Agent Helm Values

Reference for the ankra-agent chart installed from oci://registry.ankra.cloud/ankra/ankra-agent. For installation and architecture, see Cluster Agent.

helm upgrade --install ankra-agent oci://registry.ankra.cloud/ankra/ankra-agent \
  --version <agent-version> \
  --set config.ankra_url=https://platform.ankra.app \
  --set config.token=<your-token> \
  --namespace=ankra --create-namespace

Copy the exact install command from the Import dialog: it pins the agent version and carries your cluster’s token. Add --set flags for the values below to that command.

Connection

Value	Default	Description
`config.ankra_url`	`https://platform.ankra.app`	Platform endpoint the agent connects to
`config.token`	`""`	Agent token from the import flow (required unless using an existing secret)
`config.existing_secret_name`	`""`	Read the token from an existing Kubernetes Secret instead
`config.secret_key`	`""`	Key within that Secret holding the token

Workers and Performance

Value	Default	Description
`read_worker_count`	`5`	Concurrent worker slots for read jobs
`write_worker_count`	`5`	Concurrent worker slots for write jobs (create, update, delete)
`nats_worker_max_workers`	`15`	Maximum NATS worker threads for processing commands
`resources.requests.cpu`	`200m`	CPU request
`resources.requests.memory`	`256Mi`	Memory request
`resources.limits.memory`	`1Gi`	Memory limit
`replica_count`	`1`	Agent replicas
`terminationGracePeriodSeconds`	`600`	Grace period so in-flight work can finish - don’t set this low
`ci_worker_count`	`0`	Concurrent worker slots for Ankra Pipelines steps. Zero - the default - means the agent runs no pipeline-step scheduler and does not advertise the capability. Set through Ankra, not here (below)
`ci_storage_class`	`""`	StorageClass for pipeline cache volumes and for a workspace claim that names none; empty is the cluster default. Set through Ankra, not here (below)

ci_worker_count and ci_storage_class are the two values Ankra owns on the agent’s behalf. Set them per cluster through the platform - PUT /api/v1/org/clusters/{cluster_id}/agent/ci-settings, or the CLI verb Ankra Pipelines shows - and Ankra re-renders the agent’s own release with them. A value you pass to helm upgrade yourself is overwritten the next time Ankra renders that release.

Kubernetes Watch

Streaming of live resource state to the platform. Only override when you need to tune event volume.

Value	Default	Description
`k8s_watch.enabled`	`true`	Enable the resource watch stream
`k8s_watch.batch_size`	`20`	Events per batch
`k8s_watch.batch_timeout_ms`	`500`	Max wait before flushing a partial batch
`k8s_watch.reconnect_delay_ms`	`1000`	Initial reconnect delay
`k8s_watch.max_reconnect_delay_ms`	`30000`	Reconnect backoff ceiling
`k8s_watch.max_events_per_sec`	`500`	Event rate limit
`k8s_watch.strip_fields`	`true`	Strip managed fields to reduce payload size
`k8s_watch.timeout_seconds`	`300`	Watch connection timeout

Public IP Reporting (Fleet World Map)

Places imported clusters on the fleet dashboard map when they run in private networks. Disabled by default; enabling makes the agent perform an outbound HTTP lookup. Leave disabled for air-gapped clusters.

Value	Default	Description
`public_ip.reporting_enabled`	`false`	Report the agent’s public egress IP on check-in
`public_ip.lookup_url`	`https://api.ipify.org?format=json`	Endpoint returning the caller’s public IP
`public_ip.refresh_seconds`	`3600`	How often the cached IP is refreshed
`public_ip.lookup_timeout_seconds`	`5`	Per-lookup HTTP timeout

Image

Value	Default	Description
`image.repository`	`registry.ankra.cloud/ankra/agent`	Agent image
`image.tag`	`""` (follows chart version)	Explicit tag override - empty is the contract the platform auto-upgrade relies on; set only to pin a specific build
`image.pull_policy`	`Always`	Image pull policy
`image.pull_secrets`	`[]`	Pull secrets

Security

The chart enforces non-root defaults matching the image’s ankra user (UID/GID 1000) with a read-only root filesystem. Don’t lower these without a rebuilt image.

Value	Default	Description
`pod_security_context`	non-root, UID/GID 1000, `RuntimeDefault` seccomp	Pod-level security context
`security_context`	non-root, no privilege escalation, read-only rootfs, all capabilities dropped	Container-level security context
`writable_volumes.enabled`	`true`	Mount emptyDir volumes for runtime-writable paths (required with read-only rootfs)
`writable_volumes.tmp_size_limit`	`1Gi`	`/tmp` size cap
`writable_volumes.cache_size_limit`	`4Gi`	Cache size cap
`writable_volumes.config_size_limit`	`16Mi`	Config size cap

Scheduling and Service

Value	Default	Description
`node_selector` / `tolerations` / `affinity` / `topologySpreadConstraints`	empty	Standard scheduling controls
`service_account.name`	`ankra-agent-sa`	Service account name
`service_account.annotations`	`{}`	Service account annotations (e.g. IRSA)
`service.type` / `service.port`	`ClusterIP` / `8080`	Agent HTTP service
`pod_annotations`	`{}`	Extra pod annotations
`log_level`	`INFO`	`DEBUG`, `INFO`, `WARNING`, `ERROR`, or `CRITICAL`

Metrics

Value	Default	Description
`metrics.serviceMonitor.enabled`	`false`	Install a Prometheus Operator ServiceMonitor scraping `/metrics`
`metrics.serviceMonitor.interval`	`30s`	Scrape interval
`metrics.serviceMonitor.scrapeTimeout`	`10s`	Scrape timeout
`metrics.serviceMonitor.labels`	`{}`	Extra ServiceMonitor labels
`metrics_collect.enabled`	`true`	Ship built-in cluster metrics (nodes, namespaces, workloads) to the Ankra platform; `false` opts this cluster out of platform metrics
`metrics_collect.interval_seconds`	`30`	Collection interval
`metrics_collect.max_workloads`	`200`	Cap on per-workload series (top by CPU; restarting workloads are always kept)

Advanced Environment Tuning

Operator-tunable knobs go in extra_env:

extra_env:
  - name: KUBERNETES_HTTP2_ENABLED          # default "false"
    value: "false"
  - name: KUBERNETES_REQUEST_MAX_ATTEMPTS   # default "3"
    value: "3"
  - name: FORWARD_SERVICE_REQUEST_MAX_TIMEOUT_SECONDS  # default "120"
    value: "120"

See Cluster Agent - Advanced tuning for when to change these.

Get Started

Concepts

Create and Run Clusters

Ship Your App

Stacks and Add-ons

Observe and Troubleshoot

Ankra AI

Connect Tools

Source Control

Security and Access

Cost and Backups

Organisation and Account

Reference

Connection

Workers and Performance

Kubernetes Watch

Public IP Reporting (Fleet World Map)

Image

Security

Scheduling and Service

Metrics

Advanced Environment Tuning

​Connection

​Workers and Performance

​Kubernetes Watch

​Public IP Reporting (Fleet World Map)

​Image

​Security

​Scheduling and Service

​Metrics

​Advanced Environment Tuning

Connection

Workers and Performance

Kubernetes Watch

Public IP Reporting (Fleet World Map)

Image

Security

Scheduling and Service

Metrics

Advanced Environment Tuning