Skip to content

Installation

KubeSentry installs with a single Helm chart. The chart deploys Falco as a DaemonSet (one pod per node) and the KubeSentry collector as a Deployment.

Prerequisites

  • A Kubernetes cluster (v1.24+ recommended)
  • Helm 3.8 or newer
  • Nodes running a Linux kernel Falco supports — the chart uses Falco's modern_ebpf driver by default, which works on modern kernels
  • A namespace you're comfortable running privileged detection in (Falco needs privileged access to read kernel events)

Add the Helm repository

helm repo add kubesentry https://charts.kubesentry.io
helm repo update

Confirm the chart is available:

helm search repo kubesentry

You'll see the chart listed as kubesentry/kubesentry.

Install

Install with the release name kubesentry

Use kubesentry as the release name exactly as shown. Falco is configured to POST events to a fixed Service address (kubesentry-collector), so a different release name leaves Falco unable to reach the collector and no alerts arrive. If you must use another name, set --set fullnameOverride=kubesentry to keep the collector Service name aligned.

helm install kubesentry kubesentry/kubesentry \
  --namespace kubesentry \
  --create-namespace

That's it. Without a license, KubeSentry starts in a 7-day trial with a yellow banner in the dashboard — full functionality, no restrictions. See Licensing to activate a paid license.

Verify the install

kubectl get pods -n kubesentry

You should see:

  • One kubesentry-falco pod per node (the DaemonSet)
  • One kubesentry-falcosidekick pod (routes Falco events to the collector)
  • One kubesentry-collector pod (the KubeSentry Deployment: dashboard + notifier + storage)

Wait until all pods are Running, then continue to the Quickstart to trigger your first alert.

Access the dashboard

The dashboard is served by the collector. For a quick look, port-forward it:

kubectl port-forward -n kubesentry svc/kubesentry-collector 8080:8080

Then open http://localhost:8080/dashboard. For a real deployment, put it behind your ingress with authentication — see Dashboard exposure.

Uninstall

helm uninstall kubesentry -n kubesentry

Alert history is stored on a PersistentVolume. Deleting the release does not delete the PVC by default, so your data survives a reinstall. Delete the PVC manually if you want a clean slate.