Skip to content

Quick Start

This guide gets you from zero to:

  • signing in to Axis
  • deploying an Aegis Agent on one Linux host or one Kubernetes cluster
  • enrolling the agent
  • applying a policy (compliance bundle)
  • verifying health and metrics

Prerequisites

  • An Axis account with access to an Organization.
  • Outbound HTTPS connectivity from your environment to your Axis control plane URL.
  • One of:
  • Linux host with systemd and sudo access
  • Kubernetes cluster with Helm 3 and kubectl access

Warning

Bootstrap tokens and generated install scripts are secrets. Treat them like passwords. Do not paste them into tickets or chats, and do not commit them to source control.

1) Sign In to Axis

  1. Open your Axis tenant URL.
  2. Sign in (SSO or credentials).
  3. Create or select an Environment (for example production).

2) Deploy an Agent

  1. In Axis, go to Environments.
  2. Select the environment and choose Generate Install Script.
  3. Copy the downloaded install-aegis.sh to the target host.

On the host:

chmod +x install-aegis.sh
./install-aegis.sh

Verify:

sudo systemctl status velikey-aegis --no-pager
curl -fsS http://127.0.0.1:9080/health
curl -fsS http://127.0.0.1:9080/metrics | head

This installs the agent as a DaemonSet (agent-only; SaaS control plane).

  1. Obtain a bootstrap token for the target environment.
  2. Create a Kubernetes Secret with the token.
kubectl create namespace velikey-aegis

# Store the token in a file to avoid putting it directly on the command line.
cat > bootstrap-token.txt <<'EOF'
<BOOTSTRAP_TOKEN>
EOF

kubectl -n velikey-aegis create secret generic velikey-aegis-agent-secret \
  --from-file=AEGIS_BOOTSTRAP_TOKEN=bootstrap-token.txt \
  --from-file=AEGIS_CP_BEARER=bootstrap-token.txt
  1. Install/upgrade the Helm release.
CHART_REF="<chart-ref-provided-by-velikey>"  # e.g. velikey/aegis or oci://.../aegis

helm upgrade --install velikey-aegis "$CHART_REF" \
  --namespace velikey-aegis \
  --set controlPlane.enabled=false \
  --set agent.controlPlaneUrl="https://<your-axis-host>:8443" \
  --set agent.secret.existingSecretName=velikey-aegis-agent-secret

Verify:

kubectl -n velikey-aegis get ds -l app.kubernetes.io/component=agent

POD="$(kubectl -n velikey-aegis get pods -l app.kubernetes.io/component=agent -o jsonpath='{.items[0].metadata.name}')"
kubectl -n velikey-aegis exec "$POD" -- sh -lc 'curl -fsS http://127.0.0.1:9080/health && echo ok'

Note

For strict TLS with a private CA, mount the control-plane CA certificate and configure the agent to validate it. See the TLS section in Troubleshooting.

3) Confirm the Agent Is Enrolled

  • In Axis, the agent should appear under the environment within about a minute.
  • If the agent does not appear, see Troubleshooting.

4) Apply a Policy (Compliance Bundle)

  1. In Axis, go to Settings and create or select a compliance bundle.
  2. Use Apply Compliance Bundle to Agents to target your environment/agents.
  3. In production, start with observe mode, validate, then move to enforcement.

5) Confirm Health and Telemetry

  • In Axis: check Diagnostics and Analytics.
  • Locally: query /health and /metrics on the agent health endpoint.

Next Steps