Read-only · installs in minutes

Runtimez Docs

Everything an SRE wants to know before installing an agent into a production cluster: exactly what it reads, the read-only RBAC it requests, what it will never touch, where it runs, and how to remove it. First risk report in under an hour.

Before you install anything: the Runtimez agent is read-only. It requests only get/list/watch permissions, never mutates cluster state, and never reads Secret values, environment variables, or application data. Secrets and image contents never leave your cluster. This page explains the whole picture; your exact install command and connection token are generated when you connect a cluster.

1.What Runtimez is

Runtimez is read-only Kubernetes deployment intelligence. It connects to a live cluster with a single Helm command and surfaces upgrade blockers, container-image CVEs, production-readiness gaps, cost waste, and risky workload changes — before they become incidents. Every finding is scored on two axes, upgrade risk and security risk, then correlated by workload so you can fix the CVE that also blocks your next Kubernetes upgrade first.

2.How it works

  1. Connect your cluster — one read-only Helm command installs the agent.
  2. Discover & inventory — Runtimez maps every workload, image, and API in use.
  3. Score & correlate — findings are scored on the upgrade and security axes and correlated by workload.
  4. Act on what matters — you get a prioritized, cross-axis remediation list, plus a PR-time verdict on every proposed change.

3.What the agent reads — and what it never touches

✓ Reads (metadata)

  • Workload specs: names, namespaces, labels, owners
  • Container image references & tags
  • Kubernetes & API versions, deprecated APIs
  • Probes, limits, replicas, disruption budgets
  • CVE identifiers for the images you run

✕ Never reads or exfiltrates

  • Secret values, tokens, private keys
  • Environment-variable & ConfigMap values
  • Application data or database contents
  • Application logs or in-memory data
  • Anything that would leave your cluster

4.RBAC & security model

The agent installs into its own namespace and binds to a ClusterRole scoped to read-only verbs. It requests no create, update, patch, or delete permissions on your workloads, and it does not act as an admission or mutating webhook. You can review the exact chart and RBAC manifest before you install.

Illustrative — read-only ClusterRole
# The agent requests read-only verbs only. rules: - apiGroups: ["*"] resources: ["*"] verbs: ["get", "list", "watch"]

5.Supported platforms

Runtimez runs on managed Kubernetes:

Amazon EKS Google GKE Azure AKS

6.Quickstart

Connecting takes one Helm command. When you connect a cluster, we generate your exact command and a connection token. The install looks like this:

Illustrative — your exact command is generated on connect
# 1. Add the Runtimez chart repository helm repo add runtimez https://charts.runtimez.io helm repo update # 2. Install the read-only agent helm install runtimez-agent runtimez/agent \ --namespace runtimez --create-namespace \ --set token=<YOUR-CONNECT-TOKEN> # First risk report lands in under an hour.

No agent runs against your cluster until you install it, and nothing is required to leave the cluster for you to get value.

7.Uninstalling

Removing the agent is a single command. It immediately ends the agent's read access to your cluster.

helm uninstall runtimez-agent --namespace runtimez kubectl delete namespace runtimez

8.Frequently asked

Can the agent change anything in my cluster?

No. It requests read-only verbs only and is not a mutating/admission webhook.

Do secret values or images leave my cluster?

No. Secret values and image contents never leave your cluster. The agent works from metadata and findings.

How fast is the first report?

Teams typically get their first production-risk report in under an hour after connecting.

Want the full install walkthrough?

Connect a cluster to get your exact command and token, or reach us with any security question.

Connect a Cluster

Prefer email? hello@runtimez.io