Ingero GPU observability agent deployed as DaemonSet.

Pods will schedule on nodes with label: nvidia.com/gpu.present=true
{{- if not .Values.namespace.create }}

NOTICE: namespace.create=false. The agent runs a privileged container
(required for eBPF CAP_BPF + hostPID). If namespace
"{{ .Release.Namespace }}" is labeled with
pod-security.kubernetes.io/enforce=baseline or =restricted,
admission will REJECT the DaemonSet. Before installing, label the
target namespace explicitly:

  kubectl label --overwrite namespace {{ .Release.Namespace }} \
    pod-security.kubernetes.io/enforce=privileged \
    pod-security.kubernetes.io/warn=privileged

Or install with namespace.create=true so the chart creates a
correctly-labeled namespace for you.
{{- end }}

Query the agent:
  kubectl exec -n {{ .Release.Namespace }} ds/{{ include "ingero.fullname" . }} -- ingero explain --since 5m
  kubectl exec -n {{ .Release.Namespace }} ds/{{ include "ingero.fullname" . }} -- ingero query --since 1m --json

Start MCP server for AI-assisted investigation:
  kubectl exec -n {{ .Release.Namespace }} ds/{{ include "ingero.fullname" . }} -- ingero mcp --http :8080 &
  kubectl port-forward -n {{ .Release.Namespace }} ds/{{ include "ingero.fullname" . }} 8080:8080

Database location (on host): {{ .Values.trace.dbPath }}
{{- if and (eq .Values.mode "fleet-push") .Values.fleetPush.remediation.sinkEnabled }}

Remediation sink sidecar is ENABLED.
  UDS path:     /tmp/ingero-remediate.sock
  Socket mode:  {{ if ge (int .Values.fleetPush.remediation.socketGid) 0 }}0770 (gid {{ .Values.fleetPush.remediation.socketGid }}){{ else }}0700 (owner-only){{ end }}
  Sink metrics: :{{ .Values.fleetPush.remediation.sinkListenPort }}/metrics
{{- if eq .Values.fleetPush.remediation.tmpVolumeType "hostPath" }}

WARNING: fleetPush.remediation.tmpVolumeType=hostPath mounts the node's
real /tmp into this DaemonSet. Only use this mode when a separately-
deployed orchestrator pod needs to see the same socket file. The node's
/tmp is then shared with every other container that also mounts it.
{{- end }}
{{- end }}
