Quickstart

Deploy the Runtimekindle eBPF DaemonSet to your Kubernetes cluster and see your first runtime detection event in under 15 minutes.

Prerequisites

Kubernetes 1.24+ cluster (EKS, GKE, AKS, or self-managed)
Linux kernel 5.8+ with BTF enabled on worker nodes
Helm 3.10+ installed
kubectl configured with cluster access
Runtimekindle API key (from your account dashboard)

Step 1: Add the Helm repository

helm repo add runtimekindle https://charts.runtimekindle.com
helm repo update

Step 2: Create the namespace and API key secret

kubectl create namespace runtimekindle

kubectl create secret generic rtk-api-key \
  --from-literal=api-key=YOUR_API_KEY_HERE \
  --namespace runtimekindle

Step 3: Install the DaemonSet

helm install runtimekindle runtimekindle/agent \
  --namespace runtimekindle \
  --set apiKeySecret.name=rtk-api-key \
  --set apiKeySecret.key=api-key \
  --set controlPlane.endpoint=https://ingest.runtimekindle.com

Step 4: Verify the DaemonSet is running

kubectl get pods -n runtimekindle
# NAME                        READY   STATUS    RESTARTS   AGE
# runtimekindle-agent-4xkwp   1/1     Running   0          45s
# runtimekindle-agent-7mnjp   1/1     Running   0          45s
# runtimekindle-agent-q2rnv   1/1     Running   0          45s

One pod per worker node is expected. If pods are in CrashLoopBackOff, check kernel BTF support — see the K8s Install guide for troubleshooting.

Step 5: View your first events in the dashboard

Log in to your dashboard. Within 2-3 minutes of the DaemonSet becoming Ready, you should see runtime events streaming in the Events view — process executions, network connections, and any detected anomalies.

Next steps

Full Helm values reference — customize DaemonSet resource limits, policy rules, and multi-cluster configuration
Add the GitHub Actions step to generate SBOMs and sign artifacts at CI time
Configure Slack or PagerDuty alerts for critical runtime events
API reference for programmatic SBOM export and event retrieval