Skip to content
Start free

Security & Privacy

What we collect, and what we can access.

The cluster agent has no write permissions on your Deployments, Pods or nodes, and collects no container logs, environment variables or request bodies. This page lists what each component collects and every permission it asks for, including the kubelet access it needs for stats and the optional network agent, which runs privileged. Data is stored in the EU (Germany).

Read the data listsecurity@kubeadapt.io

Data Collection

What leaves your cluster.

The cluster agent sends Kubernetes metadata and resource usage once a minute. Network telemetry comes only from the optional network agent. Each category below lists its fields.

  • 6 fields

    Resource Metrics

    • Pod CPU and memory usage (per container)
    • Node CPU and memory capacity and usage
    • Pod network bytes sent and received, from the kubelet
    • Resource requests, limits, and ephemeral storage
    • StorageClasses, PVs, PVCs, and CSI volume sources
    • Per-container GPU resource allocation
  • 6 fields

    Kubernetes State

    • Pod status, phases, QoS class, and conditions
    • Node system info, conditions, and taints
    • Namespace metadata and pod distribution
    • Service types, IPs, ports, and load balancers
    • Ingress rules, hosts, and routing paths
    • Kubernetes cluster version
  • 6 fields

    Workload Controllers

    • Deployments, StatefulSets, DaemonSets
    • Jobs, CronJobs, and execution schedules
    • HPA and VPA configurations
    • PodDisruptionBudgets and PriorityClasses
    • Karpenter NodePools and custom CRD workloads
    • Replica counts, update strategies, and conditions
  • 7 fields

    Resource Metadata

    • Container image names and image IDs
    • Labels and annotations on all resources
    • Service account names
    • Node instance types, zones, and architecture
    • Pod and node IP addresses, pod CIDRs
    • Container ports, init containers, and owner references
    • Resource UIDs and creation timestamps
  • 4 fields

    Scheduling & Quotas

    • LimitRanges (default requests and limits)
    • ResourceQuotas (namespace-level caps)
    • Pod priority and scheduler configuration
    • Cloud provider and region detection
  • 5 fields

    GPU Metrics

    • GPU utilization and tensor activity
    • Memory used, free, and total bytes
    • Memory copy utilization (bandwidth)
    • Temperature and power usage
    • Device model, driver version, MIG support

    Only on nodes that run the NVIDIA DCGM exporter.

  • optional

    Network Telemetry

    • Per-connection source and destination IP, port, and protocol
    • Bytes sent and received per connection
    • DNS query names
    • TLS server names (SNI)
    • HTTP method, route, and status code, read from headers

    Collected only if you install the eBPF network agent, which is off by default. It never records payload bodies.

Permissions

What each component can do in your cluster.

The Helm chart installs the cluster agent. The other two components are optional and stay off unless you set their flag.

  • Deployment · always on

    Cluster agent

    One pod per cluster. Cluster-wide it can list and watch resources such as nodes, pods, workloads, Services, storage, and autoscalers. It also has get on the nodes/proxy and nodes/stats subresources, which it uses to read pod network usage from the kubelet. RBAC cannot narrow nodes/proxy to that endpoint, so the grant covers every kubelet endpoint reached through the API server. The cluster-wide role has no create, update, or delete permissions.

    In its own namespace, a Role lets it get, list, watch, create, and delete Jobs; get, list, create, update, and delete ConfigMaps; get and list Secrets; and get ServiceAccounts.

    helm install kubeadapt kubeadapt/kubeadapt
  • DaemonSet · off by default

    Network agent (eBPF)

    One pod per node that records connection metadata with eBPF. It runs as a privileged container, as root, with hostNetwork and hostPID, and a read-only root filesystem. It mounts the host’s /sys, /proc, cgroup, and debugfs read-only, and /sys/fs/bpf for its maps. Linux kernel 5.10 or newer.

    Requests 100m CPU and 256 MiB memory per node, with a 500m / 384 MiB limit. It sends its records to the cluster agent inside the cluster. Leave the flag out and it is never installed.

    --set kubeadapt-k8s-pulse.enabled=true
  • Sidecar · off by default

    Auto-upgrader

    Upgrades the Kubeadapt release in place. When you turn it on, it can create, update, and delete the objects the chart owns in its namespace, including the Helm release Secrets, and read pods, pod logs, and events there.

    It can also create and update the ClusterRoles and bindings the chart installs. Leave it off and you upgrade with helm yourself.

    --set agent.autoUpgrade.enabled=true

Not collected

We do not collect container logs, environment variables, Secret or ConfigMap contents, or HTTP request and response bodies.

Uninstall

One command removes everything the chart installed.

helm uninstall kubeadapt -n kubeadapt

Data Flow

How data gets from your cluster to us.

Your cluster

Kubeadapt agent

One Deployment per cluster, plus the optional network agent on each node

  • list / watch the Kubernetes API
  • Read usage from metrics-server and the kubelet
  • Send a snapshot every minute
HTTPS · API key
EU · Germany

Kubeadapt API

Hosted in Germany

  • Check the cluster’s API key
  • Store the snapshot
  • Compute cost and recommendations

The agent opens every connection, over HTTPS, and authenticates with a per-cluster API key. Only the fields listed above leave the cluster. The network agent sends its records to the cluster agent, which sends them on with the rest.

Get started

See it on your own cluster.

Install the agent in about five minutes. Everything the agents send is listed on this page.

Start freeEmail security team

See also Privacy and Terms.