Install Dexter

Dexter runs as its own Helm release in its own namespace, configured by one values file.

It does not have to share a cluster with Kloudfuse: it reads your telemetry through the Kloudfuse MCP server.

In This Topic

Prerequisites

  • A Kubernetes cluster with a default StorageClass, and kubectl access to it.

  • Helm 3.8 or later.

  • The token.json that Kloudfuse provided for your Kloudfuse install.

  • An Anthropic API key, or a Claude Max OAuth token.

  • A Kloudfuse cluster with the remote MCP server enabled, and a service account token for it.

  • To serve Dexter on your own domain (step 6): cert-manager installed in the cluster, and a DNS name you can point at a load balancer.

1. Log in to the Helm registry

cat token.json | helm registry login -u _json_key --password-stdin us-east1-docker.pkg.dev

2. Create the namespace and image pull secret

Dexter pulls its image with this secret, the same one a Kloudfuse install creates in its own namespace.

kubectl create namespace dexter

kubectl create secret docker-registry kfuse-image-pull-credentials \
  --namespace dexter --docker-server us.gcr.io --docker-username _json_key \
  --docker-password="$(cat token.json)"

3. Create the values file

The defaults install Dexter privately, with sign-in required. Only the first sub-step is required; the others change a default.

  1. Create the file in the directory you run Helm from:

    touch dexter-values.yaml

  2. To give Dexter’s data more room than the default 2 GiB, set the volume size. Set it before you install: whether the volume can grow later depends on your StorageClass.

    persistence:
  size: 10Gi
    yaml

  3. If your image pull secret is not named kfuse-image-pull-credentials, name yours:

    image:
  pullSecrets:
    - <PULL_SECRET>
    yaml
Download dexter-values.yaml for a commented copy of these settings and the public-access ones in step 6.

4. Install Dexter

helm install dexter oci://us-east1-docker.pkg.dev/mvp-demo-301906/kfuse-helm/dexter \
  --namespace dexter \
  --version 0.9.0 \
  -f dexter-values.yaml

kubectl -n dexter rollout status deployment/dexter

This installs Dexter 0.9.0, the current release. To see the latest version, run helm show chart oci://us-east1-docker.pkg.dev/mvp-demo-301906/kfuse-helm/dexter.

5. Sign in

On first start, Dexter creates a super admin account, admin, with a generated password. Dexter asks for a new password at the first sign-in.

  1. Read the initial password:

    kubectl -n dexter exec deployment/dexter -- cat /data/settings/initial-admin-password

    It works only for the first sign-in. helm install prints this command too.

  2. Open Dexter through a port-forward:

    kubectl -n dexter port-forward svc/dexter 3000:3000

  3. Sign in at http://localhost:3000 as admin with the initial password.

  4. When prompted, enter the initial password as the current password and choose a new one of at least 12 characters.

To change the password later, click your avatar at the bottom of the sidebar and choose Change password.

To sign in through Okta, Google, or Azure AD, add the provider under Admin > Identity providers.

Lost the admin password? Delete the account file and restart Dexter. It recreates admin with a new initial password, which you read with the command in the first sub-step:

kubectl -n dexter exec deployment/dexter -- rm /data/settings/local-users.json
kubectl -n dexter rollout restart deployment/dexter

6. Serve Dexter on your domain

Skip this step to keep Dexter private and reach it through a port-forward.

  1. Add the ingress settings to dexter-values.yaml, with host set to the DNS name for Dexter:

    ingress:
  enabled: true
  host: <HOST>
    yaml

  2. If you already have a static IP address for Dexter, set it in the same file. Otherwise, skip to the next step and let the cloud assign one.

    ingress-nginx:
  controller:
    service:
      loadBalancerIP: <STATIC_IP>
    yaml

    The address must be a regional static IP in the cluster’s region. A global address, the kind a GCE Ingress uses, cannot be assigned to a load balancer Service.

  3. Apply the change. Dexter gets its own load balancer and HTTPS with a Let’s Encrypt certificate:

    helm upgrade dexter oci://us-east1-docker.pkg.dev/mvp-demo-301906/kfuse-helm/dexter \
  --namespace dexter \
  --version 0.9.0 \
  -f dexter-values.yaml

  4. Find the load balancer’s EXTERNAL-IP. If you set loadBalancerIP, it is that address:

    kubectl -n dexter get svc -l app.kubernetes.io/instance=dexter,app.kubernetes.io/component=controller

  5. Create a DNS A record that points <HOST> at that address.

    cert-manager issues the certificate a minute or two after the name resolves. When READY shows True, HTTPS serves it within a few seconds:

    kubectl -n dexter get certificate
If the cluster already runs an ingress controller, use it instead: add ingress-nginx.enabled: false to the values file and set ingress.className to that controller’s IngressClass.

7. Connect Anthropic and Kloudfuse

  1. Open Dexter at https://<HOST>;, or at http://localhost:3000 through the port-forward if you skipped step 6, and sign in.

  2. Under Admin > Integrations, connect:

    • Anthropic: your Anthropic API key or Claude Max OAuth token.

    • Kloudfuse: the MCP address of your Kloudfuse cluster, https://<KLOUDFUSE_HOST>/mcp, and its service account token.