YEKE · Kubernetes management
Planned. Approved. Recorded.
Manage all your Kubernetes clusters from one interface. Every change becomes a plan first, is applied with your approval, and is recorded.
Community is free today (3 clusters · 5 users). Enterprise is enabled by a license.
Compare editions02 · What is YEKE
All your clusters in one interface
YEKE is a web-based Kubernetes management interface, like Rancher: connect multiple clusters, then monitor and manage them all from one screen.
There are two ways to connect a cluster. In agent mode, a small agent connects outbound from the cluster, and the credential does not reach the center. In direct mode, the kubeconfig is stored encrypted in YEKE.Community
Screens are generated from the cluster's own schema; when you add a custom CRD, it appears in the menu without a code change.Community
Everyone works with their own Kubernetes identity; the cluster's RBAC makes the final decision.Community
YEKE does not install clusters; it connects existing clusters, whichever tool was used to install them. Monitoring data is collected only in agent mode.
03 · Approval chain
What sets YEKE apart: the approval chain
0unapproved apply pathsA change becomes a plan first, passes your rules and an approval, and is recorded.
apps/v1 Deployment production/api (scale)| Field | Before | After |
|---|---|---|
| spec.replicas | 3 | 5 |
- Planbuilt
- dry-runpassed
- Policy+ four eyes
- EOrg approvalHook → ITSMpending
- ESecond approvalpending
- EChange freezefreeze on
- Applyqueued
Built into the design.
In the architecture, a single module writes to the cluster, and every applied write points to the approval that authorized it.Community
In management consoles, the usual path is to apply directly: a change goes to the cluster with the user's permissions the moment it is clicked.
In YEKE, the console, the AI chat, the Shell and the API use the same chain: plan, dry-run, policy, approval, apply and record.Community
Your organization's approval (validation Hook → ITSM), a second approval and a maintenance window can join the chain.Enterprise
If a rule requires it, a second approval and a maintenance window join the chain.Enterprise
Only writes that come through YEKE. kubectl from outside YEKE is out of scope. YEKE only controls changes that go through it. Direct kubectl access is governed by your own RBAC.
04 · MCP
Your agent plans. You apply.
CommunityEven when Claude Code or Codex connects over MCP, it stays inside the approval chain; the final approval is yours.
deniz-agent- reads
- proposes plans
- cannot apply
production-k3sdeniz-agentAwaiting approvalapps/v1 Deployment payments/webThe web container hits its memory limit and is OOMKilled; this raises the limit to 512Mi.
| Field | Before | After |
|---|---|---|
| resources.limits.memory | 256Mi | 512Mi |
- Planqueued
- dry-runqueued
- Policyqueued
- EOrg approvalif a rule asks
- Applyqueued
12:47ai.plan_proposedMCPdeniz-agentYour agent connects to YEKE over MCP with a read or plan proposal token you create on the My account page. A plan proposal token reads and builds plans; apply, approve and revert requests get 403.Community
Reads use your Kubernetes identity, and the cluster's RBAC has the final say. Every read from the cluster and every proposal lands in the audit trail.Community
Secret values reach the agent masked. Content read from the cluster goes to the model marked as data, and the agent is told not to follow instructions inside it.Community
A plan from your agent takes the same chain as plans from the console and the chat: validation, dry-run and policies.Community
Where your installation turns them on, org approval, a second approval and a maintenance window apply to the same card.Enterprise
With the ops.nl-strict policy turned on, every write proposed with a token requires elevated approval. A new proposal from the same token to the same cluster replaces the pending one.Community
MCP is off by default; the operator turns it on. Only clusters allowed for AI data egress can be read.Community
The agent's diagnosis is a proposal; its accuracy is not guaranteed. Marking content as data is not a safeguard on its own; the approval chain is. MCP never writes to the cluster directly, and the agent's other tools on your machine (shell, files, web) are outside YEKE's scope.
05 · Process
Your process is in the path of every change
Instead of trusting Kubernetes to a few people with full access, the team works with its own permissions and your process sits in the path of every change.
ITSMEnterprise
The validation hook asks your system when the plan is built and again at approval: is there an open change record? With no record, the plan stops and the reason is on the card.Enterprise
There is no ready-made ITSM connector; there is a hook contract and an iTop example.
