Install with Embedded Cluster

curl -f 'https://replicated.app/embedded/dreadnode/stable' \
    -H 'Authorization: <license-id>' -o dreadnode.tgz
tar -xvzf dreadnode.tgz
sudo ./dreadnode install --license license.yaml

Three commands: download, extract, install. The installer provisions Kubernetes (k0s), an ingress controller (Traefik), persistent storage (OpenEBS), and the Admin Console. Configure the initial deployment through the Admin Console or pass a KOTS ConfigValues file to the installer. Dedicated fields cover common settings, and Advanced Helm Values accepts the same YAML document used by Helm installations.

VM requirements

• OS — Ubuntu 22.04 LTS (x86_64)
• CPU — 4 vCPU minimum
• Memory — 8 Gi minimum
• Disk — 40 Gi minimum (SSD recommended)
• Access — root or sudo

The installer runs its own host preflight checks for disk, CPU, memory, and OS before provisioning anything. If your VM doesn’t meet the requirements, the installer tells you before it starts.

Network access

The VM needs outbound HTTPS to three endpoints:

• replicated.app — installer download, license validation, update checks
• proxy.enterprise.dreadnode.io — container image pulls (authenticated via your license)
• updates.enterprise.dreadnode.io — application update metadata

For air-gapped environments, download the airgap bundle from the Replicated portal instead. All images are included in the bundle.

DNS records

Point two DNS records at the VM’s public IP:

• <your-domain> — serves the frontend and API
• storage.<your-domain> — serves the MinIO S3 API

Traefik binds directly to ports 80 and 443 on the host via hostPort, so no load balancer sits in between.

Download and install

1. Get your license file. Dreadnode provides a license.yaml file. Place it on the VM.

2. Download the installer bundle:

curl -f 'https://replicated.app/embedded/dreadnode/stable' \
    -H 'Authorization: <license-id>' -o dreadnode.tgz

Your license ID is inside the license file (licenseID: field). For Beta channel releases, replace stable with beta in the URL.

3. Extract the bundle:

tar -xvzf dreadnode.tgz

Choose an interactive or automated initial installation:

Admin Console

sudo ./dreadnode install --license license.yaml

The installer prompts for an Admin Console password, then prints the Admin Console URL. Enter the application configuration there before the first deployment.

KOTS ConfigValues

Create dreadnode-config.yaml with at least the required domain:

apiVersion: kots.io/v1beta1
kind: ConfigValues
spec:
  values:
    domain:
      value: dreadnode.example.com
    scheme:
      value: http

Then install without opening the Admin Console:

sudo ./dreadnode install \
    --license license.yaml \
    --config-values dreadnode-config.yaml \
    --admin-console-password '<admin-console-password>'

The installer runs the application preflight checks from the command line. Add the remaining ConfigValues items before you install. Start a ConfigValues-only install on HTTP; after the cluster exists, create the TLS Secret and enable HTTPS through the Admin Console.

Pick a strong Admin Console password; it protects the management UI on port 30000. Installation takes 5–10 minutes depending on VM specs and download speed.

ConfigValues is an initial-install interface

Embedded Cluster does not support headless updates. After the first installation, change chart configuration in the Admin Console and select Deploy.

Embedded Cluster secures the Admin Console with a self-signed certificate by default. During the Secure the Admin Console step, continue with that certificate or upload one of your own. This certificate protects only the Admin Console on port 30000; it does not configure HTTPS for Dreadnode on port 443.

Configure via the Admin Console

Open the Admin Console at https://<vm-ip>:30000 and log in with the password you set during installation.

The config screen walks through these groups:

Dreadnode Identity — Set your domain (required) and URL scheme (HTTP or HTTPS). The organization display name defaults to your license’s customer name.

Networking & TLS — Ingress class defaults to traefik (correct for Embedded Cluster). If you chose HTTPS above, enter the name of a kubernetes.io/tls Secret you created in kotsadm, and confirm the HTTP-to-HTTPS redirect. Set trusted proxy hops if anything sits in front of the cluster. See Configuration overview.

Data Stores — PostgreSQL, ClickHouse, and S3/MinIO each default to in-cluster. Set the volume size for each bundled store here; growing one later is difficult, so size them before the first deploy. Switch any to “external” to point at a managed service (RDS, your own ClickHouse, S3 bucket) — external mode reveals the connection fields. See External data stores for requirements.

Sandbox Runtime — OpenSandbox (on-cluster, default) or E2B (cloud, requires API key), plus optional session time limits. See Sandbox runtime for the workload-location and networking tradeoffs.

Inference Proxy — Enable the bundled LiteLLM proxy if this install should serve dn/* models. Model endpoints and provider credentials are configured after deployment. The proxy needs a PostgreSQL it can create a schema in, so it is unavailable when the external database uses AWS IAM authentication.

Authentication & Email — Configure OpenID Connect, GitHub, Google, SMTP, and the password policy, including their protected client and relay secrets.

Logging — Log level and structured JSON toggle.

Scaling & Resources — Resource preset: small (~50 users), medium (~50–200), or large (200+). Optionally set API replicas and per-queue worker concurrency.

Advanced Helm Values — Paste umbrella-chart values for any chart setting without a dedicated field. The installer merges these values last, so they override a dedicated field on conflict. See Chart overrides and tuning for the Helm, Admin Console, and ConfigValues formats.

