Agent Helm Values v0.4.4

These are the values of the patch-service-agent-helm chart from version v0.4.4. Chart v0.4.4 makes images pulled through a registry mirror scannable for CVEs: an image matched through releaseCatalog.registryAliases is scanned from the registry the release catalog names, and a releaseCatalog.extraRepositories entry can name the Tetrate repository it mirrors so its images are scanned too. Earlier agents report mirrored images but cannot have them scanned. The other values are unchanged from v0.4.0.

Each value is marked with who owns it: Yours, Set by onboarding, or Leave as is. Where to Set Values explains each, and how to change a value on your kind of install.

Changes from v0.4.0

What changed since v0.4.0, and so since any chart from v0.4.0 to v0.4.3.

Value	Change
releaseCatalog.registryAliases	New meaning. Images matched through an alias are now scanned for CVEs, from the registry the catalog names. Before, they were reported but never scanned.
releaseCatalog.extraRepositories	New meaning. An entry can be written as <repository>=<published repository>, and only entries written that way are scanned for CVEs. An entry with the repository alone is reported, as before, but never scanned. The agent now also refuses to start with an entry that has a digest or a trailing slash.

Values files from v0.4.0 to v0.4.3 keep working unchanged. To have images from renamed repositories scanned, add =<published repository> to each extraRepositories entry.

Discovery

What the agent watches and how it recognizes Tetrate's images. These are the values you are most likely to change. Clusters and the Agent explains the model behind them.

Value	Owner	Description	Default
podNamespaces	Yours	Namespaces the agent watches for Deployments and DaemonSets. Empty watches every namespace. Onboarding seeds it with tetrate-dataplane-system, envoy-gateway-system, and envoy-ai-gateway-system; add a namespace if you run a Tetrate product elsewhere. It narrows what the agent looks at, not its permissions.	[]
selector	Yours	A Kubernetes label selector, such as app.kubernetes.io/part-of=gateway. When set, the agent only considers Deployments and DaemonSets whose own labels match it. It only ever narrows: an image Tetrate does not publish is never reported, whatever the selector says. Agents before 0.4.0 required it; remove it when upgrading from one of those.	""
releaseCatalog.url	Yours	Where the agent fetches the release catalog from. Point it at an internal copy of the same files if the cluster cannot reach the internet. Set it to "" to stop fetching: the agent then recognizes only what Tetrate had published when its image was built. Requires agent 0.4.0 or newer; the chart refuses to install an older image with it set.	https://releases.tetrate.io/manifests
releaseCatalog.refreshPeriod	Yours	How often the catalog is fetched again, as a duration such as 30m or 12h. 0 fetches it once at startup.	6h
releaseCatalog.registryAliases	Yours	Maps a registry the catalog names to the prefix your mirror serves it under, such as docker.io: harbor.example.com/dockerhub. One entry covers every Tetrate image on that registry. Neither side takes a trailing slash. Images matched through an alias are scanned for CVEs from the registry the catalog names, since the scan cannot reach your mirror. See Discovering Images from a Private Registry.	{}
releaseCatalog.extraRepositories	Yours	Repositories, without a tag or digest, to treat as Tetrate's, for a mirror that renamed the paths so no alias applies. Each entry covers one repository. Write an entry as <repository>=<published repository>, such as harbor.example.com/tetrate/envoy=docker.io/envoyproxy/envoy, to name the Tetrate repository it mirrors: only then are its images scanned for CVEs, from the published repository. An entry with the repository alone is reported but never scanned.	[]
resyncPeriod	Yours	How often the agent reports even when nothing changed, which keeps the cluster's Last report current. 0 reports only when something changes.	15m
argocdNamespace	Leave as is	Namespace holding the ArgoCD Applications the agent reads to report installed managed products. Empty uses the namespace the agent is installed in, which is where every managed install puts them.	""

If the published repository of an extraRepositories entry is not in the release catalog, the agent logs a warning at startup: its images are still reported, but not scanned.

The registry key of a registryAliases entry contains dots. In a values file write it as is; with --set, escape the dots: --set 'releaseCatalog.registryAliases.docker\.io=harbor.example.com/dockerhub'.

Connection to the Patch Service

How the agent identifies its cluster and reaches the Patch Service. All of them are set by onboarding.

