Infrastructure control
Your virtual machines, your containers, your Kubernetes, your firewall, your DNS, your certificates and your remote access: one console, one set of permissions, one audit trail. Running a hybrid infrastructure today means assembling eight tools that do not talk to each other, then maintaining the glue between them. kFleet replaces the assembly.
Nobody chose to run eight consoles. They were added one at a time, each for a good reason, and the cost only shows up once the whole thing is in place.
The honest way to describe kFleet is to start from what a team already maintains. The third column matters most: it separates what serves you on day one from what first needs your estate described.
| Maintained today | What kFleet brings | On install |
|---|---|---|
| Proxmox, vCenter, virt-manager | libvirt (KVM/QEMU), Lima and VirtualBox virtualisation: machine lifecycle, browser console, snapshots, cloud-init, live migration between hypervisors. | Usable as is |
| Portainer, Rancher, kubectl | Docker, Podman, LXD, Incus and LXC containers, and multi-cluster Kubernetes across thirteen resource types — one console for all three families. | Usable as is |
| pfSense, nftables scripts | A driven nftables firewall: profiles, zones, ordered rules, a diff before applying and lock-out protection. | Foundation to describe |
| BIND, dnsmasq, Kea, ISC DHCP | DNS across six supported engines and DHCP across three: zones, records, scopes, reservations, all versioned. | Foundation to describe |
| cert-manager, Caddy, ACME scripts | Authorities, certificates and distribution: ACME with nine challenge types, renewal and installation on targets. | Foundation to describe |
| Guacamole, home-grown bastions | RDP, VNC and SSH consoles in the browser, through a jump host, with encrypted credentials and a traced session. | Usable as is |
| Ad-hoc Ansible, Foreman, Spacewalk | Software estate: aggregated inventory, per-machine version gap, a security-only filter, bulk apply and follow-up. | Usable as is |
| Terraform, cloud consoles | AWS and Cloudflare: templates, planning, apply and continuous drift detection, with no local Terraform. | Foundation to describe |
| Lucidchart, Visio diagrams | A map built from the real inventory — machines, containers, pods, rules, tunnels — rather than redrawn by hand. | Usable as is |
“Foundation to describe” means the engine, the model and the screens are there, and your estate still has to be entered or imported: a driven firewall without your zones, a DNS without your domains replace nothing until they are configured. It is fast because the foundation exists; it is not instant, and we would rather say so beforehand.
Breadth is not the argument. The argument is that a certificate, the firewall rule protecting the service, the machine hosting it and the risk documenting its flaw are all driven from the same place, with the same permissions and the same log. No gateway, no cross-export, no extra console.
libvirt (KVM/QEMU), Lima and VirtualBox behind one interface. Creation from an image, start and stop, snapshots, cloud-init, a console in the browser, live migration from one hypervisor to another. A machine's configuration is versioned like everything else: compare two states, roll one back.
Docker, Podman, LXD/Incus and LXC. Engines are connected, containers are listed, started, read — logs included — and their configuration is versioned. A mixed estate does not require two tools.
Thirteen resource types — namespaces, deployments, pods, services, ingresses, volumes, jobs, cron jobs, secrets, config maps, storage classes, nodes — across as many clusters as you run. Logs, exec into a pod, port forwarding: from the browser.
The firewall is described as profiles: zones, ordered rules, a policy per chain. kFleet computes the diff before applying, refuses a rule that would cut off your own access, snapshots the rules in place and can roll back in one click.
Six supported DNS engines (BIND, dnsmasq, CoreDNS, PowerDNS, Route 53, Cloudflare) and three DHCP engines (Kea, ISC DHCP, dnsmasq). Zones, records, scopes, subnets and reservations are entered once and deployed to whichever engine serves you — the model does not change when the engine does.
Eight VPN adapters — WireGuard, OpenVPN, IPsec, cloudflared, NordVPN, AWS, GCP and Azure — with their peers. And to work on a machine, an RDP, VNC or SSH console in the browser, through a jump host, with encrypted credentials and a traced session: no fat client, no bastion to maintain.
Authorities, challenge providers and distribution targets. ACME issuance with six DNS-01 and three HTTP-01 challenges, then installation on the declared targets. The most direct consumer of that chain is the same product's Zero Trust edge — which is what guarantees it is exercised.
Ninety-five ready-to-deploy applications, sorted by category, with variable substitution and a post-install phase. For a Helm repository, deployment is guided the same way.
Software inventory aggregated across the fleet, a per-machine version gap, a security-only filter, bulk apply and real-time follow-up. A patching campaign becomes one operation instead of N scripts.