After saving the config, click Deploy. The Admin Console installs the Helm chart with your settings and shows deployment progress.

If you want HTTPS on the first deployment, create the TLS Secret before you click Deploy. You do not need to deploy over HTTP first. See TLS certificates for certificate generation, Secret creation, configuration, and verification.

Build a ConfigValues file

A ConfigValues file uses the item names behind the Admin Console fields, such as domain, postgres_mode, and sandbox_provider. It does not use chart paths such as global.domain. Every scalar must be a string. For a password item, use valuePlaintext; KOTS encrypts it during installation:

apiVersion: kots.io/v1beta1
kind: ConfigValues
spec:
  values:
    domain:
      value: dreadnode.example.com
    scheme:
      value: http
    resources_preset:
      value: medium
    oidc_enabled:
      value: '1'
    oidc_client_id:
      value: dreadnode
    oidc_client_secret:
      valuePlaintext: '<oidc-client-secret>'
    oidc_metadata_url:
      value: https://idp.example.com/.well-known/openid-configuration

You only need required items and values you want to change from their defaults. The Configure pages provide copyable fragments for each group. Merge those fragments under one spec.values mapping, then pass the file with --config-values during the initial installation.

Protect plaintext input files

valuePlaintext lets KOTS encrypt a protected field during installation, but the source file itself still contains plaintext. Restrict its permissions, keep it out of source control, and remove it from the VM when your installation workflow no longer needs it.

Access Kubernetes

Use the Embedded Cluster shell whenever a procedure requires kubectl. Run it from the directory that contains the dreadnode installer:

sudo ./dreadnode shell
export NAMESPACE=kotsadm
kubectl -n "$NAMESPACE" get pods

The Embedded Cluster shell command is the supported entry point for cluster access. It starts a root shell, exports the kubeconfig selected by that installation, and adds the bundled kubectl to PATH. Run the command on a controller node; worker nodes do not support it. See Replicated’s cluster access instructions.

Once the prompt changes, run kubectl directly; you are already root. Do not run sudo kubectl inside the shell. A nested sudo can discard KUBECONFIG and make kubectl load a different configuration.

Before changing cluster resources, inspect the configuration selected by the shell:

printf 'KUBECONFIG=%s\n' "${KUBECONFIG:-<unset>}"
command -v kubectl
kubectl config current-context
kubectl config view --minify \
    -o jsonpath='{.clusters[0].cluster.server}{"\n"}'

The kubeconfig path, bundled binary path, and context can vary by Embedded Cluster version and installation. KUBECONFIG and the current context should be nonempty, and the selected server should be the cluster’s HTTPS API endpoint.

kubectl uses the --kubeconfig flag when present, then the files named by KUBECONFIG, then $HOME/.kube/config. A connection attempt to 127.0.0.1:8080 indicates that the effective configuration does not contain the expected API server. Exit and re-enter sudo ./dreadnode shell on a controller node rather than guessing an internal path. See Kubernetes’ kubeconfig loading rules and kubectl config reference.

Dreadnode workloads and their Secrets are in the kotsadm namespace.

Verify the install

The Admin Console dashboard shows component status. Wait until everything reports Ready.

Open https://<your-domain> in a browser. If you configured URL Scheme as HTTP, use http://<your-domain> instead.

Check the API directly:

curl https://dreadnode.example.com/api/v1/health
# {"status":"ok"}

Replace dreadnode.example.com with the domain you configured. Use http:// if you selected HTTP.

Set up the platform

Components reporting Ready is not a finished install. Continue with the post-install steps, which are the same on both install paths:

1. First admin account — sign in and claim platform ownership
2. First model deployment — every model picker stays empty until you add one
3. Connect clients — point the TUI, CLI, and SDK at your deployment

Your Hub starts empty. See Loading Hub content to populate it with capabilities, task environments, and task sets from another platform.

Upgrades

The Admin Console checks for new versions automatically. When an update is available, it appears on the dashboard. Review the release notes, then click Deploy to upgrade.

Migrations are forward-only, so the Admin Console Rollback button is intentionally disabled — see Upgrades for release notifications, what runs during an upgrade, and recovery.

Reinstall from scratch

If you need a clean slate, remove the application through the Admin Console (Application → Remove), then delete persistent state:

export NAMESPACE=kotsadm

kubectl -n "$NAMESPACE" delete pvc \
    data-dreadnode-postgresql-0 \
    data-dreadnode-clickhouse-0 \
    data-dreadnode-minio-0

kubectl -n "$NAMESPACE" delete secret \
    dreadnode-postgresql \
    dreadnode-clickhouse \
    dreadnode-minio \
    dreadnode-api-encryption

Then redeploy through the Admin Console.

Caution

This destroys all platform data — Postgres rows, ClickHouse traces, MinIO objects, and the Fernet encryption key. Snapshot anything you need first.

Admin Console reference

The Admin Console at https://<vm-ip>:30000 is your ongoing management interface:

• Config — Change dedicated settings or apply an Advanced Helm Values document
• Dashboard — Component health and deployment status
• Version history — Available updates and deploy history
• Troubleshoot — Generate support bundles for diagnostics