Four eyesEnterprise
If a rule requires it, a second person reads the plan and consents; the owner still applies it.Enterprise
Maintenance windowEnterprise
During a freeze, apply waits; the card shows the time left until the window ends.Enterprise
This release has no emergency exception.
Policy packageEnterprise
Built-in policies and your own policy files are in Community.Community
Rules can also be loaded from a single package signed with your own key; a package with a bad signature is rejected.Enterprise
Notifications
If one is configured, the notification hook reports after apply by email, HTTP or a chat channel (Google Chat, Slack, Teams).Community
Of the chat channels, only Google Chat was measured live.
SIEMEnterprise
The audit trail flows to your SIEM as syslog/CEF over TLS or a signed webhook, with gap detection and signed checkpoints.Enterprise
Not tested end to end against a commercial SIEM product.
06 · GitOps
Your change reaches the repo too.
EnterpriseYEKE commits the change it applies to the cluster to the branch your controller tracks.
mainprotectedpush rejectedyeke/op-…proposala1f3c9eYEKE: patch apps/v1 Deployment shop/web7c2e9a1web: initial manifestapps/v1 Deployment shop/webApplied| Field | Before | After |
|---|---|---|
| spec.replicas | 5 | 9 |
Branch: maincommit a1f3c9edeployment/webshopThe repo says 9; the value stays.
In a cluster managed with GitOps, when a change is made directly in the cluster and the repo is not updated, the controller applies the repo's value again on the next reconcile. In our own measurement, a value raised to 9 with kubectl scale was back at 5 in 50 seconds.
In YEKE, the approval card shows both sides before you approve: what will change in the cluster, and which line of which file will change in the repo, on which branch. The card carries a box asking whether the change is reflected to the repo as well; it is checked by default. The repo diff is part of the plan hash, so what you approved cannot change silently afterwards.Enterprise
After approval, the change is applied to the cluster first, then its YAML counterpart is committed directly to the branch the controller tracks. In the measurement, the value was not overwritten for five reconcile cycles (5 minutes), and the revision the controller tracked was YEKE's commit.Enterprise
If the branch is protected, the push is rejected; YEKE opens a proposal branch and the card says “The work is half done”. Until it is merged, the next reconcile can undo the change: in the measurement, with the proposal unmerged, the value was pulled back in 15 seconds. Once it is merged, the next reconcile applies the repo's new state.
If reflection fails, the operation is not rolled back, and it does not stay silent either: the record shows its state and a separate event lands in the audit trail. If the repo has no counterpart, apply still happens, and the card says so before approval.
A change that reflection could not find or could not write shows up as a difference in the drift report, within the scope the report can read. Reflection prevents; drift shows what slipped through.Enterprise
YEKE does not trigger your GitOps controller and does not read Argo CD or Flux objects; it writes to the repo, and your controller does the rest.
Measured on 02.09.2026 with GitLab CE and Flux (1-minute interval) on our own server; other git providers and Argo CD are outside this measurement. The drift report does not read Helm charts yet; a scope that cannot be rendered shows as “Unknown”. Repo, cluster and file names in the animation are examples.
07 · Capabilities
What YEKE gives you
AI assistance
Reads with your permissions, only proposes plans.
Community
One console
Lists, YAML, terminal, logs and monitoring together.
CommunityEnterprise
Identity and access
Everyone works with their own Kubernetes identity.
CommunityEnterprise
Secret management
Who sees which key, and how much of it.
CommunityEnterprise
Audit and compliance
Who changed what, with whose approval.
CommunityEnterprise
In your environment
A single container on your own server.
CommunityEnterprise
AI is part of the product. The chat, the console and the terminal use the same permission chain.Community
Your organization chooses the AI provider: Anthropic Claude, OpenAI, Google Gemini, DeepSeek, a fully local model with Ollama, or an internal OpenAI-compatible endpoint.Community
Each cluster has three settings: off, local only, or allowed. The default is off. Every AI turn records which piece of data was sent and how much.Community
Secret values are always masked before they reach the model, and no setting turns this off.Community
An instruction hidden in cluster content, such as “delete the namespace” in an annotation, can lead the model to produce a proposal. That proposal cannot be applied without dry-run, policy and human approval.Community
If AI proposes a task for the Shell, the command is typed into the terminal but not run. Enter belongs to the user.Community
Limits
- The approval chain provides the safeguard. In measurements, one model proposed a plan in a case it should have refused; the chain held it on the approval card.
