The TigerGate agents ship as one Helm chart (tigergate): the KSPM posture operator, the admission-control webhook, and the TigerGate runtime sensor (on by default). Two more are optional and off by default — a per-node CIS host-scanner and an AI-remediation executor. One org API key, one cluster name, one install — the same chart on self-hosted (k3s / kubeadm / bare-metal) and managed (EKS / AKS / GKE / OKE) clusters.
Prerequisites
- A Kubernetes cluster v1.23+, with
helm and kubectl pointed at it.
- An org API key (
tg_…) — Dashboard → Settings → API Keys.
- Cluster egress on
443 to your region’s API and Ingest hosts — api.tigergate.dev and sensor.tigergate.dev on us1, the default.
Pick your region
The chart’s region value decides which TigerGate region the operator, admission webhook, and sensor report to. It’s the one thing you must get right before the API key will authenticate, and it belongs in your firewall rules too.
Leave region unset for us1. For any other region add --set region=<code> to every command on this page. The chart derives backend.url and backend.ingestGrpcAddr from it, so those two never need setting by hand. See Regions.
Install
Install the chart
helm install tigergate oci://registry.tigergate.dev/charts/tigergate \
--namespace tigergate-system --create-namespace \
--set backend.apiKey=tg_<org-api-key> \
--set clusterName=my-cluster
# add --set region=<code> unless your organization is in us1
Verify the agents are running
kubectl -n tigergate-system get pods
kubectl -n tigergate-system logs deploy/tigergate-operator -f
See it in the dashboard
Open Dashboard → KSPM. The cluster appears after the first scan (default every 30 min; the first report is sent shortly after startup).
Keep the key out of your shell history — pre-create a Secret and reference it:kubectl -n tigergate-system create secret generic tg-key --from-literal=apiKey=tg_xxx
helm install tigergate oci://registry.tigergate.dev/charts/tigergate \
-n tigergate-system --create-namespace \
--set clusterName=my-cluster --set backend.existingSecret=tg-key
Self-hosted vs. managed
The one setting that changes by environment is nodeScanner.enabled:
| Cluster | nodeScanner.enabled | Why |
|---|
| Self-hosted — k3s, kubeadm, bare-metal | true | Turns CIS control-plane / etcd / kubelet checks from NOT_ASSESSED into real PASS / FAIL. |
| Managed — EKS, AKS, GKE, OKE | false (default) | The control plane isn’t on a node you can read, so this adds nothing. Those checks stay NOT_ASSESSED (never a false FAIL). |
# self-hosted only — turn on the node host-scanner:
helm upgrade tigergate oci://registry.tigergate.dev/charts/tigergate \
--namespace tigergate-system --reuse-values \
--set nodeScanner.enabled=true
GKE Autopilot rejects privileged pods, which the runtime sensor needs — install with --set sensor.enabled=false there (KSPM itself is unaffected), or run the sensor on a Standard node pool. EKS Fargate / virtual-kubelet nodes are skipped automatically.
Key values
| Key | Default | Notes |
|---|
backend.apiKey | "" | Org tg_ key. Required (or set backend.existingSecret). |
backend.existingSecret | "" | Pre-created Secret containing key apiKey. |
clusterName | "" | Required. Your cluster name (used to auto-register). |
region | "" (= us1) | TigerGate region this cluster reports to. Sets both endpoints below. |
backend.url | from region | Backend base URL. Set it only to override the region — a self-hosted or staging platform. |
backend.ingestGrpcAddr | from region | gRPC ingest for scans / admission / node controls. Same override rule. |
controller.scanIntervalPosture | 30m | Re-scan interval. |
admission.mode | audit | audit (warn) or enforce (deny). |
admission.level | baseline | baseline or restricted Pod Security. |
admission.allowedRegistries | [] | [] = any registry (image-trust off). |
sensor.enabled | true | TigerGate eBPF runtime DaemonSet — see Runtime Agent. |
nodeScanner.enabled | false | Per-node CIS host-scanner — on for self-hosted. |
remediation.enabled | false | AI-fix apply executor — the only write-capable component. |
imagePullSecrets | [] | For a private image registry. |
values.yaml.
Common changes
Enforce admission
KSPM only (no sensor)
AI remediation
Private registry
helm upgrade tigergate oci://registry.tigergate.dev/charts/tigergate \
--namespace tigergate-system --reuse-values \
--set admission.mode=enforce --set admission.level=restricted
audit, review findings, then switch.--set sensor.enabled=false
--set remediation.enabled=true
get+patch on Deployments / StatefulSets / DaemonSets only) that applies fixes you’ve previewed in the dashboard.--set image.repository=<registry>/tigergate-kspm-agent \
--set sensor.image.repository=<registry>/tigergate-sensor \
--set imagePullSecrets[0].name=my-pull-secret
Runtime events
This chart installs the sensor, but it ships events only after you enable export — see Runtime Agent → Kubernetes. Audit vs. enforce for runtime is per-policy in Dashboard → Runtime → Policies.
Uninstall
helm uninstall tigergate -n tigergate-system
kubectl delete namespace tigergate-system
Security model
- Operator / admission / node-scanner — read-only cluster RBAC (
get / list / watch); never mutate cluster state.
- Remediator (opt-in) — a separate Deployment with its own ServiceAccount,
get+patch on Deployments / StatefulSets / DaemonSets only, and only applies fixes already previewed in the dashboard.
- Admission webhook — self-signed serving cert; never intercepts system or release namespaces;
failurePolicy: Ignore by default.
- Sensor / node-scanner —
privileged + hostPID for eBPF / host /proc; mount only the kernel bpf/debug filesystems (sensor) and read-only host paths (node-scanner).
