Introducing Berth: A Self-Hosted Kubernetes Dashboard With a Read-Only AI SRE

Most Kubernetes dashboards answer the wrong question. They show you every object in the cluster, beautifully, and leave the actual question you opened the dashboard for unanswered. Is anything broken right now? Is that database really redundant, or just running? Where is the capacity going? How do I ship the next change without taking the service down?

We build and operate Kubernetes for a living, and those are the questions we open a dashboard to answer, usually during an incident, usually at speed. So we built Berth: a self-hosted Kubernetes dashboard that starts from the question and follows the evidence to the resource that needs attention. It ships with an optional AI assistant that investigates the live cluster and proposes fixes for you to review, and it changes nothing on its own.

This is the first article in a series about Berth. It covers what Berth is, what it deliberately is not yet, and how to try it in a few minutes.

What Berth is

Berth is one container. A Vue single-page app is compiled into a small Go binary that talks to the Kubernetes API. You run it inside your own cluster with Helm, or point it at a cluster from your workstation with a kubeconfig. There is no external service, no data warehouse, and no phone-home. The binary verifies its own license offline against a public key baked into it, so it works the same on an internet-connected cluster and an air-gapped one.

That single process gives you four things.

An operational overview. The cluster overview leads with exposed-endpoint health, synthesized end to end from hostname to DNS to TLS to gateway to route to service. It reads Gateway API and Ingress, including cross-namespace route attachments, which is exactly where a “why is this URL down” investigation usually stalls. Below that: node and pod readiness, a provisioning verdict, and the warnings that actually need attention.

Capacity planning that names the constraint. Per node pool, Berth shows allocatable versus reserved versus used for CPU, memory, and pod slots, and then classifies the pool: reservation-bound, request-overprovisioned, or pod-density-bound. Low CPU usage alone is not proof of waste, and the page says so rather than nudging you into a bad resize.

Guided changes. Cluster-aware builders read the live cluster so you pick real images, services, gateways, issuers, and node taints instead of typing YAML from memory. The expose-an-app flow creates a Deployment, Service, Certificate, Gateway, and HTTPRoute in dependency order, then verifies the URL is actually serving. Weighted HTTPRoute backends give you canary and blue-green splits from the same screen.

A read-only AI SRE. More on this below. The short version: it reads everything and changes nothing.

Viewing all of this is free and needs no account and no license key. You only need a key to make changes.

Reads everything, changes nothing without you

The AI assistant is the part most likely to make an experienced operator nervous, so it is worth being precise about what it can and cannot do.

The agent is grounded and read-only by construction. Grounded means it does not answer availability or capacity questions from general Kubernetes knowledge. It gathers evidence from your live cluster with read-only tools and reasons over a periodically refreshed snapshot. A model that guesses whether your database is highly available is confidently wrong on a real cluster; Berth’s agent is required to look first.

Read-only means the agent can inspect every resource its Kubernetes permissions allow and mutate none of them. When it has a fix, it comes back as a manifest or a command for you to review through a propose step. There is an apply step in the code, and it is inert. This is not a policy toggle you can flip; it is how the agent is wired. That bounds the worst case of a mistaken or prompt-injected turn to a misleading answer, never a changed cluster.

It also never reads Secret or ConfigMap contents. Raw logs and describe output are disabled by default and require an explicit operator opt-in. We cover the full data-flow and trust model in a dedicated article, how Berth’s read-only AI SRE works.

Bring your own model

Berth does not sell you tokens or run inference for you. You bring the model and the credential, and Berth calls the provider directly from inside your cluster.

• Community uses a local Ollama server that you operate. Nothing leaves your infrastructure, which makes it the right fit for regulated or air-gapped clusters.
• Enterprise adds Claude via the Anthropic API or Amazon Bedrock, on your own key and under your own agreement with the provider. Berth proxies nothing and adds no markup.

Cloud models are gated behind two independent conditions: the dashboard must be authenticated, and the license must be Enterprise. An anonymous caller can never spend your key. Spend guardrails (daily and monthly token budgets, a rate limit, and a concurrency cap) plus a local usage ledger keep cloud usage visible and bounded. Those budgets are admission controls, not a guaranteed billing ceiling, so you still reconcile the ledger against the provider’s invoice.

Editions and the free key

Berth is freemium, gated by cluster size measured in node count.

Edition	Node allowance	AI providers	How to get it
Community	Up to 10 nodes, single cluster	Local Ollama	Free key, create an account
Enterprise	Agreed per deployment	Ollama plus Claude (Anthropic or Bedrock)	14-day trial, see pricing

Viewing is always free without a key. Making changes (create, edit, delete) requires a license: a free Community key, or a trial or paid key. Past your node cap, changes pause until you upgrade, and the dashboard stays fully readable the whole time. License keys are Ed25519-signed and verified offline, so nothing about your cluster is reported anywhere.

Install and first look

The dashboard installs from an OCI Helm chart. Helm 3.8 or newer is required.

helm upgrade --install berth oci://ghcr.io/unishsys/charts/berth \
  --namespace berth --create-namespace

The chart defaults to token authentication and generates a token for you. Read it and reach the UI over a loopback port-forward:

kubectl -n berth get secret berth-secrets -o jsonpath='{.data.AUTH_TOKEN}' | base64 -d ; echo
kubectl -n berth port-forward svc/berth 8081:8081

Open http://localhost:8081/ and you can explore the cluster immediately, no key needed. When you are ready to make changes or expose the dashboard over HTTPS, the full walkthrough is in installing a Kubernetes dashboard with Helm, including token auth, Ingress, and TLS.

One thing to internalize before you expose it: dashboard access is cluster access. Berth acts with its pod’s ServiceAccount permissions, and every authenticated user shares them. Treat a Berth login the way you treat a kubeconfig.

The limits, stated plainly

We would rather you hear this from us than discover it later.

• There is no per-user authorization yet. Everyone who can log in shares the dashboard’s Kubernetes permissions, so Berth today is for trusted cluster administrators.
• There is no native SSO or OIDC, no built-in audit viewer, and no multi-cluster management. These are on the roadmap, not on the box.
• The AI is read-only. Human-approved remediation is a future design, not a shipped feature.
• A live snapshot complements historical monitoring; it does not replace Prometheus or prove long-term behavior.

If any of those are hard requirements for you today, Berth is not there yet, and we will say so.

Where this goes next

Berth came out of running Kubernetes for other teams, so the roadmap follows real operational need: shared team access with real per-user authorization and audit, then historical and multi-cluster investigation, in that order. We are taking design partners, and if you run Kubernetes and want a clearer view of what is happening right now, we would like your input.

If you would rather someone just run the cluster, and Berth, for you, that is our day job: see Kubernetes consulting.

Otherwise, the fastest way to understand Berth is to point it at a cluster. Get a free Community key, install the chart, and ask it what is broken.