Helm Chart Reference

All configurable values for the DataAgent agent Helm chart.

Install or upgrade the chart:

# Install
helm install dataagent oci://ghcr.io/data-agent-co/dataagent-chart \
  --namespace dataagent --create-namespace \
  --set config.authToken=<token> \
  --set config.clusterName=<name> \
  --set imageCredentials.password=<ghcr-pat>

# Upgrade
helm upgrade dataagent oci://ghcr.io/data-agent-co/dataagent-chart \
  --namespace dataagent --reset-then-reuse-values

Top-level

Key	Type	Default	Description
`namespace`	string	`dataagent`	Kubernetes namespace to deploy into
`createNamespace`	bool	`false`	Create the namespace if it does not exist. Set to `false` when the namespace is managed externally (ArgoCD, GitOps)
`replicaCount`	int	`1`	Number of orchestrator pod replicas. Keep at `1` — the agent is stateful per cluster
`nameOverride`	string	`dataagent`	Override the resource name prefix
`fullnameOverride`	string	`""`	Override the full resource name

`image` — Orchestrator image

Key	Type	Default	Description
`image.repository`	string	`ghcr.io/data-agent-co/dataagent/orchestrator`	Container image repository
`image.pullPolicy`	string	`IfNotPresent`	Image pull policy
`image.tag`	string	`""`	Image tag. Defaults to the chart’s `appVersion` when empty

`imageCredentials` — GHCR authentication

Key	Type	Default	Description
`imageCredentials.password`	string	`""`	GitHub PAT with `read:packages` scope. Creates an `imagePullSecret` automatically

`config` — Agent configuration

Key	Type	Default	Description
`config.authToken`	string	`""`	Required. JWT auth token from the DataAgent dashboard
`config.clusterName`	string	`""`	Human-readable cluster name shown in the dashboard
`config.agentName`	string	`""`	Agent identifier. Defaults to the pod name when empty
`config.hubUrl`	string	`tunnel.data-agent.co:443`	Tunnel Broker endpoint. Do not change unless instructed by support
`config.heartbeatInterval`	duration	`30s`	How often the agent sends a heartbeat to the Hub
`config.reconnectDelay`	duration	`5s`	Initial delay before reconnecting after a dropped connection
`config.maxReconnectDelay`	duration	`60s`	Maximum back-off delay between reconnection attempts
`config.tlsEnabled`	bool	`true`	Enable mTLS for the Hub connection. Must be `true` in production
`config.tlsInsecure`	bool	`false`	Skip TLS certificate verification. Never set to `true` in production
`config.tlsCACert`	string	`""`	PEM-encoded CA certificate for manual override. When set, the chart mounts it at `/etc/ssl/dataagent/ca.crt` and skips the init container fetch

`k8sgpt` — K8sGPT sidecar

Runs cluster analysis on a schedule and reports findings to the orchestrator.

Key	Type	Default	Description
`k8sgpt.enabled`	bool	`true`	Enable the K8sGPT sidecar
`k8sgpt.image.repository`	string	`ghcr.io/k8sgpt-ai/k8sgpt`	K8sGPT image repository
`k8sgpt.image.pullPolicy`	string	`IfNotPresent`	Image pull policy
`k8sgpt.image.tag`	string	`v0.3.48`	K8sGPT version
`k8sgpt.config.grpcPort`	int	`8080`	gRPC port the orchestrator connects to (localhost only)
`k8sgpt.config.httpPort`	int	`8081`	HTTP port for K8sGPT metrics and health
`k8sgpt.config.analyzeInterval`	duration	`5m`	How often K8sGPT runs a full cluster analysis pass
`k8sgpt.config.apiCache`	bool	`true`	Serve cluster LISTs from the API server’s watch cache (RAM) instead of consistent etcd reads. Eventually consistent (~1s lag), reduces etcd and API-server load on the cluster. Set to `false` to force consistent reads
`k8sgpt.resources.limits.cpu`	string	`2000m`	CPU limit
`k8sgpt.resources.limits.memory`	string	`2Gi`	Memory limit
`k8sgpt.resources.requests.cpu`	string	`100m`	CPU request
`k8sgpt.resources.requests.memory`	string	`128Mi`	Memory request

`metricsCollector` — Metrics collector sidecar

Collects pod, node, and workload metrics and streams them to the Hub for use in AI enrichment.

