Configure the Kubernetes Agent

Configure which cluster information the IncidentFlow Kubernetes Agent can access and how it connects to IncidentFlow. The agent is designed for read-only diagnostics — configuration must not grant write access to Kubernetes resources.

Core settings

Setting	Description	Required
clusterName	Stable identifier used by IncidentFlow to identify the cluster.	Yes
platformUrl	IncidentFlow platform API endpoint.	Yes
gatewayUrl	Secure WebSocket endpoint used by the agent.	Yes
registrationToken	One-time token used only during initial registration.	Initial installation only
environment	Environment label such as development, staging, or production.	Recommended
logLevel	Agent logging level.	No

Namespace access

By default, configure the agent with the minimum Kubernetes permissions required for diagnostics. Access can include:

• namespaces;
• pods and pod status;
• deployments and rollout status;
• services;
• Kubernetes events;
• bounded pod logs.

Limit access to explicitly approved namespaces when cluster-wide visibility is not required.

Network requirements

The agent requires outbound access to:

• the IncidentFlow platform API over HTTPS;
• the IncidentFlow agent gateway over secure WebSockets.

No inbound connection from IncidentFlow to the cluster is required. If an outbound proxy is required, configure it through the supported agent environment variables or Helm values.

Credentials

The registration token is used only during initial registration. After registration, it is exchanged for agent credentials stored in the Kubernetes cluster.

Apply configuration changes

Update the Helm values or GitOps configuration and redeploy the agent. After every configuration change, verify the agent connection, permissions, rollout status, and recent logs — see Verification.