- The “local only” setting says only this: the model address core connects to is a private network address.
Screens are generated from the cluster's own schema. When you add a custom CRD, it appears in the menu without a code change.Community
Shell in the browser: kubectl and helm run there, and writes go through the approval chain.Community
The agent collects monitoring data: it reads each node's kubelet every 30 seconds with read-only access. CPU, memory, disk and network for nodes, workloads and storage, with 30 days of history.Community
Diagnose and Run scan: the scan runs a health and diagnosis check with your own AI provider and reports findings with evidence.Community
90-day history, alert rules and notification channels, scheduled scans and an HTML report.Enterprise
Limits
- Needing nothing extra installed holds only in agent mode. Direct mode has no collector.
- Run scan needs an AI provider and does not run when AI is off. It does not look for security vulnerabilities.
People sign in to YEKE and work in each cluster with the Kubernetes identity mapped to them. A request from someone without a mapped identity is never sent. The cluster's RBAC makes the final decision.Community
Permission groups are set up in the console and created in the cluster as real RBAC objects. Ready-made templates: Observer, Developer, Release team, Namespace owner, SRE / on-call.Community
In agent mode, a small agent connects outbound from the cluster; the cluster credential does not reach the center. The agent is open source (Apache-2.0).Community
Optional two-step verification with TOTP.Community
Organizational sign-in: LDAP/Active Directory and OIDC (Keycloak, Entra ID). A directory group maps to a Kubernetes group.Enterprise
Limits
- The credential stays out of the center only in agent mode. In direct mode, the kubeconfig is stored encrypted in YEKE.
- No SAML or SCIM. A second factor cannot be made mandatory installation-wide.
Secret values do not go to the AI model. When a Secret is updated, the plan and the record show only the path of the changed key (/data/password).Community
The validation Hook request carries no value either.Enterprise
Secret display: installation-wide full, masked or hidden display, applied to everyone, owner included. A new value can still be written without seeing the old one.Enterprise
Per-key access: a permission group gets a “Can view” or “Can edit” rule per Secret and key; a key without a rule, including a newly added one, starts hidden. The group does not read Secrets in the cluster; YEKE shows only the keys a rule allows.Enterprise
Secret versions: every YEKE write is versioned automatically, and a change made outside YEKE is caught on the next YEKE write. A single key or the whole Secret is restored through an approval card, and a deleted Secret can be recreated from its history.Enterprise
Effective access view: what a person can reach right now in each namespace, read from the cluster's own authorization checks.Enterprise
Limits
- These rules limit viewing through YEKE. Someone who can open a Shell in a pod can read the value from inside the container.
- Changes made outside YEKE are not watched continuously; they are caught only on the next YEKE write.
The audit trail is append-only; there is no way to edit or delete entries. Each entry holds both the YEKE user and the Kubernetes identity. Deleting a cluster record does not delete its audit events.Community
AI actions are recorded too: which resource was read, what was sent out, which plan was applied.Community
For terminal sessions, who, which pod and when is recorded in every edition.Community
Full terminal session recording that can be enabled per cluster; while it is on, the user sees it on the terminal's first line.Enterprise
SIEM export: syslog/CEF over TLS and a signed webhook, with gap detection and signed checkpoints.Enterprise
Compliance report: a single HTML file for one cluster and one period, carrying its own integrity proof.Enterprise
Limits
- SIEM export has not been tested end to end against a commercial SIEM product.
- Log reads are not written to YEKE's audit trail; their place is the apiserver's own audit log.
One-command install; no account, email address or license key needed. Community sends no telemetry.Community
Community runs on a single-file database; what you back up is one volume. An internal registry mirror for isolated networks.Community
Connecting to your PostgreSQL and running core with multiple replicas; a signed, fully offline install bundle.Enterprise
GitOps: an applied change is also written to its YAML in the repo and committed to the tracked branch; if the branch is protected, a proposal branch is opened. Drift is tracked.Enterprise
The license is verified offline and is not locked to a machine; when it expires, existing clusters remain manageable.
