Prerequisites
What you need before connecting your first cluster.
Kubernetes
| Requirement | Minimum |
|---|---|
| Kubernetes version | 1.25 |
| Helm | 3.14 |
kubectl access | Cluster-admin or equivalent |
| Node architecture | amd64 or arm64 (both supported) |
| Free capacity | About 910m CPU and 3.2Gi memory in resource requests |
The agent runs as a single pod, and the chart also installs 3 monitoring pods (Prometheus, kube-state-metrics, and node-exporter). The capacity figure above covers all of them — see Agent resource requirements for the breakdown. The agent needs a service account with read access to cluster resources — the Helm chart creates this automatically.
Network
The agent only makes outbound connections. No inbound ports are needed.
| Destination | Port | Protocol | Purpose |
|---|---|---|---|
tunnel.data-agent.co | 443 | gRPC over TLS | Agent → Hub tunnel |
ghcr.io | 443 | HTTPS | Pulling agent images and the agent’s CA certificate |
quay.io | 443 | HTTPS | Bundled monitoring: Prometheus, its config reloader, and node-exporter images |
registry.k8s.io | 443 | HTTPS | Bundled monitoring: kube-state-metrics image |
docker.io (Docker Hub) | 443 | HTTPS | Bundled monitoring: the busybox init container that clears Prometheus’s data directory |
If your cluster runs behind an egress proxy or firewall, allow outbound TCP 443 to all of the destinations above. The last three are only needed for the bundled monitoring pods — if you install with --set da-monitoring.enabled=false, you only need tunnel.data-agent.co and ghcr.io. If you use a registry mirror, the bundled monitoring images must be available through it; otherwise those pods stay in ImagePullBackOff while the agent pod itself runs.
DataAgent account
You need a DataAgent organisation and at least the Operator role to register clusters. If you do not have an account, contact your organisation owner.
Your organisation owner can retrieve the auth token from Clusters → Connect Cluster in the dashboard.