Run Collector¶

Start AI Assets Collector Using Runtime on K8s¶

A Trust3 Runtime is a lightweight deployment plane that runs inside your own EKS/AKS cluster. It lets Trust3 deploy and manage collectors — such as the AI Assets Collector — directly in your environment, without requiring inbound connectivity from the internet into your cluster.

When you create a Runtime, Trust3 installs a small agent in your cluster (the Runtime Plane) that maintains an outbound-only connection to the Trust3 control plane. You then add collectors to that Runtime through the Trust3 dashboard, and Trust3 deploys them as pods in your cluster automatically.

This approach keeps your data local — the AI Assets Collector reads from your Databricks workspace, Microsoft Copilot Studio, or Azure Foundry environment and sends only governance metadata to Trust3, never raw data.

When to use this path: Use the Runtime on K8s path if your Databricks workspace, Microsoft Copilot Studio, or Azure Foundry environment is network-restricted, if your security policy requires all compute to run inside your own cluster, or if you prefer Kubernetes-native deployment and lifecycle management over running Docker locally.

If you are evaluating Trust3 or running a quick local test, use the Docker tab instead — it requires no Kubernetes cluster.

Follow this workflow to run the AI Assets Collector in your EKS or AKS cluster using a Trust3 Runtime.

Create a Runtime¶

1. In the Trust3 dashboard, navigate to Settings > Runtime.
2. Click Create New.

3. On the Create Runtime Plane page, configure the runtime:

   Setting	Value
   Deployment Type	Partially Managed (D2P) — the Trust3 control plane is cloud-hosted; the data plane runs in your own cluster
   Configuration Mode	Basic Config
   Cloud Provider	AWS or Azure
   Region	Select the region where your cluster is deployed
   Runtime Name	Auto-generated — you can rename it, this will be your namespace in kubernetes
   Auto Upgrade	Set to true — the runtime plane updates automatically when new releases are available

4. Select the AWS Prerequisites or Azure Prerequisites checkbox to confirm all prerequisites are met. Click View full details if you need to complete any missing prerequisites before continuing.

5. Click Generate.

Deploy the Runtime Plane¶

The next screen shows two commands to run from your terminal:

1. curl or wget command — downloads the Trust3 runtime installation script to your machine.
2. Helm command — deploys the Trust3 Runtime Plane components into your Kubernetes cluster and connects them to Trust3Cloud. Run this exactly as shown — it includes a pre-populated token for your tenant.

Run the commands in order. When the status on screen changes to Connection Established, click Done.

Add AI Assets Collector¶

1. Go to Settings > Runtime and click the running runtime to open its detail view.
2. Select the Collectors tab.
3. Click Add New.

4. Choose a tile:

   Tile	Use it for	Set it up
   Databricks, Azure AI Foundry, Azure Copilot Studio, Azure M365	One Databricks workspace, or one service of one Microsoft tenant, as a connection. Add one per workspace or service; Shared connections run together in one pod.	Add a connection
   Custom agents	Traces from agents you build yourself	Collect Traces (OTLP)
   AI Assets Collector (Legacy)	One standalone collector covering Databricks and all of Azure in one form, as before connections existed	The Legacy collector form

   Runtime plane release

   The connection and Custom agents tiles need a runtime plane on release 9.2.45.3 or later. On an older runtime plane, use AI Assets Collector (Legacy), or upgrade the runtime plane first.

Add a connection¶

1. On the BASIC INFO tab, enter a Name and an optional Description.
2. Choose the Deployment Mode: Shared (the default) runs the connection on a shared host, which runs up to 10 connections in one pod; Dedicated gives it its own pod. The mode cannot change after create.
3. For Shared, choose the Shared host: Default, a named host, or + Create new shared host.
4. Click Continue, and fill in the connection's own section — Databricks or Azure — with the fields described under Databricks and Azure below. A Microsoft connection reads only its own service, so its Azure section has that service's monitoring switch only — see What each Microsoft connection needs. For a secret, you can pick a saved credential instead of typing it.
5. Click Save.

A Shared connection's scanner interval, trace classification and Kubernetes settings are on its shared host, under the runtime plane's System Applications tab. Each workspace and each tenant service can have only one connection on a runtime plane. Read Collector Connections for the rules, pausing and deleting, and limits.

The Legacy collector form¶

The AI Assets Collector (Legacy) tile creates one collector with its own pod and every section in one form. Collectors created before connections existed work the same way.

