It is 3am and something breaks. Here is what happens next.

01 — Detect · L1

Nobody pages you. It already noticed.

Twenty-four deterministic rules watch the cluster's state: crash loops, OOM kills, images that will not pull, certificates about to expire, nodes going away. Zero configuration, and not one AI credit. And they do not hand you a bare finding: each one arrives with its recommendation, so you can fix it yourself even when that incident is not in the catalog Autopilot handles on its own.

• The rules run on current state, not on history, so they work from the first minute and do not depend on how much retention your plan has.
• Detecting costs no credits. They are spent only when something needs investigating, and the next layer makes that call.
• Every rule is a Skill: it carries its own confidence threshold and says which catalog actions are valid for that incident.

02 — Diagnose · L2 to L4

The model proposes. It never executes.

When that signal becomes a question, Kobi reasons and proposes the answer, but doesn't execute it: you authorize, and it's all audited.

The rule says what broke; why it broke needs context: events, logs, metrics and recent changes. It is the only thing that crosses the channel.

• Secret values are redacted before they leave the API layer — not a prompt policy, a server-side check.
• Metadata, not content. Each flow carries source, destination, verdict, status code and latency — never the request body.
• Logs aren't shipped in bulk. They're read only when you ask for a diagnosis that needs them.
• Self-hosted, nothing reaches KubeBolt: no product telemetry, no usage ping.

How we handle your data: trust & privacy →

03 — Remediate · L5

Kobi acts alone. You approve anything destructive.

With nobody to ask, the signal fires Kobi: it detects, investigates, remediates and documents. The model proposes; a deterministic guardrail checks the action against the catalog before anything touches production.

04 — Verify and revert

If the fix does not hold, it undoes it and calls you.

Applying is not resolving. Autopilot captures the previous values before touching anything, checks the result and, if it does not pass, restores and escalates to a person. It ships today; it is not on the roadmap.

And if the diagnosis does not clear its rule's confidence threshold, Autopilot never applies anything: it leaves the plan as a suggestion.

05 — Postmortem · L6

By morning it is already written.

The last step fixes nothing: it tells the story. The timeline, what was tried, what resolved it and the evidence behind it, ready to paste into the channel or the ticket.

06 — What you install, and what you don't

One agent, one outbound channel, and nothing else.

This is what you put inside your cluster so it can do it, and what stays yours.

The access model

Traditional dashboards reach into your API server. KubeBolt inverts the direction: the agent dials out, never in, and everything else rests on that.

Where the metrics come from

The agent adapts to what you already run: it takes kubelet metrics or queries your Prometheus, without you rebuilding your observability.

How much is kept

The signal rests in VictoriaMetrics. How far back you can look depends on your plan, or on your disk if you run it yourself.

07 — And the dashboard

Everything you'd do with kubectl. From the browser.

Over that same channel you operate the whole cluster, not just watch it: terminal, logs, filesystem, port-forward and resource editing, from the browser.

08 — If you use GitOps Roadmap · in design

If you use GitOps, the fix goes to the repo.

A fix in the cluster is gone with the next deploy. Autopilot already verifies every fix and reverts it if things get worse; what's coming is for it to be written in your repo, where the truth lives.