Configure the Kubernetes Agent

Configure which cluster information the IncidentFlow Kubernetes Agent can access and how it connects to IncidentFlow. The agent is designed for read-only diagnostics — configuration must not grant write access to Kubernetes resources.

Core settings

Setting	Description	Required
clusterName	Stable identifier used by IncidentFlow to identify the cluster.	Yes
platformUrl	IncidentFlow platform API endpoint.	Yes
gatewayUrl	Secure WebSocket endpoint used by the agent.	Yes
registrationTokenSecretName	Name of the Kubernetes Secret holding the one-time token.	Initial installation only
environment	Environment label such as development, staging, or production.	Recommended
logLevel	Agent logging level.	No

Namespace access

By default, configure the agent with the minimum Kubernetes permissions required for diagnostics. Access can include:

• namespaces;
• pods and pod status;
• deployments and rollout status;
• services;
• Kubernetes events;
• bounded pod logs.

Limit access to explicitly approved namespaces when cluster-wide visibility is not required.

Network requirements

The agent requires outbound access to:

• the IncidentFlow platform API over HTTPS;
• the IncidentFlow agent gateway over secure WebSockets.

No inbound connection from IncidentFlow to the cluster is required. If an outbound proxy is required, configure it through the supported agent environment variables or Helm values.

Credentials

The registration token is used only during initial registration. The protected setup flow creates incidentflow-k8s-agent-bootstrap; Helm receives only its name through registrationTokenSecretName. After registration, the token is exchanged for agent credentials stored in the Kubernetes cluster. Remove the bootstrap Secret after your credential-lifecycle policy allows it.

Read-only security model

The Agent can inspect namespaces, workloads, pods, events, services, rollout status, and bounded logs. It has no write, exec, port-forward, Secret-read, or workload-mutation permissions. Do not broaden its role to cluster-admin.

Apply configuration changes

Update the Helm values or GitOps configuration and redeploy the agent. After every configuration change, verify the agent connection, permissions, rollout status, and recent logs — see Verification.