node-agent

Documentation

Overview

node-agent is the Fathom DaemonSet binary that scans on-disk X.509 certificates on a single node and publishes a per-node report ConfigMap that the NodeCertificateCheck controller rolls up into a HealthReport (SKA-519).

It is intentionally minimal and least-privilege: it reads certificate files from read-only hostPath mounts, writes exactly one ConfigMap (its own), and serves a Prometheus endpoint. All scan configuration is supplied by the operator via flags/env, so the agent needs no read access to the NodeCertificateCheck API.