Twenty-three wired tools — dependency analysis, container images, system hardening, CIS baselines — and an authenticated application scan with replay. A scan result becomes an assessed risk, then a traced incident, then a report: with no re-export and no second tool.
Knative jobs, their sources, revisions and triggers, with the runtime images shipped out of the box. An invocation is triggered and followed from the same console.
A graph built from the real inventory — machines, containers, pods, firewall rules, tunnels, certificates, cloud resources — rather than redrawn by hand. It stays current because the product's own events feed it, not because someone remembered to update it.
Every driven machine carries an agent reporting its state: hardware, storage, network, installed software. That collected state feeds the inventory, the map and the software estate — one report, several screens.
A self-hosted access gateway whose configuration is compiled, signed and verified before being applied, keeping the last known-good version. It is an adjacency of the control surface, not a standalone access product — but the chain of trust reaches the data plane.
Users, roles and fine-grained permissions, organisations, a sealed audit trail, a single GraphQL API, workflows, documents: kFleet rewrote none of these, it inherits them from the platform. That is why an infrastructure control surface arrives with permission management and an audit trail worth the name.
An infrastructure control surface needs users, roles, organisations and an audit trail before it needs a hypervisor. kFleet did not rewrite them.
Identity and access, nested organisations, fine-grained permissions, a sealed audit trail, a single GraphQL API, workflows, documents and artefacts. kFleet inherits them rather than rebuilding them — and Kore is also the module's technical and contractual prerequisite.
See the Kore platformDeployed on your own servers, including off-network. Go and PostgreSQL, no proprietary format, and no third-party UI components left: this is the argument for public-sector and regulated IT departments, and almost no competitor can tick it.
In this order. It is the order in which the argument holds: consolidate first, operate next, prove last.
One tool instead of eight: fewer licences, fewer accounts to manage, less training, one place to look. Thirty-two modules and more than forty adapters, under one console and one permission model.
Every configuration is versioned, comparable and revertible in one click — machines, containers, firewall, DNS, DHCP, VPN, cloud templates. Drift is detected continuously, not at the next deployment.
A scan result becomes an assessed risk, then a traced incident, then a report. No re-export, no second tool, and the platform's audit trail underneath every step.
kFleet is a licensed module on top of the Kore platform, which is its technical and contractual prerequisite.
The everyday tasks of an infrastructure team, and what the product does in their place.
| Task | What kFleet does | Order of magnitude |
|---|---|---|
| An urgent firewall rule | A diff before applying, lock-out protection, a snapshot of the rules, a one-click rollback. | < 2 min (vs 15 min) |
| A complete development environment | Three machines, an address reservation, an updated DNS zone, a browser console — without leaving the page. | < 5 min (vs 30–45 min) |
| A fleet-wide patching campaign | Aggregated inventory, per-machine version gap, a security-only filter, bulk apply and real-time follow-up. | 1 operation (vs N scripts) |
| Working on an unreachable machine | An RDP, VNC or SSH session in the browser, through a jump host, encrypted credentials, a traced session. | No fat client, no bastion |
| Preparing an audit | Twelve months of log, firewall changes with author and timestamp, access, certificates — pulled from one place. | 2 days (vs 10 days) |
These durations are orders of magnitude observed under reference conditions, not commitments. They are recalibrated against your estate during scoping — a duration presented as a commitment is a trap that springs at the first real deployment.
Five properties that do not show in a demo, and that decide the renewal.
No per-user pricing: spreading the tool through your team should not cost you more. You pay for the machines kFleet drives, and nothing else.
Machines, containers and Kubernetes. Firewall, DNS, DHCP and VPN. Application catalogue and remote console. Community support.
Everything in Community, plus cross-domain versioning and rollback, AWS and Cloudflare with drift detection, software estate and fleet patching, cross-technology mapping, single sign-on, fine-grained permissions and audit, multi-tenancy for managed service providers, and 5-day support with next-business-day response.
Everything in Pro, plus authenticated application scanning and posture reporting, a risk register with timed incidents, a self-hosted Zero Trust edge with signed configuration, long-term support releases with security backports, and 7-day support with a 4 business-hour response.
Prices are not listed here: they are provided on a separate sheet. Separating the two lets the pricing evolve without reprinting the argument, and puts the price after the value.
Better said now than in month two. These gaps are acknowledged and documented; they are not worked around with careful wording.
One hour on your current stack: what you run, with how many tools, and what convergence would save you. No commitment, and no product demo — it is your infrastructure we look at, not ours.
