Architecture

The control plane

The control plane is where you log in and manage IDP, roles, and policies. Your Kubernetes cluster is where agents and tools are deployed.

The control plane never connects into your cluster. Every interaction (an agent's status in the UI, a shell, an agent invocation) travels back along the same connection the Exo Operator opened on startup.

Components

Three components (the CRDs, the operator, and the platform) plus a few published images the operator pulls at runtime.

• CRDs. The custom resource definitions. Registering them is what lets you author agents and tools as Kubernetes objects. See CRD overview.
• Operator. The autonomic-manager, a controller-runtime operator (Deployment + RBAC + admission webhook) that reconciles the CRDs into running pods and, optionally, connects out to the platform. See Deploying the manager.
• Platform. The Exo backend with the UI embedded in the same binary, plus PostgreSQL. This is the dashboard, the identity layer, the audit store, and the control plane the Exo Operator phones home to.

Topologies

• All-in-one. Platform + operator + CRDs in one cluster. The quickstarts and a default exo-install land here.
• Hub-and-spoke. One platform cluster; many Exo Operator clusters, each in managed mode connecting back over one outbound WebSocket. Each spoke is its own deployment in the dashboard.
• Local-only. Operator + CRDs with no platform, fully unmanaged. Agents run but nothing phones home. Good for dev and air-gapped edge.