1. AI services used
Kubby's AI feature, Ask Kubby, does not include its own AI model and WhiteTR Technology does not run AI services. Ask Kubby works with an AI provider you choose and connect yourself:
- Subscriptions: Claude Code (Anthropic), Codex CLI (OpenAI ChatGPT) or Gemini CLI (Google), installed on your computer and signed in with your own account;
- API connections: an API key for OpenAI, Anthropic, Google Gemini or xAI, or your organisation's OpenAI-compatible AI gateway.
Keys and sign-ins stay on your computer; API keys are kept in Windows Credential Manager. We never receive, manage or relay them.
2. AI features and their purpose
- Questions about your cluster: troubleshooting and explanations based on the live resources, events and logs, for example why a pod restarts or why an Argo CD application is Degraded.
- Proposed changes: Ask Kubby can propose a change to a resource or to Helm values; it is shown as a diff for your approval.
Ask Kubby has no agent mode: it cannot run shell commands, read your files, browse the web or change anything by itself.
3. User control and optionality
Ask Kubby is free like every Kubby feature and is off by default. You turn it on in Preferences → External Tools, choose the provider and model, and can switch providers, pick a different model per chat, or turn it off at any time. While it is off, Kubby starts no AI tool and sends nothing anywhere. Kubby works fully without AI.
4. Topic limitation
Ask Kubby only answers questions about the cluster and DevOps work (Kubernetes, containers, Helm, servers, networks, storage, CI/CD, monitoring and their security). Kubby checks every message on your computer before sending it; an off-topic question is answered by Kubby itself and never reaches the AI provider. The model also receives the same rule as a second line of defence.
5. Data handling and privacy
5.1. When you ask a question, these may be sent from your computer directly to your chosen provider: your question and the chat history, and the cluster context the model reads through Kubby's read-only tools (resource definitions, describe output, events, log lines, Kubby's findings, Helm releases, Argo CD application status).
5.2. Never sent: Secret values, kubeconfigs, tokens, passwords, your Kubby account data and data from clusters other than the one the chat was opened on. Passwords and tokens appearing in YAML, logs or Helm values are masked before anything is sent.
5.3. Ask Kubby traffic does not pass through our servers, and we do not use it to train any model. Whether a provider stores your data or uses it for training depends on that provider's terms for your account; enterprise and API plans often exclude training. Check your provider's terms, or use your organisation's approved AI gateway.
6. Security
- The model reaches clusters only through Kubby's local tool server and only with read tools, within the permissions (RBAC) of your own kubeconfig.
- Nothing is installed in your clusters.
- A proposed change is applied only after you approve it. On protected environments such as PROD you must type the cluster name, and approved changes go to the audit log.
- For resources managed by Argo CD or Helm, Kubby points you to the right path (Git or a Helm upgrade) instead of editing the live object.
7. AI output disclaimer
AI output is guidance, not a guarantee. It can be incomplete or wrong. Review answers and proposed changes before acting, especially on production clusters; you remain responsible for the changes you approve.
8. Changes to this policy
We update this policy when we add providers or features, or when regulations change. The date at the top shows the current version; material changes are announced on the website and, where appropriate, in Kubby.
9. Contact
Questions about AI in Kubby: [email protected] or the contact page. More detail: Ask Kubby documentation.