Zeaburv0.1.0

On your own cluster, run Kubernetes as projects and services.

Zeabur reads Kubernetes objects directly, shows each namespace as a project with its services, and tells you what is wrong. A change first lists the fields it will write, and applies when you confirm.

Read the Zeabur docs Source on GitHub

All 88 features

No database of its own, and no rights of its own.

RBAC
Your own rights
Every read and write carries the signed-in person's token, and Kubernetes RBAC decides. The chart's ServiceAccount is bound to no Role.
plan
Review, then apply
Review changes lists the objects to create, change or delete. The review is valid for 10 minutes, and if someone changes the same object meanwhile, you review again.
Helm
Hands off other tools' services
Objects managed by Helm, Argo CD or Flux can only be restarted. Other edits are refused with a pointer to the Helm values or the Git repository.

Read from the cluster, write back only when you confirm.

Read
Selectors, Services, HTTPRoutes and volumes tie Deployments, PVCs and Secrets together into services.
Show
A project is a labelled namespace. Services that need attention come first, with their logs and events beside them.
Write
Every write goes through a kube-apiserver dry run first, and only when all pass are they applied. An object someone else changed is not written.

From deploying to fixing

Deploy and configure

See what a change does first

Deploy an image, a Compose file, a Git repository or plain YAML. Every change lists the fields it writes, the services that restart and any data at risk before it applies.

18 features in this group

Checking a change to web before saving: its 2 replicas are replaced one at a time with no downtime, and there is room for it

Network and domains

Domains, certificates, who connects

Adding a domain shows the DNS records to set, and certificates renew on their own. When a URL fails, the connection check says whether DNS, the ingress or the service is at fault.

12 features in this group

Data and backups

Databases with their backups

Pick a database and its operator runs it. Back up to S3 on a schedule, restore into a new database and point services at it once it looks right.

13 features in this group

A PostgreSQL database with one instance. Nothing takes over if it fails, so Zeabur asks you to set up backups.

Find what is wrong

What broke, in plain words

When a service is unhealthy, the page says why, shows the evidence and the next step, without AI. One cause behind several broken services is one item.

13 features in this group

worker has restarted 14 times. The error is in the logs of the run before the restart, and the button to open them is right there.

People and permissions

Passkeys and your own permissions

Members sign in with a passkey, and every request carries their own token for Kubernetes RBAC to judge. Admins have their own accounts, passkey only, with tokens that last 5 minutes.

8 features in this group

Everyday sign-in: a passkey button and Continue with GitHub

Cluster and nodes

The cluster itself, in view

Support dates, version skew and outdated components sit on the overview. Adding, draining and removing nodes each have their steps, and draining honours PodDisruptionBudgets.

8 features in this group

The cluster page: Kubernetes 1.34 reaches end of life, a node is at 91% memory and its disk at 88%.

Every feature

What Zeabur's main branch has today, one line each. Unfinished ones say what is missing.

Deploy and configure18

Deploy an imageName an image and it runs. Reads its ports and works with private registries.
Import Docker ComposePaste compose.yaml and see each setting it changes or skips. Databases can move to an operator.Not finished: Skips build-only services, UDP and host paths
Build from GitRailpack or a Dockerfile, from any folder. Build variables stay out of the image.Not finished: Needs Zeabur Builder
Upload a folderNo Git repository needed. Drop a folder or .zip into the page, or use zeaburctl up, then build.Not finished: Needs Zeabur Builder
Private repos with a GitHub AppCreate a GitHub App for the cluster and members pick a repository. No deploy keys.Not finished: Needs Zeabur Builder
Deploy new commitsChecks the branch every minute, builds new commits and rolls them out.Not finished: Needs Keel
Cron jobsRun a command on a schedule in your time zone. Run now, pause, keep some history.
Create and edit objects with YAMLWrite YAML for any kind the cluster provides, custom resources included.
Roll back to a previous versionThe history lists each version. Compare two, then go back to one.
Review before applyingShows the difference before it is written. If someone changed it first, it refuses and asks you to review again.
Replicas, resources and health checksSet replicas, CPU and memory, and readiness, liveness and startup checks.
Pause or restart a projectStop every service in a project and bring it back, or restart them in turns.
Environment variablesEdit row by row or as .env. Values go into a Secret.
Shared variablesOne set of variables for several services, and a list of who reads them.
Restart on config changeWhen shared config or a secret changes, the services reading it restart.Not finished: Needs Reloader
Strict or compatible securityA strict service runs as non-root, cannot escalate and drops all capabilities.
Add an existing namespaceAny namespace becomes a project in one click. Services that Helm, Argo CD or Flux manage stay theirs.
App templatesPick an app from Zeabur Catalog, fill in the domain and fields, review, then deploy.

