Datadog Agent

Deploy Edge alongside the Datadog Agent on Kubernetes

Deploy Tero Edge alongside your Datadog Agent to apply policies to logs, metrics, and traces before they leave your cluster.

How it works

Edge runs as a DaemonSet on each node. The Datadog Agent sends logs through Edge instead of directly to Datadog. Edge applies policies and forwards to Datadog.

Edge only proxies telemetry (logs, metrics, traces). Other agent traffic (security monitoring, remote config, fleet management) bypasses Edge and goes to Datadog.

Prerequisites

• Datadog Agent running on Kubernetes (via Helm or Datadog Operator)
• kubectl access to your cluster
• Tero account

Connect

1. Create the namespace and secret

   Create the namespace and store your API key as a Kubernetes secret:

   kubectl create namespace tero-system
   
   kubectl create secret generic tero-edge \
     --namespace tero-system \
     --from-literal=api-key=YOUR_API_KEY
   
2. Create the Edge ConfigMap

   Create a ConfigMap with your Edge configuration. Select your Datadog region:

   US1

   tero-edge-config.yaml

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: tero-edge-config
     namespace: tero-system
   data:
     config.json: |
       {
         "listen_address": "0.0.0.0",
         "listen_port": 8080,
         "upstream_url": "https://agent-http-intake.logs.datadoghq.com",
         "metrics_url": "https://api.datadoghq.com",
         "log_level": "info",
         "service": {
           "name": "edge",
           "namespace": "production",
           "resource_attributes": [
             { "key": "deployment.environment", "value": "production" }
           ],
           "labels": [{ "key": "team", "value": "platform" }]
         },
         "max_body_size": 1048576,
         "policy_providers": [
           {
             "id": "tero",
             "type": "http",
             "url": "https://sync.usetero.com/v1/policy/sync",
             "headers": [
               { "name": "Authorization", "value": "Bearer ${TERO_API_KEY}" }
             ]
           }
         ]
       }
   

   US3

   tero-edge-config.yaml

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: tero-edge-config
     namespace: tero-system
   data:
     config.json: |
       {
         "listen_address": "0.0.0.0",
         "listen_port": 8080,
         "upstream_url": "https://agent-http-intake.logs.us3.datadoghq.com",
         "metrics_url": "https://api.us3.datadoghq.com",
         "log_level": "info",
         "service": {
           "name": "edge",
           "namespace": "production",
           "resource_attributes": [
             { "key": "deployment.environment", "value": "production" }
           ],
           "labels": [{ "key": "team", "value": "platform" }]
         },
         "max_body_size": 1048576,
         "policy_providers": [
           {
             "id": "tero",
             "type": "http",
             "url": "https://sync.usetero.com/v1/policy/sync",
             "headers": [
               { "name": "Authorization", "value": "Bearer ${TERO_API_KEY}" }
             ]
           }
         ]
       }
   

   US5

   tero-edge-config.yaml

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: tero-edge-config
     namespace: tero-system
   data:
     config.json: |
       {
         "listen_address": "0.0.0.0",
         "listen_port": 8080,
         "upstream_url": "https://agent-http-intake.logs.us5.datadoghq.com",
         "metrics_url": "https://api.us5.datadoghq.com",
         "log_level": "info",
         "service": {
           "name": "edge",
           "namespace": "production",
           "resource_attributes": [
             { "key": "deployment.environment", "value": "production" }
           ],
           "labels": [{ "key": "team", "value": "platform" }]
         },
         "max_body_size": 1048576,
         "policy_providers": [
           {
             "id": "tero",
             "type": "http",
             "url": "https://sync.usetero.com/v1/policy/sync",
             "headers": [
               { "name": "Authorization", "value": "Bearer ${TERO_API_KEY}" }
             ]
           }
         ]
       }
   

