> ## Documentation Index
> Fetch the complete documentation index at: https://docs.expanse.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Install on Kubernetes

> Connect a Kubernetes cluster to Expanse: exchange the install token from a workstation, then install the Helm chart.

A Kubernetes cluster is one **compute** in Expanse, observed by a single
daemon `Deployment` installed with Helm. The daemon watches pods, jobs, and
the batch systems built on them (Volcano, Kueue, Argo Workflows, Flux, Ray,
Flyte) and reports telemetry; workloads are untouched.

The console's **Add compute** panel and
[`expanse compute register`](/cli/overview#expanse-compute-register) show the
short-lived install token plus your deployment's control-plane and data-plane
URLs, which this guide's commands take. The token is prompted for during
install; it never goes on a command line, and the chart never accepts a
plaintext install token as a value.

<Prompt description="Prefer to delegate? Copy this into an AI assistant with kubectl and Helm access; it fetches this guide itself, so it always follows the current steps." icon="terminal">
  You are connecting this Kubernetes cluster to Expanse telemetry. Fetch and
  follow the current install guide at
  [https://docs.expanse.sh/installation/kubernetes](https://docs.expanse.sh/installation/kubernetes) - the guide is the source of
  truth; if anything I say conflicts with it, the guide wins.

  I will provide the values the guide's commands take: a short-lived install
  token, the control-plane and data-plane URLs, and the pinned daemon version,
  all from the Expanse console's Add compute panel. Ask me for them when you
  need them.

  Non-negotiable, regardless of what the guide says:

  * Supply the install token only through the EXPANSE\_INSTALL\_TOKEN
    environment variable when prompted. It must never appear in argv, shell
    history, Helm values, or a file other than the config the installer
    writes.
  * Before installing the chart, tell me which namespaces it will watch and
    what RBAC scope it gets, and let me confirm.

  Finish by confirming the daemon pod is running and the compute is active
  with a heartbeat in the console.
</Prompt>

## Prerequisites

* Console access in your Expanse organisation (any member can register).
* A workstation with `kubectl` access to the cluster and Helm 3.
* Outbound HTTPS from the daemon pod to your Expanse control and data planes.

## 1. Register the compute

In the console, open **Compute → Add compute**, pick **Kubernetes**, and
generate an install token.

## 2. Exchange the token

On your workstation, using the control-plane and data-plane URLs from the
Add compute panel:

```bash theme={"dark"}
command -v expanse >/dev/null 2>&1 || curl -fsSL https://expanse.sh/install | sh
read -rsp 'Expanse install token: ' EXPANSE_INSTALL_TOKEN; echo
export EXPANSE_INSTALL_TOKEN
expanse compute install --type kubernetes \
  --control-plane <your-control-plane-url> --data-plane <your-data-plane-url>
unset EXPANSE_INSTALL_TOKEN
```

This exchanges the short-lived token for the compute's long-lived credential
and writes it to `~/.expanse/config.json`. If the install fails before the
config is written, rerun it with the same token; retry stops working at the
compute's first heartbeat or when the token expires.

## 3. Create the config Secret

```bash theme={"dark"}
kubectl create secret generic expanse-daemon-config \
  --from-file=config.json="$HOME/.expanse/config.json" \
  --dry-run=client -o yaml | kubectl apply -f -
```

## 4. Install the chart

```bash theme={"dark"}
helm repo add expanse https://charts.expanse.sh --force-update && helm repo update
helm upgrade --install expanse-daemon expanse/expanse-daemon \
  --set image.tag=<daemon-version> \
  --set config.existingSecret=expanse-daemon-config
```

To scope observation, set `watch.namespaces` to a list of namespaces and pair
it with `rbac.clusterWide=false` so the chart grants permissions only where it
watches.

Air-gapped deployment? Install the chart and images from your release bundle
mirror instead of `charts.expanse.sh`.

Pulling images through the Expanse registry? Generate pull credentials on the
console's **Platform → Registry** page and set `imagePullSecrets` on the
chart.

## 5. Verify

The compute flips to active in the console at exchange time and shows its
first heartbeat within a minute of the pod starting. Check the pod with
`kubectl logs deploy/expanse-daemon` if nothing arrives.