Deploy on Kubernetes - Hilt Documentation

Cluster resources

The DMG Collector is deployed as a single DaemonSet, with one pod per node. The manifest also creates the minimal RBAC resources required for operation.

Object	Name	Purpose
ServiceAccount	`dag-agent`	Identity for the DaemonSet pods
ClusterRole	`dag-agent-node-reader`	Get nodes to resolve node metadata
ClusterRoleBinding	n/a	Binds the SA to the ClusterRole
DaemonSet	`dag-agent`	Runs one collector pod per node

The DaemonSet does not create a Service or Ingress; the agent has no listening ports. The only network path is outbound HTTPS from each pod to DAG_SHIP_URL.

Runtime configuration

The DaemonSet is configured with the following:

privileged: true: Required for bpf(2) and perf ring buffer access. Without it the kernel will refuse to load the programs.
hostPID: true: Ensures pid fields in events map to real host PIDs rather than container-scoped ones. Without this the dashboard cannot correlate events from the agent with processes your operators actually see with ps, crictl, or kubectl exec.
hostNetwork: true: Allows network observation in the host namespace.
dnsPolicy: ClusterFirstWithHostNet: Ensures proper DNS resolution (e.g., private Route 53 via VPC).

Host mounts

The collector uses three read-only host mounts. No writable host mounts are used.

Mount	Purpose
`/sys/kernel/debug`	Access to tracefs for attaching tracepoints.
`/sys/kernel/btf`	BTF data for CO-RE relocation.
`/etc/machine-id`	Stable node identifier fallback.

Installation

The manifest uses seven placeholders that you substitute at apply time. The Kubernetes manifest is included in each release under k8s/daemonset.yaml.

Extract the release tarball

tar xzf dag-agent-v<X>-linux-aarch64.tar.gz
cd dag-agent-v<X>-linux-aarch64/k8s

Substitute placeholders and apply

sed -e 's|__REGISTRY__|<your-account>.dkr.ecr.<region>.amazonaws.com|' \
    -e 's|__TAG__|v1.8.0|' \
    -e 's|__SHIP_URL__|https://<name>-ingest.hilt.ai/ingest|' \
    -e 's|__CPU_REQUEST__|100m|' -e 's|__MEMORY_REQUEST__|128Mi|' \
    -e 's|__CPU_LIMIT__|500m|' -e 's|__MEMORY_LIMIT__|512Mi|' \
    daemonset.yaml | kubectl apply -f -

Verify deployment

kubectl get daemonset dag-agent -o wide
kubectl get pods -l app=dag-agent -o wide
kubectl logs -l app=dag-agent --tail=20

Tolerations and node selection

The shipped manifest tolerates the standard CriticalAddonsOnly taint. If your cluster uses dedicated node pools, tainted system pools, or GPU / special-hardware taints, add matching tolerations to the DaemonSet spec before applying. The agent is lightweight enough to run on every node in the cluster, including control-plane nodes and dedicated pools. Leaving a taint un-tolerated creates a visibility gap that the detection pipeline cannot fill. If you want to exclude specific nodes, add a nodeAffinity. Ensure exclusions are documented, as they create explicit blind spots.

Upgrade

Hilt pushes new images as both v1.<new>.<patch> and, in continuous deployments, a moving tag (dev-latest, prod-latest, etc., depending on your channel). Upgrade with immutable tag:

kubectl set image daemonset/dag-agent agent=<registry>/dag-agent:v1.9.0
kubectl rollout status daemonset/dag-agent

Upgrade with moving tag:

kubectl rollout restart daemonset/dag-agent
kubectl rollout status daemonset/dag-agent

DaemonSet rolling updates replace one pod per node at a time; event stream interruption per node is on the order of 1–2 seconds.

Uninstall

kubectl delete -f daemonset.yaml

No node reboots are required, and no host artifacts remain.