Agent 2.0.43 · chart 0.1.44

Exact access, before installation.

The public Helm chart declares every Kubernetes resource and verb used by the agent. Render it with your chosen collectors and review it before applying.

Outbound HTTPSNo kubeconfig in SaaSRead-focused standard roleOptional access is separate

Download the complete security and permissions PDF ↓Read security documentation →

What is installed

Agent DeploymentOne lightweight in-cluster collector with bounded resources.

Dedicated identityServiceAccount, ClusterRole and ClusterRoleBinding.

Connection SecretCluster key and optional identifier hash salt.

Optional NetworkPolicyExplicit egress policy when the customer enables it.

Baseline resources and verbs

API group	Resources	Verbs	Purpose
core	pods, events, nodes, namespaces, services	`get, list`	Health, topology and event evidence
metrics.k8s.io	pods, nodes	`get, list`	CPU and memory observations
apps	replicasets	`get, list`	Resolve pod ownership

Modification boundary

The published collection ClusterRole contains no create, update, patch or delete verbs.

Conditional collector access

Container logs

When logs.enabled=true, the role adds get on pods/log. Evidence is limited and privacy-filtered before transmission.

Manifest context

When manifests.enabled=true, the role adds get, list for ConfigMaps, Secrets, endpoints, PVC/PV, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, HPA, Ingresses, NetworkPolicies, EndpointSlices, StorageClasses and OpenShift Routes.

Why Secret read access does not mean Secret values leave

The agent needs to know whether a referenced Secret and required key exist. When manifest collection is enabled, its transmitted summary contains only the Secret type and key names. Secret values are always excluded. ConfigMap values are excluded by default.

Review the permission and the payload separately

Kubernetes RBAC controls what the collector may inspect; the open-source collector implementation controls the bounded summary it transmits. Buyers can review both before installation.

Runtime hardening

Non-rootThe container runs as an unprivileged user.

Read-only filesystemThe root filesystem is not writable.

No added capabilitiesLinux capabilities are dropped and privilege escalation is disabled.

Bounded resourcesDefaults: 50m/96Mi requested and 250m/256Mi limited.

Render and verify before installing

helm repo add kreate-revo https://kreaterevo.github.io/Krevopilot-agent-helm-charts
helm repo update
helm template krevopilot-agent kreate-revo/krevopilot-agent \
  --version 0.1.44 \
  --namespace krevopilot-system \
  --set logs.enabled=true \
  --set manifests.enabled=true > rendered-agent.yaml

Open chart source ↗Open agent source ↗