Requirements
Prerequisites
Before installing the OpsWorker Kubernetes Agent, ensure your environment meets these requirements.
Kubernetes
| Requirement | Details |
|---|---|
| Version | Kubernetes 1.16 or later |
| Distribution | EKS, GKE, AKS, self-hosted, OpenShift |
| Access | Cluster admin permissions for initial installation |
Tools
| Tool | Version | Purpose |
|---|---|---|
| Helm | 3.x | Agent installation and management |
| kubectl | Compatible with cluster version | Verification and troubleshooting |
Network
All traffic is outbound on port 443 only; no inbound access is required.
| Requirement | Details |
|---|---|
| Outbound HTTPS (443) | AWS SQS, api.opsworker.ai, the SaaS onboarding endpoint onboarding.ow-saas-prod-ext.opsworker.ai, and AWS STS |
| Inbound | None required; the agent communicates outbound only |
| DNS | Cluster DNS must resolve external hostnames |
Resources
| Resource | Request | Limit |
|---|---|---|
| CPU | 100m | 200m |
| Memory | 256Mi | 512Mi |
A default install creates three pods: the agent plus two bundled subcharts (kubernetes-mcp-server and grafana-mcp). No DaemonSets are used.
OpsWorker Account
- An OpsWorker account at app.opsworker.ai
- A cluster added in the portal (provides the cluster token needed for installation)
Network Considerations
Firewalls and Security Groups
If your cluster uses egress restrictions, allow outbound HTTPS (port 443) to:
- AWS SQS endpoints (
sqs.*.amazonaws.com) - AWS STS (
sts.*.amazonaws.com) api.opsworker.aionboarding.ow-saas-prod-ext.opsworker.ai
Proxy Environments
If outbound traffic goes through a proxy, configure proxy settings during Helm installation. See Agent Configuration.
Network Policies
If your cluster enforces NetworkPolicy resources, ensure the opsworker-agent namespace is allowed outbound HTTPS access.
Next Steps
- Installation - Install the agent