Helm Chart Reference
All configurable values for the DataAgent agent Helm chart.
Install or upgrade the chart:
# Install
helm upgrade --install dataagent oci://ghcr.io/data-agent-co/dataagent-chart \
--version <version> \
--namespace dataagent --create-namespace \
--set config.authToken=<token> \
--set config.clusterName=<name> \
--set imageCredentials.password=<pull-password> \
--wait --timeout 10m
# Upgrade
helm upgrade dataagent oci://ghcr.io/data-agent-co/dataagent-chart \
--namespace dataagent --reset-then-reuse-valuesTop-level
| Key | Type | Default | Description |
|---|---|---|---|
namespace | string | dataagent | Kubernetes namespace to deploy into |
createNamespace | bool | false | Create the namespace if it does not exist. Set to false when the namespace is managed externally (ArgoCD, GitOps) |
replicaCount | int | 1 | Number of orchestrator pod replicas. Keep at 1 — the agent is stateful per cluster |
nameOverride | string | dataagent | Override the resource name prefix |
fullnameOverride | string | "" | Override the full resource name |
image — Orchestrator image
| Key | Type | Default | Description |
|---|---|---|---|
image.repository | string | ghcr.io/data-agent-co/dataagent/orchestrator | Container image repository |
image.pullPolicy | string | IfNotPresent | Image pull policy |
image.tag | string | "" | Image tag. Defaults to the chart’s appVersion when empty |
imageCredentials — GHCR authentication
| Key | Type | Default | Description |
|---|---|---|---|
imageCredentials.password | string | "" | Image pull password from the dashboard’s Connect flow — you do not create it yourself. Creates an imagePullSecret automatically, and is also used by the fetch-ca-cert init container to fetch the agent’s CA certificate. When empty, neither is created, so set config.tlsCACert instead |
config — Agent configuration
| Key | Type | Default | Description |
|---|---|---|---|
config.authToken | string | "" | Required. JWT auth token from the DataAgent dashboard |
config.clusterName | string | "" | Human-readable cluster name shown in the dashboard. Always set it |
config.agentName | string | "" | Agent identifier. Defaults to the pod name when empty |
config.hubUrl | string | tunnel.data-agent.co:443 | Tunnel Broker endpoint. Do not change unless instructed by support |
config.heartbeatInterval | duration | 30s | How often the agent sends a heartbeat to the Hub |
config.reconnectDelay | duration | 5s | Initial delay before reconnecting after a dropped connection |
config.maxReconnectDelay | duration | 60s | Maximum back-off delay between reconnection attempts |
config.tlsEnabled | bool | true | Enable mTLS for the Hub connection. Must be true in production |
config.tlsInsecure | bool | false | Skip TLS certificate verification. Never set to true in production |
config.tlsCACert | string | "" | PEM-encoded CA certificate for manual override. When set, the chart mounts it at /etc/ssl/dataagent/ca.crt and skips the init container fetch |
metricsCollector — Metrics collector sidecar
Collects pod, node, and workload metrics and streams them to the Hub for use in AI enrichment.
| Key | Type | Default | Description |
|---|---|---|---|
metricsCollector.enabled | bool | true | Enable the metrics collector sidecar |
metricsCollector.config.metricsInterval | duration | 60s | Collection interval. Must be between 10s and 1h |
metricsCollector.config.healthPort | int | 8086 | Health server port |
metricsCollector.config.k8sQPS | int | 50 | Kubernetes API client max requests per second |
metricsCollector.config.k8sBurst | int | 100 | Kubernetes API client burst limit |
metricsCollector.resources.limits.cpu | string | 2000m | CPU limit |
metricsCollector.resources.limits.memory | string | 2Gi | Memory limit |
metricsCollector.resources.requests.cpu | string | 100m | CPU request |
metricsCollector.resources.requests.memory | string | 128Mi | Memory request |
topologyAnalyzer — Topology analyzer sidecar
Builds a resource graph of your cluster and sends it to the Hub for relationship-aware analysis. It also runs the K8sGPT analysis in-process — there is no separate K8sGPT container. Disabling it turns off K8sGPT-based detection too.
| Key | Type | Default | Description |
|---|---|---|---|
topologyAnalyzer.enabled | bool | true | Enable the topology analyzer sidecar |
topologyAnalyzer.config.topoServerPort | int | 8083 | Port the orchestrator’s topology service listens on (localhost only) |
topologyAnalyzer.config.healthPort | int | 8084 | Health and readiness probe port |
topologyAnalyzer.config.resyncPeriod | duration | 30m | How often the informer re-delivers its cached objects to its handlers (a resync, not an API re-list); the watch keeps the cache current between resyncs. Set to 0 to disable periodic resync entirely |
topologyAnalyzer.config.snapshotInterval | duration | 5m | How often to send a full snapshot to the Hub |
topologyAnalyzer.config.goMemLimit | string | 1638MiB | Soft memory ceiling for the Go runtime (GOMEMLIMIT). Integer plus MiB or GiB only. Keep at ~80% of resources.limits.memory — it must stay below the limit; the chart refuses to render when it isn’t (checked when the limit uses Mi/Gi units). Set "" to unset |
topologyAnalyzer.resources.limits.cpu | string | 2000m | CPU limit |
topologyAnalyzer.resources.limits.memory | string | 2Gi | Memory limit. Informer-cache residency scales with total cluster object count — raise together with config.goMemLimit on very large clusters |
topologyAnalyzer.resources.requests.cpu | string | 100m | CPU request |
topologyAnalyzer.resources.requests.memory | string | 512Mi | Memory request. Higher than the other containers because this one keeps a copy of every cluster object it watches |
topologyAnalyzer.analyze — K8sGPT analysis loop
These values pace the K8sGPT analysis that runs inside the topology analyzer.
