Install the agent on Kubernetes
The ObserveKit agent runs as a DaemonSet — one pod per node — collecting container logs, node and container metrics, Kubernetes state, and TLS certificate posture. Installing it is a single kubectl apply.
Prerequisites
kubectlconfigured against the target cluster, with permission to create a namespace, a DaemonSet, and cluster-scoped RBAC (ClusterRole/ClusterRoleBinding).- Outbound HTTPS from the cluster to the ObserveKit server (e.g.
https://observekit-api.expeed.com).
1. Create the source
Sources → + Add Source, name it (e.g. production-cluster), choose Kubernetes, click Create Source. The wizard generates a command of the form:
kubectl apply -f https://observekit-api.expeed.com/install/<install-token>
The install token is single-source, embeds the source ID + API key, and is valid for 24 hours (re-runnable within that window). If it expires, open the source and use Regenerate Install Link.
> Air-gapped / GitOps? Fetch the manifest instead of applying a URL: GET /sources/<id>/install-manifest returns the same YAML with the API key replaced by a <YOUR_API_KEY> placeholder. Drop your real key into the observekit-agent Secret and commit it to your manifests repo.
2. Run it
kubectl apply -f https://observekit-api.expeed.com/install/<install-token>
What gets installed
All in a new observekit namespace:
| Object | Name | Purpose |
|---|---|---|
| Namespace | observekit | Isolates the agent |
| Secret | observekit-agent | Holds the source API key |
| ConfigMap | observekit-agent | agent.yaml — collection + filter config (tuning) |
| DaemonSet | observekit-agent | The collector, one pod per node |
| ServiceAccount | observekit-agent | Identity for the pods |
| ClusterRole + Binding | observekit-agent | Read-only cluster access (below) |
The DaemonSet mounts /var/log and /var/log/containers read-only, reads node metrics from the kubelet (auto-detected via the node IP), and ships to the server. Default resources: requests 50m CPU / 128Mi, limits 250m CPU / 768Mi.
RBAC the agent is granted
Read-only, cluster-scoped — the agent never writes to your cluster:
pods,namespaces,nodes—get, list, watchnodes/stats,nodes/proxy—get(kubelet metrics)deployments,replicasets—get, list(workload names)secrets—listonly (TLS certificate-expiry scan; it parsestls.crt, nothing else)
3. Verify
kubectl -n observekit rollout status daemonset/observekit-agent kubectl -n observekit logs -l app=observekit-agent --tail=50
Within ~30s the source flips to CONNECTED on the Sources page (the agent heartbeats). Logs and infrastructure data start appearing in [Log Explorer](/help/logs/searching-logs) and [Infrastructure](/help/infrastructure/reading-infrastructure) shortly after.
Trim what it collects
By default the agent excludes kube-system and any pod labelled observekit/ignore: "true". To drop noisy namespaces, sidecars, or log levels, edit the ConfigMap — see [Agent configuration](/help/sources/agent-config). Aggressive agent-side filtering is the single biggest lever on cost.
Upgrade
Re-run the install command (the agent self-replaces), or open the source and use Regenerate Install Link. A yellow Agent Version pill on the Sources page means a newer agent is available.
Uninstall
kubectl delete namespace observekit
Removes the agent entirely. Historical logs and metrics already collected stay queryable; deleting the source in the UI stops it accepting new data.
Not connecting?
See [Troubleshooting: I see no data](/help/getting-started/no-data) — covers RBAC denials, egress/DNS to the server, and reading the agent's own logs.