Limits
- YEKE does not install or operate PostgreSQL. Even in an air-gapped install, the agent image must sit in a registry the managed cluster can reach.
- The GitOps chain was measured end to end against our own self-hosted GitLab CE and Flux; other git providers and Argo CD are outside that measurement. On a protected branch, the next reconcile can revert the change until the proposal is merged.
KubeWorldCommunity
- District
- namespace
- Building
- workload
- Floor, windows
- pod
- Fire truck
- crash loop
- Ambulance
- OOMKilled
- Crane, scaffold
- scaling
- Dark cloud, storm
- problems
- Vehicles
- estimated traffic, not measured
08 · KubeWorld
If your cluster were a city
Districts are namespaces, buildings are workloads, windows are pods. When a pod crashes, a fire engine pulls up outside its building.
Now you can follow your cluster this way too.Community
Voiceover in Turkish, English captions.
KubeWorld draws the cluster as a city from live monitoring data, so you see where the trouble is at a glance.Community
KubeWorld does not measure traffic; it estimates it.
09 · Editions
Community and Enterprise
The approval chain is free in Community today. Enterprise adds organizational identity, compliance and continuity.
In Community Community
3 clusters · 5 users- Approval chain
- Policy files
- AI chat
- Notification Hooks
- Audit trail
- Shell and logs
- Monitoring · 30 days
- KubeWorld
- Permission groups · TOTP
- Backup and restore
Enterprise adds Enterprise
Flat, per organization- Validation Hook · ITSM
- LDAP · AD · OIDC
- Secret display
- Secret versions
- Dual approval
- Maintenance window
- Policy package
- GitOps and drift
- Session recording
- SIEM export
- Compliance report
- Alerts · 90 days
- PostgreSQL and HA
- Air-gap bundle
- SLA-backed support
| Capability | Community | Enterprise |
|---|---|---|
| Identity and access | ||
| Local users, passwords, optional TOTP two-step verificationA second factor cannot be made mandatory. | Included | Included |
| Kubernetes identity mapping per cluster | Included | Included |
| Permission groups: definition, templates, scope, RBAC generation | Included | Included |
| Sign-in and group mapping with LDAP / Active DirectoryEnterprise | — | Included |
| Single sign-on with OIDC (Keycloak, Entra ID)Enterprise | — | Included |
| Installation-wide Secret display ceilingEnterprise | — | Included |
| Per-key Secret access for permission groupsEnterprise | — | Included |
| Another user's effective access viewEnterprise | — | Included |
| Secret versions and restoreEnterprise | — | Included |
| Change management | ||
| Plan, dry-run, policy, approval, apply and revertThe core of the product. | Included | Included |
| Built-in policies and your own policy files | Included | Included |
| Notification Hook (email, HTTP, chat) | Included | Included |
| Dual approval (four eyes)EnterpriseIf the license lapses, the rule stays in force. | — | Included |
| Maintenance window, change freezeEnterpriseIf the license lapses, the window stays in force. | — | Included |
| Central signed policy packageEnterprise | — | Included |
| Validation Hook / ITSM integrationEnterpriseNot a ready-made connector: a Hook contract, an iTop example, documentation and setup support. | — | Included |
| GitOps repo reflectionEnterprise | — | Included |
| Drift visibilityEnterprise | — | Included |
| Audit and compliance | ||
| Reading and filtering the audit trail | Included | Included |
| Terminal session details: who, which pod, when | Included | Included |
Full terminal session recording (encrypted, .cast)EnterpriseOptional per cluster. | — | Included |
| Audit trail export to a SIEMEnterprise | — | Included |
| Compliance report (cluster and period, single HTML file)Enterprise | — | Included |
| Daily operations | ||
| Multi-cluster inventory, agent or direct connection | Included | Included |
| Resource screens generated from the schema, forms and YAML, live lists | Included | Included |
| Shell, pod terminal, log streaming | Included | Included |
| AI chat (your own provider or a local model), data egress card | Included | Included |
| Port-forward CLI | Included | Included |
| Turkish and English interface, light and dark themes | Included | Included |
| Monitoring | ||
| Metric collection and charts (nothing extra to install in agent mode) | 30 days | 90 daysEnterprise |
| Diagnose, manual Run scan and JSON reportNeeds an AI provider. Does not look for security vulnerabilities. | Included | Included |
