A single self-contained binary audits every workload, read-only, and turns the noise into one maturity score, 0–100, plus a prioritized, explained report — the config problems capping your score and the runtime symptoms breaking things right now. No data ever leaves the cluster.
🍼
Critical
0–39
"just born" — open criticals, no guardrails.
🧒
Basic
40–59
"learning to walk" — probes and limits still missing.
🧑
Intermediate
60–79
"growing up" — the essentials are in place.
🧑🔧
Advanced
80–94
"self-sufficient" — hardened, well-operated.
🎓
Excellent
95–100
"graduated" — best practice, end to end.
Maturity is the check-up. Health is the emergency room — see below.
The check-up
A graded 0–100 score of configuration best practices, reconstructible by hand from the published breakdown. It answers "how well-run is this cluster?" and it's the number you improve over time.
The diagnosis
What is actually broken right now: crash loops, OOM kills, a Service with no endpoints, unschedulable pods. Observed at runtime and reported as symptoms — it never inflates or deflates the maturity score. A 95/100 cluster can still be on fire; KubeWise says both, honestly.
1 · Consultation
One read-only pass over the whole cluster. No agent to install per workload, no data leaves.
2 · Diagnosis
Every finding carries why it matters, the evidence, and often the root cause. Premium correlates them into causal chains: "app unreachable ← pods OOMKilled ← memory limit too low".
3 · Prescription
A fix for each finding, and (Premium) a remediation plan bucketed today / this week / this month, with the maturity you'd reach at each step.
4 · Follow-up
Re-scan on a schedule; "what changed" and the maturity trend over time (persistent history is Premium).
KubeWise Cluster Maturity Report Cluster: shop-prod Maturity: 74 / 100 (INTERMEDIATE) [ruleset v2] Issues: 12 (2 critical, 6 warning, 4 advisory) · 3 observed at runtime #1 CRITICAL · config · Service has no endpoints Service/payments-api (ns: shop) Why: every request to it fails — the selector matches no ready pod. Fix: make spec.selector match the backing workload's pod labels. → caps the cluster score: an open critical can't read "excellent" #2 WARNING · runtime · Container OOMKilled ← health, not score Deployment/checkout restarted 47× in 3h Why: killed at its 128Mi limit; peaked at 320Mi over 7d (Prometheus). premium ▸ diagnosis: "checkout unreachable" Service/checkout has no endpoints ← pods OOMKilled ← memory limit too low Highest-impact actions ---------------------- Fix the Service selector — Service/payments-api +9 pts reliability · 1 finding · low effort · high confidence Set a memory limit — Deployment/checkout +6 pts resources · 1 finding · medium effort · high confidence Action plan (now 74/100) =========== Immediate (today) → 83/100 - Fix the Service selector — Service/payments-api (+9 pts) This week → 89/100 - Set a memory limit — Deployment/checkout (+6 pts)
0–100
a maturity score you can reconstruct by hand — every point traces to a rule and a weight
read-only
get/list only, secrets stripped at collection · no data leaves the cluster
config vs runtime
"misconfigured" and "actually broken" are never the same number
Under the hood
✓ 20+ config rules across 6 categories — probes, requests/limits, image:latest, pod security, RBAC cluster-admin, NetworkPolicy, quotas, orphans, HPA…
✓ Maturity score + per-category breakdown + severity floor
✓ Runtime findings — OOM, crash-loop, image-pull, unschedulable, mount, probe, node health
✓ Per-object explain — evidence + cause, dependency graph, Mermaid export
✓ HTML (standalone page), SARIF (GitHub code scanning) + JSON export
✓ CI gate — -fail-under
✓ In-cluster server with /metrics (Prometheus)
✓ "What changed" + maturity trend across scans
| Feature | Community | Premium Coming soon |
|---|---|---|
| Config rules (probes, requests/limits, image:latest, pod security, RBAC, NetworkPolicy, quotas, orphans, HPA…) | ✓ | ✓ |
| Maturity score + per-category scores + severity floor | ✓ | ✓ |
| Runtime findings (OOM, crash-loop, image-pull, unschedulable, mount, probe, node health) | ✓ | ✓ |
| Per-object explain (evidence + cause), dependency graph, Mermaid | ✓ | ✓ |
| Export HTML (standalone page), SARIF (GitHub code scanning) + JSON | ✓ | ✓ |
| "What changed" + trend (in the process) | ✓ | ✓ |
| Correlation / causal diagnostics ("app unreachable ← OOM ← memory limit too low") | — | ✓ |
| Remediation plan (today / this week / this month, cumulative maturity) | — | ✓ |
| Persistent history (survives a restart) | — | ✓ |
| External sources: Prometheus (rightsizing, CPU throttling), metrics-server, Istio (sidecar coverage) | — | ✓ |
One binary. Premium unlocks with a signed license key — until then, everything above the line is free in the beta.
KubeWise Community — open beta, no waitlist
Tell us about your cluster and what you're trying to solve — we'll follow up as you get started.
Closed source. No source access is granted through the beta.