Provider Connectors
Configure the agent
Chart values for the LevelFour agent, and how to read Prometheus history, send through a proxy, pull from a private registry and verify the release signatures.
Helm installs and GitOps installs take the same chart values. With GitOps, add them to your values. With Helm, apply a values file over the install you have:
helm upgrade levelfour-agent oci://public.ecr.aws/levelfour/charts/levelfour-agent \
--version 0.1.0 \
--namespace levelfour --reuse-values -f values.yamlSet --version to the chart version you run. Without it, Helm pulls the newest chart and upgrades the agent as well.
Chart values
The chart validates its values and refuses to install when clusterName breaks the naming rule, when neither token nor existingSecret.name is set, or when both are.
| Value | Default | What it sets |
|---|---|---|
clusterName | none | The cluster's name in LevelFour. Required. Lowercase letters, digits and hyphens, at most 63 characters, starting and ending with a letter or digit. Unique across your organization |
token | none | A cluster token (l4k_...) or an install key (l4ki_...). Set token or existingSecret.name, not both |
existingSecret.name | none | A Secret in the release namespace that holds the token or install key |
existingSecret.key | token | The key inside that Secret |
apiUrl | https://api.levelfour.ai | Where the agent sends data. Keep the default |
prometheus.url | none | An in-cluster Prometheus to read usage and history from. See Read history from Prometheus |
kubelet.insecureSkipTLSVerify | false | Skips kubelet certificate checks, for local kind clusters only. On a real cluster it sends the agent's service account token to kubelets the agent cannot verify |
image.repository | public.ecr.aws/levelfour/k8s-agent | The agent image. Point it at your mirror |
image.tag | The chart's version | Leave it unset so the image moves with the chart |
image.digest | none | Pulls the image by digest (sha256:...) instead of by tag |
image.pullPolicy | IfNotPresent | IfNotPresent, Always or Never |
imagePullSecrets | [] | Pull Secrets for a private registry |
nameOverride | none | Replaces the chart name in object names and in the app.kubernetes.io/name label |
fullnameOverride | none | Replaces the whole object name. A release named levelfour-agent names its objects levelfour-agent |
serviceAccount.create | true | Whether the chart creates the agent's service account |
serviceAccount.name | The object name | The service account the agent runs as. With create: false, name one that exists |
serviceAccount.annotations | {} | Annotations on the service account the chart creates |
commonLabels | {} | Labels added to every object the chart creates |
podAnnotations | {} | Annotations on the agent pod |
podLabels | {} | Labels on the agent pod, added to the chart's own |
priorityClassName | none | The PriorityClass of the agent pod |
podSecurityContext | Non-root user and group 65532, RuntimeDefault seccomp | The pod security context |
containerSecurityContext | No privilege escalation, read-only root filesystem, every capability dropped | The container security context |
resources | See Footprint | CPU and memory requests and limits |
metrics.port | 9090 | The port that serves /metrics and /healthz |
extraEnv | [] | Extra environment variables for the agent, such as a proxy |
nodeSelector | kubernetes.io/os: linux | Node selector for the agent pod |
tolerations | [] | Tolerations for the agent pod |
affinity | {} | Affinity rules for the agent pod |
Read history from Prometheus
The agent measures usage from the kubelet on each node, so it needs no Prometheus. If the cluster already runs one, such as kube-prometheus-stack, point the agent at it. At its first start the agent reads up to 14 days of history from Prometheus, so the first recommendations can come sooner than 7 days after install.
prometheus:
url: http://prometheus-operated.monitoring.svc:9090With Helm, set it on the command line:
helm upgrade levelfour-agent oci://public.ecr.aws/levelfour/charts/levelfour-agent \
--version 0.1.0 \
--namespace levelfour --reuse-values \
--set prometheus.url=http://prometheus-operated.monitoring.svc:9090The agent queries Prometheus from inside the cluster. LevelFour never connects to it, and nothing is exposed outside the cluster.
