Agent Helm Values v0.3.1

These are the values of the patch-service-agent-helm chart from version v0.3.1 to v0.3.2. Chart v0.3.1 added resyncPeriod and argocdNamespace. Agents of these versions find workloads by label rather than from the release catalog; upgrade to v0.4.0 or later to stop labeling workloads.

Agent-only installs

On the managed data plane, Tetrate keeps the agent current through upgrade pull requests, so these versions only remain on agent-only installs.

Each value is marked with who owns it: Yours, Set by onboarding, or Leave as is. Where to Set Values explains each, and how to change a value on your kind of install.

Changes from v0.1.0

What changed since v0.1.0, and so since any chart from v0.1.0 to v0.2.1.

Value	Change
resyncPeriod	Added. The agent now also reports every 15m when nothing changed, so a quiet cluster's Last report stays current. Set it to 0 to keep reporting only on changes.
argocdNamespace	Added. The agent reports which managed products are installed, from the ArgoCD Applications in its own namespace. Leave it empty.

Values files from v0.1.0 to v0.2.1 keep working unchanged.

Discovery

What the agent watches and which workloads it reports. Before chart v0.4.0 the agent has no release catalog: it reports every container of the Deployments and DaemonSets that selector matches, in the namespaces podNamespaces lists.

Value	Owner	Description	Default
podNamespaces	Yours	Namespaces the agent watches for Deployments and DaemonSets. Empty watches every namespace. It narrows what the agent looks at, not its permissions.	[]
selector	Set by onboarding	A Kubernetes label selector that opts Deployments and DaemonSets into reporting, matched against their own labels. The agent reports every container of the workloads it matches. Onboarding sets it to dataplane.tetrate.io=<customer-id>, so a workload is reported only once it carries that label; on the managed data plane Tetrate also excludes app=redis. Empty reports every workload in the watched namespaces, including your own applications.	""
resyncPeriod	Yours	How often the agent reports even when nothing changed, which keeps the cluster's Last report current. 0 reports only when something changes.	15m
argocdNamespace	Leave as is	Namespace holding the ArgoCD Applications the agent reads to report installed managed products. Empty uses the namespace the agent is installed in, which is where every managed install puts them.	""

Connection to the Patch Service

How the agent identifies its cluster and reaches the Patch Service. All of them are set by onboarding.

Value	Owner	Description	Default
customerId	Set by onboarding	Your organization's identifier. Every report is filed under it. Required when server.url is set.	""
clusterName	Leave as is	The cluster's name, written into the chart. Onboarding sets clusterNameConfigMap instead, because the name is only settled when the cluster registers. One of the two is required.	""
clusterNameConfigMap.name	Set by onboarding	A ConfigMap in the agent's namespace to read the cluster name from. Onboarding creates patch-service-agent-config and sets this to it. Takes precedence over clusterName.	""
clusterNameConfigMap.key	Set by onboarding	The key in that ConfigMap holding the name.	clusterName
server.url	Set by onboarding	The Patch Service API the agent reports to. Empty makes the agent log what it finds instead of reporting it, which is only useful to try the chart out.	""
server.tokenUrl	Set by onboarding	Where the agent obtains its access tokens.	https://auth.patch.tetrate.io/oauth2/token
server.clientId	Set by onboarding	The agent's machine identity for your organization.	""
server.existingSecretName	Set by onboarding	A Secret holding the client secret for server.clientId. Onboarding creates patch-service-agent and sets this to it, so the secret never appears in the Helm release.	""
server.existingSecretKey	Set by onboarding	The key in that Secret holding the client secret.	clientSecret
server.clientSecret	Leave as is	The client secret given directly as a value. The chart then creates a Secret for it, and the secret is stored in the Helm release history. Use server.existingSecretName instead.	""

Image

Value	Owner	Description	Default
image.repository	Set by onboarding	Where the agent image is pulled from. Onboarding sets fips-containers.teg.tetratelabs.com/patch-service-agent, which your Tetrate Hub credentials can pull. On an agent-only install, change it only if you mirror the agent image into your own registry.	ghcr.io/tetrateio/patch-service-agent
image.tag	Set by onboarding	The agent version. Onboarding pins it, so an upgrade has to set it: see Upgrading the Agent.	the chart's version
image.pullPolicy	Yours, agent-only	Standard Kubernetes image pull policy. On the managed data plane Tetrate sets it to Always.	IfNotPresent
imagePullSecrets	Set by onboarding	Secrets used to pull the image. Onboarding sets tetrate-pull-credentials, which holds your Tetrate Hub credentials. If you mirror the agent image, add the Secret for your registry.	[]

Availability and Scheduling

Standard Kubernetes settings for the agent's Deployment.

Value	Owner	Description	Default
replicaCount	Yours	Number of agent replicas. Only one reports at a time; the others stand by to take over. More than one requires leaderElection: true.	1
leaderElection	Leave as is	Coordinates replicas through a Lease in the agent's namespace, so only one reports. Leave it enabled; the chart refuses replicaCount above 1 without it.	true
resources	Yours	CPU and memory requests and limits for the agent container.	{}
nodeSelector	Yours	Node labels the agent's Pods must run on.	{}
tolerations	Yours	Tolerations for the agent's Pods, to run on tainted nodes.	[]
affinity	Yours	Affinity and anti-affinity rules for the agent's Pods.	{}
podAnnotations	Yours	Annotations added to the agent's Pods.	{}
podLabels	Set by onboarding	Labels added to the agent's Pods. Onboarding adds dataplane.tetrate.io: <customer-id>. Add your own labels alongside it on either kind of install: they are kept, and only that one label is Tetrate's.	{}
commonLabels	Set by onboarding	Labels added to every resource the chart creates. Onboarding adds dataplane.tetrate.io: <customer-id>. Add your own labels alongside it on either kind of install: they are kept, and only that one label is Tetrate's.	{}
env	Yours, agent-only	Extra environment variables for the agent container, as standard Kubernetes EnvVar entries. Use it for LOG_LEVEL (debug, info, error, or none; default info). On the managed data plane Tetrate sets this list, so your entries are replaced.	[]

Resource Names and Service Account

Value	Owner	Description	Default
nameOverride	Leave as is	The name used in resource names and the app.kubernetes.io/name label.	agent
fullnameOverride	Leave as is	Replaces the full resource name prefix. The onboarding flows find the agent by its resource names, so changing either name makes the Patch Service treat the agent as one it did not install.	""
serviceAccount.create	Leave as is	Creates the agent's service account.	true
serviceAccount.name	Leave as is	The service account's name. Empty derives it from the release.	""
serviceAccount.annotations	Yours	Annotations on the service account.	{}

Values the Chart Rejects

The chart fails the install, with a message naming the problem, instead of installing an agent that cannot work:

• Neither clusterName nor clusterNameConfigMap.name is set.
• server.url is set without customerId, server.tokenUrl, server.clientId, or a client secret through server.existingSecretName or server.clientSecret.
• replicaCount is above 1 with leaderElection: false.

Next Steps

• Agent Helm Values explains where to set these values on your kind of install, and which page matches the chart version you run.
• Upgrade the agent on an agent-only install, keeping the values you set.