CI/CD that runs in your own Kubernetes cluster.
CI/CD orchestration that runs every execution in ephemeral pods inside your own Kubernetes cluster. Pipelines over GitHub repositories, modelled as stages, jobs and steps — with gates, scoped secrets and versioned builds.
Orchestration without the hosting
Hephaestus is the control plane: it decides what runs, where and when. The compute, the network and the data stay in your cluster.
Your cluster, your compute
Every stage runs as an ephemeral pod in a Kubernetes cluster you connect with a kubeconfig. Hephaestus orchestrates; it never hosts your builds.
Stages, jobs and steps
Model pipelines as stages with needs, jobs inside them and shell, PowerShell or Python steps. Pass artifacts and outputs along the graph.
Gates that wait for people
Approval gates with listed approvers and no self-approval by default, plus wait gates that hold one continuous execution across the pull-request merge.
Scoped, write-only secrets
Secrets are encrypted at rest, masked in logs and resolved most-specific-wins across account, project and repository — per environment.
GitHub webhooks, verified
Onboard a repository and Hephaestus registers its webhook. Deliveries are HMAC-checked on the raw body and idempotent.
Versioned templates
Share pipeline templates across a project, pinned as template@version. Published versions are immutable, so a run is always reproducible.
From kubeconfig to first run
Four steps, all in the browser.
Connect
Link GitHub and add a kubeconfig for the cluster your pipelines run in.
Create a project
Pick the target cluster, image registry and builder policy; dev, stg and prd come ready.
Onboard repositories
Choose repositories from your connection; webhooks are registered for you.
Run pipelines
Pushes, tags and pull requests start executions you can follow stage by stage.
Built on a few firm rules
Nothing leaves your cluster by accident
Kubeconfigs and SCM tokens are never mounted into pods; stages see only what they declare.
Every run is reproducible
An execution stores the expanded definition it ran, including pinned template versions.
Least privilege by default
Privileged builders, node-local caches and self-approval are off until an Owner turns them on.
Questions
Where do my builds actually run?
In your own Kubernetes cluster. Each stage is an ephemeral pod created through the kubeconfig you connect; Hephaestus keeps only the orchestration state, logs and artifacts.
Which source-control providers are supported?
GitHub today, with Azure DevOps following on the same normalised event model (pull request, push and tag).
Can I build container images without privileged pods?
Yes. Image builds use a rootless BuildKit sidecar by default. Privileged Docker-in-Docker is available only when a project Owner opts in.
How are secrets protected?
Values are encrypted on save and never shown again. A stage receives only the secrets it declares, and connection credentials such as kubeconfigs are never injected into pods.
How are builds versioned?
Successful CI builds get a semantic version per repository (1.0.0, then 1.0.1, …), recorded on the execution and used as the image tag.
Run your next pipeline in your own cluster
Create an account, connect a cluster and onboard a repository.
Get started