Network and domains12

Public domains with HTTPSShows the DNS records to add. Certificates are issued and renewed for you.
Wildcard certificatesDNS-01 with Cloudflare, Route 53, Google Cloud DNS, DigitalOcean or Azure DNS.
Bring your own certificatePaste a PEM. Dates, names and the key are checked first.
Redirects301 or 302 to another domain, keeping the path.Not finished: Traefik only
Password protectionPut a user name and password in front of a domain.Not finished: Traefik only
Maintenance modeA domain shows a maintenance page while the service keeps running.
Custom error pagesYour own HTML when a service answers 502, 503 or 504.Not finished: Traefik only
Gateway APIDomains can be served by an HTTPRoute.
Open a port to the internetOpen a TCP port without a domain, for a database for example.
Connection rulesIsolate a service or allow only some callers. Inbound and outbound are listed apart.
Connection checkWhen a URL fails, checks from inside the cluster and your browser and names the broken step.
Limit inbound and outbound IPsOnly listed IPs open a domain, and a service reaches only listed IPs.Not finished: Domain limits are Traefik only

Data and backups13

DatabasesPostgreSQL, MongoDB, MySQL, MariaDB and Dragonfly, each run by its operator.
Replicated databasesMongoDB and MySQL with 1, 3 or 5 instances.
Connect a databaseTick a service and it gets DATABASE_URL and friends. The password stays in a Secret.
Scheduled backupsDaily or weekly to S3, with each run's result.Not finished: No backup-now for MySQL and Dragonfly
Restore to a new databaseRestore a backup next to the old one, then point services at it.
PostgreSQL WAL archiveWAL goes to S3 continuously.Not finished: Restores pick a backup, not a point in time
Download a dumpGet a pg_dump, mongodump or mysqldump file in the browser.
S3 object storageSeaweedFS and buckets, with the endpoint and keys added to a service.Not finished: Beta, one copy of the data
VolumesMount, pick local or replicated storage, grow, make read-only.
Volume backupsK8up to S3 on a schedule, with retention.Not finished: An admin restores by hand
Cluster backupsVelero for the whole cluster or chosen projects. Restore a namespace from the UI.Not finished: Admins only
Shared S3 destinationsAdd a bucket once for all three kinds of backup. Rotating the key updates every copy.
Browse filesBrowse a container or volume. Upload, download, preview, rename, delete.

Find what is wrong13

What went wrongOne line on the cause and one on what to do, with the evidence and buttons that take you to the fix.
Needs attentionThe home page lists stopped services. Cluster overview lists Kubernetes version, node and component problems.
Missing settingsPoints out missing readiness checks, memory limits and backups, with a button to fix each.
LogsFilter, exclude, see the previous run, download.
Log historyLogs from every replica, replaced ones too.Not finished: Needs Zeabur Proxy and a log store
TerminalA shell in the browser. Adds a debug container when the image has none.
kubectl terminalA short-lived terminal with kubectl and helm, as you.
UsageCPU and memory per replica against limits. History marks out-of-memory kills and restarts.Not finished: Needs metrics-server, and a metrics store for history
EventsKubernetes events such as scheduling, failed probes and out-of-memory kills, newest first.Not finished: Kubernetes keeps about an hour
NotificationsSlack, Discord, Telegram, email, webhooks, ntfy and Gotify, per cluster or project.
AlertsFailed deploys, crash loops, out of memory, failed backups, expiring certificates.
Runtime alerts (Falco)With Falco installed, see its alerts and send them on.
zeaburctl doctorChecks the cluster's versions, components and sign-in from your laptop.

