Skip to main content

Plans and Feature Scope

Is a menu described in this guide missing from your screen? What KIOPS provides depends on how it was installed (SaaS or on-premises) and on your license plan. This page tells you what your plan includes.

The lists on this page are generated from KIOPS capability catalog v4 (synced 2026-09-21). When the product changes, the catalog changes first and this page follows.

1. Check your plan​

Open the Plan menu in the top header (path /plan). It lists included / not included per sidebar page.

On-premises Basic does not provide this screen. It is absent from the header menu, and the /plan address returns a 404 page. In a Basic environment, check the following instead.

2. Plans at a glance​

Licenses are issued under three plans.

PlanInstalled asFeature limits
PlatformSaaS (kiops.cloud)None. What you see is decided by your permissions alone
On-premises EnterpriseCustomer infrastructureNone. All three purchasable options are included
On-premises BasicCustomer infrastructureMany features are excluded. The list below applies

On-premises Basic is the only plan whose features are limited. Every "excluded" list on this page is about on-premises Basic.

Structural differences between SaaS and on-premises​

Independently of the plan, the way KIOPS is installed creates differences of its own.

  • The Organization concept: on SaaS many organizations share one platform, so there is an [Organization Management] menu and organization-level signup approval. On-premises has a single organization, so the concept never appears on screen and the team becomes the isolation unit.
  • Who the PlatformAdmin is: on SaaS, the KIOPS operator. On-premises, the support account of the vendor that performed the installation, while the customer's top-level administrator is the organization Manager.
  • System administrator screens: on-premises exposes only the screens needed for remote diagnosis (see below).

3. The three purchasable options​

These three features are bought separately, per page.

FeatureMenuOn-prem BasicOn-prem EnterpriseSaaS (Platform)
VPN Management[VPN Management]OptionalIncludedIncluded
Database Management[Database Management]OptionalIncludedIncluded
Audit Log[Audit Log]OptionalIncludedIncluded

On-premises Basic enables only what was selected at issuance. A feature that was not purchased does not appear in the menu at all.

4. Features excluded on on-premises Basic​

None of these restrictions apply to on-premises Enterprise or to SaaS.

On-premises Basic excludes 50 items. The text after each item is where that function lives on screen.

Dashboard​

  • Runtime and server/node detail view — Dashboard > Service detail > Runtime environment card · Server/node card (hidden in the UI only)

Service Management​

  • Deploy automatically after a successful build — Service Management > Run build dialog > Run options
  • Generate and commit build files automatically — Build wizard
  • Enter the build version by hand — Service Management > Run build dialog > Version per build target
  • Choose a build resource profile — Service Management > Run build dialog · Auto CI settings > Profile per build target
  • Check the domain's HTTP response — Service Management > Operate > Domain settings > Domain actions
  • Pause a domain — Service Management > Operate > Domain settings > Domain actions
  • Issue a domain SSL certificate (Let's Encrypt) — Service Management > Operate > Domain settings > Domain actions
  • Edit the K8s deployment manifest (modify/regenerate) — Service Management > Run deployment > K8s deployment YAML review > right of the tab bar
  • Create/delete autoscaling (HPA) — Service Management > Operate > Workloads > Autoscaling
  • One-click build-then-deploy button — Service Management list > [Build/Deploy] (hidden in the UI only)
  • Config/Secret tab — Service operations > Config/Secret tab (hidden in the UI only)
  • Choose the connection path (via VPN / direct SSH) — Service operations > connection bar > [Change connection method] (hidden in the UI only)
  • Command execution (terminal) — Service operations > Command execution tab
  • Create GitLab users automatically — Git integration
  • Register the same repository more than once, per branch — Service Management > Register/create service · repository group in the list
  • Bulk-delete pending pods — Service operations > Pod list (hidden in the UI only)
  • Resources-by-kind tab — Service operations > Resources tab
  • Favorites, collapse, screen guide, copy link — Auxiliary controls on list and detail screens
  • List search, filter, sort — Toolbar at the top of list screens (Dashboard, Service Management, Runtime Environment, Device Management, VPN Management, Team Management, User Management), the severity filter and search box in security results, and the audit log query fields (hidden in the UI only)