1. In Basic Info, enter:
   • Name — a descriptive name for this collector instance
   • Description (optional)
2. Click Continue.

3. In Datasource Configuration, provide your configuration values.

   Collector Configs — each platform has its own discovery switch, and turning it on reveals that platform's credentials and its monitoring switch. Turn on only the platforms you are connecting; everything starts off on a new collector.

   See Discovery and monitoring for how the two switches relate. In short: monitoring collects traces from assets that discovery found, so a platform with discovery off collects nothing.

   Databricks

   Setting	Property	Default	Purpose
   Enable Databricks discovery	collector.databricks.discovery.enabled	false	Discovers MLflow agents, Genie spaces and serving endpoints. Turn on to reveal the fields below.
   Databricks host	databricks.host	—	Workspace URL, e.g. https://your-workspace.cloud.databricks.com
   Databricks token	databricks.token	—	Personal access token. Only for the personal-access-token method — see the note below.
   Databricks environment name	databricks.environment-name	—	Optional label stored on ingested assets. Use dev, stage, prod or test.
   Enable Databricks trace monitoring	collector.databricks.monitoring.enabled	true	Collects traces from the discovered Databricks assets
   Enable model usage collection	collector.databricks.model-usage.enabled	true	Queries system.ai_gateway.usage and system.serving.endpoint_usage
   SQL warehouse HTTP path	collector.databricks.sql-warehouse-http-path	—	Required when model usage is on. Only shown while that toggle is on. See Model usage traces.

   Authentication method

   The Databricks section also has an Authentication method dropdown: Personal access token (default), Service principal (OAuth M2M), Entra ID service principal (Azure only), or Entra ID workload identity (Azure AKS only). Selecting one shows only that method's credential fields and hides the others, so the token field above applies to the first option only.

   Env equivalent for the Docker path: DATABRICKS_AUTH_TYPE — pat, service_principal, azure_service_principal or azure_workload_identity.

   Each method has its own setup page — see Choose an authentication method.

   Azure

   On a Legacy collector, one section covers all three Azure flavors — Azure AI Foundry, Microsoft Copilot Studio, and M365 Copilot. A single service principal covers all three; the collector attempts each and logs the ones it cannot reach, so there is no per-flavor switch. Scope what is collected by controlling what you grant the service principal. To scan one service only, use a connection tile instead.

   Setting	Property	Default	Purpose
   Enable Azure discovery	collector.azure.discovery.enabled	false	Discovers Foundry, Copilot Studio and M365 Copilot assets. Turn on to reveal the fields below.
   Azure tenant ID	azure.tenant-id	—	Directory (tenant) ID
   Azure client ID	azure.client-id	—	Application (client) ID of the service principal
   Azure client secret	azure.client-secret	—	Client secret
   Enable Azure trace monitoring	collector.azure.monitoring.enabled	true	Collects M365 Copilot / Defender interactions and Foundry agent traces

   M365 and Defender monitoring needs Graph permissions

   Trace monitoring for M365 Copilot and Defender requires ThreatHunting.Read.All, AiEnterpriseInteraction.Read.All and AuditLogsQuery.Read.All on the service principal. Without them each fetch cycle logs a 403 for that flavor — Azure AI Foundry monitoring is unaffected and keeps working. See Azure M365 Agents prerequisites.

   Custom Agents

   For agents you build yourself — LangChain, LangGraph, or any custom framework. This section has no discovery switch, because you publish those agents to the inventory from your own code using the Trust3 collector SDK. See Monitoring custom agents for the full setup — Publish inventory for the SDK half, and Monitoring for the trace half, including how to make traces link to your assets.

   Trust3 reads OTLP trace files from an S3 bucket. Either your existing Langfuse or OTel collector already writes them there, or you can have Trust3 run a trace ingester for you — see the Trace Ingester section below.

   Setting	Property	Default	Purpose
   Enable Langfuse / OTEL Trace Monitoring	collector.otel_langfuse.monitoring.enabled	false	Reads OTLP traces Langfuse exported to S3
   S3 Bucket Name	otel_langfuse.s3_bucket	—	Bucket holding the trace files
   S3 Key Prefix	otel_langfuse.s3_prefix	—	Prefix under which they are written; blank scans the whole bucket
   S3 region	otel_langfuse.s3_region	us-east-1	AWS region of the bucket

   The collector reads the bucket using the runtime plane's IAM role — there are no access-key fields. Make sure that role has read access to the bucket.