People and permissions8

Passkey sign-inTouch ID, Windows Hello or a security key. No passwords.
GitHub or GoogleMembers can link an account for everyday sign-in.
Invite and removeOne-time setup links for 7 days. Removing someone clears their passkeys and sessions.
Project rolesDeveloper or viewer per project. Viewers see no logs or Secrets.
Separate admin accountsUse a regular account day to day, and sign in to the admin account to change the cluster.
Your own permissionsZeabur has no cluster rights. Kubernetes RBAC decides each request.
Clear refusalsTells a missing permission from a missing component, a policy or a quota.
Passkeys for kubectlkubectl signs in through the browser. Tokens last minutes.

Cluster and nodes8

Cluster componentsSee what is installed. Install from Zeabur, or get Helm, HelmChart, Flux or Argo CD output.
Cluster name, domain and usage historyRename the cluster, choose where usage history comes from, and set the domain for new services.
Sync secrets from a vaultConnect OpenBao, Vault, 1Password or AWS Secrets Manager and sync into Secrets.
Add nodesA short-lived token and one command on the new machine.Not finished: Installer clusters only
Node maintenanceMoves replicas off first, honours PodDisruptionBudgets, lists what cannot move.
Remove nodesDrains, deletes the Node and gives you the cleanup command for the machine.
Node shellA host shell for admins in the browser, logged on the node each time.
Several control planesThree or more servers keep going with one down.Not finished: Added from the host

Install12

Install in the browserFive steps to RKE2, Zeabur Identity and Zeabur, ending with the admin's passkey.
Host checksRoot, clock, swap, ports, disk space and disk encryption before installing.Not finished: Unencrypted disks only warn by default
Memory estimatePick lean, standard or hardened. Too little memory and Install stays off.
Install from a fileplan shows what happens, apply does it, and a rerun resumes.
Try without DNSUses sslip.io names and a local CA.
Hardened defaultsCIS profile, encrypted etcd, an audit policy and baseline network policies.
Into your clusterAlready have one? Install the Helm chart.
Run it on your laptopzeaburctl ui with your kubeconfig. Nothing goes into the cluster.
Signed releasesEvery binary, image and chart has a Sigstore signature and provenance.
zeabur-installer doctorChecks RKE2, components, storage and sign-in after installing.
Your own artifactsPoint the installer at your own catalog, image archives and charts.
Zeabur by GitOpsDeploy Zeabur's chart with Argo CD or Flux.

Leave Zeabur4

Services keep runningProjects and domains are plain Kubernetes objects. Remove Zeabur and sites still answer.
Choose how much goesZeabur alone, with Zeabur Identity, or the whole machine.
Hand over permissionsWhich roles go away and how to take over with your own RBAC.
Backups keep runningOperators, K8up and Velero run them without Zeabur.

What it does, and what it needs

Feature	Scope	Needs in the cluster
Deploy from Git	Build and deploy on every push	Zeabur Builder
Images and Compose	Deploy container images, import Docker Compose services	Nothing extra
Databases	Create, back up and restore	The database's operator, such as CloudNativePG
Object storage	Create S3 object storage and buckets	SeaweedFS operator
Public domains	Domains with HTTPS, maintenance and error pages	An ingress controller or Gateway, and cert-manager
Cluster	Member rights, nodes, alert notifications, cluster backups, components	Admin rights

Start with what you have

All three open the same interface. They differ in where Zeabur runs and whose credential it uses.