Skip to content

Installation

KubeSentry installs with a single Helm chart. The chart deploys Falco as a DaemonSet (one pod per node) and the KubeSentry collector as a Deployment.

Prerequisites

  • A standard Kubernetes cluster (v1.24+ recommended) whose nodes allow privileged pods and hostPath mounts
  • Helm 3.8 or newer
  • Nodes running a Linux kernel Falco supports — the chart uses Falco's modern_ebpf driver by default, which works on modern kernels
  • A namespace you're comfortable running privileged detection in (Falco needs privileged access to read kernel events)

Supported clusters

KubeSentry detects threats by reading kernel events, so Falco runs as a privileged DaemonSet with host mounts (the container runtime socket, /proc, /etc). Any cluster that permits that will work:

  • Self-managed and kubeadm clusters
  • k3s
  • GKE Standard
  • EKS, and AKS with default node pools
  • kind and minikube (great for evaluating)

Not supported: GKE Autopilot, and other managed or hardened environments that block privileged containers and host mounts — including restrictive PodSecurity or Pod Security Admission policies. These platforms deny kernel-level access by design, and it isn't something the chart can configure around. If you're on Autopilot, run KubeSentry on a Standard cluster or a node pool that permits privileged workloads.

Add the Helm repository

helm repo add kubesentry https://charts.kubesentry.io
helm repo update

Confirm the chart is available:

helm search repo kubesentry

You'll see the chart listed as kubesentry/kubesentry.

Install

Any release name works

The collector's Service name is pinned to kubesentry-collector (the chart sets fullnameOverride: kubesentry), so Falco can always reach the collector no matter what you name the release. These examples use kubesentry. Only override fullnameOverride if you need to run two installs in one namespace — then also point falco.falcosidekick.config.webhook.address at your collector Service.

helm install kubesentry kubesentry/kubesentry \
  --namespace kubesentry \
  --create-namespace

That's it. Without a license, KubeSentry starts in a 7-day trial with a yellow banner in the dashboard — full functionality, no restrictions. See Licensing to activate a paid license.

Verify the install

kubectl get pods -n kubesentry

You should see:

  • One kubesentry-falco pod per node (the DaemonSet)
  • One kubesentry-falcosidekick pod (routes Falco events to the collector)
  • One kubesentry-collector pod (the KubeSentry Deployment: dashboard + notifier + storage)

Wait until all pods are Running, then continue to the Quickstart to trigger your first alert.

Access the dashboard

The dashboard is served by the collector. For a quick look, port-forward it:

kubectl port-forward -n kubesentry svc/kubesentry-collector 8080:8080

Then open http://localhost:8080/dashboard. For a real deployment, put it behind your ingress with authentication — see Dashboard exposure.

Uninstall

helm uninstall kubesentry -n kubesentry

Alert history is stored on a PersistentVolume. Deleting the release does not delete the PVC by default, so your data survives a reinstall. Delete the PVC manually if you want a clean slate.