| KubeWorld | Included | Included |
| Alert rules and notification channelsEnterprise | — | Included |
| Scheduled scans and HTML reportEnterprise | — | Included |
| Installation and continuity | ||
| Single-container install, SQLite, backup and restore | Included | Included |
| Internal registry mirror (isolated network, no extra package) | Included | Included |
| PostgreSQL driver and multi-replica coreEnterprise | — | Included |
| Long retention and archive (with PostgreSQL)Enterprise | — | Included |
| Migration tool from SQLite to PostgreSQLEnterprise | — | Included |
| Signed, fully offline install bundleEnterprise | — | Included |
| CapacityNo node, vCPU or pod limit. | 3 clusters · 5 active users | By contractEnterprise |
| SLA-backed support in TurkishEnterpriseScope is set in the contract. | — | Included |
10 · Questions
Frequently asked
The objections we hear most in meetings, with short answers.
We already use Rancher.
Rancher is a good tool. YEKE is built for enterprises, which is why it fits them better:
Every change goes through the approval chain and is recorded.Community
Your own systems join changes at the approval level through the validation Hook (ITSM)Enterprise, and at the notification level through the notification Hook (chat channels).Community
AI works with the person's own permissions, its proposals go through the same approval chain, and Secret values are not sent to the model.Community
Monitoring screens come built in; in agent mode there is nothing extra to install.Community
Enterprise features such as SSO, SIEM export, compliance reports, second approval and maintenance windows connect to your corporate processes.Enterprise
Let's try it together on your own cluster in a pilot.
Where does our data go? Can it run air-gapped?
YEKE runs on your own server. The license is verified offline; there is no license server or activation. Community sends no telemetry.Community
Data sent to AI is controlled per cluster and is off by default. A fully local model can be used with Ollama. Secret values do not go to the model.Community
For isolated networks there are two paths: an internal registry mirrorCommunity or a signed, fully offline install bundle.Enterprise In both, the agent image must sit in a registry the managed cluster can reach.
Is AI safe in production?
AI cannot do more than the person's own permissions allow and cannot write; it only proposes plans. A proposal goes through dry-run, policy and human approval. For a destructive operation, the object's name must be typed.Community The validation Hook adds your organization's approval.Enterprise
To be clear: the chain provides the safeguard. In a measurement, a model proposed a plan in a case it should have refused, and the chain held it on the approval card.
If you want, you can enable the template that moves every write coming from natural language to elevated approval.Community
How long does installation take?
A single docker run command. No repo to clone and no config file to prepare; the first admin is created in the browser.Community
Connecting a cluster in agent mode takes a single kubectl apply.Community
What about licensing and price?
Community is free today, does not expire and is limited to 3 clusters and 5 active users. At the limit, existing environments keep working; only new ones cannot be added.Community
Enterprise is a flat subscription per organization; scope and price are settled in a conversation. When a license expires, you get a warning first, then a grace period, and then new configuration is restricted. Existing clusters remain manageable.Enterprise
Does the team have to learn a new tool?
Kubernetes concepts and RBAC stay the same; YEKE brings no role system of its own. The team can keep using kubectl and helm in the browser. The interface is in Turkish and English.Community
What is new is the approval card. It shows what will happen with every change.
Isn't it risky to give our kubeconfig to YEKE?
That is what agent mode is for. The credential stays in the cluster; even if YEKE is compromised, that cluster's credential does not leak.Community
Direct mode is for convenience, and the product states this risk when you connect.Community
11 · Get started
Install first, talk later.
Try YEKE in your own environment.
Install it yourself
A single docker run command; no account or license key needed.Community
Demo or pilot
Write to us. Put one of these in the subject line:
- YEKE demo request
- YEKE pilot request
- YEKE Enterprise