   Note

   Amazon S3 only. Traces must be written as uncompressed JSON; compressed objects are skipped.

   Trace Ingester (EKS planes only)

   Optional. Turn this on and Trust3 runs a trace ingester as a sidecar on the AI Assets Collector pod, exposing an authenticated OTLP endpoint that your agents push to. The sidecar writes the traces to your S3 bucket, and the Custom Agents section above then reads them back from that same bucket. It is an OpenTelemetry collector internally, named Trace Ingester to keep it distinct from the otel-collector service that carries Trust3's own platform telemetry.

   Use this if you do not already have a Langfuse or OTel collector exporting to S3. If you do, leave this off and just point the Custom Agents section at your existing bucket.

   Setting	Property	Default	Purpose
   Enable trace ingester	traceIngesterEnabled	false	Adds the trace ingester sidecar, a Service and an Ingress
   S3 bucket name	trace_ingester.s3.bucket	—	Bucket that receives the traces. Overrides the plane's AWS S3 Bucket Name; blank uses that plane-level value.
   S3 path prefix	trace_ingester.s3.prefix	—	Blank uses trust3/agent/traces/tenant=<tenant>/plane=<plane>. Give each plane a different prefix if they share a bucket.
   Trace ingester username	trace_ingester.security.basic_auth_username	trust3agent	Basic Auth user your agents send as
   Trace ingester password	trace_ingester.security.basic_auth_password	—	Basic Auth password. On an AWS Secrets Manager plane, enter the key name inside the secret rather than the password itself.

   This requires an EKS runtime plane created with Advanced Config, with storage, Ingress and DNS configured — AWS S3 Bucket Name, ACM ARN, ALB Subnet IDs and Domain Name / R53 Hosted Zone Name — plus an IAM Role ARN with s3:* on the bucket. See What custom agent monitoring needs. If any is missing the deploy still succeeds but no endpoint is created, and Runtime Manager logs a warning naming what is missing.

   Traces written by this sidecar go only to your S3 bucket — there is no Privacera Cloud destination in that pipeline. Turning the toggle off removes the sidecar, Service and Ingress.

   Trace classification

   Applies to every monitoring provider — there is no per-platform classification switch.

   Setting	Property	Default	Purpose
   Enable trace classification	collector.trace.classification.enabled	false	Classifies collected traces with an LLM to derive categories and policy signals
   Classifier LLM provider	collector.classifier.llm.provider	—	The LLM vendor
   Classifier LLM model	collector.classifier.llm.model	—	e.g. claude-haiku-4-5 for Anthropic, gpt-4o-mini for OpenAI
   Classifier LLM API key	classifier.llm.api-key	—	API key for that provider

   When classification is on, all three fields are required. If any is missing the collector logs a warning and leaves traces unclassified — it does not fail to start, and trace collection continues.

   General

   Setting	Property	Default	Purpose
   Scanner interval (minutes)	collector.scanner.interval-minutes	15	Minutes between full collector pipeline runs

   Kubernetes Configs — update resource values to match your cluster configuration.

4. Click Save. Trust3 creates the AI Assets Collector pod in your runtime namespace.

Verify the Collector Pod¶

Confirm the collector is running using kubectl:

1

kubectl get pods -n <your-runtime-namespace>

Look for the collector's pod with status Running. Its name starts with the application's name:

If the pod is in CrashLoopBackOff or Error, check the logs:

1

kubectl logs -n <your-runtime-namespace> <your-pod-name> --tail=50

You can also open Collectors in the Trust3 Portal, Navigate to Settings > Runtime > Runtime Name > Collectors Tab and confirm the AI Assets Collector shows a running status there.

Quick checklist¶

• Deployment Type set to Partially Managed (D2P)
• Cloud Provider set to AWS or Azure, region matches AWS / AKS cluster region
• AWS / Azure prerequisites confirmed
• Runtime installation commands run from terminal (curl/wget first, then Helm)
• Runtime shows Connection Established before clicking Done
• AI Asset Collector added from Collectors > Add New — one connection per workspace or tenant service, or a Legacy collector
• For a Shared connection, scanner interval and classification set on its shared host under System Applications
• Discovery enabled for each platform you are connecting (nothing is collected until you do)
• Databricks configuration provided (if connecting Databricks)
• AWS configuration provided (if connecting AWS)
• Microsoft Copilot Studio configuration provided (if connecting Copilot Studio)
• Collector pod shows Running in kubectl
• AI assets appear in Trust3 portal within 15 minutes
• Databricks: Databricks
• Microsoft Copilot Studio: Microsoft Copilot Studio prerequisites
• Azure Foundry: Azure Foundry
• Azure M365 Agents: Azure M365 Agents prerequisites

Download docker-compose.yml¶

Save the file in a directory on your machine (for example ai-assets-collector/). Use the link below — it triggers a download using the site’s download helper.

