Install Coral with Helm

• Kubernetes 1.30 or later, with nodes on amd64 or arm64.
• A connect token from the Connect dialog in the Zoorik console. A token works once, within an hour of being issued. Coral is in early access — book a demo (opens in a new tab) for a console account.
• The control plane origin the console names. It is the origin only: no path and no trailing slash.
• The cloud identity, if Zoorik is to remove nodes. Install Coral with Terraform + Helm creates it as code, or zoorikctl cluster grant-node-deletion creates it from the command line.

$ helm install coral-agent \
  oci://ghcr.io/getzoorik/charts/coral-agent \
  --kube-context <context> \
  --namespace default \
  --set controlPlaneUrl=<control plane origin> \
  --set connectToken.value=<connect token>

Install the release in any namespace except zoorik-agent and zoorik-node. The chart creates those two namespaces itself with their Pod Security labels, so --namespace zoorik-agent --create-namespace fails with an ownership error.

The agent redeems the token when it starts and keeps the cluster credential it receives in the Secret zoorik-agent/zoorik-agent-credential, which it creates and owns. The agent Deployment sets minReadySeconds: 120, so helm install --wait takes at least two minutes.

Already connected with zoorikctl? Objects it applied carry no Helm ownership, so helm install refuses them. Run zoorikctl cluster disconnect first, then install the chart with a new connect token.

The agent’s resources suit clusters of up to 5,000 pods. For larger clusters, raise them as zoorikctl does, and keep cpu: 100m (agent) and cpu: 50m (webhook) in the requests when you set them:

The agent reads the cloud through the identity bound to its ServiceAccount. Set it with serviceAccount.annotations:

On the command line, for AKS:

--set-string 'serviceAccount.annotations.azure\.workload\.identity/client-id=<client id>'

A change to these annotations restarts the agent, because the cloud credential is injected only when a pod is created.

To keep the token out of your values, set connectToken.existingSecret to the name of a Secret in zoorik-agent with the token under the key bootstrap-token. The chart creates that namespace, so create the Secret after the install, or deliver it with the same GitOps application. The agent pod waits for it.

The pod webhook, the agent and the node daemon write to some objects after the install. Ignore these fields in an Argo CD application:

ignoreDifferences:
  - group: admissionregistration.k8s.io
    kind: MutatingWebhookConfiguration
    name: zoorik-agent-webhook
    jqPathExpressions:
      - .webhooks[].clientConfig.caBundle
      - .webhooks[] | select(.name == "pods.webhook.coral.zoorik.com") | .objectSelector
      - .metadata.annotations["coral.zoorik.com/webhook-state"]
  - kind: Secret
    name: zoorik-agent-webhook-tls
    jsonPointers: [/data]
  - kind: Secret
    name: zoorik-node-tls
    jsonPointers: [/data]
  - kind: Secret
    name: zoorik-node-ca
    jsonPointers: [/data]
  - kind: ConfigMap
    name: zoorik-rollout-markers
    jsonPointers: [/data]
  - kind: ConfigMap
    name: zoorik-agent-forced-drains
    jsonPointers: [/data]
  - kind: ConfigMap
    name: zoorik-agent-live-migrations
    jsonPointers: [/data]

A Helm-installed agent does not upgrade itself. Each chart version pins one agent release, and helm upgrade to a newer chart version moves it. Helm installs the custom resource definitions only on the first install; the agent applies the definitions its own release carries every time it starts.

Connect again with a new token

$ helm upgrade coral-agent \
  oci://ghcr.io/getzoorik/charts/coral-agent \
  --kube-context <context> --namespace default \
  --reuse-values --set connectToken.value=<new connect token>

The new token changes the pod annotation, so the agent restarts and enrols with it. With existingSecret, replace the token in the Secret and run kubectl --context <context> -n zoorik-agent rollout restart deployment/zoorik-agent.

helm uninstall removes the objects this chart installed, including both namespaces. It does not undo what the agent changed on nodes and workloads (Zoorik cordons and taints, HPA and VPA holds, rollout markers and deletion-cost settings); zoorikctl cluster disconnect does. Helm leaves the custom resource definitions in place.