AgentFleet — Deployable Fleet Agent

What Is AgentFleet?

AgentFleet extends AgentWatch attribution and control from browser and API traffic out to your production estate — the Kubernetes clusters and Linux VMs where your AI workloads actually run. The existing agentwatch-connect client gains a sidecar deployment mode purpose-built for co-located deployment: it runs next to (or on the same node as) a workload, presents an OpenAI-compatible endpoint and a forward proxy the workload points at, stamps user/workload attribution, and forwards to the central gateway where DLP, budgets, routing, and Insider Risk apply.

Like the endpoint agent, AgentFleet is fail-open: if the gateway is unreachable it passes traffic through rather than breaking the workload.

Interfaces Exposed by a Fleet Agent

Interface	Default Port	Purpose
OpenAI-compatible endpoint	:8088	Drop-in base URL for SDKs (OPENAI_BASE_URL)
HTTP(S) forward proxy	:7443	HTTP_PROXY / HTTPS_PROXY for un-instrumented processes
Health	/healthz	Liveness/readiness probe target
Metrics	/metrics	Prometheus-style metrics scrape

Heartbeat & Deployment Tagging

Every 30 seconds each agent posts a heartbeat to the gateway tagged with:

• deployment — one of endpoint, sidecar, or daemonset.
• kubernetes — { node, pod, namespace } when running in a cluster.

These tags drive the Fleet honeycomb (§7.19): one hex per deployed agent, colored by health, plus a per-agent table and a deployment-type breakdown.

Configuration (Environment Variables)

Variable	Purpose	Default
AGENTWATCH_SIDECAR_PORT	OpenAI-compatible endpoint port	8088
AGENTWATCH_PROXY_PORT	HTTP(S) forward-proxy port	7443
AGENTWATCH_DEPLOYMENT	Deployment tag (endpoint / sidecar / daemonset)	sidecar
AGENTWATCH_NODE_NAME	Kubernetes node name (from the downward API)	—
AGENTWATCH_POD_NAME	Kubernetes pod name (from the downward API)	—
AGENTWATCH_NAMESPACE	Kubernetes namespace (from the downward API)	—
AGENTWATCH_FAIL_OPEN	Pass traffic through when the gateway is unreachable	1 (true)
AGENTWATCH_HEARTBEAT_MS	Heartbeat interval in milliseconds	30000

Packaging

AgentFleet ships every artifact needed to deploy at fleet scale:

Artifact	Use
Multi-arch Docker image	linux/amd64 + linux/arm64 container for the agent
Kubernetes DaemonSet	One agent per node — transparent node-wide coverage
Sidecar-injection example	Inject the agent as a sidecar container into a workload pod
Helm chart	Parameterized install for clusters (image, ports, gateway URL, tags)
VM installer	One-line curl … | sudo -E sh for RHEL / CentOS / Ubuntu hosts

Deploy Example: Linux VM (one-liner)

# as a normal user with sudo rights; AgentWatch 2.0.360 or later
export AGENTWATCH_SERVER_URL="https://<host>"
export AGENTWATCH_EMAIL="john.doe@acme.com"
export AGENTWATCH_API_KEY="ak_…"
curl -fsSL "$AGENTWATCH_SERVER_URL/agent/install.sh" | sudo -E sh

The installer drops the agent, wires the OpenAI-compatible endpoint (:8088) and forward proxy (:7443), and starts it under the host init system. Point a workload at it with:

export OPENAI_BASE_URL=http://127.0.0.1:8088/v1
# or, for un-instrumented processes:
export HTTPS_PROXY=http://127.0.0.1:7443

Deploy Example: Kubernetes DaemonSet

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: agentwatch-fleet
  namespace: agentwatch
spec:
  selector:
    matchLabels: { app: agentwatch-fleet }
  template:
    metadata:
      labels: { app: agentwatch-fleet }
    spec:
      containers:
        - name: agentwatch-connect
          image: iterateai/agentwatch-connect:latest   # multi-arch
          args: ["sidecar"]
          ports:
            - { containerPort: 8088, name: openai }
            - { containerPort: 7443, name: proxy }
          env:
            - { name: AGENTWATCH_DEPLOYMENT, value: "daemonset" }
            - name: AGENTWATCH_NODE_NAME
              valueFrom: { fieldRef: { fieldPath: spec.nodeName } }
            - name: AGENTWATCH_POD_NAME
              valueFrom: { fieldRef: { fieldPath: metadata.name } }
            - name: AGENTWATCH_NAMESPACE
              valueFrom: { fieldRef: { fieldPath: metadata.namespace } }
          livenessProbe:
            httpGet: { path: /healthz, port: 8088 }

Deploy Example: Helm

helm install agentwatch-fleet ./charts/agentwatch-fleet \
  --namespace agentwatch --create-namespace \
  --set gatewayUrl=https://<host> \
  --set deployment=daemonset \
  --set image.tag=latest

Verifying the Fleet

After deploy, confirm health locally and in the console:

# On the host / in the pod
curl -s http://127.0.0.1:8088/healthz     # -> ok
curl -s http://127.0.0.1:8088/metrics | head

Then open Observe Platform → Fleet: each running agent appears as a hex colored by health, with a per-agent table and a breakdown by deployment type (endpoint / sidecar / daemonset).

---