Install with Helm⚓︎

xControl is installed as one Helm release from Expeto's chart repository. This page takes you from an empty namespace to the first login; it assumes the cluster meets the prerequisites and that you have the credentials issued by Expeto Support.

Add the Helm repository⚓︎

helm repo add expeto https://repo.expeto.io/repository/ngc \
    --username '<username>' --password '<password>'
helm repo update
helm search repo expeto/xcontrol

The search must list the xcontrol chart. If it does not, check the credentials and that the machine can reach https://repo.expeto.io.

Write the values file⚓︎

Keep the deployment-specific settings in a values.yaml file under version control; it is the source of truth for the installation and the input to every later upgrade. A minimal file for a cluster with a working ingress controller and a cert-manager ACME issuer looks like this:

global:
  config:
    primaryDomain: xcontrol.example.com
    acmeTls: true
xview:
  enabled: true
kubemonitoring:
  enabled: false

• global.config.primaryDomain is the hostname on every Ingress the chart renders and the base of every URL xControl hands out, so it must be the name users and Agents resolve.
• global.config.acmeTls annotates the Ingress objects for cert-manager. Leave it false when TLS terminates elsewhere or when you reference an existing certificate Secret instead.
• xview.enabled installs the monitoring system alongside xControl. kubemonitoring is the alternative Prometheus-only option; the two are mutually exclusive.

Every other value has a working default. The configuration reference lists the ones you are most likely to change.

Install⚓︎

kubectl create namespace xcontrol
helm install xcontrol expeto/xcontrol -n xcontrol -f values.yaml \
    --set imageCredentials.username='<username>' \
    --set imageCredentials.password='<password>' \
    --set imageCredentials.email='user@example.com'

Quote every --set value in single quotes so the shell and Helm's type coercion leave it alone.

The release installs the CloudNativePG operator and its CustomResourceDefinitions, bootstraps the PostgreSQL cluster, runs the database migrations, imports the Keycloak realm and then starts the API server and the frontend. Expect several minutes on a fresh cluster, most of it spent pulling images and initialising the three database instances.

kubectl -n xcontrol get pods -w

When the install has settled, the namespace contains these workloads (names carry the release name as a prefix):

Helm also prints the commands below in its release notes.

First login⚓︎

The install generates an administrator Account and stores its credentials in a Secret named <release>-xcontrol-admin-credentials:

kubectl -n xcontrol get secret xcontrol-xcontrol-admin-credentials \
    -o jsonpath='{.data.username}' | base64 -d; echo
kubectl -n xcontrol get secret xcontrol-xcontrol-admin-credentials \
    -o jsonpath='{.data.password}' | base64 -d; echo

Open https://xcontrol.example.com/ngui/, sign in through Keycloak with those credentials, and change the password as described in Getting Started.

The Keycloak administration console is at https://xcontrol.example.com/auth/. Its admin user's password is in the <release>-keycloak-admin Secret under the password key. xControl users live in the expeto realm.

OpenShift⚓︎

The chart detects OpenShift and switches to the router's Ingress dialect, OpenShift-compatible security context constraints and the project's assigned user ID range. Two things differ from a plain Kubernetes install:

• Create a project instead of a namespace (oc new-project xcontrol) and use oc where this guide says kubectl.
• Leave cert-manager.enabled and kubemonitoring.enabled at false. OpenShift's cluster operators own the cert-manager and Prometheus CustomResourceDefinitions, and a second copy installed by Helm fails on the ownership conflict. Use the cert-manager Operator from OperatorHub for certificates and xView for monitoring.

Next steps⚓︎

Continue with Verify the installation to confirm the endpoints answer and to connect the first Site.