Skip to content

Changelog

v1.0.0 — 2 August 2026

First generally available release.

KubeManta is a Kubernetes SRE platform: real-time workload visibility, AI-assisted diagnosis, a browser terminal, and remediation that always waits for your approval. It installs with one Helm command and runs entirely inside your cluster.

helm install kubemanta oci://registry.kubemanta.com/kubemanta/charts/stable/kubemanta \
  --version 1.0.0 -n kubemanta-system --create-namespace \
  --set license.key=<your-key>

What you get

See what is broken, first. An incident-first overview leads with what is failing, where, and for how long — then per-pod incident stories built from events, logs, exit codes and resource pressure. Failure-cascade and network-topology visualizers show how one broken thing is blocking another.

A real terminal in the browser. kubectl, helm, k9s and Node.js preinstalled, running as a separate unprivileged user, with every command attributed to the account that ran it. Sessions start explicitly — opening the tab never spawns a shell.

AI that cites its sources. The Copilot answers questions about your cluster by reading Mobula, KubeManta's live model of what exists and what is wrong, so answers link to the actual resources they came from. Bring your own model — Anthropic, OpenAI, Google, Azure, Groq, Ollama or any OpenAI-compatible endpoint. AI is entirely optional and can be switched off completely by an administrator.

Changes wait for you. Every write — pod restart, scale, Helm upgrade, manifest apply — is previewed, approved and audited. There is no autonomous remediation.

Security posture. Read your existing trivy-operator reports or run scans on demand, with an A–F grade, per-workload drill-down and risk acceptance.

Enterprise identity. SAML, OIDC and LDAP with JIT provisioning and group→role mapping; several methods can run at once.

Pricing

Per paid admin seat. Viewers are free and unlimited on every tier, and there is no node counting — a 3-node and a 300-node cluster cost the same. Free includes the full read-only platform on one cluster with one admin seat.

Operating notes worth reading

  • Single instance by design. The agent owns a SQLite database on a ReadWriteOnce volume; the chart refuses replicaCount > 1 rather than letting you discover why. Recovery time after a node failure depends on your StorageClass: networked storage reattaches in minutes, node-local storage (local-path, hostPath) cannot move and waits for that node to return.
  • Alerting shares the agent's fate. KubeManta both detects and delivers alerts in one process, so if the agent is down, alerting is down. Enable the heartbeat (alerts.heartbeat.enabled) and alert on its absence, and alert on the agent's own readiness from outside KubeManta.
  • Behind a proxy or edge, set security.trustedProxyCidrs. Without it every request is attributed to your edge, which collapses audit attribution and lets one client's failed logins ban that shared IP for everyone. Setting it also lets KubeManta mark the session cookie Secure automatically.
  • Secure by default. A vanilla install is read-only. Writes need rbac.allowWrites=true; the terminal and Helm need expertMode.enabled=true. Secret reading is opt-in separately.

Data and retention

Everything stays in your cluster. Operational tables prune themselves on write — audit trail 365 days, routine access logs 7, metrics 7, scan history 90 — and your own content (saved bundles, runbooks, workspace files) is never auto-deleted. Admin → Database shows size and retention per table.

Known limitations

Honest about what this release does not do:

  • Sustained heavy concurrency can restart the agent. Under machine-driven load the health endpoint can stall long enough for Kubernetes to restart the process. Normal use, including several administrators with dashboards open, has not reproduced it. A restart interrupts alert evaluation until the agent is back.
  • Images the scanner cannot pull are not reported as gaps. A workload whose image sits behind registry credentials the scanner does not have currently looks the same as a workload with no findings.
  • Scanner source detection uses CRDs. If a trivy-operator is uninstalled but its CRDs remain, KubeManta will keep reading the reports it left behind.
  • YAML editing has no schema IntelliSense. The editor, plan, apply, diff and bundle import all work; live validation against Kubernetes schemas does not ship in this release.
  • Session invalidation is all-or-nothing. An administrator can invalidate every session, but there is no per-session revoke or active-session list yet.

Upgrading

This is the first release; there is nothing to upgrade from. Chart and application versions track together, and the chart version you install pins the image version.