Skip to main content

Set up Agent Operator with Helm charts

Helm is a package manager for Kubernetes, which helps manage Kubernetes applications. Helm uses charts to configure, install, and upgrade Kubernetes Operators. This is the recommended method of installation.

Before you begin

Make sure you have everything you need before you start:

Steps

  1. Run these Helm commands:

    helm repo add contrast https://contrastsecurity.dev/helm-charts
helm repo update contrast
helm show values contrast/contrast-agent-operator > contrast-agent-operator.yaml

  2. Add agent keys to the clusterDefaults section of the YAML file. You will also need to set the enabled property to true.

    clusterDefaults:
  enabled: true
  tokenValue: <YourContrastToken>
  yaml: |-
    enable: true

  3. Run this Helm command:

    helm upgrade --install --namespace contrast-agent-operator --create-namespace -f contrast-agent-operator.yaml contrast-agent-operator contrast/contrast-agent-operator

    The Helm notes include details on the labels to apply to your workloads, as shown in this example:

    Release "contrast-agent-operator" does not exist. Installing it now.
NAME: contrast-agent-operator
LAST DEPLOYED: Mon Apr  6 16:08:43 2026
NAMESPACE: contrast-agent-operator
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
contrast-agent-operator chart version 6.0.0 deployed!
✅ 6 cluster agent injectors have been deployed for namespace: default
  To label additional namespaces for injectors:

    ⎈ kubectl label namespace/<YourNamespaceName> agents.contrastsecurity.com/agent-injectors=true

  To label workloads:

  contrast-java-injector (java):
    ⎈ kubectl label deployment/<YourDeploymentName> contrast-agent=java

  contrast-dotnet-core-injector (dotnet-core):
    ⎈ kubectl label deployment/<YourDeploymentName> contrast-agent=dotnet-core

  contrast-nodejs-injector (nodejs):
    ⎈ kubectl label deployment/<YourDeploymentName> contrast-agent=nodejs

  contrast-php-injector (php):
    ⎈ kubectl label deployment/<YourDeploymentName> contrast-agent=php

  contrast-python-injector (python):
    ⎈ kubectl label deployment/<YourDeploymentName> contrast-agent=python

  contrast-flex-injector (flex):
    ⎈ kubectl label deployment/<YourDeploymentName> contrast-agent=flex


⚠️  clusterDefaults.enabled was false, so no agent connections deployed. Enable this and provide agent credentials for easier deployment via this chart, or refer to documentation here to manually create them: https://docs.contrastsecurity.com/en/agent-operator-configuration.html#clusteragentconnection or https://docs.contrastsecurity.com/en/agent-operator-configuration.html#agentconnection

👀 To watch the operator logs:
    ⎈ kubectl logs -f -l app.kubernetes.io/part-of=contrast-agent-operator --namespace contrast-agent-operator

📄 More documentation: https://docs.contrastsecurity.com/en/agent-operator.html

🙋 Get support: https://support.contrastsecurity.com / support@contrastsecurity.com

  4. Label your deployments by using the values from the table.

    Tip

    Run the kubectl get deployments command to also find the deployment names.

    Example commands for labeling a deployment:

    Run:

    kubectl get deployments

    Get an output (for example):

    NAME                READY   UP-TO-DATE   AVAILABLE   AGE
app1-deployment     0/3     0            0           1s

    Then run the following command:

    kubectl label deployment app1-deployment contrast-agent=java

    The default configuration from the YAML file creates ClusterAgentInjectors for the ‘default’ namespace. If you use other namespaces, you can either label the namespaces with agents.contrastsecurity.com/agent-injectors='true' or add them to the agentInjectors.namespaces array in the YAML file.

    The following example shows how you might configure the agentInjectors.namespaces array:

    agentInjectors:
  enabled: true
  # Optional, target namespaces for AgentInjectors.
  namespaces:
    - default
  injectors:
    ...
In this section: