Skip to main content

​
Connectivity & Networking

No. Both Edge and Edge Proxy initiate outbound connections only. Edge Proxy dials my.nofire.ai:443 and maintains a long-lived bidirectional gRPC stream. Edge publishes graph updates to the same backend. No inbound ports need to be opened and no load balancer is required.
Edge Proxy communicates over HTTP/2 with a long-lived gRPC stream (connections span 30+ minutes). Standard HTTP/1.1 proxies will not support this. If your outbound traffic passes through an internal proxy:
  • The proxy must support HTTP/2 with long-lived streaming connections
  • If it does not, allowlist my.nofire.ai:443 directly so Edge Proxy bypasses the proxy for that destination
Edge Proxy reconnects automatically. It uses exponential backoff starting at 1 second, capped at 60 seconds. All three internal loops (heartbeat, receive, send) monitor the connection — if any exits with an error, the stream is cancelled and reconnection begins immediately.You can observe reconnections in the proxy logs:
Edge still runs and publishes your cluster topology (pods, services, deployments, namespaces, nodes). What you lose is runtime service dependency discovery — the edges between services in the dependency graph will not be populated.Without DNSTap, NOFire can see your infrastructure but cannot automatically map which services call which. You can still use the platform, but dependency-based production context will be less accurate.See Installation for setup steps.
CoreDNS is configured to forward DNS tap frames to the Edge service by IP address (not DNS name). If Edge is uninstalled and reinstalled without pinning the ClusterIP, Kubernetes assigns a new IP, and CoreDNS stops sending DNS traffic until manually reconfigured.Pinning the ClusterIP at install time prevents this. It is a one-time step — helm upgrade preserves the ClusterIP without reinstalling.

​
Data & Security

No. Credentials are stored as Kubernetes Secrets and mounted into the Edge Proxy pod at /var/run/secrets/<secret-name>/. The proxy resolves credentials locally and injects them into HTTP requests to your data sources. Raw secret values are never included in the gRPC stream sent to NOFire’s backend.
Two data streams:
  1. Kubernetes resource graph — Edge continuously watches your cluster and publishes changes: pods, services, deployments, namespaces, nodes, and service-to-service dependency edges discovered via DNS. No workload data (secrets, configmap values, environment variables) is included.
  2. Observability query results — When NOFire AI queries your on-prem data sources (Prometheus, Loki, Grafana etc.), Edge Proxy executes the HTTP request locally and returns the response body over the gRPC stream. PII redaction runs on this data before it leaves the cluster.
No. Edge operates in read-only mode. It uses the Kubernetes Watch API with get, list, and watch verbs only. It never creates, modifies, or deletes any Kubernetes resources.See RBAC Permissions for the full permission list.
No. Redaction must be explicitly enabled. When enabled, the proxy runs the following passes on every response body before transmission:
  1. Standard patterns — email, SSN, credit card, phone, IPv4 addresses
  2. Custom regex patterns — user-defined rules with configurable replacement strings
  3. JSON path targeting — redact specific fields by dot-notation path
To enable standard redaction:
See Sensitive Data Redaction for custom pattern configuration.
Yes. Add security contexts to your values.yaml:

​
Performance & Scaling

Edge Agent and Edge Proxy are deployed as separate pods. The agent keeps an in-memory graph of all Kubernetes resources, so memory scales with cluster size.Typical small-to-medium cluster (up to ~1,000 pods):For large clusters, increase the memory request for the Edge Agent. Resource limits can be set via resources in values.yaml.
Edge Proxy uses a semaphore to bound concurrent outbound HTTP requests. The default limit is 10 concurrent requests. Requests that arrive while all slots are occupied receive a 503 Too Many Requests response, which is returned to NOFire Brain.To increase the limit:
Yes. Edge Proxy enforces a 50MB maximum response body per request. Responses larger than 1MB are automatically split into chunks before transmission over the gRPC stream. Both limits are configurable:
Edge uses the Kubernetes Watch API rather than polling. It receives real-time push events when resources are created, updated, or deleted. There is no configurable polling interval — changes are reflected within seconds of occurring in the cluster.

​
Configuration & GitOps

No. All Edge and Edge Proxy configuration is managed through your values.yaml and applied via Helm. NOFire’s backend has no ability to modify your connector list, credentials, or any other settings remotely.This means configuration changes follow your standard code review and deployment process. The running state always matches what is in version control.

​
Deployment & Operations

Use helm upgrade. Your DNSTap configuration and pinned ClusterIP are preserved across upgrades.
To upgrade to a specific chart version:
If something goes wrong, roll back to the previous release:
Yes. Deploy a separate Helm release in each cluster with a unique kube.clusterName. Each cluster appears independently in the NOFire dashboard.
Check the proxy logs for a successful stream handshake:
Expected output: a log line containing StreamAck with status: OK.To check the health of all configured connectors:
This returns the health status of each data source connection.
Use the health endpoint with a specific connector key:
The response indicates whether the connector’s health check endpoint is reachable and responding correctly. Each connector type uses a different health check path (e.g., Prometheus uses /api/v1/query?query=up, Loki uses /loki/api/v1/status/buildinfo).
Add certificate configuration to the connector in your values.yaml. You can specify the certificate content directly or reference file paths if the certificates are mounted via secrets.