External control-plane dependency
Critical lifecycle work can depend on a third-party service, egress path or identity boundary.
Sovereign operations
Keep Kubernetes operational authority inside your own boundary.
ClusterPilot gives platform and operations teams a self-hosted control plane for provider infrastructure, cluster lifecycle work, add-ons and validation. The customer controls where state, credentials, artifacts, agents and target clusters run.
Operational challenge
Sovereignty is an operating model, not a hosting label.
Moving a control plane into a customer network does not automatically create sovereignty. Teams still need explicit control over trust, identity, dependencies, software supply chain, execution and evidence.
Distributed privileged access
Provider tokens, SSH access, kubeconfigs and registry credentials move through scripts and operator workstations.
Unclear evidence ownership
Operational proof is split between vendor logs, local terminals, tickets and target systems.
Enterprise value
Customer control across the complete operation.
The value comes from shared state, explicit ownership and reviewable execution.
Self-hosted control plane
API, workers, PostgreSQL and artifact storage run under the customer’s deployment and recovery model.
Local execution boundary
Lifecycle Agents receive bounded, versioned work and materialize target credentials only inside the approved environment.
Portable release evidence
Immutable digests, signatures, SBOM, provenance and compatibility metadata identify what is deployed.
Controlled workflow
A practical sovereignty workflow
Each boundary is prepared and accepted independently before production-gated capabilities are enabled.
Define the boundary
Place control plane, persistence, artifacts, registry and agents according to network, trust and availability requirements.
Verify the release
Mirror and verify exact image and bundle digests together with signed metadata, SBOM and provenance.
Connect targets safely
Reference provider, registry and cluster credentials without placing secret values in plans, logs or evidence.
Accept with evidence
Exercise backup, restore, failure, cleanup and one bounded lifecycle path before environment approval.
Evidence
Evidence the customer can review and retain.
The operation record connects intention, admission, execution and outcome without requiring a vendor-hosted audit trail.
Before execution
Actor, scope, plan, resource impact, compatibility, capability gates and destructive confirmation.
During execution
Ordered steps, leases, status, events, timings, correlation, redacted logs and stable failure codes.
After execution
Results, artifacts, checksums, cleanup status, retry history, acceptance and retention context.
Honest product boundary
What this does—and does not—claim
- ClusterPilot does not claim that self-hosting alone creates legal, organizational or technical sovereignty.
- The customer remains responsible for identity, network, encryption, backup, retention, platform hardening and environment approval.
- v0.0.1 is a gated release candidate; no capability is presented as generally available.
Frequently asked questions
Questions about Sovereign Kubernetes Operations
Clear answers about fit, boundaries and the evaluation path.
Is ClusterPilot a mandatory SaaS control plane?+
No. The documented deployment model is self-hosted and places the application, state, artifacts and lifecycle execution in the customer environment.
Does self-hosted automatically mean sovereign or compliant?+
No. ClusterPilot provides technical controls and evidence. Legal, organizational and environmental requirements still need a customer-specific assessment.
Can ClusterPilot work with private registries and restricted networks?+
The release contract includes digest-pinned distribution, private registry and air-gap workflows. Exact network and trust prerequisites must be validated for the target environment.
Capability scope: v0.0.1 release candidate. Review the current release boundary →
Start with a measurable workflow
Translate the requirements into a bounded technical evaluation.
We will review the environment, operational bottleneck, control boundaries and evidence needed for a decision.
hello@clusterpilot.de