EKS clusters

What an Amazon EKS cluster needs before xpander installs, and how to check it after.

xpander installs from a Helm chart into your EKS cluster. Hybrid runs execution in your VPC with the control plane in xpander’s cloud. Air-Gapped runs everything in your cluster, with no connection to xpander.

Before the install

Prerequisite	What xpander needs	Guide
VPC and subnets	Two Availability Zones and private subnets for EKS and the data stores. Hybrid: internet and NAT gateways. Air-Gapped: a sealed VPC with VPC endpoints (ECR, S3 gateway endpoint)	EKS setup
Storage	EBS CSI driver with Pod Identity and a default StorageClass. The executor fleet needs an XFS StorageClass with prjquota (fleet.storage.createClass: true creates it)	StorageClass
Executor fleet nodes	cgroup v2, a namespace that admits PodSecurity baseline, Landlock in the kernel (or fleet.landlock.enabled: false), room for turns of 8 GiB and 4 vCPU each	Node prerequisites
Minimum footprint	Hybrid: 3 nodes of 8 vCPU / 32 GiB, about 50 GiB of volumes. Air-Gapped: 5 nodes of 16 vCPU / 64 GiB, 300 to 500 GiB of volumes	Deploy
Registry	Hybrid: public images. Air-Gapped: a mirror in your registry, which the installer can fill	Mirroring
IAM for AWS skills	EKS Pod Identity or IRSA on the AWS Operator, with per-skill roles	AWS Operator, IAM best practices
Bedrock without a key	Bedrock permissions on the role the pods run as	AI vendors

Install

Run the installer from a terminal with kubectl access. It asks for the edition. Hybrid identifies itself with the organization id, environment id and deployment-manager key from the install card in xpander Chat (Hybrid deployment). Air-Gapped uses the two signed license files (Air-gapped deployment).

After the install

kubectl get pods -n xpander

You should see one Running, 1/1 pod each for agent-controller, agent-worker, api, aws-operator, chat, code-runner and mcp, at least one executor, and two llm-gw pods (kubectl -n xpander get pods -l app=llm-gw), or one on a single-node cluster installed with install.sh.

Platform > Agents > Runtime > Locations shows the cluster with a heartbeat per component. On Hybrid, only the Agent Controller reaches xpander’s cloud. On Air-Gapped, nothing does.

Next steps

Set up the EKS cluster

VPC, storage, nodes

Size the nodes

Executor fleet sizing