Deploy your first Pro DAG
Take a DAG from Lite to a Kubernetes control plane — your first Pro deployment.
Version v0.5.5 of the documentation is no longer actively maintained. The site that you are currently viewing is an archived snapshot. For up-to-date documentation, see the latest version.
Deploy & operate
Take Dexaflow to production — deploy from CI, run the Helm chart, upgrade, back up, and keep the scheduler resilient.
Running Dexaflow in production: promotion from Lite to Pro, the deploy pipeline, and the day-2 operations that keep a control plane healthy.
Start here
Deploy your first Pro DAG
Take a DAG from Lite to a Kubernetes control plane, end to end.
Go to production →
Deploy prerequisites & why shortcuts fail
Every gate a Pro deploy enforces, its exact error, and the fix.
Check the gates →
CI/CD & deploy
Build, push, and register DAGs from CI — GitHub Actions, GitLab, Cloud Build.
Wire up CI/CD →
Helm chart
Install and configure the Pro control plane on Kubernetes.
Install with Helm →
Troubleshooting & observability
Diagnose DAG, scheduler, and executor problems — and find where the logs live.
Diagnose issues →
Resilience & latency
Scheduler resilience, control-plane HA & disruption posture, and warm worker pools — availability and latency.
Security & data-path internals
Agent credential transport, Pro TLS, the staging volume, and external secrets.
Workspaces and targets
Keep many DAGs in one repository and deploy them to named control planes, with no wrapper scripts.
Try Pro on a local cluster
Run the Pro deployment path on a throwaway k3d cluster on your machine, from the Helm chart to a first DAG run. For local testing and evaluation, not for production.
How deploy builds the DAG image
The builders dexaflow deploy, compile --build and build choose from, in order, the remote builder on Cloud Build or on the in-cluster builder the Helm chart can run, how the target platform is picked, and the local container daemon as the fallback.
From Lite to Pro
What stays the same and what changes when a DAG you ran with dexaflow lite moves to a Pro control plane.
Deploy prerequisites & why shortcuts fail
Every gate dexaflow deploy/push enforces — the exact error, why it exists, and the fix.
CI/CD & deploy examples
Build, push and register DAGs from CI: GitHub Actions, GitLab CI, Cloud Build, Argo Workflows, Tekton and Jenkins, with buildah or kaniko.
Helm chart
Install and configure the Dexaflow Pro control plane on Kubernetes with the official Helm chart.
Upgrades
Upgrade a Dexaflow control plane safely, edition by edition.
Backup & restore
Back up and restore Dexaflow state — metadata, secrets, and logs.
Trigger a run from an external system
Obtain a token, trigger a DAG run with conf over the REST API, and poll it — the raw-HTTP path for an external integrator.
External secrets (keyless, ESO, and mounted secrets)
Reach credentials that live in your cloud secret store or Vault from task pods — keyless first, then External Secrets Operator or a mounted Kubernetes Secret — without duplicating them in Dexaflow.
Validate the native resolver on a real cluster (before enabling)
A turnkey runbook to prove the keyless external-secrets resolver end-to-end on EKS or GKE — the one thing an emulated store cannot validate — before turning the backend on in production.
Troubleshooting & observability
Diagnose DAG, scheduler and executor problems; where the logs and signals live.
Scheduler resilience
How the scheduler survives restarts, leader loss and partial failure.
Control-plane HA and disruption posture
Why a single control-plane replica is evicted as routine housekeeping, what each restart costs, and the one-switch HA profile that turns it into seconds of failover.
Cataloguing Dexaflow in OpenMetadata
Point OpenMetadata’s Airflow connector at Dexaflow over REST, and understand what it does and does not give you.
Task pod hardening
What the executor puts in every task pod’s securityContext, what readOnlyRootFilesystem changes, and how to run task pods in a Pod Security Admission restricted namespace.
Placement allowlist
Restrict which task placement fields (priority class, node selector, affinity, tolerations and the rest) DAG authors may set on a shared cluster.
Warm worker pools
Cut task start latency with pre-warmed worker pods.
Agent credential transport
How declared secrets reach the in-container agent, and the trust boundary.
Single sign-on with Google Workspace
Turn on OIDC login against Google Workspace, and read the audit log when it denies.
Single sign-on with Microsoft Entra ID, Okta, or another OIDC provider
Turn on OIDC login against an IdP other than Google Workspace, and the two settings that differ per provider.
Single sign-on with Amazon Cognito
Turn on OIDC login against a Cognito user pool, including the three things that differ from every other provider.
Pro TLS (cert-manager)
Terminate TLS on the Pro control plane with cert-manager.
In-transit encryption
Encrypt every hop inside the cluster: a service mesh with mTLS, or TLS on the API listener for load balancer re-encryption, and who may dial the agent gRPC port.
Rotate agent certificates
Renew the agent gRPC server certificate and roll the CA that task pods trust, without restarting the control plane or killing running tasks.
Staging volume
The ephemeral per-run volume that shares large data between tasks.
Source mode
Run a Pro DAG straight from its dag.py on a shared runtime image, with no image build.