Skip to main content

Deploy Expanso on Single-Node OpenShift

Deploy the Expanso Edge agent as a DaemonSet on your SNO cluster to enable log collection and monitoring.

DaemonSet Deployment​

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: expanso-edge
  namespace: expanso-system
spec:
  selector:
    matchLabels:
      app: expanso-edge
  template:
    metadata:
      labels:
        app: expanso-edge
    spec:
      serviceAccountName: expanso-edge
      hostNetwork: true
      containers:
      - name: expanso-edge
        # The stock image runs the edge agent only. OpenShift log collection
        # shells out to `oc`, which is not in this image; build a custom image
        # on top with `oc` on PATH for the log-collection pipelines (see note).
        image: ghcr.io/expanso-io/expanso-edge:latest
        args:
        - run
        - --bootstrap-token
        - "$(EXPANSO_EDGE_BOOTSTRAP_TOKEN)"
        env:
        - name: EXPANSO_EDGE_BOOTSTRAP_TOKEN
          valueFrom:
            secretKeyRef:
              name: expanso-bootstrap
              key: token
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: CLUSTER_NAME
          value: "sno-retail-001"
        - name: LOCATION
          value: "store-chicago-north"
        - name: KUBECONFIG
          value: /etc/expanso/kube/config
        volumeMounts:
        - name: data
          mountPath: /var/lib/expanso
        - name: kubeconfig
          mountPath: /etc/expanso/kube
          readOnly: true
      volumes:
      - name: data
        emptyDir: {}
      - name: kubeconfig
        secret:
          secretName: expanso-kubeconfig
OpenShift log collection needs a custom image

The stock ghcr.io/expanso-io/expanso-edge image ships only the edge binary (plus ca-certificates and tzdata) and does not include oc. The log-collection pipelines in this guide shell out to oc, so build a custom image on top of the edge image with the OpenShift CLI on PATH, and reference it in the DaemonSet.

Configuration​

Namespace: Create the expanso-system namespace first:

oc create namespace expanso-system

Environment variables:

  • EXPANSO_EDGE_BOOTSTRAP_TOKEN: Bootstrap token the agent uses to enroll with your workspace (sourced from a Secret)
  • NODE_NAME: Automatically populated from pod spec
  • CLUSTER_NAME: Unique identifier for this SNO cluster
  • LOCATION: Physical location (store, factory, etc.)
  • KUBECONFIG: Path to the mounted kubeconfig used by oc-based log-collection pipelines

Bootstrap token: The agent enrolls with your workspace using a bootstrap token from Expanso Cloud. Store it in a Secret:

oc create secret generic expanso-bootstrap \
  --from-literal=token=exp_bk_your_token_here \
  -n expanso-system

Kubeconfig: The log-collection pipelines run oc against the cluster. Provide a kubeconfig as a Secret:

oc create secret generic expanso-kubeconfig \
  --from-file=config=$HOME/.kube/config \
  -n expanso-system

Pipelines: In this managed setup you do not mount a pipeline into the agent. Once the agent is enrolled, deploy log-collection pipelines to it as jobs from Expanso Cloud (see Collect Logs).

ServiceAccount: Required for RBAC permissions (see RBAC Setup)

Host Network Mode​

hostNetwork: true

Why: Allows Expanso to access oc commands and cluster resources directly from the node without network isolation.

Security consideration: Only use when Expanso needs direct node access for log collection.

Apply Deployment​

# Create namespace
oc create namespace expanso-system

# Create service account (see RBAC Setup)
oc apply -f expanso-rbac.yaml

# Create the bootstrap token and kubeconfig secrets
oc create secret generic expanso-bootstrap \
  --from-literal=token=exp_bk_your_token_here \
  -n expanso-system
oc create secret generic expanso-kubeconfig \
  --from-file=config=$HOME/.kube/config \
  -n expanso-system

# Deploy DaemonSet
oc apply -f expanso-daemonset.yaml

# Verify deployment
oc get pods -n expanso-system
oc logs -n expanso-system -l app=expanso-edge --follow

Resource Limits​

For SNO environments, set conservative resource limits:

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi

Next Steps​