Installation

Prerequisites

Kubernetes v1.20+
Helm v3+
Administrator access to the cluster (for RBAC and CoreDNS patching)
Outbound HTTPS access to NOFire AI
NOFire API Key from your dashboard
(Optional) Prometheus Operator for ServiceMonitor support

1. Helm install

Add the Helm repository

helm repo add nofire https://nofireai.github.io/edge-helm-chart
helm repo update

Step 1: Initial install

helm install nofire-edge nofire/nofire-edge \
  --set config.publisher.apiKey=YOUR_API_KEY \
  -n nofire-system --create-namespace

Step 2: Get the ClusterIP

kubectl get service nofire-edge -n nofire-system

Copy the ClusterIP from the output (for example, 10.96.145.200).

Step 3: Reinstall with static IP

A static ClusterIP keeps the service IP unchanged during upgrades and reinstalls. This is critical for CoreDNS configuration stability.Use the auto-assigned IP from Step 2 as your static IP to avoid conflicts. Learn more about ClusterIP allocation strategy.

helm uninstall nofire-edge -n nofire-system

helm install nofire-edge nofire/nofire-edge \
  --set config.publisher.apiKey=YOUR_API_KEY \
  --set service.clusterIP=<CLUSTER_IP_FROM_STEP_2> \
  -n nofire-system --create-namespace

Alternatively, you can use a values file:

config:
  publisher:
    apiKey: "YOUR_API_KEY"

service:
  clusterIP: "10.96.145.200"

# Optional: enable if Prometheus Operator is installed
# monitoring:
#   serviceMonitor:
#     enabled: true

helm install nofire-edge nofire/nofire-edge -f values.yaml -n nofire-system --create-namespace

2. DNSTap configuration

Without DNSTap, Edge will only see static resources and will not show runtime service dependencies.

Step 1: Find the ClusterIP

EDGE_IP=$(kubectl get svc nofire-edge -n nofire-system -o jsonpath='{.spec.clusterIP}')
echo "Edge ClusterIP: $EDGE_IP"

Step 2: Patch CoreDNS

If you set up DNSTap from the NOFire AI dashboard, check the ConfigMap before you apply it. The dashboard’s copy button on this step does not copy the dnstap tcp://<CLUSTER_IP>:6000 full line shown below. Add it by hand.

Get the current CoreDNS ConfigMap:

kubectl get configmap coredns -n kube-system -o yaml > coredns.yaml

Open coredns.yaml and insert the dnstap line inside the .:53 block:

.:53 {
    errors
    health {
        lameduck 5s
    }
    ready
    kubernetes cluster.local in-addr.arpa ip6.arpa {
        pods insecure
        fallthrough in-addr.arpa ip6.arpa
        ttl 30
    }
    # --- INSERT THIS LINE ---
    dnstap tcp://NOFIRE_EDGE_IP:6000 full
    # ------------------------
    prometheus :9153
    forward . /etc/resolv.conf {
        max_concurrent 1000
    }
    cache 30
    loop
    reload
    loadbalance
}

Replace NOFIRE_EDGE_IP with the ClusterIP from Step 1. Apply and restart CoreDNS:

kubectl apply -f coredns.yaml
kubectl rollout restart deployment coredns -n kube-system

Step 3: Test the DNSTap connection

Check the Edge logs for connection and handshake messages:

kubectl logs -l app.kubernetes.io/name=nofire-edge -n nofire-system | grep -iE "DNS Tap connection accepted|Handshake successful|Received data frame"

The logs show these messages, in order:

"New DNS Tap connection accepted": CoreDNS connected
"Handshake successful, ready to receive frames": the handshake completed
"Received data frame": DNS tap data is flowing

To test that Edge detects dependencies:

kubectl logs -l app.kubernetes.io/name=nofire-edge -n nofire-system | grep "dependency"

If no connection logs appear, CoreDNS is not reaching Edge. Check:

The dnstap line in the CoreDNS ConfigMap uses the correct Edge ClusterIP
You restarted CoreDNS after the ConfigMap change
CoreDNS logs for dropped dnstap messages: kubectl logs -l k8s-app=kube-dns -n kube-system | grep -i drop

3. Test that Edge is running

kubectl get pods -n nofire-system
kubectl logs -l app.kubernetes.io/name=nofire-edge -n nofire-system

Look for Graph published successfully in the logs.

