Networking and identity

Enrolled hosts send traces to an HTTPS endpoint in your infrastructure. The analyzer connects to your database, trace bucket, Instruction Hub, model provider, and Promptless. A private endpoint works when every enrolled host can reach it.

Upload ingress

Enrolled hostsWorkstations, laptops, and agent hosts

Session tracesthen

Trace analyzerYour HTTPS endpoint · port 443

Connections initiated by the analyzer

Trace analyzerYour cluster

Trace objectsthen

Trace bucketYour storage · HTTPS 443

Analysis statethen

PostgreSQLYour database · TLS, usually TCP 5432

Findings, remediations, & analyzer statusthen

PromptlessPromptless cluster · HTTPS 443

Hub source & proposed updatesthen

Instruction HubGitHub repository and API · HTTPS 443

Trace digestthen

Model providerReuse the provider your agents use · HTTPS 443

Database and trace storage stay in your infrastructure. Arrows show who initiates each connection; requests and responses travel over that connection. The table below also covers release downloads and identity endpoints.

Allow the required paths

Source	Destination	Purpose
Enrolled hosts	Analyzer ingress, HTTPS 443.	Enrollment, check-ins, and trace uploads.
Analyzer and migration Jobs	Your PostgreSQL endpoint, normally TCP 5432.	Data access and schema migrations over TLS.
Analyzer	Your trace storage endpoint, HTTPS 443.	Write raw uploads and read trace objects.
Analyzer	Registered Promptless runtime URL, HTTPS 443.	Policy, status, findings, and remediation synchronization.
Analyzer	GitHub repository and required GitHub API endpoints, HTTPS 443.	Read the Instruction Hub and coordinate connected workflows.
Analyzer	Your model endpoint, HTTPS 443.	Analyze sessions using your provider account.
Supervisor and cluster nodes	Release metadata and artifact registries, HTTPS 443.	Resolve releases and pull images.
Workloads using federation	Your cloud’s identity endpoints.	Obtain and refresh workload credentials.

Allow cluster DNS and your platform’s required control-plane traffic. Apply policies to migration Jobs as well as long-running pods. Storage private endpoints need matching private DNS and routing; creating an endpoint alone does not make it reachable.

Route uploads and health checks

The analyzer Service listens on port 8080. Route these paths through your HTTPS ingress:

• /healthz
• /v0/host-enrollment/policy
• /v0/host-enrollment/check-ins
• /v0/traces/batches

Configure every proxy and load balancer on the upload path to accept at least 10 MiB per encoded request. For ingress-nginx:

endpoint:
  ingressAnnotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"

Use your ingress controller’s equivalent setting. A smaller limit can reject uploads with HTTP 413 while /healthz still succeeds. The decoded trace-batch limit is a separate application setting.

Separate identities by purpose

Identity	Scope
Host enrollment credential	An individual enrolled host’s collection access.
Deployment installation token	The registered analyzer’s connection to Promptless.
Analyzer workload identity	Its configured trace objects and, if selected, authorized model access.
PostgreSQL role	The dedicated PIG database and schema migrations.
Hub read credential	The configured private GitHub repository.
Supervisor ServiceAccount	PIG application resources and its own updates within installed Kubernetes RBAC.
Terraform execution identity	Reviewed cloud infrastructure changes made by your platform team.

Keep cloud management privileges with your Terraform workflow. The supervisor does not need them. A model’s authorization remains separate from storage access even when both use the same workload identity.

Deliver application credentials through your secret manager, rotate them in place, and preserve Secret names referenced by PIGDeployment. Keep TLS certificate renewal in your existing certificate-management workflow.