Before you start
In many enterprises, network egress rules and host privileges are what block an install or stop data from reaching KloudMate. Check both before you start.
Network access
Section titled “Network access”The agent only makes outbound connections to KloudMate. It needs no inbound access from the internet. Allow outbound HTTPS from each host, pod, or ECS task to:
| Purpose | Destination (default) | Port |
|---|---|---|
| Send telemetry | otel.kloudmate.com (your workspace’s collector endpoint) | 4318 |
| Fetch configuration | api.kloudmate.com | 443 |
| Download the install script | cdn.kloudmate.com | 443 |
External endpoints
Section titled “External endpoints”| Host(s) | Used for |
|---|---|
github.com | Used by the install script to download the agent. |
api.github.com | Used for agent update checks. |
ghcr.io | GitHub Container Registry, where the agent and collector container images are hosted (Docker and Kubernetes installs). |
pkg-containers.githubusercontent.com | Backing storage for ghcr.io image layers. |
charts.kloudmate.com | Home of the agent’s Helm chart. Relevant when installing the Kubernetes agent from a VM, since helm repo add / helm install fetches the chart from here. |
quay.io | cert-manager images, a prerequisite for the Kubernetes agent. |
Permissions by environment
Section titled “Permissions by environment”| Environment | To install | To run and send data |
|---|---|---|
| Linux (VM or host) | root, through sudo | Runs as root. eBPF monitoring needs kernel 4.14+, the CAP_SYS_ADMIN or CAP_BPF capability, and debugfs mounted. Without these, the host still gets metrics and logs. Instrumenting a service writes a systemd config file and restarts that one service. |
| Windows | Administrator (Server 2016 or newer) | Runs as the Local System account, which it needs to read IIS and WMI. |
| Docker | Permission to run a container with host mounts | Mount the Docker socket (/var/run/docker.sock) for container discovery and PHP tracing. eBPF needs a privileged container with host access; a plain container gets container metrics and logs only. |
| Kubernetes | Kubernetes 1.24+, Helm 3+, and cert-manager; permission to create the namespace, cluster RBAC, and CRDs | The node DaemonSet runs privileged (runAsUser: 0, CAP_SYS_ADMIN, hostPID, and hostNetwork for network flows) with host-path mounts. On clusters with Pod Security restrictions, allow this in the agent’s namespace. The chart installs the RBAC. |
| Amazon ECS | AWS permission to register task-definition revisions and update the services you instrument | Reading task definitions uses ecs:DescribeTaskDefinition. A Secrets Manager API key needs secretsmanager:GetSecretValue on the task execution role; a custom log group needs logs:CreateLogGroup. eBPF needs privileged tasks, or set KM_EBPF_ENABLED=false. |
For kernel and privilege detail, see eBPF observability. For per-platform specifics, see the platform notes for Kubernetes, Docker, and Windows.
Next steps
Section titled “Next steps” Linux Install the KloudMate Agent on Debian, Ubuntu, RHEL, or CentOS.
Docker Deploy the KloudMate Agent as a Docker container.
Windows Install the KloudMate Agent on Windows Server 2016 and above.
Kubernetes Deploy the KloudMate Agent via DaemonSet and Deployment.
Amazon ECS Install the agent on Amazon ECS.