Installation

Prerequisites

Kubernetes v1.20+
Helm v3+
Administrator access to the cluster (for RBAC and CoreDNS patching)
Outbound HTTPS access to NOFire AI
NOFire API Key from your dashboard
(Optional) Prometheus Operator for ServiceMonitor support

1. Helm Install

Add the Helm Repository

helm repo add nofire https://nofireai.github.io/edge-helm-chart
helm repo update

Step 1: Initial Install

helm install nofire-edge nofire/nofire-edge \
  --set config.publisher.apiKey=YOUR_API_KEY \
  -n nofire-system --create-namespace

Step 2: Get the ClusterIP

kubectl get service nofire-edge -n nofire-system

Copy the ClusterIP from the output (e.g., 10.96.145.200).

Step 3: Reinstall with Static IP

Setting a static ClusterIP ensures the service IP does not change during upgrades or reinstalls. This is critical for CoreDNS configuration stability.Use the auto-assigned IP from Step 2 as your static IP to avoid conflicts. Learn more about ClusterIP allocation strategy.

helm uninstall nofire-edge -n nofire-system

helm install nofire-edge nofire/nofire-edge \
  --set config.publisher.apiKey=YOUR_API_KEY \
  --set service.clusterIP=<CLUSTER_IP_FROM_STEP_2> \
  -n nofire-system --create-namespace

Alternatively, using a values file:

config:
  publisher:
    apiKey: "YOUR_API_KEY"

service:
  clusterIP: "10.96.145.200"

# Optional: enable if Prometheus Operator is installed
# monitoring:
#   serviceMonitor:
#     enabled: true

helm install nofire-edge nofire/nofire-edge -f values.yaml -n nofire-system --create-namespace

2. DNSTap Configuration

Without DNSTap, Edge will only see static resources and will not show runtime service dependencies.

Step 1: Confirm the ClusterIP

EDGE_IP=$(kubectl get svc nofire-edge -n nofire-system -o jsonpath='{.spec.clusterIP}')
echo "Edge ClusterIP: $EDGE_IP"

Step 2: Patch CoreDNS

Get the current CoreDNS ConfigMap:

kubectl get configmap coredns -n kube-system -o yaml > coredns.yaml

Open coredns.yaml and insert the dnstap line inside the .:53 block:

.:53 {
    errors
    health {
        lameduck 5s
    }
    ready
    kubernetes cluster.local in-addr.arpa ip6.arpa {
        pods insecure
        fallthrough in-addr.arpa ip6.arpa
        ttl 30
    }
    # --- INSERT THIS LINE ---
    dnstap tcp://NOFIRE_EDGE_IP:6000 full
    # ------------------------
    prometheus :9153
    forward . /etc/resolv.conf {
        max_concurrent 1000
    }
    cache 30
    loop
    reload
    loadbalance
}

Replace NOFIRE_EDGE_IP with the ClusterIP from Step 1. Apply and restart CoreDNS:

kubectl apply -f coredns.yaml
kubectl rollout restart deployment coredns -n kube-system

Step 3: Verify DNSTap Connection

Check the Edge logs for connection and handshake messages:

kubectl logs -l app.kubernetes.io/name=nofire-edge -n nofire-system | grep -iE "DNS Tap connection accepted|Handshake successful|Received data frame"

You should see, in order:

"New DNS Tap connection accepted" — CoreDNS connected
"Handshake successful, ready to receive frames" — protocol handshake completed
"Received data frame" — DNS tap data is flowing

To verify dependencies are being detected:

kubectl logs -l app.kubernetes.io/name=nofire-edge -n nofire-system | grep "dependency"

If no connection logs appear, CoreDNS is not reaching Edge. Check:

The dnstap line in the CoreDNS ConfigMap uses the correct Edge ClusterIP
CoreDNS was restarted after the ConfigMap change
CoreDNS logs for dropped dnstap messages: kubectl logs -l k8s-app=kube-dns -n kube-system | grep -i drop

3. Verify Edge Is Running

kubectl get pods -n nofire-system
kubectl logs -l app.kubernetes.io/name=nofire-edge -n nofire-system

Look for Graph published successfully in the logs.

