Agent Permissions & Security Posture

What the agent's Kubernetes ServiceAccount can do, what it can't, and why.

What the DataAgent agent’s Kubernetes ServiceAccount can do in your cluster, what it can’t, and why. Companion to the Agent Install Guide.

TL;DR

Read-only on your workloads — the agent cannot create, modify, or delete any of your Deployments, Pods, Services, or configurations.
Your secrets stay in your cluster on the default path — K8sGPT runs inside the agent pod, and the default analysis path does not send workload contents (Secrets, ConfigMaps, or other resource bodies) to the DataAgent platform.
No AWS IAM, no cloud-provider access — the agent talks only to the DataAgent platform and to ghcr.io for image pulls. Nothing else.
You can verify and lock down further — audit live permissions with the command below; disable analyzers or apply quotas to narrow the surface.

What the agent does NOT do

Modify your workloads — no create, update, delete, or patch verbs on Deployments, Pods, Services, ConfigMaps, or any workload object.
Send workload contents (Secrets, ConfigMaps, or other resource bodies) to the DataAgent platform on the default analysis path. Default-mode analysis emits textual findings only; raw values are not forwarded.
Require any AWS IAM role, IRSA, or EKS Pod Identity configuration.
Reach into your cloud provider’s APIs — IAM, storage, networking, billing.
Make any outbound connection other than tunnel.data-agent.co:443 (mTLS-authenticated) and ghcr.io:443 (image pulls).

Verify the live permissions

helm registry login ghcr.io                    # required while the chart is private
helm template dataagent oci://ghcr.io/data-agent-co/dataagent-chart \
  | grep -B2 -A40 'kind: ClusterRole\|kind: Role'

The helm registry login step is required only while the chart is distributed as a private OCI artefact; it will go away when the chart moves to public, anonymous pull.

The chart installs one namespace-scoped Role and up to three ClusterRoles — two of which are gated behind optional features and can be disabled at install time.

Why the agent reads Secrets and ConfigMaps

The default install gives the agent cluster-wide read access to Secrets and ConfigMaps. Here’s why, what the agent does with the contents, and how to narrow the surface if your posture requires it.

Why — failure diagnosis. K8sGPT and the topology analyzer identify pods stuck on a missing or unreadable Secret, ConfigMaps with the wrong key mounted, or admission webhooks rejecting deployments. None of these diagnoses are possible without reading what’s mounted.

What the agent does with the contents:

Reads only. There are no write verbs anywhere in the analyzer ClusterRoles.
In-cluster processing. Values are scanned by K8sGPT inside the agent pod, never exported raw.
The default analysis path does not forward workload contents. K8sGPT runs locally inside the agent pod, emitting textual findings (e.g. “Secret db-creds mounted by api-server is missing key password”). The default path operates without the LLM backend, so the Secret’s value is not transmitted to the DataAgent platform — note this is a property of the default path, not an in-pod redaction boundary.

To narrow the surface, disable both analyzers:

--set k8sgpt.enabled=false --set topologyAnalyzer.enabled=false

The agent continues to function but no longer produces K8sGPT- or topology-based signals.

Namespace-scoped — `dataagent` namespace

Resource	Verbs	Why
`secrets`	`create` (any in the `dataagent` namespace)	Write the agent’s mTLS certificate Secret when it doesn’t already exist. The verb cannot be name-scoped because the object doesn’t exist at create time.
`secrets`	`get`, `update`, `delete` on `dataagent-mtls-credentials` only	Read the agent’s own certificate on connect, update it on rotation, delete it on stale-credential cleanup. The agent has no access to any other Secret in this namespace.

Cluster-scoped — always created

These rules are created whenever the chart’s rbac.create is true (the default), independent of which analyzers are enabled. They power Prometheus auto-discovery.

Resource	Verbs	Why
core/`services`	`list`	Scan well-known namespaces for a Prometheus Service when the Operator CRD isn’t present.
`apiextensions.k8s.io`/`customresourcedefinitions`	`get` (cluster-wide on all CRDs)	Detect whether the Prometheus Operator is installed. Denied gracefully — the agent falls back to Service scan. The rule is not name-restricted; the chart grants `get` cluster-wide on all CRDs, but the agent only reads the `prometheuses` CRD by name.
`monitoring.coreos.com`/`prometheuses`	`list`	When the Operator CRD is present, find Prometheus CR instances to derive the Service endpoint.

The agent never writes any of the resources above, and it does not read Prometheus contents over the Kubernetes API — it talks plain HTTP to the discovered Service endpoint.

Cluster-scoped — metrics collector (optional)

Created only when metricsCollector.enabled=true (the default). Disable with --set metricsCollector.enabled=false to remove every rule below.

Resource	Verbs	Why
core/`pods`, `nodes`, `events`	`get`, `list`	Resource inventory and event correlation for SRE golden signals (latency, errors, traffic, saturation).
apps/`deployments`, `statefulsets`, `daemonsets`	`get`, `list`	Workload-level signal attribution — link metrics back to the controller that owns the pod.
`metrics.k8s.io`/`pods`, `nodes`	`get`, `list`	Read CPU/memory utilisation from metrics-server. The agent fails gracefully if metrics-server is unavailable.

Cluster-scoped — K8sGPT + topology analyzer (optional)

Created when either k8sgpt.enabled=true or topologyAnalyzer.enabled=true (both default to true). See Why the agent reads Secrets and ConfigMaps above for the rationale on the wider read scope.

Resource	Verbs	Why
core/`pods`, `pods/log`, `pods/status`, `events`, `services`, `configmaps`, `secrets`, `persistentvolumeclaims`, `nodes`, `namespaces`, `serviceaccounts`, `resourcequotas`, `endpoints`, `limitranges`	`get`, `list`, `watch`	Configuration objects K8sGPT reads to diagnose issues.
apps/`deployments`, `replicasets`, `statefulsets`, `daemonsets`	`get`, `list`, `watch`	Workload graph and status.
batch/`jobs`, `cronjobs`	`get`, `list`, `watch`	Batch workload visibility.
`networking.k8s.io`/`ingresses`, `networkpolicies`	`get`, `list`, `watch`	Network topology and policy context.
`policy`/`poddisruptionbudgets`	`get`, `list`, `watch`	PDB-related disruption diagnosis.
`autoscaling`/`horizontalpodautoscalers`	`get`, `list`, `watch`	Scaling-decision context.
`apiextensions.k8s.io`/`customresourcedefinitions`	`get`, `list`, `watch`	CRD discovery for topology mapping.
`admissionregistration.k8s.io`/`mutatingwebhookconfigurations`, `validatingwebhookconfigurations`	`get`, `list`, `watch`	K8sGPT analyzer reads webhook configuration to diagnose admission-related failures.

You’re in control

Disable the analyzers to remove cluster-wide Secret and ConfigMap read access: --set k8sgpt.enabled=false --set topologyAnalyzer.enabled=false.
Apply a ResourceQuota capping count/secrets on the dataagent namespace for a hard ceiling on what the agent can create.
Audit at any time with the helm template … | grep ClusterRole command above.
Manage RBAC yourself by installing with --set rbac.create=false and binding your own ServiceAccount.