| Key | Type | Default | Description |
|---|---|---|---|
topologyAnalyzer.analyze.port | int | 8093 | Loopback port the analysis engine serves on (localhost only, never exposed as a Service) |
topologyAnalyzer.analyze.interval | duration | 30s | Target time between the start of one analysis run and the next |
topologyAnalyzer.analyze.minGap | duration | 15s | Minimum pause after a run finishes, so a slow run is never followed immediately by another |
topologyAnalyzer.analyze.timeout | duration | 10m | Maximum duration of a single analysis run |
topologyAnalyzer.analyze.readyTimeout | duration | 120s | How long the agent waits at startup for the analysis engine to become ready before exiting. Covers the first cache sync on large clusters |
watcher — Event and ConfigMap watcher sidecar
Watches Kubernetes Warning events and ConfigMap changes and turns them into signals.
| Key | Type | Default | Description |
|---|---|---|---|
watcher.enabled | bool | true | Enable the watcher sidecar. false removes the container |
watcher.resources.limits.cpu | string | 2000m | CPU limit |
watcher.resources.limits.memory | string | 2Gi | Memory limit |
watcher.resources.requests.cpu | string | 100m | CPU request |
watcher.resources.requests.memory | string | 128Mi | Memory request |
To report changes to a specific ConfigMap at critical severity, label it dataagent.io/critical: "true".
logWatcher — Log watcher sidecar
Follows pod log streams and matches lines against a built-in library of known error patterns, so application errors that never show up in pod status are still detected.
| Key | Type | Default | Description |
|---|---|---|---|
logWatcher.enabled | bool | true | Enable the log watcher sidecar. false removes the container |
logWatcher.config.namespaces | list | [] | Namespaces whose pod logs are read. Empty means all namespaces. A non-empty list scopes the log watcher’s own RBAC grant to those namespaces, but it does not remove cluster-wide pod-log read: the topology analyzer’s ClusterRole grants pods/log cluster-wide to the same service account. That remains unless you also set topologyAnalyzer.enabled=false |
logWatcher.config.containerFilter | list | [istio-proxy, linkerd-proxy] | Container names whose logs are never read |
logWatcher.config.customPatterns | string | "" | Your own patterns (YAML, patterns: [{name, regex, severity, fault_class}]), merged with the built-in library. A pattern with the same name as a built-in one replaces it |
logWatcher.resources.limits.cpu | string | 2000m | CPU limit |
logWatcher.resources.limits.memory | string | 2Gi | Memory limit |
logWatcher.resources.requests.cpu | string | 100m | CPU request |
logWatcher.resources.requests.memory | string | 128Mi | Memory request |
liveRead — Live object lookups during analysis
Lets root-cause analysis read the current state of individual Kubernetes objects during an incident, instead of only the snapshot the agent collected earlier. The lookups run as a separate dataagent-live-read ServiceAccount bound to the built-in view ClusterRole, which cannot read Secrets.
| Key | Type | Default | Description |
|---|---|---|---|
liveRead.enabled | bool | true | Create the live-read ServiceAccount. false removes it and turns the feature off |
liveRead.extraReadRules | list | [] | Extra RBAC read rules for custom resources the view role cannot see. Name specific API groups — never use a wildcard, which would also grant Secret access |
da-monitoring — Bundled monitoring stack
| Key | Type | Default | Description |
|---|---|---|---|
da-monitoring.enabled | bool | true | Install the bundled monitoring pods: prometheus-server, kube-state-metrics, and node-exporter (one per node). They collect infrastructure metrics only — your application metrics are never scraped. The bundled Prometheus is the only Prometheus the agent supports, so setting this to false turns off Prometheus-based detection |
Connecting the agent to a Prometheus you already run is not supported. Your own monitoring stack is optional and can keep running alongside the bundled one for your application metrics.
helm uninstall removes these pods along with the agent.
Orchestrator resources
| Key | Type | Default | Description |
|---|---|---|---|
resources.limits.cpu | string | 2000m | CPU limit |
resources.limits.memory | string | 2Gi | Memory limit |
resources.requests.cpu | string | 100m | CPU request |
resources.requests.memory | string | 128Mi | Memory request |
healthPort | int | 8087 | Liveness (/health) and readiness (/ready) probe port |
Scheduling
| Key | Type | Default | Description |
|---|---|---|---|
nodeSelector | object | {} | Node selector labels. The agent images support both amd64 and arm64 (including Graviton), so no selector is needed. Supply your own to constrain scheduling |
tolerations | list | [] | Pod tolerations |
affinity | object | {} | Pod affinity rules |
podAnnotations | object | {} | Annotations added to the agent pod |
Security
All containers run with a hardened security context by default. These values should not be changed.
| Setting | Value |
|---|---|
runAsNonRoot | true |
runAsUser | 1000 |
fsGroup | 1000 |
readOnlyRootFilesystem | true |
allowPrivilegeEscalation | false |
capabilities.drop | ALL |
seccompProfile | RuntimeDefault |
RBAC
| Key | Type | Default | Description |
|---|---|---|---|
rbac.create | bool | true | Create all of the agent’s RBAC — every Role, ClusterRole, and binding listed on Agent permissions. Set to false only if you bind your own. The bundled monitoring pods’ RBAC is not affected; it follows da-monitoring.enabled |
serviceAccount.create | bool | true | Create a dedicated service account |
serviceAccount.name | string | "" | Override the service account name. Defaults to the release name |