4. Network Observability (Optional)

Beyond the DNS-derived dependency map, Edge can map the real service-to-service calls in your cluster by reading an observability stack you already run (Hubble, Istio, or Caretta). It is disabled by default. See Network Observability to enable it and compare what each backend surfaces.

5. Edge Proxy (Optional)

If your observability backends are behind a firewall, the Edge Proxy gives NOFire direct access to them on demand. No VPN or inbound firewall rules required.

Step 1: Create a Connector Secret

kubectl create secret generic prometheus-creds \
  --from-literal=token=YOUR_PROMETHEUS_TOKEN \
  -n nofire-system

Step 2: Add to `values.yaml`

edgeProxy:
  stream:
    serverAddress: "edge.nofire.ai:443"

onPremConnections:
  prod-prometheus:
    type: prometheus
    url: "http://prometheus.monitoring:9090"
    secretName: prometheus-creds

The proxy pod is created automatically when onPremConnections is defined.

Step 3: Upgrade

helm upgrade nofire-edge nofire/nofire-edge \
  -f values.yaml \
  -n nofire-system

Step 4: Verify the Proxy

kubectl get pods -l app.kubernetes.io/component=edge-proxy -n nofire-system
kubectl logs -l app.kubernetes.io/component=edge-proxy -n nofire-system | grep "handshake complete"

Expected: Stream connected and handshake complete See On-Prem Connections to add more data sources.

Troubleshooting

No dependencies showing up. Check CoreDNS logs: kubectl logs -n kube-system -l k8s-app=kube-dns. Verify the DNSTap line uses the correct Edge ClusterIP and that CoreDNS was restarted.
Permission errors. Ensure the nofire-edge ServiceAccount has the necessary RBAC permissions (ClusterRole).
Graph not publishing. Verify the API key is correct and outbound HTTPS to NOFire AI is allowed.

Get Started

Skills

Platform Features

Setup & Integrations

Security

Prerequisites

1. Helm Install

Add the Helm Repository

Step 1: Initial Install

Step 2: Get the ClusterIP

Step 3: Reinstall with Static IP

2. DNSTap Configuration

Step 1: Confirm the ClusterIP

Step 2: Patch CoreDNS

Step 3: Verify DNSTap Connection

3. Verify Edge Is Running

4. Network Observability (Optional)

5. Edge Proxy (Optional)

Step 1: Create a Connector Secret

Step 2: Add to `values.yaml`

Step 3: Upgrade

Step 4: Verify the Proxy

Troubleshooting

​Prerequisites

​1. Helm Install

​Add the Helm Repository

​Step 1: Initial Install

​Step 2: Get the ClusterIP

​Step 3: Reinstall with Static IP

​2. DNSTap Configuration

​Step 1: Confirm the ClusterIP

​Step 2: Patch CoreDNS

​Step 3: Verify DNSTap Connection

​3. Verify Edge Is Running

​4. Network Observability (Optional)

​5. Edge Proxy (Optional)

​Step 1: Create a Connector Secret

​Step 2: Add to values.yaml

​Step 3: Upgrade

​Step 4: Verify the Proxy

​Troubleshooting

Prerequisites

1. Helm Install

Add the Helm Repository

Step 1: Initial Install

Step 2: Get the ClusterIP

Step 3: Reinstall with Static IP

2. DNSTap Configuration

Step 1: Confirm the ClusterIP

Step 2: Patch CoreDNS

Step 3: Verify DNSTap Connection

3. Verify Edge Is Running

4. Network Observability (Optional)

5. Edge Proxy (Optional)

Step 1: Create a Connector Secret

Step 2: Add to `values.yaml`

Step 3: Upgrade

Step 4: Verify the Proxy

Troubleshooting