Kubernetes

Route status: PUBLISHED — acceptance steps 1–7 passed on 2026-08-12 against agent 0.1.1 on a real three-node cluster, including a pod delete that came back on the persisted credential.

Get your token first (step 1); the enrolment panel renders this block with the token and your server URL already substituted.

kubectl create secret generic wirewatch-agent \
  --from-literal=token=<your-token> \
  --from-literal=server=<your-server-url>
kubectl apply -f https://github.com/WireWatch/agent-releases/releases/download/agent-v0.1.3/agent-k8s.yaml

The manifest is a published, signed release artifact, identical for every customer, with the image already pinned by digest — never a floating tag. Only the token and the server URL are yours, and they live in the Secret rather than in a YAML that tends to end up committed to a GitOps repo. Verify the manifest against its own bundle first: Verify a release.

What the manifest contains, and why each part is load-bearing

• replicas: 1. Two pods sharing one enrolled identity are duplicate execution for the same monitor and location, which the fencing-token check rejects — the second pod’s results are discarded and its probes wasted. Scale by enrolling more agents, never by raising this. A DaemonSet is wrong for the same reason.
• strategy: Recreate with a ReadWriteOnce PVC. RollingUpdate would briefly want two pods, and on a single-node cluster the second blocks on the volume.
• A PersistentVolumeClaim at /var/lib/wirewatch plus --config-dir=/var/lib/wirewatch, with fsGroup: 65532 so the non-root container can write it. Same reason as the Docker route.
• fsGroupChangePolicy: OnRootMismatch, without which the kubelet re-applies g+rw to that volume on every mount and the agent’s 0600 key comes back 0660, which it refuses to load.
• A non-root initContainer that narrows an already-widened key back to 0600. It is what lets a volume enrolled under an older manifest come back at all: that key is already 0660, its token is already spent, and the image has no shell to kubectl exec into.

The previous release’s manifest is missing the last two, and release assets are immutable

Applying it enrols the first pod and strands every one after it in CrashLoopBackOff, with the single-use token already spent. An operator chmod does not help.

The URL above names the current release, which carries both. If you are on the broken one, apply this manifest over it and delete the pod: the initContainer narrows the key back and the agent resumes on the credential it already holds, with no new token.

Rollout and logs

kubectl rollout status deployment/wirewatch-agent
kubectl logs deployment/wirewatch-agent

Delete the pod (kubectl delete pod -l app.kubernetes.io/name=wirewatch-agent); it must come back on the persisted credential without a new token.