Configuration
Overview
The OpsWorker Kubernetes Agent is configured through Helm values during installation or upgrade. The chart is published to a public OCI registry: oci://public.ecr.aws/k1v3l8a8/opsworker-agent.
Options
Required
| Value | Description |
|---|---|
clusterToken | The cluster's immutable identifier. Auto-filled by the portal Add Cluster wizard. |
apiKey | API key used to authenticate the agent. Auto-filled by the portal Add Cluster wizard. |
Both values are required. The portal generates and fills them in for you; you do not type them manually.
Image
| Value | Default | Description |
|---|---|---|
image.repository | public.ecr.aws/k1v3l8a8/opsworker-agent | Container image repository |
image.tag | 0.9.3 | Agent image tag |
image.pullPolicy | IfNotPresent | Image pull policy |
Resources
| Value | Default | Description |
|---|---|---|
resources.requests.cpu | 100m | CPU request |
resources.requests.memory | 256Mi | Memory request |
resources.limits.cpu | 200m | CPU limit |
resources.limits.memory | 512Mi | Memory limit |
Deployment
| Value | Default | Description |
|---|---|---|
replicaCount | 1 | Number of agent replicas |
serviceAccount.create | true | Whether to create the opsworker-agent ServiceAccount |
serviceAccount.name | opsworker-agent | ServiceAccount name |
RBAC
| Value | Default | Description |
|---|---|---|
rbac.create | true | Create the ClusterRoleBinding |
rbac.clusterRole | view | Built-in ClusterRole the agent binds to (read-only) |
See RBAC for details on the binding model and how to scope access to specific namespaces.
Scheduling
| Value | Default | Description |
|---|---|---|
nodeSelector | {} | Node selector for pod scheduling |
tolerations | [] | Tolerations for tainted nodes |
affinity | {} | Affinity rules for pod placement |
Environment Variables (including Proxy)
The chart has no proxy.* values. Set proxy and other environment variables through the env list. Use the standard HTTP_PROXY, HTTPS_PROXY, and NO_PROXY variables for proxied environments.
env:
- name: HTTPS_PROXY
value: "http://proxy.internal:3128"
- name: NO_PROXY
value: "10.0.0.0/8,172.16.0.0/12"
There is no logLevel value; the log level is fixed. The namespace is set with --namespace, not a chart value.
Bundled Subcharts
A default install enables two subcharts, each running as its own pod:
| Value | Default | Description |
|---|---|---|
kubernetes-mcp-server.enabled | true | Read-only Kubernetes MCP server (read_only: true) |
grafana-mcp.enabled | false/true per chart | Grafana MCP server for observability queries |
grafana-mcp.grafana.url | - | Your Grafana instance URL (e.g., https://grafana.example.com) |
grafana-mcp.grafana.apiKey | - | Grafana service account token (Viewer role) |
Grafana MCP is a separate integration from Grafana Alerting (webhook). See Grafana MCP Setup.
Example values.yaml
clusterToken: "auto-filled-by-portal"
apiKey: "auto-filled-by-portal"
image:
repository: public.ecr.aws/k1v3l8a8/opsworker-agent
tag: "0.9.3"
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: 200m
memory: 512Mi
rbac:
create: true
clusterRole: view
nodeSelector:
kubernetes.io/os: linux
tolerations:
- key: "dedicated"
operator: "Equal"
value: "monitoring"
effect: "NoSchedule"
env:
- name: HTTPS_PROXY
value: "http://proxy.internal:3128"
- name: NO_PROXY
value: "10.0.0.0/8,172.16.0.0/12"
# Optional: enable Grafana MCP for observability queries
grafana-mcp:
enabled: true
grafana:
url: "https://grafana.example.com"
apiKey: "glsa_xxxxxxxxxxxx"
Applying Configuration Changes
Update configuration with helm upgrade:
helm upgrade opsworker-agent oci://public.ecr.aws/k1v3l8a8/opsworker-agent \
--version=v0.9.3 \
-n opsworker-agent \
-f values.yaml
Or override individual values:
helm upgrade opsworker-agent oci://public.ecr.aws/k1v3l8a8/opsworker-agent \
--version=v0.9.3 \
-n opsworker-agent \
--reuse-values \
--set resources.limits.memory=512Mi