Manual install · manifests & Helm

Raw manifests under GitOps instead of the installer: the platform deploy.yaml, the Helm chart, the CRD bundle, and the edits the stock files need.

exo-install is the fastest path, but if you run everything through Argo CD, Flux, or a reviewed kustomize tree, you want rendered manifests. The installer embeds charts under exo/exo-install/charts/, synced from helm/. Rendering requires Helm. The repo-root deploy.yaml is a separate control-plane installation option.

When to go manual

You manage cluster state declaratively and don't want a binary mutating it.
You need to diff and review every change to RBAC or the platform Secret.
You install the operator via Helm as part of a larger release.

Render & apply

The operator and platform sources are templated (namespace, image, managed mode, secrets, service type), so use exo-install render to materialise a concrete copy. Apply in order: crds/ → operator/ → platform/ with zero application replicas. Run database migrations and wait for success before starting application replicas.

terminal· bash

exo-install render crds     | kubectl apply -f -

exo-install render operator | kubectl apply -f -

exo-install render platform --replicas 0 | kubectl apply -f -

Platform · deploy.yaml

The repo root ships a standalone deploy.yaml for the control plane (Namespace, Secret exo-secrets, ConfigMap exo-config, Service plus Deployment exo-app on port 9092, 2 replicas with a rolling update). Two edits make it ready for configuration. Then follow the migration sequence in Install with deploy.yaml:

Fix these before applying

Replace the changeme-* secrets. The stock Secret ships placeholder values for EXO_JWT_SECRET, EXO_ENCRYPTION_KEY, and EXO_DATABASE_DSN. Set real ones; the backend won't boot unless EXO_ENCRYPTION_KEY is a 32-byte key (openssl rand -hex 16). See Config & secrets.
Pick your namespace. Every object ships in namespace exo. Rename it consistently if you want it elsewhere (or use exo-install, which templates the namespace for you).

exo-secrets · stringData· yaml

1stringData:
2  EXO_JWT_SECRET:     "<openssl rand -base64 48>"
3  EXO_ENCRYPTION_KEY: "<openssl rand -hex 16>"
4  EXO_DATABASE_DSN:   "host=db user=exo dbname=exo sslmode=require"
5  EXO_CLAUDE_API_KEY: ""

terminal· bash

kubectl apply -f deploy.yaml

Operator · Helm chart

The exo chart covers all three components: operator, platform, and an optional in-cluster Postgres. CRDs sit in the chart's native crds/ directory, applied on helm install and never touched on upgrade or uninstall.

terminal· bash

helm repo add exo https://exo.assets.adaptive.live/charts

helm install exo exo/exo \
  --set platform.enabled=false --set postgres.enabled=false \
  --set operator.managed=true \
  --set operator.baseURL=https://exo.example.com

values.yaml (operator knobs)· yaml

1imagePullSecrets: []
2operator:
3  namespace:
4    name: autonomic-system
5    create: true
6  image:
7    repository: docker.io/adaptivelive/autonomic-manager
8    tag: ""
9    pullPolicy: IfNotPresent
10  replicas: 1
11  args:
12    - --leader-elect
13  managed: false
14  baseURL: https://exo.adaptive.live
15  authTokenSecret:
16    name: autonomic-auth
17    key: token
18  webhook:
19    enabled: true
20    failurePolicy: Fail
21crds:
22  install: true

Provide the secrets. The chart creates the exo-secrets Secret from the values you pass: the 32-byte AES-256 EXO_ENCRYPTION_KEY and the JWT signing secret. Generate them inline so they are not hard-coded:

terminal· bash

helm repo add exo https://exo.assets.adaptive.live/charts

helm repo update

helm install exo exo/exo --namespace exo --create-namespace \
  --set platform.replicas=0 \
  --set 'platform.image.tag=<release-tag>' \
  --set platform.encryptionKey=$(openssl rand -hex 16) \
  --set platform.jwt.secret=$(openssl rand -base64 48)

Replace <release-tag> with your target release. Complete database migrations, then set platform.replicas to the desired count with helm upgrade, retaining the same values and secrets.

Back up the key

EXO_ENCRYPTION_KEY must be exactly 32 bytes; generate it with openssl rand -hex 16 (base64 of 32 bytes is 44 chars and is rejected). Omit --set platform.encryptionKey to auto-generate one instead; the chart persists it across helm upgrade by reading it back from exo-secrets, so it never has to appear in --set. Losing or changing the key makes all encrypted data unrecoverable, so back it up like a root credential. See Config & secrets.

CRDs

The chart definitions live in helm/exo/crds/. The bundle reviewed on 11 November 2026 has 13 CRDs; the operator source has 15, including App and WebAgent. Use the definitions from the matching operator release when those resources are needed. See Installing the CRDs.