Unified Cluster Management
Stop finding out from your users — without shipping telemetry to someone else's cloud. Kairos runs in your network, warns you before disk, memory or capacity runs out, and brings you a fix with the evidence behind it. Nothing changes until a person approves it.
Kairos runs in your network. Type a command, or pick one below.
Six things that follow from the product living in your network instead of ours.
Designed for
The operating loop
From the first signal to a verified fix, every step is written down and every change waits for a person. This is the part of the product that does the work, not just the watching.
A forecast raises an alert before a disk, a memory limit or a cluster's capacity runs out, and every forecast is graded afterwards against what actually happened. A rule raises one when a reading crosses its line. Related alerts are correlated into one incident, with the signals that raised it, and sent to Slack, Teams, Google Chat, email or PagerDuty. A maintenance window holds those messages during planned work and announces anything still wrong when it ends.
Who does itThe platform — statistics and rules over the readings it stored. No model involved.
The incident agent runs the checks a person would — events, logs, the workload, what changed recently — and writes each step down as it goes. Steps are appended, never rewritten, so the record cannot be tidied to fit its conclusion. Each incident reads as what happened, why, and how to fix it; run a step in the built-in terminal and the model reads the output back, quoting only lines that were really printed.
Who does itAn AI agent, on the model you assigned to this job — yours, on your hardware, if you prefer.
A concrete change — restart, scale, roll back, set resources, cordon a node — with the evidence it rests on and how it would be undone. Without a model, the remedy the rule itself names is proposed instead.
Who does itChosen from a fixed catalogue of operations. Nothing can name an arbitrary API call.
A deny-by-default policy decides whether the change may happen at all. Only low-risk changes may ever run unattended, and every change the agent can make is medium risk or higher — so each one waits for someone to approve it. A command an administrator types themselves, in a container or a bastion shell, is not a proposal: it is recorded word for word, not approved.
Who does itYou. Risk is computed from the verb and the target, never taken from whatever proposed it.
The agent in your cluster claims the approved change and runs it under its own ServiceAccount. A claim that is not picked up in time expires rather than running late against an object that may have been replaced.
Who does itThe agent in your cluster. The platform holds no cluster credential and never connects inward to make a change.
After a wait long enough for a rollout to finish, the platform checks whether the problem went away — the object's phase, ready count, restarts and the alerts naming it — and records the verdict beside the incident.
Who does itThe platform — arithmetic over stored readings, never a model's opinion of its own fix.
When a similar incident comes back, it shows what was changed last time and whether verification said it worked. A fix verified to have made things worse is not proposed again for the same object.
Who does itThe platform — records it already keeps, matched by the shape of the signals. A candidate, never a promise.
The consoles
What breaks if this breaks. Every object in the cluster and the manifest field that connects it to the next one, walked from one focus outward.
See what it collectsWhy this and not a hosted platform
Not a longer feature list — a different shape. Everything below is a consequence of the product running inside your network instead of ours, and every claim is checkable in the code that ships.
Telemetry lands in your own database, behind your own address. The whole product installs into your cluster or onto a host beside it, and the install bundle carries its own checksums.
Hosted platformsCollection is the vendor's cloud by definition — the question is only which region it lands in.
On OpenShift, describe the cluster you want and it generates the Ansible, runs it on vSphere, and hands you the same bundle it ran. Observability and the thing being observed are one product.
Hosted platformsMonitoring only. Provisioning is a separate tool, a separate contract and a separate audit trail.
Design, authoring, diagnosis, alerting and the assistant each take their own provider — six are supported, including Ollama on your own hardware. Sending a feature's data outside needs an explicit acknowledgement for that feature, which the database enforces.
Hosted platformsOne assistant, the vendor's model, the vendor's inference. Opting a single feature out is not usually on offer.
Collection asks only to read, and the platform refuses to start if its collection catalogue gains a write verb. Changes are opt-in, one operation at a time, each approved. Secrets are never listed — the Secrets page is derived from what references a secret, so it shows the secrets your workloads use and never their contents.
Hosted platformsAgent permissions are a document you are asked to trust, checked at review time rather than at run time.
Once for the request, once for the generated bytes — and there is no state from which model output reaches a hypervisor without a person in between. The absent transitions are asserted by tests, not just missing.
Hosted platformsAI suggestions are advisory text. What happens after you copy them out is outside the product.
Security
Every control below is something the system makes impossible, not something we intend. Each one names the mechanism and the file, because a claim you cannot check is a claim you should not believe.
Enforced bya queue, not a call
No kubeconfig, no service-account token, no network path inward to make a change. The agent inside your cluster asks for work and carries it out under its own ServiceAccount, so compromising this platform yields a queue of proposals your own RBAC still has to permit. The exceptions are ones you add: a bastion host or a monitored VM is reached over SSH with the key you give it.
packages/core/src/actions/
Enforced bya guard at module load
A write verb anywhere in the collection catalogue throws in the platform before its first request is served — the catalogue that renders the ClusterRole you apply. Changes are a separate, opt-in catalogue whose rules reach the ClusterRole you apply only for the operations you enable — and the same catalogues render the table the console shows you, so the grant and the description cannot disagree.
agents/permissions.ts — assertReadOnly()
Enforced byan absent grant
Kubernetes has no metadata-only list verb for secrets, so listing them would hand a token inside your cluster the ability to read every credential in it. The Secrets page is derived from what references a secret instead — names and where they are used, never contents.
