Install the Kubernetes Agent

Connect a Kubernetes cluster to IncidentFlow by installing the read-only IncidentFlow Kubernetes Agent. The agent establishes an outbound encrypted connection to IncidentFlow — it does not require an inbound endpoint or direct access from IncidentFlow to the Kubernetes API.

Get guided help in MCP

Ask your connected IncidentFlow MCP client: “Help me install a read-only Kubernetes Agent with Helm and then verify it.” The client uses the structured integration_guide workflow rather than workspace knowledge search. It starts a new installation flow; it does not inspect an already connected cluster. First it asks exactly which cluster_identifier should appear in IncidentFlow, then shows the prerequisites and Secret-first Helm flow. It never accepts, returns, or stores a real registration token.

For a concise response, use integration_guide with integration="kubernetes", goal="install", method="helm", and a non-secret context such as { "cluster_identifier": "production-eu1" }.

When the identifier is missing, the expected first response is:

I’ll help connect a new cluster using Helm and read-only RBAC. What cluster identifier should appear in IncidentFlow? For example: production-eu1.

Prerequisites

Before you begin, make sure you have:

• access to an IncidentFlow workspace;
• permission to create a Kubernetes Agent in IncidentFlow;
• a unique cluster_identifier for this cluster;
• kubectl configured for the target cluster;
• Kubernetes 1.24 or later;
• Helm 3.10 or later;
• permission to create a namespace, ServiceAccount, Secret, and read-only RBAC resources;
• outbound HTTPS and secure WebSocket access to IncidentFlow;
• permission to install a Helm release in the target namespace.

Install

1. Create an agent registration

   Open IncidentFlow → Kubernetes Agents and select Install Agent. Enter a human-readable cluster display name and a unique cluster identifier.

   The cluster identifier is used to identify the cluster and cannot be changed after registration.

2. Create the bootstrap Secret

   Generate the one-time token in the IncidentFlow installation screen, then run the protected Run first command shown there. The command creates the incidentflow-agent namespace and the incidentflow-k8s-agent-bootstrap Kubernetes Secret. The token stays in that Secret; it is never passed to Helm, a values file, GitOps state, logs, or MCP output.

3. Install with Helm

   Run the safe Helm command below. It supplies the exact cluster identifier and the name of the bootstrap Secret only.

4. Continue to verification

   Return to IncidentFlow and wait for the agent to connect. A successful installation transitions from Waiting to Connected.

Install with Helm

Create the bootstrap Secret first with the protected setup flow, then use this copyable command. Replace only <cluster-identifier> with the identifier used when registering the agent. The token itself never appears in Helm values, shell arguments, GitOps manifests, or Terraform state.

For hosted IncidentFlow, the chart uses the managed service endpoints by default. Do not add endpoint values to the command below. Self-hosted deployments configure their endpoints separately.

Helm is the currently supported installation method.

helm upgrade --install incidentflow-k8s-agent \
  oci://ghcr.io/incidentflow-io/charts/incidentflow-k8s-agent \
  --version 1.0.14 \
  --namespace incidentflow-agent \
  --create-namespace \
  --set-string clusterName="<cluster-identifier>" \
  --set registrationTokenSecretName="incidentflow-k8s-agent-bootstrap"

Upgrade and uninstall

Use the same Helm release name to upgrade. An upgrade normally retains existing agent credentials and does not require a new registration token. To uninstall, run helm uninstall incidentflow-k8s-agent --namespace incidentflow-agent and then remove the bootstrap Secret only after confirming it is no longer needed. See Troubleshooting if Helm cannot install or upgrade the release.

Next steps