Value	Owner	Description	Default
customerId	Set by onboarding	Your organization's identifier. Every report is filed under it. Required when server.url is set.	""
clusterName	Leave as is	The cluster's name, written into the chart. Onboarding sets clusterNameConfigMap instead, because the name is only settled when the cluster registers. One of the two is required.	""
clusterNameConfigMap.name	Set by onboarding	A ConfigMap in the agent's namespace to read the cluster name from. Onboarding creates patch-service-agent-config and sets this to it. Takes precedence over clusterName.	""
clusterNameConfigMap.key	Set by onboarding	The key in that ConfigMap holding the name.	clusterName
server.url	Set by onboarding	The Patch Service API the agent reports to. Empty makes the agent log what it finds instead of reporting it, which is only useful to try the chart out.	""
server.tokenUrl	Set by onboarding	Where the agent obtains its access tokens.	https://auth.patch.tetrate.io/oauth2/token
server.clientId	Set by onboarding	The agent's machine identity for your organization.	""
server.existingSecretName	Set by onboarding	A Secret holding the client secret for server.clientId. Onboarding creates patch-service-agent and sets this to it, so the secret never appears in the Helm release.	""
server.existingSecretKey	Set by onboarding	The key in that Secret holding the client secret.	clientSecret
server.clientSecret	Leave as is	The client secret given directly as a value. The chart then creates a Secret for it, and the secret is stored in the Helm release history. Use server.existingSecretName instead.	""

Image

Value	Owner	Description	Default
image.repository	Set by onboarding	Where the agent image is pulled from. Onboarding sets fips-containers.teg.tetratelabs.com/patch-service-agent, which your Tetrate Hub credentials can pull. On an agent-only install, change it only if you mirror the agent image into your own registry.	ghcr.io/tetrateio/patch-service-agent
image.tag	Set by onboarding	The agent version. Onboarding pins it, so an upgrade has to set it: see Upgrading the Agent.	the chart's version
image.pullPolicy	Yours, agent-only	Standard Kubernetes image pull policy. On the managed data plane Tetrate sets it to Always.	IfNotPresent
imagePullSecrets	Set by onboarding	Secrets used to pull the image. Onboarding sets tetrate-pull-credentials, which holds your Tetrate Hub credentials. If you mirror the agent image, add the Secret for your registry.	[]

Availability and Scheduling

Standard Kubernetes settings for the agent's Deployment.

Value	Owner	Description	Default
replicaCount	Yours	Number of agent replicas. Only one reports at a time; the others stand by to take over. More than one requires leaderElection: true.	1
leaderElection	Leave as is	Coordinates replicas through a Lease in the agent's namespace, so only one reports. Leave it enabled; the chart refuses replicaCount above 1 without it.	true
resources	Yours	CPU and memory requests and limits for the agent container.	{}
nodeSelector	Yours	Node labels the agent's Pods must run on.	{}
tolerations	Yours	Tolerations for the agent's Pods, to run on tainted nodes.	[]
affinity	Yours	Affinity and anti-affinity rules for the agent's Pods.	{}
podAnnotations	Yours	Annotations added to the agent's Pods.	{}
podLabels	Set by onboarding	Labels added to the agent's Pods. Onboarding adds dataplane.tetrate.io: <customer-id>. Add your own labels alongside it on either kind of install: they are kept, and only that one label is Tetrate's.	{}
commonLabels	Set by onboarding	Labels added to every resource the chart creates. Onboarding adds dataplane.tetrate.io: <customer-id>. Add your own labels alongside it on either kind of install: they are kept, and only that one label is Tetrate's.	{}
env	Yours, agent-only	Extra environment variables for the agent container, as standard Kubernetes EnvVar entries. Use it for LOG_LEVEL (debug, info, error, or none; default info), or for HTTPS_PROXY and SSL_CERT_FILE when the cluster reaches the internet through a proxy. On the managed data plane Tetrate sets this list, so your entries are replaced.	[]

Resource Names and Service Account

Value	Owner	Description	Default
nameOverride	Leave as is	The name used in resource names and the app.kubernetes.io/name label.	agent
fullnameOverride	Leave as is	Replaces the full resource name prefix. The onboarding flows find the agent by its resource names, so changing either name makes the Patch Service treat the agent as one it did not install.	""
serviceAccount.create	Leave as is	Creates the agent's service account.	true
serviceAccount.name	Leave as is	The service account's name. Empty derives it from the release.	""
serviceAccount.annotations	Yours	Annotations on the service account.	{}

Values the Chart Rejects

The chart fails the install, with a message naming the problem, instead of installing an agent that cannot work:

• Neither clusterName nor clusterNameConfigMap.name is set.
• server.url is set without customerId, server.tokenUrl, server.clientId, or a client secret through server.existingSecretName or server.clientSecret.
• replicaCount is above 1 with leaderElection: false.
• releaseCatalog.url is set and image.tag is older than 0.4.0.

A malformed registryAliases or extraRepositories entry passes the chart but stops the agent at startup, and the agent's log names the entry.

Next Steps

• Agent Helm Values explains where to set these values on your kind of install, and which page matches the chart version you run.
• Upgrade the agent on an agent-only install, keeping the values you set.