   EU

   tero-edge-config.yaml

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: tero-edge-config
     namespace: tero-system
   data:
     config.json: |
       {
         "listen_address": "0.0.0.0",
         "listen_port": 8080,
         "upstream_url": "https://agent-http-intake.logs.datadoghq.eu",
         "metrics_url": "https://api.datadoghq.eu",
         "log_level": "info",
         "service": {
           "name": "edge",
           "namespace": "production",
           "resource_attributes": [
             { "key": "deployment.environment", "value": "production" }
           ],
           "labels": [{ "key": "team", "value": "platform" }]
         },
         "max_body_size": 1048576,
         "policy_providers": [
           {
             "id": "tero",
             "type": "http",
             "url": "https://sync.usetero.com/v1/policy/sync",
             "headers": [
               { "name": "Authorization", "value": "Bearer ${TERO_API_KEY}" }
             ]
           }
         ]
       }
   

   AP1

   tero-edge-config.yaml

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: tero-edge-config
     namespace: tero-system
   data:
     config.json: |
       {
         "listen_address": "0.0.0.0",
         "listen_port": 8080,
         "upstream_url": "https://agent-http-intake.logs.ap1.datadoghq.com",
         "metrics_url": "https://api.ap1.datadoghq.com",
         "log_level": "info",
         "service": {
           "name": "edge",
           "namespace": "production",
           "resource_attributes": [
             { "key": "deployment.environment", "value": "production" }
           ],
           "labels": [{ "key": "team", "value": "platform" }]
         },
         "max_body_size": 1048576,
         "policy_providers": [
           {
             "id": "tero",
             "type": "http",
             "url": "https://sync.usetero.com/v1/policy/sync",
             "headers": [
               { "name": "Authorization", "value": "Bearer ${TERO_API_KEY}" }
             ]
           }
         ]
       }
   

   Using a file provider instead?

   If you prefer to manage policies locally instead of syncing from Tero, use a file provider. Add policies.json to your ConfigMap:

   tero-edge-config.yaml

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: tero-edge-config
     namespace: tero-system
   data:
     config.json: |
       {
         "listen_address": "0.0.0.0",
         "listen_port": 8080,
         "upstream_url": "https://agent-http-intake.logs.datadoghq.com",
         "metrics_url": "https://api.datadoghq.com",
         "log_level": "info",
         "service": {
           "name": "edge",
           "namespace": "production",
           "resource_attributes": [
             { "key": "deployment.environment", "value": "production" }
           ],
           "labels": [{ "key": "team", "value": "platform" }]
         },
         "max_body_size": 1048576,
         "policy_providers": [
           {
             "id": "file",
             "type": "file",
             "path": "/etc/tero/policies.json"
           }
         ]
       }
     policies.json: |
       {
         "policies": [
           {
             "id": "drop-debug-logs",
             "name": "drop-debug-logs",
             "enabled": true,
             "log": {
               "match": [{ "log_field": "severity_text", "regex": "DEBUG" }],
               "keep": "none"
             }
           }
         ]
       }
   

   Update upstream_url and metrics_url for your Datadog region.

   kubectl apply -f tero-edge-config.yaml
   
3. Deploy the Edge DaemonSet

   Deploy Edge to run on each node:

   tero-edge-daemonset.yaml

   apiVersion: apps/v1
   kind: DaemonSet
   metadata:
     name: tero-edge
     namespace: tero-system
     labels:
       app: tero-edge
   spec:
     selector:
       matchLabels:
         app: tero-edge
     template:
       metadata:
         labels:
           app: tero-edge
       spec:
         containers:
           - name: tero-edge
             image: ghcr.io/usetero/edge:latest
             args:
               - /etc/tero/config.json
             env:
               - name: TERO_API_KEY
                 valueFrom:
                   secretKeyRef:
                     name: tero-edge
                     key: api-key
             ports:
               - containerPort: 8080
                 hostPort: 8080
                 protocol: TCP
             resources:
               requests:
                 cpu: 50m
                 memory: 32Mi
               limits:
                 cpu: 200m
                 memory: 64Mi
             volumeMounts:
               - name: tero-edge-config
                 mountPath: /etc/tero
                 readOnly: true
             livenessProbe:
               httpGet:
                 path: /_health
                 port: 8080
               initialDelaySeconds: 5
               periodSeconds: 10
             readinessProbe:
               httpGet:
                 path: /_health
                 port: 8080
               initialDelaySeconds: 2
               periodSeconds: 5
         volumes:
           - name: tero-edge-config
             configMap:
               name: tero-edge-config
         tolerations:
           - operator: Exists
   

