Watch your cluster from the Kubernetes API — not a Prometheus stack.
Bayqus reads your cluster the way kubectl does: it talks directly to the Kubernetes API and reacts to what's actually happening — a pod OOMKilled, a deployment stuck below its desired replicas, a node gone NotReady. One manifest deploys a single read-only agent; its findings ride the same outbound-only channel as the rest of your monitoring. No Prometheus, no scraping, no inbound port.
One manifest. One read-only agent. One device.
You deploy a single agent into its own namespace with one kubectl apply. It enrolls the whole cluster as a single device — identified by the UID of the kube-system namespace, so a pod restart never mints a duplicate — and opens one outbound TLS connection back to Bayqus. There is nothing to scrape and nothing to expose: the agent uses a client-go informer to watch the Kubernetes API in real time and pushes findings out the same channel your servers and PCs use.
kubectl apply
One manifest creates a Namespace, a read-only ClusterRole, the token Secret and a single-replica Deployment.
Enrolls
The agent registers the cluster as one device (kube-system UID = stable ID) and connects outbound over TLS 8884.
Watches
A shared informer streams Events, Nodes, Pods and workloads; steady-state conditions are re-checked every 30s.
Alerts
Problems are de-duplicated and pushed to your existing alert channels; recovery clears them.
The failures that page you, straight from the API.
The agent watches Warning events plus live object state, maps each finding to a severity, and de-duplicates so a flapping pod doesn't spam you. These severities are the defaults — each account can override the severity of any finding, or suppress a kind entirely, under Alerts → Rules → Event Alerts.
| Band | Means | Typical findings |
|---|---|---|
| Critical | Wake someone up | OOMKilled, CrashLoopBackOff, NodeNotReady, FailedCreatePodSandBox. |
| High | Look today | ImagePullBackOff, a Deployment/StatefulSet/DaemonSet sustained below its desired replicas, Evicted pods, node DiskPressure / MemoryPressure / PIDPressure. |
| Warn | Good to know | Unhealthy (failing probes), FailedMount, pods stuck Pending past the threshold. |
| Info | Context | Other Warning events, plus optional "recovered" notices, kept for history and correlation. |
One kubectl apply. Scope by namespace. Alerts where you already get them.
kubectl apply creates the Namespace, ServiceAccount, a read-only ClusterRole and binding, the enrollment-token Secret and a single Deployment (1 replica). Paste the token, apply, done.(kind, namespace, object) and only re-sent when the count climbs, so a CrashLoop doesn't flood you.The things people ask first.
Q. Do I need Prometheus or a metrics stack?
No. The cluster agent talks directly to the Kubernetes API with a client-go informer — it watches Events, Nodes, Pods and workloads and reacts to what actually happens. There's no Prometheus, no Grafana and no scrape config to maintain. Cluster CPU/RAM come from metrics-server when present, and disk from each node's kubelet stats.
Q. What access does it need?
A least-privilege, read-only ClusterRole: get/list/watch on events, nodes, pods, namespaces and apps workloads, plus node metrics and kubelet stats for CPU, RAM and disk. Nothing else — no write access, no exec into pods, and no reading your Secrets.
Q. Does it open any inbound ports?
No. A single pod opens one outbound TLS connection and pushes findings out over it. Nothing inbound is exposed, so a cluster behind NAT or a firewall is monitored exactly like everything else in Bayqus — the agent reaches out, nothing reaches in.
Q. Will a crash-looping pod flood my alerts?
No. Findings are de-duplicated per (kind, namespace, object): a new problem sends immediately, then only re-sends once per window or when its count climbs. Stale events replayed by the informer are age-gated out, and you get per-account rules to override a finding's severity or suppress a kind entirely.
Q. How is it priced?
A whole cluster enrolls as a single device — it counts as one device against your plan's limit, with no per-node or per-pod charge, so it fits any paid plan (Team at $5.99/mo and up). Larger fleets and long metric retention are covered by the Business tier.
More on how it fits together
Point Bayqus at your cluster with one kubectl apply.
A single read-only agent, straight from the Kubernetes API — and the failures that page you land in the alert channels you already use.
Start free Talk to usVerified against the cluster-agent contract (docs/cluster-agent.md · cluster-agent/collector.go) — 2026-08-01