4. Network observability (optional)

Beyond the DNS-derived dependency map, Edge can map the real service-to-service calls in your cluster by reading an observability stack you already run (Hubble, Istio, or Caretta). It is disabled by default. See Network Observability to enable it and compare what each backend surfaces.

5. Edge Proxy (optional)

If your observability backends are behind a firewall, the Edge Proxy gives NOFire direct access to them on demand. No VPN or inbound firewall rules are required.

Step 1: Create a connector secret

kubectl create secret generic prometheus-creds \
  --from-literal=token=YOUR_PROMETHEUS_TOKEN \
  -n nofire-system

Step 2: Add to `values.yaml`

edgeProxy:
  stream:
    serverAddress: "edge.nofire.ai:443"

onPremConnections:
  prod-prometheus:
    type: prometheus
    url: "http://prometheus.monitoring:9090"
    secretName: prometheus-creds

The proxy pod is created automatically when you define onPremConnections.

Step 3: Upgrade

helm upgrade nofire-edge nofire/nofire-edge \
  -f values.yaml \
  -n nofire-system

Step 4: Test the proxy

kubectl get pods -l app.kubernetes.io/component=edge-proxy -n nofire-system
kubectl logs -l app.kubernetes.io/component=edge-proxy -n nofire-system | grep "handshake complete"

Expected: Stream connected and handshake complete See On-Prem Connections to add more data sources.

Troubleshooting

No dependencies showing up. Check CoreDNS logs: kubectl logs -n kube-system -l k8s-app=kube-dns. Make sure that the DNSTap line uses the correct Edge ClusterIP and that you restarted CoreDNS.
Permission errors. Make sure that the nofire-edge ServiceAccount has the necessary RBAC permissions (ClusterRole).
Graph not publishing. Make sure that the API key is correct and that outbound HTTPS to NOFire AI is allowed.

Get Started

Production readiness

Change management

Incidents

Always-On Workflows

Analytics

Setup & Integrations

Security

Prerequisites

1. Helm install

Add the Helm repository

Step 1: Initial install

Step 2: Get the ClusterIP

Step 3: Reinstall with static IP

2. DNSTap configuration

Step 1: Find the ClusterIP

Step 2: Patch CoreDNS

Step 3: Test the DNSTap connection

3. Test that Edge is running

4. Network observability (optional)

5. Edge Proxy (optional)

Step 1: Create a connector secret

Step 2: Add to `values.yaml`

Step 3: Upgrade

Step 4: Test the proxy

Troubleshooting

​Prerequisites

​1. Helm install

​Add the Helm repository

​Step 1: Initial install

​Step 2: Get the ClusterIP

​Step 3: Reinstall with static IP

​2. DNSTap configuration

​Step 1: Find the ClusterIP

​Step 2: Patch CoreDNS

​Step 3: Test the DNSTap connection

​3. Test that Edge is running

​4. Network observability (optional)

​5. Edge Proxy (optional)

​Step 1: Create a connector secret

​Step 2: Add to values.yaml

​Step 3: Upgrade

​Step 4: Test the proxy

​Troubleshooting

Prerequisites

1. Helm install

Add the Helm repository

Step 1: Initial install

Step 2: Get the ClusterIP

Step 3: Reinstall with static IP

2. DNSTap configuration

Step 1: Find the ClusterIP

Step 2: Patch CoreDNS

Step 3: Test the DNSTap connection

3. Test that Edge is running

4. Network observability (optional)

5. Edge Proxy (optional)

Step 1: Create a connector secret

Step 2: Add to `values.yaml`

Step 3: Upgrade

Step 4: Test the proxy

Troubleshooting