KubeSREAI is a self-hosted AI SRE that detects Kubernetes incidents, traces root causes, and proposes remediations — running entirely inside your network, even fully air-gapped and on CPU, with no data leaving your environment.
Alert fatigue buries the signal, and root-cause analysis is slow because a symptom is not a cause. Generalist AI copilots make it worse — they have never seen your cluster topology, so they guess.
Sources: New Relic 2024 Observability Forecast; PagerDuty 2024 Cost of Incidents study; ITIC 2024 Hourly Cost of Downtime Report.
K8sGPT operator scans cluster state continuously. Prometheus metrics and live pod logs feed a rolling anomaly baseline.
Fine-tuned Phi-3.5-mini + RAG queries (postmortems / runbooks / K8s docs, Tempo trace graph) distinguish root cause from symptom.
Remediation is proposed as concrete kubectl commands, matched to the failure mode — bump memory, roll back, or restart.
Autonomous fixes are off by default. When enabled, only allowlisted non-destructive actions run; escalations need human sign-off in the operator console or CLI.
Event-driven watcher triggers analysis before anyone opens a ticket. It reads K8s events and Prometheus alerts as they fire, and peer-relative z-scores rank each component against its own baseline — no static thresholds to hand-tune.
RAG plus a fine-tuned model localises the true root cause across the service graph. It separates the failing dependency from its downstream noise.
Identifies the failure mode and applies the least-invasive fix — bump memory, roll back, restart — then verifies the workload stays healthy before resolving, or escalates to a human. Model-guided fix choice Coming soon: the model helps choose the next fix from a checked set; it never runs commands itself.
Installs in diagnose-only mode with no cluster writes. Approve and auto modes are opt-in. Every action passes one validator, only in namespaces you allow, and pods pass the Kubernetes “restricted” security profile. Ack, resolve, or approve from the operator console or CLI.
One Helm chart installs the model server (llama.cpp on CPU, or vLLM on GPU), the RCA API with its built-in knowledge store, and the watcher — wired to your existing Prometheus, K8sGPT, and Tempo. Installs offline in under 10 minutes on a prepared cluster.
One checksummed bundle with every image pinned by digest, the Helm chart, the model, an SBOM and a mirror script for any OCI registry (Harbor, Artifactory, Nexus and others). Tested with outbound traffic blocked.
A quantized model in about 4 GB of RAM, with no GPU needed. On CPU an answer takes minutes, which is fine for event-driven RCA; a GPU makes it faster.
Load your runbooks and wiki pages as knowledge packs. They are cited ahead of ours, fully offline.
An audit log of every approval and action. One login, roles per cluster and namespace, and one console across clusters Coming soon.
Not a policy. An architectural guarantee.
The fine-tuned model runs locally (llama.cpp on CPU or vLLM on GPU) — no external model APIs, and your logs, metrics, traces, and prompts stay in-cluster. Optional outbound notifications and model-artifact pulls are off by default, so air-gapped installs send nothing.
Regulated industries — finance, healthcare, government — cannot send production logs to external AI APIs. This is a hard procurement requirement, not a nice-to-have.
MIT-licensed base model. Full dataset provenance on request. RBAC least-privilege service accounts.
Self-hosted only. Everything runs inside your network, on your CPUs or GPUs. Your telemetry never leaves it and never reaches a third-party model API.
An annual license per company, tiered by company size — not per cluster. Everything runs in your cluster; nothing leaves your environment.
For teams with air-gap, security-review, and procurement needs.
Licensed per company and sized to your environment. Contact us for terms.