§08 · Deploy & operate

Deploying the manager

The autonomic-manager operator: its namespace, the ServiceAccount and ClusterRole it needs, the Service it exposes, and the admission webhook it self-bootstraps.

The autonomic-manager is a controller-runtime operator. It watches the CRDs (agents tools) and reconciles them into pods, Services, and Secrets. It installs into a fixed namespace, autonomic-system, as a single Deployment plus its RBAC and a self-managed admission webhook.

What gets installed

Namespace autonomic-system.
ServiceAccount, ClusterRole, and ClusterRoleBinding, all named autonomic-manager.
Deployment autonomic-manager (1 replica, leader-elect) and a Service of the same name.
A ValidatingWebhookConfiguration gating pods/exec and Tool operations.

Installing

The simplest path is exo-install; for GitOps use the Helm chart or the raw manifests (see Manual install).

●terminal· bash

exo-install operator --managed --base-url https://exo.example.com

helm repo add exo https://exo.assets.adaptive.live/charts

helm install autonomic exo/autonomic \
  --namespace autonomic-system --create-namespace \
  --set manager.managed=true --set manager.baseURL=https://exo.example.com

RBAC

The ClusterRole is broad because the operator builds and tears down real workloads. The notable grants:

●ClusterRole autonomic-manager· text

1autonomic.sh  agents, tools (+ /status)  full
2apps          deployments                                              full
3core          services, configmaps, pvcs, pods                         full
4core          pods/log                                                 get     (stream run logs)
5core          pods/exec                                                create  (shell into agent pods)
6core          secrets                                                  full    (credential management)
7core          events                                                   create,patch
8batch         jobs                                                     create  (Tool permission provisioning)
9rbac          clusterroles/bindings, roles/bindings   full + bind,escalate    (Kubernetes Tool policies)
10coordination  leases                                                   full    (leader election)
11admission     validatingwebhookconfigurations                         update  (webhook cert bootstrap)

Service & ports

The autonomic-manager Service exposes four ports:

●Service autonomic-manager· text

1webhook   443 → 9443   admission reviews (TLS; cert self-bootstrapped)
2metrics   8080         Prometheus /metrics
3probes    8081         /healthz, /readyz
4invoke    8082         agent invocation API (in-cluster, or via apiserver proxy)

The invoke port is what the exo CLI's cluster commands proxy to via the kube-apiserver: …/services/http:autonomic-manager:invoke/proxy/….

Admission webhook

On startup the manager mints its own serving cert (signed for autonomic-manager.autonomic-system.svc) and patches the ValidatingWebhookConfiguration with the CA bundle. No cert-manager dependency. The webhook gates pods/exec into Agents and Tool operations. You can turn it off with webhook.enabled=false, but keep it on.

Verifying

●terminal· bash

kubectl -n autonomic-system rollout status deploy/autonomic-manager

kubectl -n autonomic-system logs deploy/autonomic-manager --tail=50

kubectl get crds | grep autonomic.sh

Once it's up, connect it to the control plane (next page) or start authoring CRDs.