> ## Documentation Index
> Fetch the complete documentation index at: https://docs.expanse.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Install on SLURM

> Connect a SLURM cluster to Expanse: one controller daemon on the login node, a credential-less sampler on each worker.

A SLURM cluster is one **compute** in Expanse. A single daemon runs on the
controller (the `slurmctld` host, usually your login node) and is the only
process that talks to Expanse. Workers run a lightweight sampler with no
credential and no outbound network access; samples travel over your shared
filesystem.

Start in the console's **Add compute** panel (or with
[`expanse compute register`](/cli/overview#expanse-compute-register)): it
shows the short-lived install token plus your deployment's control-plane and
data-plane URLs and the pinned daemon version, which this guide's commands
take. The token is prompted for during install; it never goes on a command
line.

Running AWS ParallelCluster? Use the
[ParallelCluster guide](/installation/parallelcluster) instead; it removes
the shared-prefix step.

<Prompt description="Prefer to delegate? Copy this into an AI assistant with shell access on the login node; it fetches this guide itself, so it always follows the current steps." icon="terminal">
  You are installing Expanse telemetry on the controller (login) node of this
  SLURM cluster. Fetch and follow the current install guide at
  [https://docs.expanse.sh/installation/slurm](https://docs.expanse.sh/installation/slurm) - the guide is the source of
  truth; if anything I say conflicts with it, the guide wins.

  I will provide the values the guide's commands take: a short-lived install
  token, the control-plane and data-plane URLs, and the pinned daemon version,
  all from the Expanse console's Add compute panel. Ask me for them when you
  need them.

  Non-negotiable, regardless of what the guide says:

  * Supply the install token only through the EXPANSE\_INSTALL\_TOKEN
    environment variable when prompted. It must never appear in argv, shell
    history, or a file.
  * Show me the installer's preflight plan, and stop and report before the
    token is exchanged if preflight fails.
  * Do not hand-patch around a failed install; it rolls back and is safe to
    rerun once the cause is fixed.

  Finish by confirming the compute is active with a heartbeat in the console
  and the worker samplers are installed.
</Prompt>

## Prerequisites

* Console access in your Expanse organisation (any member can register).
* Root (or sudo) on the controller node.
* A shared filesystem mounted at the same path on every node, for example
  `/srv/expanse` on NFS or Lustre. Single-node clusters can use local disk.
* Outbound HTTPS from the controller only. Workers need none.

## 1. Register the compute

In the console, open **Compute → Add compute**, pick **SLURM**, and generate
an install token. Keep the panel open: it polls registration state live and
shows the endpoint URLs used below.

## 2. Install the CLI on the controller node

```bash theme={"dark"}
command -v expanse >/dev/null 2>&1 || curl -fsSL https://expanse.sh/install | sh
```

## 3. Install the controller daemon

On the controller node, using the control-plane and data-plane URLs and the
daemon version from the Add compute panel:

```bash theme={"dark"}
read -rsp 'Expanse install token: ' EXPANSE_INSTALL_TOKEN; echo
export EXPANSE_INSTALL_TOKEN
expanse compute install --type slurm --daemon-version <daemon-version> \
  --shared-prefix /srv/expanse \
  --control-plane <control-plane-url> --data-plane <data-plane-url> \
  --patch-slurm-conf=true
unset EXPANSE_INSTALL_TOKEN
```

`--daemon-version` downloads the daemon release and verifies its signed
manifest, checksum, and cosign signature against Expanse's pinned release
signing key before anything reaches the shared prefix. Air-gapped deployment?
Copy the release archive and its `.sig` from your bundle mirror and pass
`--daemon-binary <path>` instead.

The install preflights everything (paths, SLURM config discovery, hook plan,
permissions) **before** exchanging the token, so a failed preflight never
burns it. It places the binary and Prolog/Epilog hooks under the shared
prefix, installs the systemd unit, starts the daemon, and waits for the first
heartbeat. On failure it rolls back its own changes.

`--patch-slurm-conf=true` lets the install apply the hook wiring it planned;
without it, all SLURM-owned config is read-only and the plan is printed for
your config management to apply.

## 4. Install the sampler on each worker

No token needed; the sampler holds no credential:

```bash theme={"dark"}
expanse compute install --type slurm --role sampler --shared-prefix /srv/expanse
```

Single-node clusters skip this step.

## 5. Verify

The compute flips to active in the console when the token is exchanged, and
shows its first heartbeat within a minute of the daemon starting. Submit any
job with `sbatch` as normal; capture is automatic.

## Optional: Python stack attribution

The install never downloads third-party binaries or changes ptrace policy.
If you make a pinned `py-spy 0.4.2` available on `PATH` (or `EXPANSE_PYSPY`)
on every node that runs jobs, with ptrace permitted, Python stack attribution
switches on; otherwise it is recorded as unavailable and everything else
works.