KubeSREAI is a self-hosted AI SRE that detects Kubernetes incidents, traces root causes, and proposes remediations — running entirely inside your cluster, with no data leaving your environment.
Alert fatigue buries the signal, and root-cause analysis is slow because a symptom is not a cause. Generalist AI copilots make it worse — they have never seen your cluster topology, so they guess.
Sources: New Relic 2024 Observability Forecast; PagerDuty 2024 Cost of Incidents study; ITIC 2024 Hourly Cost of Downtime Report.
K8sGPT operator scans cluster state continuously. Prometheus metrics and live pod logs feed a rolling anomaly baseline.
Fine-tuned Phi-3.5-mini + RAG queries (cert docs, runbooks, Tempo trace graph) distinguish root cause from symptom.
Remediation is proposed as concrete kubectl commands, matched to the failure mode — bump memory, roll back, or restart.
Autonomous fixes are off by default. When enabled, only allowlisted non-destructive actions run; escalations need human sign-off in the operator console or CLI.
Event-driven watcher triggers analysis before anyone opens a ticket. It reads K8s events and Prometheus alerts as they fire.
RAG plus a fine-tuned model localises the true root cause across the service graph. It separates the failing dependency from its downstream noise.
Identifies the failure mode and applies the least-invasive fix — bump memory, roll back, restart — then verifies the workload stays healthy before resolving, or escalates to a human.
Peer-relative z-scores rank each component against its own baseline on Prometheus metrics, surfacing deviations without static thresholds to hand-tune.
Ack, resolve, or approve each incident from the operator console or CLI. Every approved command passes an allowlist that blocks anything destructive — exec, apply, or deleting workloads.
One Helm chart installs the model server (vLLM), RAG API (Chroma), and watcher — wired to your existing Prometheus, K8sGPT, and Tempo. Minutes to first diagnosis on a prepared cluster.
Not a policy. An architectural guarantee.
The fine-tuned model runs locally via vLLM — no external model APIs, and your logs, metrics, traces, and prompts stay in-cluster. Optional outbound notifications and model-artifact pulls are off by default, so air-gapped installs send nothing.
Regulated industries — finance, healthcare, government — cannot send production logs to external AI APIs. This is a hard procurement requirement, not a nice-to-have.
MIT-licensed base model. Full dataset provenance on request. RBAC least-privilege service accounts.
Two ways to run it: fully in-cluster on your own GPUs, or usage-based on ours over a private link. Either way, your telemetry never touches the public internet and never reaches a third-party model API.
For smaller teams that don't want to run GPUs. The model runs on our GPU; your telemetry reaches it over a private link.
For teams that run their own GPUs and want everything in-cluster — nothing leaves your environment.
For finance, healthcare, and government teams with air-gap, compliance, and procurement needs.
Usage plans meter incident counts only — never your logs or telemetry. Self-hosted licenses (per cluster or per node) run fully in-cluster and activate offline. Compliance, multi-cluster, and volume terms via sales.
We're working with a small group of engineering teams before general availability.