About

Decide what can change your applications, and when.

Kubernetes RBAC decides who may change something, not when. Telark adds the when: it freezes the apps that matter during risky windows, checks that the freeze holds, records every change, and helps you find out why an app broke. It is built for platform and SRE teams running shared clusters for several application teams.

What it does today

Protection plans scoped to applications or namespaces, in audit or enforce mode, for a set time window, with exclusions.
Approvals, kinds, environments and tags, per-action permissions and a downloadable report for every plan.
Nine built-in policy templates, enforced at admission by Kyverno.
Plan health checked against the live cluster, drift repair and a list of admission decisions.
Field-level change history for every application, with snapshots and rollback.
Insights: incident cards and a setup review from deterministic rules, worded by a local open-weight model. No data leaves the cluster.
Passkeys, Google SSO and roles per area with deny rules.

What it does not do

Manage several clusters. Telark runs in one cluster.
Run as a hosted service. It is self-hosted by license and by design.
Change your cluster on its own. Insights is read-only: it suggests, you decide.

Get in touch

Telark is in early access, and its API (telark.io/v1alpha1) may change before 1.0. Open an issue or start a discussion at https://github.com/telark/telark, or email contact@telark.io.