Serversfrazer.ai

Use the cloud you already pay for.
Instances join. Clusters attach.

Linux instances in your cloud accounts join Frazer as dedicated nodes, like any server: with frazer servers add over SSH, or the install command in their cloud-init. Clusters you already run attach through an outbound agent, and you choose how much Frazer does: watch them, work in them, or deliver to them from Git.

Attach a cluster Read the docs

Attach an existing cluster1Configure2Prerequisites3Plan4Validate5Apply

Nameacme-legacyShow in projectacme-production

ModeChange any time; upgrades stay with you

Observed

See it in Frazer

Frazer can: Inventory, health, metrics, logs, cost, MCP read
Installs: frazer-clusterlet
Permissions: Read-only ClusterRole, no Secrets
Workloads: Yours, untouched
Price: Free

ConnectedRecommended

Work with it from Frazer

Frazer can: + console and kubectl through Frazer Link
Installs: Same agent, connect on
Permissions: Impersonation; your RBAC decides
Workloads: Yours, untouched
Price: Free

Managed

Deliver to it from Git

Frazer can: + environments, policies, secrets
Installs: + Frazer GitOps, or adopt yours
Permissions: GitOps per namespace or per cluster
Workloads: From your Git, through Frazer GitOps
Price: $0.75 per node vCPU / month

Install the agentOutbound only · no inbound ports or load balancer

# run with a kubeconfig for acme-legacy · Helm 3.14 or newer
helm install frazer-clusterlet oci://registry.frazer.ai/charts/frazer-clusterlet \
  --namespace frazer-system --create-namespace \
  --set mode=connected --set link.location=us-virginia1 \
  --set token=fct_••••••••••••7Q2c

Single use · expires in 58 min · only makes the cluster appear as pending

Waiting for acceptanceMatch the code printed by helm status

ClusterDetectedAgent fingerprintCode

acme-legacyKubernetes 1.33 · 14 nodesSHA256:9f2c…a71eH4K-2MXAcceptReject

After you accept

✓AgentConnected · Link us-virginia1

…Inventory14 nodes · 38 namespaces

–TelemetryMetrics, logs to Acme

–kubectlThrough Frazer, your RBAC

!RBACBind groups · sample YAML

–GitOpsNot installed

Detach

Delete the namespace frazer-system, or use Detach in Frazer. Nothing else in the cluster is touched; your workloads keep running.

Impersonation. When lena runs kubectl through Frazer, the agent forwards the request as lena@acme.example with her Frazer groups. The cluster’s own RBAC allows or denies it and writes it to its audit log. Frazer never gets cluster-admin.

Attach a Kubernetes cluster you already runproduct UI, demo organization

01 · How it worksFig. 1

Two ways in.
Both dial out.

Fig. 1Instances and an existing cluster, connected from inside your cloud account

02 · Attached clusters

Choose how much Frazer does.
Change it any time.

An attached cluster stays yours: your cloud or your team upgrades it, and nothing inside changes until you pick a mode that changes it. Registration is double opt-in; detaching removes the agent and nothing else.

The three modes of an attached cluster
Mode	What Frazer can do	Rights in the cluster	Price
Observed	Inventory, health, metrics, logs, cost, MCP read	Read-only ClusterRole, no Secrets	Free
Connected	+ console and kubectl through Frazer Link	Impersonation; your RBAC decides	Free
Managed	+ environments, policies, secrets	GitOps per namespace or per cluster	$0.75 per node vCPU / month

03 · Instances

An instance is a server.
With your OS on it.

Add an instance with frazer servers add, or put the install command in its cloud-init, and it joins like any server you bring: a checked code, a pool, a site. Frazer builds clusters on it and never touches your account.

RoleDedicated node: the whole instance goes to one cluster. No VMs on an OS Frazer does not control.

Operating systemYours. You patch it; the agent reports the patch level.

IdentityA machine key made on the instance, sealed in its TPM when it has one.

Leavingsudo frazer-nodelet detach works even when Frazer is down. Billing stops.

$ frazer servers add ubuntu@203.0.113.24 --site cloud-a
✓ SSH          ubuntu@203.0.113.24 · host key known
✓ Join token   cloud-a · single use · for this run only
✓ Agent        signed · checksum verified
✓ Preflight    kernel · cgroups v2 · clock · swap · disk · 443
✓ Machine key  generated on the server · TPM-sealed when present
→ Fingerprint  sha256:4b7e…19d0
✓ Code M3T-8QX read over SSH · accepted by you
  inspecting … available

$ curl -fsSL https://get.frazer.ai/node | sudo sh -s -- \
    --token <join-token> --site cloud-a
✓ Script and agent signed · checksum verified
✓ Preflight   kernel · cgroups v2 · clock · swap · disk · 443
✓ Machine key generated here · TPM-sealed when present
→ Fingerprint sha256:4b7e…19d0
→ Code        M3T-8QX   match it in the console
  pending · no credentials until someone accepts

$ sudo frazer-nodelet detach
  Works even when Frazer is unreachable
✓ Drained · left the cluster
✓ Frazer components and credentials removed
? Disks: keep · reset state · crypto-erase › keep
  detached · billing stopped · record kept for audit

04 · What you get

Your cloud, our control plane.
Your keys stay home.