agents/permissions.ts
Enforced bythe query layer
Tenant-scoped reads inspect their own SQL and refuse to execute unless the text constrains the tenant. Forgetting the predicate is an error at the call site, not a leak discovered later.
packages/db — TenantScopeError
Enforced bymount order
The ingest routes are mounted ahead of the session middleware, so a cookie arriving on an ingestion request is never resolved into a principal. Agent keys carry ingestion-only scopes the database constrains, plus two switches that are off unless you turn them on: container exec, and carrying out approved changes.
services/api/src/index.ts
Enforced bysealed at rest
Hypervisor accounts, model provider keys and Git tokens are sealed with AES-256-GCM and decrypted only where they are used; reads return a hint and a fingerprint. One deliberate exception: a backup destination's access key is written into the storage-location file you download to apply to your cluster. A build credential is destroyed when the build reaches a terminal state.
packages/core/src/crypto.ts
Enforced bya CHECK constraint
Auto-execution requires the low risk tier, and the tier is computed from the verb and the scope rather than taken from whatever proposed the change. For delete, exec and rollback the database refuses an automatic policy outright, so that rule survives a bug in the layer above it; for every other verb the policy code enforces it.
migration 005 — ai_auto_requires_low_risk
Enforced bya static gate
An allowlist of modules, no shell, raw or script, file lookups only, egress limited to addresses the request itself creates, and no_log required on any task that interpolates a secret. It ends in a real syntax check over a temporary directory rather than a guess about strings, and a refused bundle is never stored — so there is nothing to approve by mistake.
provisioning/gate.ts
Collection
The Go agent is a static image under 7 MB with no third-party modules. Metrics from the kubelet, logs from the node filesystem, events, traces over OTLP, and more than fifty kinds of cluster inventory. A TypeScript collector (about 130 MB) also ships and speaks the same protocol; the Go agent is where new collection work goes.
In the in-cluster install, agents post to a gateway inside your own cluster. It acknowledges in milliseconds, writes to disk and forwards on its own schedule, so a platform outage costs bounded disk on one StatefulSet. If the outage outlasts the disk, the oldest data goes first.
A batch marks what it did not contain as gone, so a deleted workload disappears instead of lingering. An incomplete listing reconciles nothing at all — a stale row beats an emptied console.
Collection asks only for read verbs — get, list and watch — and the platform refuses to start if its collection catalogue ever gains a write verb. One grant does more than read: get on nodes/proxy, which is how kubelet metrics are read today, also reaches the kubelet's exec endpoint on current Kubernetes versions — so treat the agent's token as able to run commands on its node's pods, and keep it to that ServiceAccount. Changes are a separate, opt-in catalogue: an operation appears in the ClusterRole you apply only when you enable it, and each one is policy-checked and approved before the agent carries it out.
Side by side
| Capability | Kairos | Hosted SaaS observability |
|---|---|---|
| Where telemetry lives | Your own database, on your network. | The vendor's cloud, in a region you pick. |
| Air-gapped install | Supported. The platform fetches nothing at runtime; mirror the images to your registry and use a local model. | Needs a path from your network to the vendor's cloud. |
| Cluster provisioning | On OpenShift, generates and runs the Ansible. A person requests every build, and larger ones wait for an operator's approval. | Usually a separate product. |
| Agent footprint | A Go agent under 7 MB with no third-party modules (a TypeScript collector, about 130 MB, also ships). | Varies by vendor — compare the image size and its dependency list. |
| What the agent may write | Nothing by default. Each change you enable is policy-checked and approved. | Varies by vendor and by integration. |
| AI model | Yours, chosen per feature — or none at all. | The vendor's, applied platform-wide. |
| During a platform outage | In-cluster installs buffer to disk and forward later; if the disk fills, the oldest data goes first. | Varies by vendor — ask where it buffers and what it drops first. |
The right-hand column describes the hosted category as a whole, not any one vendor, and covers only properties that follow from being hosted. Individual products differ; check yours.
How it works
Tell us what you run. We agree the plan and the platforms that fit, then issue a licence key naming them, with the install bundle and the guide for your topology. Licences run for a term — a year unless agreed otherwise.
Inside your OpenShift cluster, or on a host beside any supported cluster, from a dated bundle that carries its own SHA-256 checksums. Register the cluster in the console, then deploy the agent with the key the console issues for it.
Within minutes of the agent starting: nodes, workloads and the rest of the inventory, metrics and events — it sends a heartbeat and metrics every 30 seconds. Alerts evaluate from the first readings; forecasts start as history builds, and each is graded once its moment passes.
Plans
Every plan runs the same product in your network. What scales is how many clusters, nodes and people it covers, how long it keeps history, and how much the AI agents may spend each day.
One cluster, to prove it on.
Includes
Priced per estate — ask us about Starter
A production estate of a few clusters.
Everything in Starter, plus
Priced per estate — ask us about Pro
Large or regulated estates.
Everything in Pro, plus
Priced per estate — ask us about Enterprise
There is no public price list: each licence is quoted for the estate it covers, and its limits can be adjusted to fit.
Ask about pricingTalk to us
Send this and someone from our team will reply. We talk through what you run, then issue a licence key, the install bundle and the guide for your topology.