Agents on every cluster. Guardrails on every action.
KubeHero is the agentic control surface for AKS, GKE, and EKS. Agents read every metric, explain your clusters in plain language, and propose the exact change — cost, capacity, GPUs. Every action is a guarded CRD. Nothing fires until you arm it.
KubeHero in 30 seconds.
Kubernetes is a scheduler, not an economist.
It does exactly what you ask. And what most teams ask for is 6× more capacity than they actually use. Here's what that looks like at the pod, node, and cluster layer.
Requests are fiction.
Developers set CPU/memory requests once, to avoid the 3AM page. Industry studies report real utilization at ~13% of what pods request. The other 87% is paid-for air.
Limits are scar tissue.
That 16 vCPU limit on a service that uses 0.4 average? Someone set it during an incident six months ago. Nobody touches it because nobody knows why it's there.
GPUs are the silent killer.
A single idle A100 burns ~$32/hour. H100s worse. Most clusters have 30–60% GPU idle time that never shows up in a dashboard until finance opens the invoice.
The autoscaler doesn't know your budget.
Karpenter and the cluster autoscaler optimize for scheduling, not spend. A bad deploy can spawn 400 nodes before anyone notices. By the time Slack lights up, you owe $18k.
One plane for every cluster.
Every dollar accounted for.
KubeHero runs a lightweight DaemonSet on every cluster and streams compressed telemetry to a control plane you host, or that we host for you. No invasive sidecars. No re-architecting. No vendor lock-in.
eBPF-accurate telemetry.
Kernel-level pod attribution. Not the 30s-averaged guesswork you get from metrics-server. Per-pod CPU, memory pressure, syscalls, I/O — second-granularity.
Unified cloud pricing.
Live EC2 + Savings Plans + Spot for EKS, committed-use for GKE, Spot VMs and Reserved Instances for AKS — one mental model, one cost-per-second number per pod.
GPU- and TPU-native.
DCGM-integrated GPU telemetry, tensor core utilization, per-process VRAM, MIG slice efficiency. TPU utilization via GCP SDK. Idle A100? Flagged in 60 seconds.
Policy engine + spend ceiling.
Budget CRDs. Automated rightsizing recommendations. A circuit-breaker that evicts runaway pods, caps HPA, or quarantines node pools before a bad deploy melts the card.
An SRE that reads every metric.
And can only act through guardrails.
Bring your own Anthropic API key and the advisor runs on Claude. Don't, and a deterministic rules engine does the same job. Either way the loop is identical: observe, explain, propose — and apply only through the operator's arming flow.
Observe.
The advisor reads the same eBPF telemetry you do — per-pod CPU, memory pressure, GPU utilization, burn rate — at 1-second resolution. It holds zero write credentials. It cannot touch a resource.
Explain.
A daily or on-demand briefing in plain language: what changed, what it costs, what needs a decision. Read it in the dashboard, or have the browser speak it while you make coffee.
Propose.
Not "consider rightsizing" — the exact change. Every proposal is rendered as a BudgetPolicy, CeilingPolicy, or RightsizingPolicy CRD with the $ impact and a risk call. Review it like any other diff.
Guarded apply.
Nothing executes until you arm it. Enforcement runs in the deterministic operator — PDB-aware eviction, bounded change rates, undo within the cooldown. The AI never gets the trigger.
The advisor can propose. It cannot mutate. No write credentials, by design.
Every proposal is a policy object you can review, diff, and GitOps like anything else.
Deterministic reconciler with arming, PDB-aware eviction, and kubehero undo.
Without an Anthropic key, the rules engine produces the same briefings and CRDs — deterministically.
One pane of glass.
AKS, GKE, EKS — side by side.
The dashboard is built for operators, not dashboards-as-art. Spend rolls up from pod to cluster to fleet. Drill down until you see the exact workload wasting the money, then ship the fix — or arm the spend ceiling.
| Cluster | Cloud | Region | Nodes | GPU | Cost / day | Recoverable | State |
|---|---|---|---|---|---|---|---|
aks-westeu-prod-01 | AKS | westeurope | 142 | 8× A100 | $4,820 | $1,920 | overcommit |
aks-ne-staging | AKS | northeurope | 24 | — | $480 | $110 | healthy |
gke-usc1-prod | GKE | us-central1 | 88 | — | $2,140 | $380 | healthy |
gke-euw4-batch | GKE | europe-west4 | 62 | 16× L4 | $1,680 | $540 | overcommit |
eks-use1-prod | EKS | us-east-1 | 210 | 32× H100 | $12,940 | $5,180 | overrun |
eks-usw2-dev | EKS | us-west-2 | 38 | — | $620 | $180 | healthy |
Watch it work — end to end.
Connect a cloud account, stream telemetry, evaluate policies, act — all in under five minutes on a real cluster. Pause any step to read.
Connect any cluster in under five minutes.
Helm install the agent, paste an OIDC role ARN, and KubeHero discovers every AWS account, Azure subscription, and GCP project in scope.
Live telemetry, not yesterday's PDF.
Panels update every second from a real ClickHouse feed. Hover the burn-rate chart to scrub back through the window.
Follow the money, from namespace to invoice.
Ribbon thickness is $/mo. Hover a node or a flow — everything else dims so you can see exactly which team's workload is running on which cloud, and what it costs.
Three things legacy FinOps tools can't do.
Sub-minute telemetry, retroactive Savings Plan re-attribution, and an enforcement layer with humanArm: true. Flexera, Cloudability, and their peers are structurally incapable of any of these.
Live burn rate
Savings Plan replay
Ceiling policies
Declare what you refuse to spend.
KubeHero enforces it.
Most cost tools report yesterday's damage. KubeHero lets you define a hard ceiling as a Kubernetes CRD and acts in real time when a bad deploy, a runaway cron, or a forgotten dev namespace starts overrun budget.
apiVersion: kubehero.io/v1 kind: BudgetPolicy spec: ceiling: $8400/hr hardStop: true humanArm: true escalation: [hpa, evict, quarantine, page]
Run KubeHero in your own cluster.
KubeHero is open source and self-hosted. Add the Helm repo, install the chart, point it at AKS, GKE, or EKS — no account, no waitlist, no license key. The agent is read-only by default.
helm repo add kubehero https://charts.kubehero.io
helm repo update
helm install kubehero kubehero/kubehero \
--namespace kubehero --create-namespace