Connecting Remote Clusters

Once Odigos Central is running, you need to configure your remote clusters to connect to it. This is done by installing Odigos in each remote cluster with the Central Proxy configuration. Set centralProxy.centralBackendURL (and clusterName). That URL is what the Central Proxy uses to open a WebSocket to Central at /ws/proxy. It must be reachable from the remote cluster, include a scheme (https:// in production), and match the hostname you expose for central-backend. If UI and backend share one ingress host, use that host — and make sure /ws/proxy is routed to central-backend, not central-ui. See Authentication and Architecture.

To connect VM hosts, see VM Agent. For cloud accounts (AWS, GCP, and more), see Cloud Connectors.

Remote clusters require the same Odigos Enterprise license token as the central installation.

Connect a remote cluster

CLI
Helm

odigos install \
  --onprem-token <token> \
  --set centralProxy.centralBackendURL=<your-central-backend-url> \
  --set clusterName=<your-cluster-name>

Example:

odigos install \
  --onprem-token <token> \
  --set centralProxy.centralBackendURL=https://central-backend.example.com:8081 \
  --set clusterName=production-east-1

Add the following to your remote cluster’s values.yaml:

clusterName: 'production-east-1'

centralProxy:
  centralBackendURL: 'https://central-backend.example.com:8081'

Then install:

helm upgrade --install odigos odigos/odigos \
  --namespace odigos-system \
  --create-namespace \
  -f values.yaml

TLS Configuration

For production deployments, configure TLS for secure communication between the Central Proxy and Central Backend:

centralProxy:
  centralBackendURL: 'https://central-backend.example.com:8081'
  tls:
    # Skip certificate verification (for testing/self-signed certificates only)
    skipVerify: false

    # Secret name containing CA certificate (key: 'ca.crt')
    caSecretName: 'central-ca-cert'

    # Secret name for mTLS client certificate (keys: 'tls.crt', 'tls.key')
    clientCertSecretName: 'central-client-cert'

Create the CA certificate secret:

kubectl create secret generic central-ca-cert \
  --from-file=ca.crt=/path/to/ca.crt \
  -n odigos-system

Create the client certificate secret (for mTLS):

kubectl create secret generic central-client-cert \
  --from-file=tls.crt=/path/to/client.crt \
  --from-file=tls.key=/path/to/client.key \
  -n odigos-system

The proxy connects to /ws/proxy (not /wss/proxy). It uses the wss scheme when the backend URL host ends with :443. Verify the connection with:

kubectl logs deploy/central-proxy -n odigos-system --tail=20

Look for WebSocket connection established.

​Connect a remote cluster

​TLS Configuration

Connect a remote cluster

TLS Configuration