Install the agent

One Helm chart, two pods, outbound-only networking. The agent runs inside your cluster and tunnels back to klstr via Cloudflare — no inbound firewall rules, no kubeconfig shipped outside.

TL;DR

helm install klstr-agent https://app.klstr.dev/install/klstr-agent-chart.tgz \
  --set agent.registrationToken="k8s_reg_XXXX" \
  --namespace klstr-agent \
  --create-namespace

Mint the token from Settings → API Keys in the dashboard. Two pods appear: the agent itself + a cloudflared sidecar that holds the tunnel open.

Chart values

Value	Default	Purpose
`agent.image.repository`	`klstrdev/agent`	Docker Hub image
`agent.image.tag`	`0.1.0`	Bumped per release
`agent.port`	`8080`	Local HTTP/WS listener
`agent.resources.requests`	`64 Mi / 10 m`	Enough up to 500-node clusters
`agent.resources.limits`	`128 Mi / 100 m`
`agent.registrationToken`	`(required)`	From Settings → API Keys
`agent.dashboardUrl`	`https://app.klstr.dev`	Override for staging
`agent.extraEnv`	`{}`	Escape hatch, e.g. NODE_TLS_REJECT_UNAUTHORIZED=0 on kind
`cloudflared.enabled`	`true`	Disable if you DIY the tunnel

RBAC

The chart installs a ClusterRole the agent needs:

pods/* (get, list, watch, exec, log, portforward)
services, endpoints, namespaces, nodes, events
deployments, statefulsets, daemonsets, replicasets
ingresses (networking.k8s.io/v1)
Custom resources via get, list for plug-in detection

klstr does not request secrets/* verbs by default. Secret content is fetched only when a user opens a specific secret in the dashboard, at which point the request is scoped to that name.

TLS

The agent probes the in-cluster API server cert chain at boot. If the chain is not verifiable against the ServiceAccount CA (common on kind, vcluster, ad-hoc clusters), it falls back to rejectUnauthorized: false. Production clusters with valid certs land in the verified branch.

Force strict TLS in production:

--set agent.extraEnv.K8S_DASHBOARD_STRICT_TLS=true

Upgrading

helm upgrade klstr-agent https://app.klstr.dev/install/klstr-agent-chart.tgz \
  --reuse-values \
  --namespace klstr-agent

The agent replays deltas on every boot, so rolling restarts are safe — no data loss.

Uninstall

helm uninstall klstr-agent --namespace klstr-agent

Then delete the cluster in Clusters → ⋯ → Delete. klstr tears down the Cloudflare tunnel + Access service token in the correct order.

Troubleshooting

Cluster stuck on "Connecting" — check agent pod logs for auth errors. Usually an expired or mistyped registration token.
Heartbeat stale — the cloudflared sidecar may have lost its tunnel. kubectl logs deploy/klstr-agent -c cloudflared shows it.
Pod logs missing— verify the agent's ClusterRole bindings include pods/log.
Still stuck? info@klstr.dev

Next: connect a second cluster.