   kubectl apply -f tero-edge-daemonset.yaml
   
4. Configure the Datadog Agent

   Point the Datadog Agent’s log output to Edge running on the same node.

   Datadog Operator

   Add to your DatadogAgent CR:

   spec:
     features:
       logCollection:
         enabled: true
     override:
       nodeAgent:
         env:
           - name: HOST_IP
             valueFrom:
               fieldRef:
                 fieldPath: status.hostIP
           - name: DD_LOGS_CONFIG_LOGS_DD_URL
             value: "http://$(HOST_IP):8080"
         tolerations:
           - operator: Exists
   

   Helm

   Add to your values.yaml:

   datadog:
     logs:
       enabled: true
   
   agents:
     containers:
       agent:
         env:
           - name: HOST_IP
             valueFrom:
               fieldRef:
                 fieldPath: status.hostIP
           - name: DD_LOGS_CONFIG_LOGS_DD_URL
             value: "http://$(HOST_IP):8080"
     tolerations:
       - operator: Exists
   

   The HOST_IP variable points the agent at the Edge instance on the same node via the hostPort.

5. Verify

   Check that Edge pods are running:

   kubectl get pods -n tero-system -l app=tero-edge
   

   Check Edge logs for incoming traffic:

   kubectl logs -n tero-system -l app=tero-edge --tail=50
   

Policy providers

Edge supports multiple policy sources. Configure them in the policy_providers array in your ConfigMap.

File provider

Load policies from a local file. Use this for static policies bundled in the ConfigMap.

{
  "id": "file",
  "type": "file",
  "path": "/etc/tero/policies.json"
}

HTTP provider

Fetch policies from a remote endpoint. This fits dynamic policies managed via the Tero API.

{
  "id": "tero",
  "type": "http",
  "url": "https://sync.usetero.com/v1/policy/sync",
  "headers": [{ "name": "Authorization", "value": "Bearer ${TERO_API_KEY}" }]
}

The DaemonSet injects ${TERO_API_KEY} from the Kubernetes secret through its environment configuration.

Example policies

Add policies to the policies.json section of your ConfigMap:

{
  "policies": [
    {
      "id": "drop-debug-logs",
      "name": "drop-debug-logs",
      "enabled": true,
      "log": {
        "match": [{ "log_field": "severity_text", "regex": "DEBUG" }],
        "keep": "none"
      }
    },
    {
      "id": "drop-nginx-source",
      "name": "drop-nginx-source",
      "enabled": true,
      "log": {
        "match": [{ "log_attribute": "ddsource", "regex": "nginx" }],
        "keep": "none"
      }
    },
    {
      "id": "keep-errors",
      "name": "keep-errors",
      "enabled": true,
      "log": {
        "match": [
          { "log_field": "severity_text", "regex": "error" },
          { "log_field": "severity_text", "regex": "critical" }
        ],
        "keep": "all"
      }
    }
  ]
}

See Policy Reference for all filtering options.

Troubleshooting

Agent can’t reach Edge

Verify Edge is listening on the hostPort:

kubectl get pods -n tero-system -l app=tero-edge -o wide

Ensure both the agent and Edge have matching tolerations so they run on the same nodes.

Policies not applying

Check that Edge loaded policies:

kubectl logs -n tero-system -l app=tero-edge | grep -i policy

Traffic not reaching Datadog

Verify upstream_url matches your Datadog region. Check Edge logs for upstream connection errors.