Skip to content
Start free

Configuration

Configuration Overview

View source

Kubeadapt Helm chart installation, platform support, prerequisites, and upgrade instructions.

Last updated

The kubeadapt Helm chart deploys a single-pod agent into your Kubernetes cluster. The agent collects cluster metrics and sends them to Kubeadapt Cloud for cost analysis and rightsizing recommendations.

Platform Support

PlatformCost agenteBPF network agentNotes
Amazon EKSSupportedSupported on EC2 nodesFargate runs the cost agent only. Install metrics-server, which EKS does not include.
Azure AKSSupportedSupported
Google GKESupportedStandard onlyAutopilot rejects privileged, hostNetwork and hostPID pods.
Red Hat OpenShiftSupportedNeeds the privileged SCC4.x and later. Install with the flags under OpenShift.
On-premise / self-hostedSupportedSupportedkubeadm, kops, Rancher, k3s, RKE2

The network agent needs Linux nodes with kernel 5.10 or later.

Prerequisites

  • Kubernetes 1.24 through 1.35
  • Helm 3.0 or later
  • metrics-server running in the cluster. GKE and AKS include it; EKS and kind clusters need it installed. The agent reads live CPU and memory usage from the metrics.k8s.io API. Without it, the platform cannot generate rightsizing recommendations.

Installation

Keep the token in a Secret, so it never appears in the Helm command, your shell history or helm get values:

bash
1helm repo add kubeadapt https://kubeadapt.github.io/kubeadapt-helm
2helm repo update
3kubectl create namespace kubeadapt
4kubectl create secret generic kubeadapt-agent-token \
5  --namespace kubeadapt --from-literal=token="<your-token>"
6helm install kubeadapt kubeadapt/kubeadapt \
7  --namespace kubeadapt \
8  --set agent.config.existingSecret=kubeadapt-agent-token

For a quick try, pass the token directly:

bash
helm install kubeadapt kubeadapt/kubeadapt \
  --namespace kubeadapt --create-namespace \
  --set agent.config.token="<your-token>"

Get a token from app.kubeadapt.io under Clusters → Add cluster.

From chart 1.0.8 the agent pod meets the Kubernetes restricted Pod Security Standard: it runs as a non-root user, with a read-only root filesystem, no privilege escalation and no Linux capabilities.

OpenShift

Add these flags so the restricted-v2 SCC can assign the user and group:

bash
--set agent.podSecurityContext.runAsUser=null \
--set agent.podSecurityContext.runAsGroup=null \
--set agent.podSecurityContext.fsGroup=null

OCI Registry

You can also pull from the OCI registry instead of the Helm repo:

bash
helm install kubeadapt oci://ghcr.io/kubeadapt/kubeadapt-helm/kubeadapt \
  --namespace kubeadapt --create-namespace \
  --set agent.config.token="<your-token>"

Upgrading

bash
helm repo update
helm upgrade kubeadapt kubeadapt/kubeadapt \
  --namespace kubeadapt \
  --reset-then-reuse-values

Or enable Auto-Upgrade to handle this automatically.

Uninstalling

bash
helm uninstall kubeadapt --namespace kubeadapt
kubectl delete namespace kubeadapt

helm uninstall removes the resources the chart created. It leaves the kubeadapt namespace and any Secret you created yourself, such as kubeadapt-agent-token; deleting the namespace removes both. Then delete the cluster on the Clusters page in Kubeadapt, which revokes its token.

Chart Signing

All chart packages are GPG-signed. The public key is published at the Helm repo root.

  • Fingerprint: 3C8109B607AD3E119B7033D8948AD9EDA6BD626E
  • Key ID: 948AD9EDA6BD626E

Verify a downloaded package:

bash
helm verify kubeadapt-1.0.7.tgz --keyring pubkeys.gpg

See also

  • Agent Configuration: token and Secret handling, collection intervals, resource sizing, GPU metrics and scheduling.
  • eBPF Agent: the optional network traffic agent.
  • Auto-Upgrade: keep the chart current without manual upgrades.