ | ✅ |
Helm write ops (install, upgrade, rollback) (helm) |
❌ | ✅ | ✅ |
Resource Builder — Apply (builder_apply) |
❌ | ✅ | ✅ |
Container Scanning — self-scan (built-in Trivy Job) (scanning_selfscan) |
❌ | ✅ | ✅ |
Risk exclusion — expiry policy (auto-reactivating) (risk_acceptance) |
❌ | ✅ | ✅ |
Observability — Prometheus history + inbound-alert auto-investigation (observability) |
❌ | ✅ | ✅ |
MCP server — expose KubeManta's read-only K8s tools to external agents (mcp) |
✅ | ✅ | ✅ |
Live network probe — active DNS / TCP / HTTP check from the source's real network namespace (network_probe). The static reachability analysis and visualizer stay free for everyone, viewers included. |
❌ | ✅ | ✅ |
Guided Prometheus deployment — one-click in-cluster Prometheus (prometheus_deploy). Detection, the copy-pasteable manifest plan, and removing the instance stay free for admins. |
❌ | ✅ | ✅ |
Multi-cloud network topology (AWS / GCP / Azure) (multicloud) |
❌ | ✅ | ✅ |
Developer role — restart, scale and exec into pods, and approve an AI-proposed restart or scale, in non-system namespaces; occupies a paid seat (developer_role) |
❌ | ✅ | ✅ |
Incident tickets — each incident mirrored as one Jira issue or Trello card for its whole life: opened, commented on recurrence, resolved (ticketing) |
❌ | ✅ | ✅ |
Enterprise SSO (SAML 2.0 / OIDC / LDAP) (sso) |
❌ | ❌ | ✅ |
AI egress governance — configuring the AI egress allowlist: which hosts AI traffic may reach (ai_governance). Every other AI guardrail, prompt-audit retention included, is on every plan. |
❌ | ❌ | ✅ |
Login white-labeling (custom logo/background) (branding) |
❌ | ❌ | ✅ |
AI Guardrails egress enforcement is always on
Enforcement of an already-configured AI egress allowlist runs on every tier — a set policy is honored regardless of license. Only configuring it is Enterprise (ai_governance). See AI Guardrails.
Pricing¶
| Plan | Price | What you get |
|---|---|---|
| Free | $0 | One cluster, 1 admin seat, unlimited viewers |
| Pro | $49 per admin seat / month — or $468 per seat / year ($39/mo billed annually, save 20%) | One cluster, as many admin seats as you buy, unlimited viewers |
| Enterprise | Contact sales | SSO, AI governance, air-gap, white-labeling, SLA |
An admin is anyone who can change the cluster — restart, scale, apply manifests, run Helm, or open the terminal. Viewers see everything and change nothing, and they are free and unlimited on every tier. You only pay for people who can act.
There is no per-node charge and no node limit: a 3-node cluster and a 300-node cluster cost the same. By default the licence heartbeat does report the cluster's node count — a number only, never node names or workload data — and it is never used to charge you or to limit a feature. Set license.reportNodeCount=false in your Helm values to keep it in the cluster; it is still shown to you in Admin → License. See Network Egress.
No self-serve trial. The Free tier already runs the whole read-only product in your own cluster with no time limit, so there is nothing to expire. Paid plans carry a 14-day money-back guarantee from your first payment. For a time-boxed full-Pro evaluation across a team, contact us.
One subscription covers one cluster, and the Paddle quantity is your admin-seat count. Reinstalling or upgrading KubeManta on the same cluster does not consume a new cluster activation. A genuinely different or rebuilt cluster (different kube-system namespace UID) is a new activation.
How to get a license¶
Free license¶
Visit kubemanta.com and click Deploy free.
Enter your email and the key arrives immediately, together with the exact helm
commands filled in for your key — the same commands this documentation shows,
generated from one source so they cannot drift apart.
Pro license (paid)¶
Visit kubemanta.com and click Subscribe. Billing is handled by Paddle as Merchant of Record, so global tax and VAT are included. The license key is shown on checkout and emailed to you.
License-as-pull¶
Your license key is also your registry password. The chart auto-creates a pull secret from it:
helm install kubemanta oci://registry.kubemanta.com/kubemanta/charts/stable/kubemanta \
--version CHART_VERSION \
-n kubemanta-system --create-namespace \
--set license.key=YOUR_KEY
Which version?
Replace CHART_VERSION with the release you are installing. The newest is at
the top of the Changelog, or read it from the
registry once you are logged in:
Always pin it. An unpinned install resolves to whatever stable points at
today, which is not necessarily the release you tested against.
No separate pull token, no kubectl create secret required.
What happens when a license lapses¶
Free tier (core observability) never stops working — including after a trial ends or a paid license expires.
| Situation | Premium features | Free / core |
|---|---|---|
| Active license | ✅ | ✅ |
| Paid, expired ≤ 7 days (grace period) | ✅ | ✅ |
| Paid, expired > 7 days | ❌ | ✅ |
| Trial expired | ❌ | ✅ |
| License suspended / revoked | ❌ | ✅ |
| Second cluster on same license | ❌ | ✅ |
| License service unreachable ≤ 7 days | last known state | ✅ |
| License service unreachable > 7 days | ❌ | ✅ |
| Air-gapped install with a valid offline licence file | ✅ until the file expires | ✅ |
| Offline licence file expired, or fails verification | ❌ | ✅ |
When a premium feature is unavailable, its tab shows a lock icon with an upsell prompt — features do not silently disappear. Gated API endpoints return HTTP 402.
- Reading a settings screen is never paid. Where a screen has a paid action — switching an alert integration on, setting an expiry on a risk acceptance, changing the AI egress list — only that action returns 402. Reading the same settings never does, and neither does saving an integration switched off.
- An Enterprise lapse never locks anyone out. SSO sign-in methods that are already on keep working, and you can still edit them or turn SSO off. A live SAML method can also still be maintained: refreshing the identity provider's metadata after it rotates its signing certificate, and generating a new SP certificate, both work while SAML is on. Only switching a method on needs an active Enterprise license, including through a configuration import. See Enterprise SSO.
- A lapse never stops alerting that is already running. Every rule keeps evaluating, and every destination that is switched on keeps delivering, PagerDuty, Datadog, CloudWatch and the webhook included; there is no license check at delivery time. You can still edit a Pro destination that is on and save the rest of the Integrations form, and switch any destination off. What needs Pro again is switching a Pro destination on (or back on) and Send test alert to one, plus the paid work after an alert: AI diagnosis, new incident tickets and the firing history view. Destinations given as Helm values (
alerting.slackWebhookUrl,alerting.pagerdutyRoutingKey,alerting.webhookUrl) deliver on every plan, Free included. - Removing a stored secret is never paid. Setting or testing cloud credentials needs Pro; removing them does not, so a lapsed install can always stop holding a credential it can no longer use. See Cloud IAM.
- A configuration import follows the license. On an install without the plan, the file still imports, but SSO sign-in methods that were not already on, Pro alert destinations that were not already on, AI diagnosis of alerts, incident ticketing and Slack inbound arrive switched off, and login branding and the AI egress allowlist keep this install's values. Check file lists each one before anything changes, the import result repeats it, and the audit entry records it.
Moving to a new cluster¶
After uninstalling KubeManta from the old cluster, the agent stops sending heartbeats and the license service releases the cluster activation for the new one once its heartbeat window lapses. The agent pings every 6 hours by default, so allow hours rather than minutes. No manual step required; contact us if you need it released sooner. (This is unrelated to admin seats — activations track clusters, seats track people.)