Skip to main content
Edge is a lightweight Kubernetes agent that maps how your services depend on each other and gives NOFire secure access to on-prem data sources behind your firewall. The dependency map shows blast radius before you deploy. The Edge Proxy fetches metrics, logs, and traces from Prometheus, Loki, Tempo, and other backends on demand, without exposing credentials or requiring inbound firewall rules.

​
Why It Matters

Without Edge

  • No dependency map before deploy
  • No blast radius visibility for changes
  • Correlation-based analysis during incidents
  • Manual service mapping required
  • VPNs or tunnels needed for on-prem data
  • Credentials shared with external services

With Edge

  • Dependency map updated on every deploy
  • Blast radius shown before changes roll out
  • Cause-and-effect reasoning during incidents
  • On-prem query access through outbound-only connections
  • No inbound firewall rules, VPNs, or tunnels
  • Self-service data source onboarding via Helm values
  • Credentials never leave your cluster

​
How It Works

Edge runs as a lightweight, read-only Kubernetes agent that:
  1. Monitors your Kubernetes clusters. Observes pods, services, deployments, configmaps, and other resources across configured namespaces.
  2. Maps service relationships. Discovers how services depend on each other through DNS traffic (CoreDNS via DNSTap). No sidecars, no application changes.
  3. Tracks changes over time. Records deployments, scaling events, and configuration updates.
  4. Builds the Production Context Graph. A live map of your services, how they connect, and what changed. Used for blast radius, deployment risk, and incident investigation. The graph gets richer as you connect more sources (GitHub, Prometheus, cloud providers, etc.).
  5. Streams updates to NOFire. Sends dependency and change data over HTTPS (outbound only).
NOFire AI Explore view showing the cart service Production Context Graph with connections to checkout, frontend, valkey-cart, otel-collector, and flagd, plus recent infrastructure events

The Production Context Graph in the NOFire AI Explore view — service relationships, pod-level detail, and recent change events for the cart service.

All connections are outbound-only over TCP 443. Edge never modifies Kubernetes resources and has no inbound ports. Most APM tools require you to instrument your code, deploy sidecar proxies, or maintain a service catalog by hand. Edge takes a different approach: it watches DNS traffic through CoreDNS DNSTap to see which services talk to each other at runtime. No changes to your application code, no sidecars, no annotations.

​
What the Production Context Graph enables

Deployment Risk

See which services your changes affect and get a risk score before you merge.

Root Cause Analysis

Investigations follow actual service relationships instead of guessing at connections.

Change Management

Track what changed across your cluster: deployments, scaling, config updates, all in one timeline.

Alert Triage

When an alert fires, NOFire knows which downstream services are affected.

​
Security & Privacy

  • Read-only access. Edge never modifies your Kubernetes resources; the proxy only forwards read requests.
  • Encrypted in transit. All communication uses TLS (HTTPS for graph data, TLS-secured gRPC for queries).
  • Credentials never leave your cluster. Tokens and passwords are read from Kubernetes Secrets mounted as volumes. NOFire only receives query results, never data source URLs or credentials.
  • PII redaction. Query results can be scrubbed before leaving your network. See Sensitive Data Redaction.
  • Configurable scope. Control which namespaces to monitor with namespace allow/deny filtering, and which data sources to expose.
  • Open architecture. Review permissions via the ClusterRole definition.

​
On-Prem Data Access

NOFire queries metrics, logs, and traces from your data sources directly. If those backends are behind a firewall, the Edge Proxy fetches the data on NOFire’s behalf. The Edge Proxy initiates an outbound-only gRPC stream to NOFire. Your credentials and data source URLs stay inside the cluster. NOFire only receives query results.
If your data sources are already accessible from the internet (e.g., Grafana Cloud, Datadog), connect them directly through Integrations. The Edge Proxy is for data sources that NOFire cannot reach directly.
Self-service onboarding — Teams add data sources by declaring them in values.yaml and deploying with Helm. No tickets, no manual provisioning. Firewall-friendly — The proxy initiates an outbound-only gRPC stream over TCP 443. No inbound firewall rules, no VPNs, no tunnels. GitOps-ready — Data source configuration lives in a declarative values.yaml, version-controlled alongside the rest of your infrastructure. Supported types: Prometheus, Loki, Tempo, Grafana, Elasticsearch, OpenSearch, MongoDB Atlas, and Alertmanager. All query results pass through PII redaction before leaving your network. NOFire never sees your credentials or data source URLs. See On-Prem Connections for setup instructions and Configuration for the full reference.

​
Next Steps

Installation

Deploy Edge and map your first cluster

On-Prem Connections

Connect Prometheus, Loki, Tempo, and other backends behind your firewall

Configuration

Full reference for Edge and Edge Proxy settings
Have a specific question about networking, credentials, upgrades, or scaling? See the FAQ.