Run the agent in your cluster

The agent also runs as a Deployment in a Kubernetes cluster: one pod that dials out, keeps its pairing on a small volume, and runs as an unprivileged user with a read-only filesystem. Its image is ghcr.io/wizardmordamir/slate, built for amd64 and arm64 from the same signed files the installer serves.

1. Make its namespace and the key for its keyring. The key encrypts the agent's token on its volume, and it stays in your cluster:

kubectl create namespace slate-agent
kubectl -n slate-agent create secret generic slate-agent --from-literal=SLATE_KEYRING_KEY="$(openssl rand -hex 32)"

2. Read the manifest, then apply it. It is a namespace, a ServiceAccount bound to a read-only ClusterRole (get, list and watch: no verb that changes anything), a 64 MiB volume, and the Deployment. Its image is pinned to the digest this release signed, so the cluster pulls exactly what was published:

curl -fsSL https://orbslate.com/agent/kubernetes.yaml -o slate-agent.yaml
kubectl apply -f slate-agent.yaml

?environment=staging on that address names the cluster's tier (prod unless you say).

3. Pair it. kubectl -n slate-agent logs deploy/slate-agent prints a code and the address of its pairing page. Open that address, sign in, check the code, and choose Pair this agent, as for slate login. The pod waits ten minutes for it, then starts again with a new code. Once paired, it adds its own cluster as a connection named cluster, read through its ServiceAccount, never a kubeconfig.

A new release means a new manifest: fetch it again and apply it. kubectl delete namespace slate-agent removes it all; revoke the agent in Agents too.