Agent Not Connecting

Check pod status

kubectl get pods -n dataagent

The agent pod should show 5/5 and Running. If any container is in CrashLoopBackOff, Error, or ImagePullBackOff, check its logs:

kubectl logs -n dataagent -l app.kubernetes.io/name=dataagent -c orchestrator
kubectl logs -n dataagent -l app.kubernetes.io/name=dataagent -c topology-analyzer
kubectl logs -n dataagent -l app.kubernetes.io/name=dataagent -c metrics-collector
kubectl logs -n dataagent -l app.kubernetes.io/name=dataagent -c watcher
kubectl logs -n dataagent -l app.kubernetes.io/name=dataagent -c log-watcher

If the pod is stuck in Init, the fetch-ca-cert init container could not fetch the CA certificate. Check its logs:

kubectl logs -n dataagent -l app.kubernetes.io/name=dataagent -c fetch-ca-cert

Image pull failure

If the agent pod is in ImagePullBackOff or stuck in Init, either the image pull password is wrong or the cluster cannot reach ghcr.io.

If only the monitoring pods (prometheus-server, kube-state-metrics, node-exporter) are in ImagePullBackOff, the pull password is not the cause — those pods pull public images from quay.io, registry.k8s.io, and docker.io. Allow those registries (see Network / egress blocked), or reinstall with --set da-monitoring.enabled=false.

For the agent pod:

1. Copy the image pull password from the dashboard (Clusters → Connect Cluster — it is part of the install command). You do not need to create a GitHub token.
2. Update the Helm release:

helm upgrade dataagent oci://ghcr.io/data-agent-co/dataagent-chart \
  --namespace dataagent \
  --reset-then-reuse-values \
  --set imageCredentials.password=<pull-password>

3. If the error persists, check that the cluster can reach ghcr.io:443 — see Network / egress blocked below.

Auth token invalid or expired

The auth token from the dashboard is valid for 60 minutes. If you installed the chart more than 60 minutes after copying the token, it will have expired.

1. Go to Clusters → Connect Cluster in the dashboard
2. Copy a new auth token
3. Update the Helm release:

helm upgrade dataagent oci://ghcr.io/data-agent-co/dataagent-chart \
  --namespace dataagent \
  --reset-then-reuse-values \
  --set config.authToken=<new-token>

Network / egress blocked

The agent connects outbound to tunnel.data-agent.co:443, and pulls images and its CA certificate from ghcr.io:443. The bundled monitoring pods pull public images from quay.io, registry.k8s.io, and docker.io (all on 443). Verify they are reachable from the cluster:

kubectl run -n default netcheck --image=busybox:1.37 --rm -i --restart=Never -- \
  sh -c "for h in tunnel.data-agent.co ghcr.io quay.io registry.k8s.io registry-1.docker.io; do nc -zv -w5 \$h 443; done"

Each host should report open. A timeout or Connection refused means that destination is blocked. Each host is checked independently, so one failing does not hide the others. The check pod’s own busybox image comes from Docker Hub, so if the pod cannot start at all, docker.io is blocked.

The check pod runs in default because the dataagent namespace may not exist yet, or may not allow extra pods. If your cluster rejects pods in default (for example, a restricted PodSecurity policy), use a namespace that allows them.

If a connection fails, check your cluster’s egress firewall rules and network policies against the full list in Prerequisites → Network.

TLS certificate issues

If the orchestrator logs show TLS errors, the CA certificate may not have been fetched correctly by the init container. You can override the CA manually:

1. Obtain the CA certificate PEM from DataAgent support
2. Install with the certificate value:

helm upgrade dataagent oci://ghcr.io/data-agent-co/dataagent-chart \
  --namespace dataagent \
  --reset-then-reuse-values \
  --set-file config.tlsCACert=/path/to/ca.pem

Still not connecting?

Contact support with:

• Output of kubectl get pods -n dataagent
• Output of kubectl logs -n dataagent -l app.kubernetes.io/name=dataagent -c orchestrator --tail=100
• Your cluster name and Kubernetes version