Install  /  Helm overview

Install Veirox Connect on Kubernetes

This is the router page. Pick the guide that matches your cluster:

Before you install:

• [ ] You have an Veirox project and can mint an enrollment token at <veirox>/console/settings/connectors.
• [ ] You have kubectl access to the target cluster (kubectl auth can-i create namespace → yes).
• [ ] You have helm 3.9+.
• [ ] Egress to your Veirox backend on 443/TCP is reachable from the cluster pod network.

After you install — verify the signature of the image + chart before trusting them:
→ docs/connect/cosign-verify.md

Quickstart

This is the minimum viable install. For anything production-grade, use
the cloud-specific guide above.

1. Create a namespace and the enrollment-token Secret

copykubectl create namespace veirox
kubectl -n veirox create secret generic veirox-connector-token \
  --from-literal=token=veirox_enr_REPLACE_ME

Never pass --set token=... on the helm install command line
— helm get values leaks it. Use a Secret.

2. Install the chart

copyhelm install veirox-connector \
  oci://ghcr.io/msrashed2018/charts/veirox-connector \
  --namespace veirox \
  --set backendUrl=https://www.veirox.com \
  --set rbacPreset=readOnly

3. Verify the pod is up

copykubectl -n veirox get pods -l app.kubernetes.io/name=veirox-connector
kubectl -n veirox logs -f deploy/veirox-connector --tail=30

Expect:

copyINFO agent_connecting url=wss://veirox.com/api/connectors/ws
INFO connector_authenticated
INFO tunnel_broker_registered connector_id=...

4. Confirm the connector appeared in Veirox

Open <veirox>/console/settings/connectors. A new row with online=true
and type=k8s_pod should appear within ~30 seconds.

5. Walk the verification checklist

→ docs/connect/verification-checklist.md

This step is important — it confirms the Claude agent can actually
execute commands through the connector, not just that the pod is
running.

Configuration reference

All values below are --set key=value flags or entries in a
values.yaml override file (-f my-values.yaml).

RBAC presets

• readOnly — get/list/watch on core + apps + batch +
  networking. Backed by a ClusterRole (cluster-wide read, including
  Secrets metadata via configmaps/events). The agent can
  kubectl get pods -A, describe, stream logs, but cannot mutate
  anything. Safe default.
• nsAdmin — full verbs on core + apps + batch + networking +
  autoscaling + policy, limited to the release namespace. Uses a
  Role, not a ClusterRole, so the blast radius is one namespace.
• clusterAdmin — binds the agent's ServiceAccount to the
  built-in cluster-admin ClusterRole. Only pick this when you
  explicitly want Veirox to be able to mutate any resource anywhere.
  The per-connector approval policy in the Veirox UI is your last
  line of defence — review it before granting this.

Upgrade

copyhelm upgrade veirox-connector \
  oci://ghcr.io/msrashed2018/charts/veirox-connector \
  --namespace veirox \
  --set image.tag=<new-version>-k8s

The chart uses strategy: Recreate because the agent is a stateful
WS client — running two instances would collide. Expect ~10 s of
downtime during the upgrade. Running commands are re-queued to the
new pod when it reconnects.

→ Full upgrade guide: docs/connect/upgrade.md

Uninstall

copyhelm uninstall veirox-connector --namespace veirox
kubectl delete namespace veirox

Then delete the connector record in Veirox UI →
<veirox>/console/settings/connectors → (select) → Delete.

Troubleshooting