Stack
The open-source building blocks KubeHero runs on and integrates with — and the ones it deliberately doesn't rebuild.
KubeHero builds the parts that didn't exist — one collector for every signal, one cost model across them, guarded automation, read-only agents — and stands on proven open source for everything else.
What KubeHero is built on
| Role | Choice | Why |
|---|---|---|
| Time series (cost, logs, profiles, flows, usage, events) | ClickHouse | columnar compression and aggregation over billions of rows; TTLs and materialized rollups in the schema |
| Metadata, policies, alerts, audit | PostgreSQL | the boring, durable choice; point-in-time recovery everywhere |
| Wire protocol | Connect-RPC on protobuf | one contract for Go, TypeScript, the CLI and curl |
| Kernel telemetry | eBPF via cilium/ebpf | stable UAPI programs, compiled at build time, no runtime toolchain |
| Operator | controller-runtime | the standard way to reconcile CRDs |
| Agents | Claude (your key) or a deterministic rules brain | explanation where a model helps; determinism where it must |
| Agent protocol | Model Context Protocol (official Go SDK) | so Claude and other agents can use KubeHero's tools |
| Distribution | Helm, OCI registry, cosign, SPDX SBOMs | what your platform team already runs and verifies |
The chart embeds single-replica Postgres and ClickHouse from their official images so a fresh install works immediately; in production you point it at managed stores.
What it integrates with
- Prometheus + Grafana — KubeHero exports chargeback series, ships recording rules and dashboards, and serves Grafana's Loki data source. See Prometheus + Grafana.
- Log shippers — Promtail, Grafana Alloy, Fluent Bit and the OpenTelemetry Collector can push to KubeHero's Loki and OTLP endpoints. See Compatibility.
- Pyroscope SDKs — push to KubeHero's
/ingest. - OpenCost clients and FinOps tools — the OpenCost allocation API and FOCUS export.
- Alerting — Slack, PagerDuty, Opsgenie, Microsoft Teams, Discord, webhooks, Alertmanager.
- Identity — any OIDC provider, directly or through Dex (LDAP, SAML). See Identity.
- Autoscalers — Karpenter, Cluster Autoscaler, HPA, KEDA and VPA keep doing their jobs; KubeHero prices their nodes and never fights them.
Optional subcharts
Off by default; enable them when you want one Helm release to bring them along:
| Subchart | Value | Use |
|---|---|---|
| kube-prometheus-stack | prometheus.embedded | a Prometheus + Grafana for greenfield clusters (don't enable next to an existing one) |
| Dex | auth.dex.embedded | OIDC bridge to LDAP, SAML and social logins |
| Trivy Operator | security.trivy.embedded | vulnerability reports for the posture view, ranked by workload cost |
| Tetragon | security.tetragon.embedded | eBPF runtime security alongside KubeHero's collector |
| External Secrets Operator | secrets.externalSecrets.embedded | sync the API key and tokens from your secret manager |
What we deliberately don't build
- A metrics TSDB — Prometheus and Mimir own that; KubeHero exports to them.
- A tracing backend — v0.3 doesn't store traces; trace IDs in logs link out.
- An autoscaler — rightsizing changes requests through guarded policies; replica and node scaling stay with the tools you run.
- A Grafana replacement — the dashboard is opinionated for operators; Grafana keeps working against KubeHero's APIs.
Compatibility
Point Grafana, Promtail, Grafana Alloy, Fluent Bit, the OpenTelemetry Collector, Pyroscope SDKs, OpenCost clients, FinOps tools, Alertmanager and MCP clients at KubeHero — with config snippets.
CLI reference
Every kubehero command — cost, logs, profiles, network, rightsizing, alerts, ask, mcp, policies and undo.