Runtime Environment​

  • Stop/delete containers — Service operations > Container list · Docker detail dialog > Runtime environment tab > Container list
  • Renew certificates — Runtime detail > Certificate management
  • Kubernetes version upgrade check — Runtime detail > Overview > Version upgrade check
  • Kubernetes end-of-life (EOL) indicator — Runtime detail > Overview — EOL warning banner and the EOL tag next to the Kubernetes version
  • Detach a node (drain/cordon/detach) — Node list tab > Detach node
  • Change node labels/taints — Node list tab > Node labels/taints
  • Create/delete Kubernetes RBAC — Permissions tab
  • Kubernetes permissions tab — Runtime detail > Permissions tab · permission badge right of the tab bar
  • Start/restart containers (Runtime environment tab) — Docker detail dialog > Runtime environment tab > container list [Start]/[Restart] (bulk button and per-row action menu) (hidden in the UI only)
  • Install a new runtime — Node list tab > Add node
  • Disk/resource prune — Runtime environment tab

Device Management​

  • SSH key authentication — SSH credential entry > Authentication method [SSH key] (hidden in the UI only)
  • Remote automated installation (runtimes, backup tools) — Runs during runtime (K8s/Docker) installation and backup tool (Velero/MinIO/SeaweedFS) installation

Backup Management​

  • Backup/restore excluding data — Backup settings > Include data (PVC) · Restore settings > Restore PVC data · Restore volume data
  • Control plane (etcd) backup/restore — Control plane backup
  • Install the etcd backup tool — Control plane backup
  • Restore only part of a backup — Restore settings > Namespaces to restore · Containers to restore
  • Install/remove Velero — Backup Management > Install
  • Install object storage directly — Backup storage

Security Analysis​

  • One-click scan of all deployed images — Security Analysis > Image analysis (SCA) · SBOM/License > [Scan deployed images] (hidden in the UI only)
  • Change the resolution status of a vulnerability — Security Analysis > each scan tab > checkbox on a finding · [Resolved/False positive/Deferred]
  • Assessment completeness box — Security Analysis > Overview > Assessment completeness (hidden in the UI only)
  • Latest-build tag indicator — Security Analysis > status badge in the image list of Image analysis (SCA) and SBOM/License (hidden in the UI only)
  • Type the DAST target URL by hand — Security Analysis > Domain analysis (DAST) > [Scan] dialog > URL input method (hidden in the UI only)
  • Download results (audit log, SBOM, issued documents) — Audit Log > Export · Security Analysis > SBOM and document issuance
  • Security risk grade/score display and its scoring settings — Dashboard risk column · service card score · Security Analysis overview · risk scoring settings
  • Helper text on scan tabs — Security Analysis > the ⓘ icon at the head of each scan tab (hidden in the UI only)

Audit Log​

  • Narrow the audit log by organization — Audit Log > Organization query field and list column
  • Search by trace number — Audit Log > Request ID query field · Trace ID row in the log detail

Guide​

  • Guide screen — Sidebar > Guide

Items marked (hidden in the UI only) share a server endpoint with another feature that is inside the provided scope, so the server is not closed — only the entry point in the UI is removed. What you see is the same either way: that button or tab is not on the screen.

On-premises Basic has no in-app guide

The Guide screen in the list above is excluded, so this guide and its chatbot cannot be opened from inside KIOPS. On-premises Basic users should open this site directly in a browser.

5. Values that become fewer​

These items remain available, but there are fewer values to choose from.

  • Service connection method — Service operations > Domain settings
    • Selectable: External Nginx · DNS only
    • Excluded: Kubernetes Ingress · NodePort · LoadBalancer · Project Nginx
  • Service source type — Register/create service > Source selection
    • Selectable: GitLab
    • Excluded: GitHub · Docker Hub
  • Image registry type — Service Management > Build/deploy presets > Registry
    • Selectable: Harbor
    • Excluded: Docker Hub
  • Runtime type — Runtime Environment > Register/import runtime
    • Selectable: Kubernetes · Docker
    • Excluded: Podman
  • DAST scan depth — Security Analysis > Domain analysis (DAST) > [Scan] dialog
    • Selectable: Baseline (fast, major findings only)
    • Excluded: Full (slow, all findings) · API (for REST APIs)
  • Backup storage product — Backup Management > Storage management > [Add storage] > Storage type
    • Selectable: SeaweedFS
    • Excluded: MinIO
  • Backup type — Create backup > Backup type
    • Selectable: Volumes only
    • Excluded: Full · Config only · Compose file only
  • Container backup scope — Create backup > Backup scope
    • Selectable: Compose project
    • Excluded: Selected containers · All containers
  • Resource restore scope — Backup list > Restore > Resource restore scope
    • Selectable: All resources
    • Excluded: Exclude PV/PVC · App resources only · Custom selection

6. Team limit​

On-premises Basic can create up to 5 teams. On-premises Enterprise and SaaS have no limit. Once the limit is reached, team creation is rejected (Team Management).

