Introduction

Edge is a lightweight Kubernetes agent that maps how your services depend on each other and gives NOFire secure access to on-prem data sources behind your firewall. The dependency map shows blast radius before you deploy. The Edge Proxy fetches metrics, logs, and traces from Prometheus, Loki, Tempo, and other backends on demand, without exposing credentials or requiring inbound firewall rules.

​

How it works

Edge runs as a lightweight, read-only Kubernetes agent that:

1. Monitors your Kubernetes clusters. Observes pods, services, deployments, configmaps, and other resources across configured namespaces.
2. Maps service relationships. Discovers how services depend on each other through DNS traffic (CoreDNS via DNSTap). No sidecars, no application changes.
3. Tracks changes over time. Records deployments, scaling events, and configuration updates.
4. Builds the production map. A live record of your services, how they connect, and what changed. Used for blast radius, deployment risk, and incident investigation. The graph gets richer as you connect more sources (GitHub, Prometheus, cloud providers, etc.).
5. Streams updates to NOFire. Sends dependency and change data over HTTPS (outbound only).

All connections are outbound-only over TCP 443. Edge never modifies Kubernetes resources and has no inbound ports. Most APM tools require you to instrument your code, deploy sidecar proxies, or maintain a service catalog by hand. Edge takes a different approach: it watches DNS traffic through CoreDNS DNSTap to see which services talk to each other at runtime. No changes to your application code, no sidecars, no annotations.

​

What the production map gives you

​

Security & privacy

• Read-only access. Edge never modifies your Kubernetes resources, and the proxy only forwards read requests.
• Encrypted in transit. All communication uses TLS (HTTPS for graph data, TLS-secured gRPC for queries).
• Credentials never leave your cluster. Tokens and passwords are read from Kubernetes Secrets mounted as volumes. NOFire only receives query results, never data source URLs or credentials.
• PII redaction. Query results can be scrubbed before leaving your network. See Sensitive Data Redaction.
• Configurable scope. Control which namespaces to monitor with namespace allow/deny filtering, and which data sources to expose.
• Open architecture. Review permissions via the ClusterRole definition.

​

On-prem data access

NOFire queries metrics, logs, and traces from your data sources directly. If those backends are behind a firewall, the Edge Proxy fetches the data on NOFire’s behalf. The Edge Proxy initiates an outbound-only gRPC stream to NOFire. Your credentials and data source URLs stay inside the cluster. NOFire only receives query results. Self-service onboarding: Teams add data sources by declaring them in values.yaml and deploying with Helm. No tickets, no manual provisioning. Firewall-friendly: The proxy initiates an outbound-only gRPC stream over TCP 443. No inbound firewall rules, no VPNs, no tunnels. GitOps-ready: Data source configuration lives in a declarative values.yaml, version-controlled alongside the rest of your infrastructure. Supported types: Prometheus, Loki, Tempo, Grafana, Elasticsearch, OpenSearch, MongoDB Atlas, and Alertmanager. All query results pass through PII redaction before leaving your network. NOFire never sees your credentials or data source URLs. See On-Prem Connections for setup instructions and Configuration for the full reference.

​

Next steps

Have a specific question about networking, credentials, upgrades, or scaling? See the FAQ.