One command per instance
The signed script checks its checksum, runs preflight and prints a code you match in the console.
Nothing is wiped
The agent installs on the system you already run, and leaves your OS to you.
Outbound only
The agents dial out on 443. No inbound port, no load balancer in front of your cluster.
No cloud keys
Frazer needs no access key to your cloud account: instances use a join token, clusters a single-use agent token.
Double opt-in
An attached cluster stays pending until you match its code and accept it.
Your RBAC decides
In Connected mode each kubectl request impersonates the Frazer user; the cluster’s own RBAC allows it and logs it.
GitOps when you want it
Managed mode installs Frazer GitOps, or adopts the GitOps you run, and delivers your environments from Git.
Detach cleanly
Detach removes the agent’s namespace and nothing else; your workloads keep running.

05 · Controls

Your RBAC still decides.
Frazer forwards, it does not override.

Who may do what

Servers admin: Creates join tokens and accepts or rejects each instance by its code.
Project admin: Attaches a cluster to a project, accepts it and picks its mode.
Your cluster’s RBAC: Decides every kubectl request that comes through Frazer, for people and agents alike.
Frazer: Reads what the mode allows. No Secrets in Observed mode, and no stored cluster-admin credential.

What is logged

Join tokens, accepts and rejects, with the fingerprint and the token used
The attach, the mode and every change of mode
kubectl through Frazer: in Frazer’s audit log and in the cluster’s own
Detach, from the console or from the instance itself

At the cap

Instances: dedicated node only; no VMs on an OS Frazer does not control
Observed: a read-only role with no access to Secrets
Tokens: single use or limited uses, short-lived, revocable; they only make a machine or cluster appear as pending
Budget cap: refuses new billable items, such as accepting more instances; what already runs never stops

06 · Pricing

Pay only when Frazer manages.
Watching and connecting are free.

Observed and connected clusters cost nothing. Managed clusters pay per node vCPU, with no minimum and a ceiling per node. Instances that join pay the server fee, like any server you bring. Your cloud keeps billing you for the machines.

See every price

ObservedFree · 10,000 series and 10 GB logs a month included

ConnectedFree

Managed$0.75 per node vCPU / month · no minimum, max $150 per node

Instances$1.50 per physical core / month · min $15, max $150 per server · first server ≤ 16 cores free

Your cloudThe instances and the cluster, as today

Questions

Your cloud accounts, answered.

Which clouds work?

Any cloud where you run a supported Linux instance with outbound access on 443: Ubuntu 22.04 or 24.04, Debian 12 or 13, Rocky Linux or RHEL 9 or 10. Any conformant Kubernetes cluster can attach, whether your cloud runs it or you do.

Can Frazer run VMs or devboxes on my instances?

No. An instance joins as a dedicated node, and Frazer does not run VMs on an operating system it does not control. Your clusters run on it; VMs and devboxes need servers whose OS Frazer installs.

Does attaching change my cluster?

Observed installs one agent with a read-only role and no access to Secrets. Connected adds the console and kubectl through Frazer Link, decided by your own RBAC. Managed adds Frazer GitOps, or adopts the GitOps you run. Upgrades stay with you or your cloud.

What can Frazer do in Connected mode?

Forward requests, not act on its own. When a person runs kubectl through Frazer, the agent impersonates that person and their Frazer groups, and the cluster’s RBAC allows or denies the request. Frazer never holds a cluster-admin credential.

How do I leave?

Detach a cluster in Frazer or delete its frazer-system namespace; nothing else is touched and your workloads keep running. Detach an instance with sudo frazer-nodelet detach, which works even when Frazer is down.

Does Frazer need my cloud credentials?

No. Instances join with a join token and clusters with a single-use agent token. Frazer needs no access key for your cloud account to do either.

Attach what you run.
Detach any time.

Attach a cluster Read the docs

Use the cloud you already pay for.Instances join. Clusters attach.

Two ways in.Both dial out.

Choose how much Frazer does.Change it any time.

An instance is a server.With your OS on it.

Your cloud, our control plane.Your keys stay home.

One command per instance

Nothing is wiped

Outbound only

No cloud keys

Double opt-in

Your RBAC decides

GitOps when you want it

Detach cleanly

Your RBAC still decides.Frazer forwards, it does not override.