Overview
The Niro agent starts with a read-only RBAC role. Additional capabilities are opt-in — you enable them by re-running the installer with the appropriate environment flag. Each capability grants a specific set of RBAC permissions and unlocks corresponding features in the dashboard.
Capabilities are additive and reversible: setting a flag to 1 adds the RBAC grant; setting it to 0 removes it. No enrollment token is needed for capability changes — the agent reuses its existing key.
Enabling capabilities
Re-run the installer with the flags you want:
# Enable log streaming
curl -fsSL https://get.niro.cx/install.sh | NIRO_ENABLE_LOGS=1 sh
# Enable manifest apply
curl -fsSL https://get.niro.cx/install.sh | NIRO_ENABLE_APPLY=1 sh
# Enable agent self-update
curl -fsSL https://get.niro.cx/install.sh | NIRO_ENABLE_SELF_UPDATE=1 sh
# Enable multiple capabilities at once
curl -fsSL https://get.niro.cx/install.sh | NIRO_ENABLE_LOGS=1 NIRO_ENABLE_APPLY=1 sh
Revoking capabilities
Set any flag to 0 to revoke the corresponding RBAC grant:
# Revoke log streaming
curl -fsSL https://get.niro.cx/install.sh | NIRO_ENABLE_LOGS=0 sh
# Revoke apply capability
curl -fsSL https://get.niro.cx/install.sh | NIRO_ENABLE_APPLY=0 sh
Capabilities reference
NIRO_ENABLE_PODS (default: on)
Controls whether the agent includes pod details in its heartbeat.
| Default | 1 (enabled) |
|---|
| RBAC | get, list, watch on pods in all namespaces |
| Dashboard feature | Pod inventory page, pod details in cluster view |
Set to 0 | Pod inventory page is blank for this cluster |
NIRO_ENABLE_LOGS
Enables live pod log streaming to the browser.
| Default | 0 (disabled) |
|---|
| RBAC added | get on pods/log in all namespaces |
| Dashboard feature | View logs button on pod detail panels |
| Required for | Stream Pod Logs |
kubectl logs --follow back to the browser.
Log streaming establishes a pods/log SubResource access on your cluster. This means Niro will have access to your pod logs. Only enable this if your security model permits Niro to access application logs.
NIRO_ENABLE_APPLY
Enables applying Kubernetes manifests from the Niro dashboard and GitOps flow.
| Default | 0 (disabled) |
|---|
| RBAC added | create, update, patch, delete on managed namespaced resources (Deployments, StatefulSets, Services, Ingresses, ConfigMaps, Secrets, PVCs, HPAs); create and patch on Namespaces |
| Dashboard feature | Apply to cluster in Visual Builder, auto-apply on PR merge, Secret and ConfigMap management |
| Required for | Deploy an App, GitOps, Manage Secrets and ConfigMaps |
The apply role includes delete for managed namespaced resources so Niro can remove resources you delete in the dashboard and clean up managed objects during sync. Namespaces are never deleted by Niro.
NIRO_ENABLE_SELF_UPDATE
Allows the agent to update itself to the version specified by Niro.
| Default | 0 (disabled) |
|---|
| RBAC added | patch on the niro-agent Deployment in niro-system |
| Dashboard feature | Automatic agent version rollout; version shown in cluster settings |
| Required for | Fleet-wide agent version management |
- Niro signals the desired agent version in the response to each status update
- If the agent’s current image tag doesn’t match, the agent patches its own Deployment’s image tag
- Kubernetes rolls out the new pod; the old pod terminates
- The new pod reports the updated version on its first heartbeat
Self-update replaces the running pod. There’s no in-place upgrade — the pod is replaced as part of a normal Kubernetes rollout. If you have a single replica (the default), there’s a brief gap between the old pod terminating and the new pod becoming ready.
Default RBAC (always granted)
Even without any opt-in capability flags, the agent always has:
rules:
- apiGroups: [""]
resources: ["nodes", "namespaces", "events", "pods"]
verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
verbs: ["get", "list", "watch"]
- apiGroups: ["metrics.k8s.io"]
resources: ["nodes", "pods"]
verbs: ["get", "list"]
- Report node inventory in heartbeats
- Report pod inventory in heartbeats
- Report resource usage (if metrics-server is installed)
- Report Kubernetes Warning events in heartbeats
Checking enabled capabilities
The dashboard shows a capabilities badge on the cluster card in the Fleet view and in the cluster settings. You can also check directly:
kubectl get clusterrolebinding -n niro-system | grep niro
kubectl logs -n niro-system -l app=niro-agent | grep capabilities
