radiantone/eoc-byok-agent repository overview

⁠RadiantOne EOC BYOK Agent (eoc-byok-agent)

Author: Vinay Manchikatla
Version: 1.0.0
Status: Production Runtime Component (Minimal DX & Inlets Uplink Standard)

⁠1. Overview & Objective

The eoc-byok-agent is a lightweight, containerized Customer-Side Agent / Controller designed to run inside customer-owned Kubernetes clusters (AWS EKS, Azure AKS, Google GKE, or On-Premises).

Installed via a minimal helm install command, it automates cluster onboarding into the RadiantOne Environment Operational Center (EOC), enabling central GitOps deployment of RadiantOne identity workloads (FID/IDDM, IDA, and Observability) into isolated customer namespaces following radiant-<tenant-slug>-<env-slug>.

⁠Key Features

• Ultra-Minimal Installation: Stripped of all unneeded CLI arguments; requires only eoc.controlPlaneUrl (WHERE) and agent.registrationToken (AUTHORIZATION).
• Inlets Uplink Outbound Reverse Tunneling: Uses inlets-pro uplink client to open an outbound WebSocket tunnel to the EOC Inlets Uplink Gateway. Customer firewalls open 0 inbound ports.
• Control-Plane Enforced Licensing: The commercial inlets-pro license key lives 100% inside Radiant Logic's EOC Control Plane (AWS KMS). Zero license keys are passed to customer environments.
• Native Per-Namespace RBAC: argocd-manager has no cluster-wide namespace discovery rights; workload access is granted per environment namespace by EOC Provisioner RoleBindings.
• Strict Namespace Model: Tenant namespaces follow radiant-<tenant-slug>-<env-slug> (lowercase), for example radiant-ans-en01.

⁠2. Quick Start: Customer Installation Guide

To register your Kubernetes cluster with RadiantOne EOC, copy and run the command from the EOC UI:

helm install eoc-byok-agent oci://ghcr.io/radiantlogic-v8/helm-charts/eoc-byok-agent \
  --version 1.0.0 \
  --namespace radiant-system \
  --create-namespace \
  --set eoc.controlPlaneUrl="https://eoc-us-east-01.radiantlogic.com" \
  --set agent.registrationToken="YOUR_EPHEMERAL_REGISTRATION_TOKEN"

radiant-system is the recommended install namespace for consistency. Custom install namespaces are supported.

⁠Verification

Check that the agent pod is running cleanly in your cluster:

kubectl get pods -n radiant-system

Expected Output:

NAME                                   READY   STATUS    RESTARTS   AGE
eoc-byok-agent-7f9b8c6d4-x2p8n         1/1     Running   0          15s

⁠3. Configuration Reference (values.yaml)

⁠4. End-to-End Execution Lifecycle

┌─────────────────────────────────────────────────────────────────────────────┐
│                   EOC AGENT EXECUTION LIFECYCLE (UPLINK)                    │
├─────────────────────────────────────────────────────────────────────────────┤
│ 1. User runs `helm install eoc-byok-agent ...`                              │
│ 2. Agent Pod starts in install namespace (recommended: `radiant-system`).   │
│ 3. Agent generates local RSA/ECDSA keypair (Private key stays in K8s).       │
│ 4. Agent calls EOC Handshake API -> EOC calls Uplink REST API (/v1/tunnels)  │
│ 5. EOC Backend returns dedicated per-cluster TUNNEL_TOKEN.                  │
│ 6. Agent executes `inlets-pro uplink client` dialing outbound WSS (:443).   │
│ 7. Inlets Uplink Gateway validates token & authorizes tunnel (Server-side).  │
│ 8. ArgoCD deploys FID/IDA workloads down the pipe into radiant-<tenant>-<env>. │
│ 9. Background ticker pings EOC every 30s (`POST /api/v1/clusters/heartbeat`). │
└─────────────────────────────────────────────────────────────────────────────┘

⁠5. Security & Customer Sovereignty

⁠Customer Kill Switch

Enterprise security teams retain 100% sovereignty and can revoke RadiantOne EOC access instantly without contacting Radiant Logic:

• Option 1 (Namespace Teardown): Run kubectl delete namespace <agent-namespace> to remove the agent pod and local credentials immediately.
• Option 2 (Network Firewall Block): Block outbound HTTPS/WSS egress to eoc.radiantlogic.com:443 at the corporate perimeter firewall.

⁠6. Developer & Local Testing Workflow

# Build Go binary locally
make build

# Run unit tests
make test

# Build Docker image
make docker-build

# Lint Helm chart
make helm-lint

# Package Helm chart
make helm-package

# Push Helm chart to GHCR OCI
make helm-push

# Push Docker image to Docker Hub
make docker-push

# Multi-arch build exactly as CI does it (linux/amd64 + linux/arm64)
make docker-buildx PUSH=false

⁠7. Continuous Integration & Releases

All images are built for linux/amd64 and linux/arm64. The Go binary is cross-compiled from the build platform, so arm64 images build at native speed.

⁠Cutting a release

Tags are bare SemVer with no leading v — 1.0.0, not v1.0.0. The tag is the single source of truth: the image tag, the chart version and the chart's appVersion are all set from it at build time, so Chart.yaml never needs a release commit. The release workflow refuses to build a tag that is not on main.

git tag 1.0.0 && git push origin 1.0.0
gh release create 1.0.0 --title 1.0.0 --generate-notes

After a release, bump version in charts/eoc-byok-agent/Chart.yaml on dev to the next target version. Dev charts are published as prereleases of that value (1.1.0-dev.42), and a prerelease sorts below the release it shares a version with.

⁠Required repository configuration

Secrets must be set at repository level, not inside an environment — both build workflows fail fast with an explicit message if they are missing.

⁠8. License and Support

Copyright © 2026 Radiant Logic, Inc. All rights reserved.
For technical support or architecture inquiries, contact the EOC Architecture Team at [email protected].