Skip to content

Lear runs inside your infrastructure, not ours

You should not have to hand production to a stranger to get help with it. Lear lives in your environment, uses your credentials where they already are, and asks before it changes anything that matters.

Start free read-only trial

Your environment

Credentialsstay where they are
used in place
Learruns here
reads, then acts on approval
Your systemsCI, cloud, Kubernetes
Drufiyno route back
Where Lear runs and what it can reach. Credentials never leave your environment.

Five things that hold on every install

  1. 01

    Your credentials stay where they are

    Lear runs inside your own environment and uses credentials where they already live. No hosted third party touches them.

    Runs in
    your cluster or VM
    Credentials
    your secret store, read in place
    Leaves
    nothing, there is no route back to Drufiy
  2. 02

    Ask is the default

    Lear has five permission modes and ships on ask. In every mode, even bypass, an action in the approval tier waits for a person, and an action in the never tier is refused outright.

    1. read-only
    2. ask
    3. auto-safe
    4. environment-scoped
    5. bypass

    approval tier always waits for a person

  3. 03

    Every action goes on the record

    Each proposed and executed action is appended to an audit trail, with who approved it and when. Entries are added, not rewritten.

    An example audit trail
    14:05:20Plan proposedby Lear
    14:06:02Plan approvedby you
    14:06:09Rollback appliedby Lear
    14:11:09Recovery verifiedby Lear

    Append-only audit trail

  4. 04

    Dry-run a plan before it is real

    See exactly what a plan would touch before you approve it.

    dry run restart checkout-api
would restart 3 pods
would drain 0 nodes

    nothing changed

  5. 05

    It stops itself when something loops

    A circuit breaker caps how often Lear can act on one resource. By default, after five actions in sixty seconds it stops acting on that resource and hands it to you. It stays open until a person resets it.

    1. 03:12:04 restart worker-7
    2. 03:12:19 restart worker-7
    3. 03:12:33 restart worker-7
    4. 03:12:48 restart worker-7
    5. 03:12:59 restart worker-7
    6. Breaker open on worker-7. Handed to you.

    5 actions per resource per 60 s, by default

What we deliberately leave to people

  • Changes to production data

    Lear does not change production databases or customer data on its own.

  • Network and load-balancer changes

    Routing and traffic stay in your hands, on purpose.