The Agent — KubeBolt Docs

KubeBolt works with just a kubeconfig. The agent is the optional next step: a lightweight component you install in a cluster to unlock historical metrics, Hubble network flows, and cost data. It connects outbound only over gRPC — the cluster’s API server is never exposed, which is what makes private, firewalled and air-gapped-egress clusters workable.

Two deployment shapes, chosen in the Add Cluster wizard:

DaemonSet mode — collects kubelet stats per node (plus Hubble flows when present) and ships them to KubeBolt’s embedded metrics store.
promread mode (Deployment) — no per-node pods; instead the agent reads the relevant metric families from a Prometheus you already run, including the managed offerings (AMP, GMP, Azure Monitor) with per-provider auth (basic, bearer, AWS SigV4, GCP IAM, Azure Workload Identity).

The chart

The agent ships as its own OCI chart, generated with the right values by the wizard:

helm install kubebolt-agent \
  oci://ghcr.io/clm-cloud-solutions/kubebolt/helm/kubebolt-agent \
  --set backendUrl=https://kubebolt.example.com

Key values (see the chart’s values.yaml for the full, commented reference):

Value	Purpose
`backendUrl`	Where the agent dials home (required)
`cluster.name` / `cluster.id`	How the cluster registers and displays in KubeBolt
`hubble.*`	Enable network-flow collection from an existing Hubble relay
`collectors.*`	Tune what gets collected (exporters, interface drops, …)
`opencost.*`	Cost sourcing — bundled OpenCost sub-chart, or `exporterUrl` for one you already run (details)
`agent.promRead.*`	`promread` mode — endpoint `url`, per-provider `auth`, optional `cost.enabled`
`scrape.*`	Optional scrape sidecar with relabeling and discovery controls
`auth.mode`	Backend authentication: `disabled`, `tokenreview` (same-cluster), or `ingest-token` (issued in the admin UI; required for cross-cluster/SaaS)
`tls.*`	Transport TLS and optional mTLS (CA bundle, client cert, SNI override)
`gomemlimit`	Explicit Go memory target for tight nodes

Versioning

The agent follows its own release cadence (currently the 1.3.x line) on a stable v1.0 metric/label schema, and is compatible with KubeBolt backend 1.13 or newer — you can upgrade either side independently within those bounds. Upgrade with your values explicit (or a values file) rather than --reuse-values, so new chart defaults aren’t pinned to old values.

Security posture: outbound-only connection, no inbound ports, runs as non-root, and authenticates with a scoped ingest token in cross-cluster setups. Metrics flow through the backend — the agent never writes to the metrics store directly.