Behind a proxy
The agent sends data to api.levelfour.ai on port 443. If the cluster reaches the internet through a proxy, set HTTPS_PROXY for the agent with extraEnv. Set NO_PROXY to your in-cluster addresses so the agent still reaches the kubelets and the API server directly: .svc, .cluster.local, the service CIDR, and the pod and node CIDRs.
extraEnv:
- name: HTTPS_PROXY
value: http://proxy.example.com:3128
- name: NO_PROXY
value: .svc,.cluster.local,172.20.0.0/16,10.0.0.0/16Replace the CIDRs with your cluster's. The API server's in-cluster address sits in the service CIDR. On Amazon EKS, read it with:
aws eks describe-cluster --name YOUR_EKS_CLUSTER \
--query cluster.kubernetesNetworkConfig.serviceIpv4Cidr --output textPrivate registry mirror
To pull the agent from your own registry, copy the image there and point the chart at it. Copy both architectures (linux/amd64 and linux/arm64) and keep the tag, because the chart pulls the tag that matches its version. crane copy copies every architecture by default; with skopeo copy, pass --all.
crane copy public.ecr.aws/levelfour/k8s-agent:0.1.0 registry.example.com/levelfour/k8s-agent:0.1.0image:
repository: registry.example.com/levelfour/k8s-agent
imagePullSecrets:
- name: registry-credentialsregistry-credentials is a kubernetes.io/dockerconfigjson Secret in the levelfour namespace. To pin the exact image you verified, set image.digest to the digest crane digest public.ecr.aws/levelfour/k8s-agent:0.1.0 prints. crane copy keeps that digest.
To mirror the chart as well, pull it and push it to your registry, then install from oci://registry.example.com/levelfour/charts/levelfour-agent:
helm pull oci://public.ecr.aws/levelfour/charts/levelfour-agent --version 0.1.0
helm push levelfour-agent-0.1.0.tgz oci://registry.example.com/levelfour/chartsVerify the signatures on the public copies before you mirror them.
Verify the signatures and SBOM
LevelFour signs every agent image and chart with cosign, and attaches an SPDX SBOM to each image as a signed attestation. The signing key stays in AWS KMS. Check a release with the LevelFour public key and cosign 3 or later.
Download the public key:
curl -sSfLO https://docs.levelfour.ai/keys/levelfour-k8s-agent.pubVerify the image and the chart:
cosign verify --key levelfour-k8s-agent.pub public.ecr.aws/levelfour/k8s-agent:0.1.0
cosign verify --key levelfour-k8s-agent.pub public.ecr.aws/levelfour/charts/levelfour-agent:0.1.0Verify the SBOM attestation:
cosign verify-attestation --key levelfour-k8s-agent.pub --type spdxjson public.ecr.aws/levelfour/k8s-agent:0.1.0To save the SBOM itself, pipe that command's output through jq -r .payload | base64 -d | jq .predicate > levelfour-agent-0.1.0.spdx.json.
Each command exits with an error when the signature is missing or a different key made it.
Verify the chart in Flux
Flux 2.8 and later verify cosign 3 signatures, so Flux can check the chart on every pull. Put the public key in a Secret next to the OCIRepository. Flux reads every key in that Secret whose name ends in .pub, and the file name gives the key that name:
kubectl -n levelfour create secret generic levelfour-cosign-key \
--from-file=levelfour-k8s-agent.pubThen add verify to the OCIRepository from Install with GitOps. Flux refuses a chart that the LevelFour key did not sign:
spec:
verify:
provider: cosign
secretRef:
name: levelfour-cosign-keyInstall with GitOps
Connect many Kubernetes clusters with one organization install key, a Secret from your secret manager, and the LevelFour chart deployed by Argo CD, Flux or Terraform.
What the agent reads
Every Kubernetes permission the LevelFour agent holds, every field it sends to LevelFour, and what it never reads or sends.