Download docker-compose.yml

Create .env¶

Under the same directory where you keep docker-compose.yml, create a file named .env and add the variables below. Set values for each platform you connect (Databricks, Microsoft Copilot Studio, Azure Foundry, or all) and AI_GOVERNANCE_API_KEY (To retrieve the API key, log in to Trust3 and navigate to Settings -> API Keys. Make sure you have ADMIN Role to access this page)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

# Databricks
COLLECTOR_DATABRICKS_DISCOVERY_ENABLED=true
COLLECTOR_DATABRICKS_MONITORING_ENABLED=true
DATABRICKS_HOST=https://your-workspace.cloud.databricks.com
DATABRICKS_TOKEN=
DATABRICKS_ENVIRONMENT_NAME=(dev/test/prod/stage)
DATABRICKS_SQL_WAREHOUSE_HTTP_PATH=

# Azure — covers Foundry, Copilot Studio and M365 Copilot
COLLECTOR_AZURE_DISCOVERY_ENABLED=true
COLLECTOR_AZURE_MONITORING_ENABLED=true
TRUST3_AZURE_TENANT_ID=
TRUST3_AZURE_CLIENT_ID=
TRUST3_AZURE_CLIENT_SECRET=
AZURE_FOUNDRY_ENVIRONMENT_NAME=(dev/test/prod/stage)

# Custom agents over OTLP — see the Custom Agents guide
COLLECTOR_OTEL_LANGFUSE_MONITORING_ENABLED=false
OTEL_LANGFUSE_S3_BUCKET=
OTEL_LANGFUSE_S3_PREFIX=
OTEL_LANGFUSE_S3_REGION=us-east-1
OTEL_LANGFUSE_S3_IAM_ROLE=
OTEL_LANGFUSE_S3_ACCESS_KEY_ID=
OTEL_LANGFUSE_S3_SECRET_ACCESS_KEY=

# Trace classification — applies to every provider
COLLECTOR_TRACE_CLASSIFICATION_ENABLED=false

AI_GOVERNANCE_API_KEY=

Discovery is off unless you turn it on, so set the discovery variable for each platform you are connecting. Monitoring only runs for a platform whose discovery is on — see Discovery and monitoring.

Leave a line blank or omit variables you are not using, following your collector’s expectations.

Login Trust3 AI Docker Repository¶

To log in to the Trust3 AI Docker repository, use the following command:

1

docker login api.na.trust3ai.com -u trust3

When prompted for a password, enter your API key. To retrieve the API key, log in to Trust3 and navigate to Settings > API Keys.

Run with Docker Compose¶

1. Open a terminal under the directory where you keep docker-compose.yml and .env.

2. Start the collector (detached):

   Bash
   1	docker compose up -d

3. Watch logs — while docker compose is up, the collector runs on a schedule (every 15 minutes in the current release):

   Bash
   1	docker compose logs -f trust3-ai-assets-collector

4. Tear down when you no longer want scheduled collection on this host:

   Bash
   1	docker compose down

Environment variables (for .env)¶

Monitoring environment variables¶

Monitoring is off by default and is enabled per platform.

Discovery and monitoring are set per platform. Monitoring requires that platform's discovery to be on.

When a discovery or monitoring variable is left unset, the collector falls back to how it behaved before per-platform switches existed — credentials imply discovery, and monitoring follows TRACE_COLLECTION_ENABLED. Existing .env files therefore keep working unchanged.

Deprecated variables¶

Both still work, and are still what an unset per-platform flag falls back to. Prefer the per-platform variables for new configurations.

Quick checklist¶

• docker-compose.yml in a directory (download or copy from ai-assets-collector/docker/ in the repo)
• .env under that same directory with the variables above filled in as needed
• Discovery variable set for each platform you are connecting
• docker compose up -d
• docker compose logs -f trust3-ai-assets-collector to verify the run
• Databricks: Databricks
• Microsoft Copilot Studio: Microsoft Copilot Studio prerequisites
• Azure Foundry: Azure Foundry
• Azure M365 Agents: Azure M365 Agents prerequisites
• Custom agents: Custom Agents