Key	Type	Default	Description
`metricsCollector.enabled`	bool	`true`	Enable the metrics collector sidecar
`metricsCollector.config.metricsInterval`	duration	`60s`	Collection interval. Must be between `10s` and `1h`
`metricsCollector.config.healthPort`	int	`8086`	Health server port
`metricsCollector.config.k8sQPS`	int	`50`	Kubernetes API client max requests per second
`metricsCollector.config.k8sBurst`	int	`100`	Kubernetes API client burst limit
`metricsCollector.resources.limits.cpu`	string	`2000m`	CPU limit
`metricsCollector.resources.limits.memory`	string	`2Gi`	Memory limit
`metricsCollector.resources.requests.cpu`	string	`100m`	CPU request
`metricsCollector.resources.requests.memory`	string	`128Mi`	Memory request

`topologyAnalyzer` — Topology analyzer sidecar

Builds a resource graph of your cluster and sends it to the Hub for relationship-aware analysis.

Key	Type	Default	Description
`topologyAnalyzer.enabled`	bool	`true`	Enable the topology analyzer sidecar
`topologyAnalyzer.config.topoServerPort`	int	`8083`	Port the orchestrator’s topology service listens on (localhost only)
`topologyAnalyzer.config.healthPort`	int	`8084`	Health and readiness probe port
`topologyAnalyzer.config.resyncPeriod`	duration	`30m`	How often the informer re-delivers its cached objects to its handlers (a resync, not an API re-list); the watch keeps the cache current between resyncs. Set to `0` to disable periodic resync entirely
`topologyAnalyzer.config.snapshotInterval`	duration	`5m`	How often to send a full snapshot to the Hub
`topologyAnalyzer.config.goMemLimit`	string	`819MiB`	Soft memory ceiling for the Go runtime (`GOMEMLIMIT`). Integer plus `MiB` or `GiB` only. Keep at ~80% of `resources.limits.memory` — it must stay below the limit; the chart refuses to render when it isn’t (checked when the limit uses `Mi`/`Gi` units). Set `""` to unset
`topologyAnalyzer.resources.limits.cpu`	string	`2000m`	CPU limit
`topologyAnalyzer.resources.limits.memory`	string	`1Gi`	Memory limit. Informer-cache residency scales with total cluster object count — raise together with `config.goMemLimit` on very large clusters
`topologyAnalyzer.resources.requests.cpu`	string	`100m`	CPU request
`topologyAnalyzer.resources.requests.memory`	string	`128Mi`	Memory request

Orchestrator resources

Key	Type	Default	Description
`resources.limits.cpu`	string	`2000m`	CPU limit
`resources.limits.memory`	string	`2Gi`	Memory limit
`resources.requests.cpu`	string	`100m`	CPU request
`resources.requests.memory`	string	`128Mi`	Memory request
`healthPort`	int	`8087`	Liveness (`/health`) and readiness (`/ready`) probe port

Scheduling

Key	Type	Default	Description
`nodeSelector`	object	`{kubernetes.io/arch: amd64}`	Node selector labels. Pinned to amd64 by default because the agent images are built single-arch (linux/amd64); scheduling onto an arm64/Graviton node would crash-loop. Override (set to `null` to remove it, or supply your own selector) only once multi-arch images are published.
`tolerations`	list	`[]`	Pod tolerations
`affinity`	object	`{}`	Pod affinity rules
`podAnnotations`	object	`{}`	Annotations added to the agent pod

Security

All containers run with a hardened security context by default. These values should not be changed.

Setting	Value
`runAsNonRoot`	`true`
`runAsUser`	`1000`
`fsGroup`	`1000`
`readOnlyRootFilesystem`	`true`
`allowPrivilegeEscalation`	`false`
`capabilities.drop`	`ALL`
`seccompProfile`	`RuntimeDefault`

RBAC

Key	Type	Default	Description
`rbac.create`	bool	`true`	Create ClusterRole and ClusterRoleBinding giving K8sGPT read access to cluster resources
`serviceAccount.create`	bool	`true`	Create a dedicated service account
`serviceAccount.name`	string	`""`	Override the service account name. Defaults to the release name

Top-level

image — Orchestrator image

imageCredentials — GHCR authentication

config — Agent configuration

k8sgpt — K8sGPT sidecar

metricsCollector — Metrics collector sidecar

topologyAnalyzer — Topology analyzer sidecar