Deploy

Agent only (federated)

Run only the collector in an edge cluster and stream telemetry to a hub control plane you operate.

helm repo add kubehero https://charts.kubehero.io
helm install kubehero-agent kubehero/kubehero \
  --namespace kubehero-system --create-namespace \
  --set controlPlane.enabled=false \
  --set operator.enabled=false \
  --set dashboard.enabled=false \
  --set pricingEngine.enabled=false \
  --set cloud.enabled=true \
  --set cloud.hubEndpoint=https://ingress.kubehero.internal \
  --set-file cloud.clusterCert=./cluster-cert.pem

Full stack (single cluster)

Everything runs inside your cluster. No egress required.

helm install kubehero kubehero/kubehero \
  --namespace kubehero-system --create-namespace \
  -f values.yaml

See deploy/helm/kubehero/values.yaml in the source for every tunable.

Air-gapped

Pre-mirror images to your internal registry, then:

helm install kubehero kubehero/kubehero \
  -f values.yaml \
  -f values.airgap.yaml \
  --set image.registry=registry.internal.acme.com \
  --set imagePullSecrets[0].name=acme-regcred

Troubleshooting

• "collector pods not ready" — check RBAC; the DaemonSet needs hostPID: true. On GKE Autopilot, see the GKE Autopilot guide.
• "no telemetry at control plane" — kubectl -n kubehero-system logs ds/kubehero-collector. If you see ebpf: load: invalid argument, your kernel is too old. The collector falls back to cAdvisor automatically; see --enable-cadvisor-fallback.
• "policies not firing" — confirm humanArm is false, or run kubehero cap --arm --policy <name>.