Kubernetes

Use the Helm chart from the repository or complete package. The DaemonSet separates main, analyzer, and endpoint containers, with a local WAL per node. There is no central control plane or cross-node queue migration.

Prepare an image

Build a complete package on Linux/OrbStack before building the image. Replace this placeholder registry with one you control and push the image:

sh scripts/build_image.sh registry.example/netflowscout:0.3.0-beta.3
docker push registry.example/netflowscout:0.3.0-beta.3

Run deployment from a directory containing deploy/helm/netflowscout:

helm upgrade --install netflowscout deploy/helm/netflowscout \
  -n observability --create-namespace \
  --set image.repository=registry.example/netflowscout \
  --set image.tag=0.3.0-beta.3 \
  --set endpoint.namespace=apps \
  --set endpoint.labelSelector='app=billing' \
  --set endpoint.executable=/opt/billing/server

This does not configure real Dataway credentials. Reference an existing Secret through chart dataway.tokenSecret/tokenKey; do not pass actual tokens on the command line.

Permissions and selectors

Endpoint containers need host PID, BTF, and probe privileges. The analyzer retains required capture capabilities; the main service runs non-root. Network mode additionally requires hostNetwork. Check cluster policy before deploying.

Restrict targets through namespace, label selector, and executable/policies. API discovery selects Pods on the current node, then uses cgroup container IDs to match local processes. Attribution includes namespace, Pod, node, and direct controller. It does not guess Deployment names from ReplicaSet names.

Storage and resources

storage.hostPath defaults to /var/lib/netflowscout, preserving node-local backlog across Pod rebuilds. Node loss has no automatic queue relocation. The analyzer defaults to a 2 GiB limit for the full plugin set, host overhead, and draining generations. Adjust after measuring; declared linear memory is not RSS.

endpoint.maxTargets defaults to eight. High concurrency, multiprocess databases, and multiple discovery instances require coordinated target, bridge-client, and memory budgets.

Runtime verification

Inspect Pods and container logs. Run unified onboarding inside the endpoint container, typically with /etc/netflowscout/netflowscout.json and /etc/netflowscout/endpoint.json. Wait for actual attachment, generate new business traffic, and check events and independent sink acknowledgements.

During API failure, discovery preserves attribution for living targets, cleans exited processes, refuses new attachments from stale listings, and reports an error. Recovery admits new generations automatically. A successful Helm render does not prove probe, RBAC, or live capture functionality.