The Icebreaker Agent is configured at install time through Helm chart values. This page is the lookup reference; for the install narrative, see Install the Icebreaker Agent.
The chart lives in the eyrie repository at deploy/helm/eyrie-agent. Defaults shown here match the chart’s values.yaml.
| Value | Type | Default | Description |
|---|
agent.serverUrl | string | wss://console.icebreakerdata.com/ws/virtual-cluster | WebSocket URL of the Icebreaker control plane. Required. |
agent.token | string | "" | Agent token shown when you created the Agent. Set this or agent.existingSecret (not both). When set, the chart creates a Kubernetes Secret containing the token. |
agent.existingSecret | string | "" | Name of a pre-created Kubernetes Secret containing the token. Preferred over agent.token for production deployments. |
agent.existingSecretKey | string | token | Key within agent.existingSecret that holds the token value. |
The workload namespace is where the Icebreaker Agent reconciles Data Server Deployments, Services, and Ingresses. It must already exist before installation — the chart does not create it.
| Value | Type | Default | Description |
|---|
agent.workloadNamespace | string | eyrie-compute | Namespace for Icebreaker workloads. |
agent.workloadServiceAccount | string | colibri | ServiceAccount name for Data Server pods. The chart creates this if rbac.createWorkloadRbac is true. |
agent.workloadServiceAccountAnnotations | map | {} | Annotations applied to the colibri ServiceAccount. Use this to set IRSA role ARNs (e.g., eks.amazonaws.com/role-arn) for IAM-backed pod identity. |
Ingress configuration determines how SQL clients reach Data Server endpoints. The two modes are mutually exclusive.
| Value | Type | Default | Description |
|---|
agent.ingressDomain | string | "ds.icebreakerdata.com" | Base domain for nginx Ingress. The Icebreaker Agent creates one Ingress per Data Server at {data_server_id}.{ingressDomain}. Requires a wildcard DNS record pointing at the nginx controller’s load balancer. Override this with your own domain. The default is an Icebreaker-internal value that will not resolve in customer clusters. |
agent.ingressTlsSecret | string | "colibri-tls" | Name of a kubernetes.io/tls Secret in the workload namespace holding a wildcard certificate for *.{ingressDomain}. When set, connection URLs use grpc+tls:// and Ingresses include a TLS block. Leave unset for plain grpc://. Override this with the name of your wildcard TLS Secret. The default is an Icebreaker-internal value. |
| Value | Type | Default | Description |
|---|
agent.albIngress | bool | false | Enable AWS ALB Ingress mode. Mutually exclusive with agent.ingressDomain. |
agent.albCertificateArn | string | unset | ACM certificate ARN for the ALB HTTPS listener. Required when agent.albIngress is true. |
| Value | Type | Default | Description |
|---|
rbac.create | bool | true | Create the Icebreaker Agent’s own ServiceAccount, Role, and RoleBinding. |
rbac.manageNodePools | bool | true | Grant cluster-scoped permissions to manage Karpenter NodePool CRDs. Set to false if Karpenter is not installed; the Icebreaker Agent logs errors for Capacity Policy reconciliation but Data Server reconciliation continues. |
rbac.createWorkloadRbac | bool | true | Create the colibri ServiceAccount and Role in the workload namespace so Data Server pods can schedule their own query executor pods. |
rbac.monitorNodeCosts | bool | true | Grant the colibri ServiceAccount cluster-scoped read access to Nodes for the per-Data Server node cost monitor. Set to false to opt out — the monitor logs warnings and stays idle, but queries are unaffected. The monitor also needs AWS read permission for EC2 spot pricing; supply that via agent.workloadServiceAccountAnnotations (IRSA) or node-instance IAM. |
| Value | Type | Default | Description |
|---|
image.repository | string | Icebreaker’s private container registry path | Container image for the Icebreaker Agent. |
image.tag | string | v0.0.3 (defaults to chart appVersion when empty) | Image tag. Pin to a specific release version in production. |
image.pullPolicy | string | IfNotPresent | Kubernetes pull policy. |
imagePullSecrets | list | [] | imagePullSecrets references if your cluster needs them to pull from the Icebreaker registry. |
| Value | Type | Default | Description |
|---|
agent.logLevel | string | info | Passed to the Icebreaker Agent as RUST_LOG. Use debug for verbose logs during troubleshooting. |
Standard Kubernetes pod controls. Set as needed for your cluster.
| Value | Type | Default | Description |
|---|
resources.requests.cpu | string | 50m | CPU request for the Icebreaker Agent pod. |
resources.requests.memory | string | 64Mi | Memory request. |
resources.limits.cpu | string | 500m | CPU limit. |
resources.limits.memory | string | 256Mi | Memory limit. |
nodeSelector | map | {} | Standard nodeSelector. |
tolerations | list | [] | Standard tolerations. |
affinity | map | {} | Standard affinity rules. |
priorityClassName | string | "" | Standard PriorityClass reference. |
podAnnotations | map | {} | Annotations added to the Icebreaker Agent pod. |
podLabels | map | {} | Labels added to the Icebreaker Agent pod. |
The chart sets a hardened default. Override only if your environment requires it.
| Value | Type | Default |
|---|
podSecurityContext.runAsNonRoot | bool | true |
podSecurityContext.runAsUser | int | 65532 |
podSecurityContext.runAsGroup | int | 65532 |
podSecurityContext.fsGroup | int | 65532 |
podSecurityContext.seccompProfile.type | string | RuntimeDefault |
securityContext.allowPrivilegeEscalation | bool | false |
securityContext.readOnlyRootFilesystem | bool | true |
securityContext.capabilities.drop | list | ["ALL"] |
When you view a Data Server in the Admin console, the status field is derived from the underlying Kubernetes Deployment.
| Condition in the cluster | Status reported |
|---|
| No Deployment exists yet | pending |
Progressing=False with reason=ProgressDeadlineExceeded | error |
ReplicaFailure=True (any reason) | error |
ready_replicas >= desired.replicas | running |
| Otherwise | deploying |
Available=False / MinimumReplicasUnavailable during startup is normal and is intentionally not reported as an error.
The Icebreaker Agent can also be run directly as a binary. Each Helm value maps to a CLI flag and an environment variable. The most common mapping:
| Flag | Env var | Helm equivalent |
|---|
--token | AGENT_TOKEN | agent.token |
--server-url | SERVER_URL | agent.serverUrl |
--namespace | NAMESPACE | agent.workloadNamespace |
--service-account | COLIBRI_SERVICE_ACCOUNT | agent.workloadServiceAccount |
--ingress-domain | COLIBRI_INGRESS_DOMAIN | agent.ingressDomain |
--ingress-tls-secret | COLIBRI_INGRESS_TLS_SECRET | agent.ingressTlsSecret |
--alb-ingress | COLIBRI_ALB_INGRESS | agent.albIngress |
--alb-certificate-arn | COLIBRI_ALB_CERTIFICATE_ARN | agent.albCertificateArn |
For most early-adopter deployments, the Helm chart is the supported install path. The CLI / env interface exists primarily for development and integration testing.