7. Excluded features do not appear on screen​

A feature that is not in your plan is not shown in a locked state. It disappears, as though it had never been there.

  • The sidebar menu disappears. No padlock icon, no dimmed entry. If a group has no remaining items, the whole group disappears.
  • Typing the address gives you a 404 page. There is no "not included in your current plan" message. The sidebar and header are gone too — it is exactly the screen you get from a mistyped address.
  • Buttons and tabs inside a screen are not shown either. They are not left disabled. If a button described in this guide is not on your screen, your plan does not provide it.
  • When only one value remains, the choice is skipped. The selection screen disappears and that value is applied.

This is intended behaviour. It also means you cannot learn what is excluded from the screen — use this page and your license contract.

Four reasons a feature may be missing​

  • How it was installed — SaaS or on-premises. Organization management and the system administrator screens differ according to the product specification.
  • Purchasable options — features bought separately, per page: VPN Management, Database Management, Audit Log.
  • Plan-based feature limits — what on-premises Basic excludes. This reaches beyond screens to tabs, buttons, and selectable values.
  • Permissions — separate from the three above. The license decides whether the feature exists in this environment; permissions decide whether you may use it.

For a screen to appear it must be included in the license and permitted for your account at the same time. If either blocks it, you will not see it.

The list reflects standard issuance

It can be adjusted per contract at issuance — excluding further items, or opening a normally excluded item as an exception.

8. When a feature is missing — how to diagnose​

A missing menu can be a license matter or a permission matter. Both remove the menu from the sidebar, so check in this order.

  1. Open the screen's address directly. Type the path given on the guide page (for example /settings/vpn) into the address bar.
    • A 404 page → a license matter. This environment does not have the feature.
    • An "access denied" notice → a permission matter. The feature exists; your account lacks the permission.
  2. If it is a permission matter, check which permission you need in User Permission Management, then use the access request card on the [Dashboard]. Features that were not purchased do not appear in that card's request list.
  3. If it is a license matter, look the item up in The three purchasable options or the exclusion list above. A purchasable option opens with an additional purchase; other limits open with a contract adjustment (Contact).
  4. If the menu is there but a specific button or tab is not, it is a plan-based limit. Look up that screen in the list.
  5. If organization-related menus are missing, you are on an on-premises installation and this is expected. Manage by team instead (Team Management).

9. System administrator screens​

The System Administrator sidebar group is platform-administrator only. Customer accounts (organization Manager and below) never see it in either installation, so the difference below concerns the vendor support account alone.

  • SaaS: all 20 screens
  • On-premises: only the 8 needed for remote diagnosis

The screens available on-premises:

  • System Health: health, pods, logs — the starting point of remote diagnosis
  • RabbitMQ Monitoring: queue backlog and lost consumers
  • API Monitoring: slow APIs and error rates
  • Build Queue: checking and clearing build backlog
  • Security Scan Queue: a single queue, so one stuck item stops everything. Cancelling is the recovery path.
  • Security Score Policy: adjusting grading criteria without a redeploy
  • License Management: the renewal path (never excluded under any plan)
  • Install Secrets: a read-only screen used to verify installation (never excluded under any plan)

The remaining 12 screens, which carry customer personal data or audit risk (DB explorer, activity analytics, deployment history, and so on), are not exposed on-premises.

10. License states​

A license has four states based on its expiry. A perpetual license with no expiry date is always active.

  • Active: operates without restriction.
  • Warning: a banner appears 30 days before expiry; features continue to work normally.
  • Grace: after expiry, a strong warning is shown for the contracted grace period, but features are retained.
  • ReadOnly: once the grace period passes, only viewing is possible and all modifying operations are blocked. A missing or invalid license also lands in this state.
In ReadOnly, deployment, backup, and restore are all blocked

Renew before the grace period begins, as soon as you see the expiry warning banner. In ReadOnly, even the changes needed to respond to an incident are blocked. The platform administrator performs renewal from [System Administrator > License Management].

If the server clock appears to have been set backwards, an additional warning banner is shown. Nothing is locked, but check the server's time synchronization.