Built by operators, for the 3 AM page.

A log spike, a hot function, a cross-zone edge and a cost jump are usually the same incident seen from four tools. We collect each signal once, on every node, store it once, and label it the same way — cluster, namespace, workload, team — so they can be joined, and so each one carries a dollar figure.

The join is the product. Everything else is plumbing we try to make boring.

The collector’s Kubernetes permissions are read-only. Its eBPF programs observe traffic and CPU; they never drop, rewrite or redirect anything. You deploy it because the worst outcome is that it misses something — the worst outcome of a write-capable agent is doing the wrong thing at scale.

Our agents read every signal and can explain a cost spike with cited evidence. They cannot change a single resource: no Kubernetes credentials, no mutation RPCs, and every proposal validated against a CRD whitelist. A proposal becomes a change only when a human arms it, and then only through a deterministic operator that moves in bounded steps.

The model never holds the pen. That’s not a prompt instruction; it’s the architecture.

Every action records the state it replaces before it touches anything. kubehero undo <audit-id> puts it back. The audit log is append-only and signed, so the record of what happened can be trusted by someone who wasn’t there.

Logs, profiles and flows are the most sensitive telemetry you have. They stay in your infrastructure — no SaaS control plane, no phone-home, air-gap capable. The one optional exception is explicit: if you give the advisor your own Anthropic key, what it reasons over goes to that API under your terms. Without a key, a deterministic brain does the job and nothing leaves.

Adopting KubeHero should be a config change, not a migration. So it speaks the formats your tools already use: Loki push and query, the OpenCost allocation API, Pyroscope ingest, OTLP logs, Alertmanager, MCP. Keep your Grafana dashboards, your shippers and your FinOps pipeline — point them here.

eBPF needs Linux ≥ 5.8 with cgroup v2. User-space stacks need frame pointers, which Go and Rust have and the JVM gets with a flag. Allocation is an estimate reconciled to node prices, not your cloud invoice. We keep Prometheus for metrics and don’t store traces. We would rather tell you than have you find out.

The code that runs on your nodes — collector, CLI, cost model, protos — is Apache 2.0. The control plane, operator, advisor and dashboard are BSL 1.1: source-available and free to self-host. Every CRD is a public schema and every metric is Prometheus format. If we disappeared tomorrow, your data would not.

ClickHouse for time series. Postgres for state. Connect-RPC over HTTP/2. Helm for distribution. Cosign and SBOMs for the supply chain. None of it is surprising — which means our value is what we build on top, not what we ask you to adopt.

Software that works, not slides. Every release says what changed, and what was wrong when we fixed it. We don’t promise what we can’t deliver, and it’s all open — read every line and run it yourself today.