How It Works
Architecture overview — from cluster signal to dashboard incident.
DataAgent has two parts: a lightweight agent that runs in your cluster, and a cloud hub that your team interacts with through the dashboard.
Architecture
Step by step
- Detection — The K8sGPT sidecar runs a full cluster analysis every 5 minutes. It inspects pods, deployments, nodes, persistent volumes, and jobs for known failure patterns.
- Deduplication — Each finding is fingerprinted with a SHA-256 hash of its resource kind, namespace, name, and error. Identical findings from repeated analysis cycles are deduplicated — the same issue does not create multiple incidents.
- Streaming to Hub — The orchestrator sends findings to the DataAgent cloud over a persistent gRPC stream, secured with mutual TLS. No inbound ports are opened in your cluster.
- AI Enrichment — The AI worker receives each new finding and runs an enrichment pipeline using Claude on AWS Bedrock. It queries pod metrics, node conditions, and related incidents to produce a structured explanation.
- Dashboard — The enriched incident appears in the dashboard with severity, affected resource, AI explanation, and a chat interface. Your team can investigate, assign, and resolve from a single view.
Security model
- No inbound connections — the agent initiates an outbound gRPC connection to
tunnel.data-agent.co:443. No ports need to be opened in your cluster or firewall. - Mutual TLS — the agent authenticates with a certificate issued by DataAgent. The Hub verifies the certificate before accepting any data.
- Tenant isolation — all data is scoped to your organisation. No data is shared between tenants.
- Read-only cluster access — the agent’s Kubernetes service account has read-only permissions. It cannot modify cluster resources.