Data Collection
Overview
During an investigation, OpsWorker collects data from your Kubernetes cluster through the in-cluster agent. All collection is read-only and scoped to the resources relevant to the investigation.
What Is Collected on the Core Path
The core investigation path uses the in-cluster agent, which runs with the built-in view ClusterRole, to gather the following:
| Data Type | Source | Purpose |
|---|---|---|
| Pod status | kubectl get pod | Current state, restart counts, container statuses |
| Pod logs | kubectl logs | Application errors, stack traces, crash output |
| Kubernetes events | kubectl get events | Scheduling, state transitions, errors, warnings |
| Deployment specs | kubectl get deployment | Replica count, strategy, resource limits |
| Service specs | kubectl get service | Selectors, ports, type |
| Ingress rules | kubectl get ingress | Routing rules, TLS configuration |
By default the agent has read-only access and does not read Secret values.
Optional Data via the Kubernetes MCP Server
The following data types are not collected on the core path. They can be gathered only when the optional Kubernetes MCP server is deployed and enabled:
| Data Type | Notes |
|---|---|
| ConfigMaps | Application configuration |
| Secrets | Access is opt-in and disabled by default; the agent does not read Secret values by default |
| Nodes | Conditions, capacity, allocatable resources |
| Endpoints | Healthy/unhealthy backends |
| Metrics | Cluster metrics are not collected on the core path |
How Collection Works
- The investigation engine determines what data is needed based on the alert and discovered topology
- Commands are sent to the in-cluster agent via SQS
- The agent executes the kubectl-equivalent query against the Kubernetes API
- Results are returned via SQS to the investigation engine
What Is NOT Collected
- Secret values: By default the agent has read-only access and does not read Secret values; secret access is opt-in and disabled by default
- Container filesystem: No exec or file access inside containers
- Network traffic: No packet capture or network monitoring
- Metrics on the core path: Cluster metrics are not collected on the core investigation path; use the Grafana MCP integration to query metrics on demand
Data Minimization
OpsWorker only collects data relevant to the specific investigation:
- Only resources in the discovered topology are queried
- Log collection is limited to recent entries
- Collection stops once sufficient data is gathered for analysis
Data in Transit
All data between the agent and OpsWorker cloud is transmitted via AWS SQS over TLS-encrypted connections.
Next Steps
- Data Processing: How collected data is analyzed
- Isolation & Encryption: Data protection details