Managed Kubernetes control planes
We run your Kubernetes control plane: API server, etcd, upgrades, backups, the pager. Your bare metal, GPUs and VMs join with one kubeadm join and stay where they are.
Invited? Sign in
# Create a control plane. It runs on our side. ~ $ curl -X POST $KESTREL_API/v1/clusters -d '{"name":"prod"}' "endpoint": "prod-a8f9e2d4.cp.kestrelinfrastructure.com:6443" # Join your servers, wherever they are. root@node-01 # kubeadm join prod-a8f9e2d4.cp.kestrelinfrastructure.com:6443 --token k7x2pq.… --discovery-token-ca-cert-hash sha256:4c1e… This node has joined the cluster. root@gpu-01 # kubeadm join prod-a8f9e2d4.cp.kestrelinfrastructure.com:6443 --token k7x2pq.… --discovery-token-ca-cert-hash sha256:4c1e… This node has joined the cluster. root@vm-01 # kubeadm join prod-a8f9e2d4.cp.kestrelinfrastructure.com:6443 --token k7x2pq.… --discovery-token-ca-cert-hash sha256:4c1e… This node has joined the cluster. ~ $ kubectl get nodes NAME STATUS VERSION node-01 Ready v1.37.1 gpu-01 Ready v1.37.1 vm-01 Ready v1.37.1
What we run
Kestrel is managed Kubernetes without the servers. The control plane lives on our infrastructure; your machines join it as worker nodes.
Managed by Kestrel
Managed by you
In every cluster
Who it’s for
I run my own servers
Servers in a colo, a GPU cloud or a closet. Point them at a Kestrel control plane and run them like a managed cluster.
I sell servers
For hosting, colo and bare metal providers. Offer Kubernetes without building a platform team. We run the control planes.
I want a cluster to build on
Join a VM, a cheap VPS or the box under your desk. Suspend it when you’re done.
Under the hood
A Standard cluster, drawn as it is. See how it scales, how it’s locked down, and what happens when something fails.
Pricing
Three tiers, one per control plane size. We don’t count your servers, cores or GPUs.
For trying things and CI.
Free
one cluster
Most teams
For production.
$99
per cluster / month
For large and bursty clusters.
$599
per cluster / month
24/7 on-call
An engineer answers your page around the clock. One price covers every Standard cluster in your organization. Included with Performance.
$200per organization / month
| Feature | Development | Standard | Performance |
|---|---|---|---|
| API servers | 1 | 2 | 3 |
| etcd members | 1 | 3, in three zones | 3, in three zones |
| Survives losing a zone | No | Yes | Yes |
| Control plane resources | Base | Base, scales up | 10× base, scales up |
| etcd snapshots | Every 5 minutes | Every 5 minutes | Every 5 minutes |
| Support | Email, business hours | Email and 24/7 on-call | |
| 24/7 on-call | Not available | Add for $200 per org / month | Included |
| Price | Free | $99 per cluster / month | $599 per cluster / month |
Hosting provider? Resell managed Kubernetes on your servers at wholesale prices.
Partner pricingUSD. Pay annually, get two months free. Volume pricing from ten clusters.
Compared
AWS, Google and Azure manage Kubernetes on your servers for a fee on every vCPU. Running a control plane is the same work at 16 cores or 192, so our price doesn’t move.
Your monthly bill, compared
That’s $9,118 a month you keep.
AWS figure: EKS Hybrid Nodes at published rates ($0.020 per vCPU-hour, tiered down to $0.006) plus $0.10 an hour per cluster, from aws.amazon.com/eks/pricing. AWS prices hosts over 32 vCPUs through sales, so a negotiated bill may be lower. Kestrel Standard is $99 per cluster per month, whatever the size.
Security
A control plane holds the keys to everything on your servers. These are the controls today; the full set is available under NDA.
Your own API server, etcd and network segment. Nothing in the path is shared.
A certificate authority per cluster. Every connection authenticated and encrypted.
etcd on per-cluster keys, secrets envelope-encrypted, backups encrypted before they leave.
Your servers connect out. Nothing to open in your firewall.
Bring your OIDC provider. Standard Kubernetes RBAC, under your control.
Only on-call engineers, through a recorded break-glass path you can review.
Every API call, retained and streamable to your own log store.
Security fixes land within a set window. Version upgrades wait for you.
SOC 2 in preparation. Until then, we’ll walk your security team through it under NDA.
Request the security overviewWho runs it
We ran managed Kubernetes control planes inside the large clouds for years. Kestrel is small on purpose: the engineers who built it are the ones on call.
Reliability
Three zones, each with its own power and network. Lose one and the cluster keeps serving.
Regions
Coming soon
Need another region? Tell us. Early customers set the order.
Questions
Your pods run on your servers and your data stays there. The control plane can reach your nodes for things like kubectl exec and logs, as any control plane does, so on our side that access is limited to on-call engineers and every session is recorded.
Linux with containerd or CRI-O, plus kubeadm and kubelet. They only need to reach your cluster’s endpoint on port 6443. Nothing has to reach in.
You can, and the commands on your nodes would be the same. What you’d be signing up for is everything behind the endpoint: etcd across three zones, backups, certificates, upgrades and the pager. That’s the part we take on.
They bill for every vCPU you connect, and they work best if you already live in their cloud. We charge per cluster, and the only thing you adopt is upstream Kubernetes.
We don’t count them. The control plane grows as your cluster does. If you’re running something very large or spiky, the Performance tier gives you more room from day one.
Only if an outage can’t wait until morning. Standard comes with email support in business hours, and the control plane recovers from most failures without anyone stepping in. If you want someone on call, it’s $200 a month for your whole organization.
You offer managed Kubernetes to your customers and we run the control planes behind it. The customer and the server revenue stay with you, and you pay us a wholesale price per cluster. It all works through our API, so it can live in your own portal.
Only our on-call engineers, through a break-glass process that’s recorded and open to your review. Nobody keeps standing admin credentials.
Early access
An engineer reads every request and writes back, usually the same day.
Or write topartnerships@