canasta install

Install dependencies on the target host

Synopsis

Install one or more dependencies on the target host. Supported packages: docker, k8s-cp, k8s-worker, git-crypt, sops, canasta.

k8s-cp installs k3s as a control-plane node — the cluster's API server, scheduler, etc., plus kubectl + helm on the same machine. The right install for single-node K8s deployments and for the first node of a multi-node cluster.

k8s-worker joins the target host to an existing k3s cluster as a worker (agent) node — runs only the kubelet + container runtime, no kubectl/helm. Use --cp-host <name> to point at a registered host where the control plane lives; canasta will SSH to the control plane to fetch the join token and the cluster's internal API URL automatically.

Pass --public-ip <addr> (k8s-cp only) whenever the canasta CLI runs on a different machine than the control plane — i.e. for any multi-node cluster, and for single-node setups where canasta is installed on a separate host (laptop / VPS / etc.). The address is added to the k3s API server's TLS certificate so kubectl can verify the cert when reaching the cluster over that address. Repeat to add more than one (e.g. an IP and a hostname).

sops installs the SOPS toolchain (sops + age), required for encrypted secrets in Kubernetes gitops (gitops init --encrypt-secrets). Two hosts need it: the controller (where the CLI runs) uses age-keygen to manage the operator key, and the gitops target host uses sops to encrypt Secret manifests. Run it once per role: canasta install sops (no --host) for the controller and canasta install -H <host> sops for the target (they may be the same machine). Idempotent — skips a binary already present.

canasta installs the Canasta CLI (canasta-native) on the target host, so an instance deployed remotely from a controller can also be operated directly on its own host. This is required before scheduling backups on a remote host — the schedule's cron runs canasta backup there — and is useful any time you want to manage an instance locally on the host it runs on rather than only through the controller. Idempotent — skips if canasta is already present.

Multiple packages can be combined in a single command, except that k8s-cp and k8s-worker are mutually exclusive on a given host.

canasta install [flags] PACKAGES...

Examples

canasta install docker
canasta install k8s-cp
canasta install k8s-cp --public-ip 203.0.113.10
canasta install --host node2 k8s-worker --cp-host node1
canasta install docker git-crypt
canasta install -i mysite git-crypt
canasta install -i mysite sops
canasta install -i mysite canasta

Arguments

Argument	Description	Default	Required	Orchestrator
`PACKAGES`	Dependencies to install (docker, k8s-cp, k8s-worker, git-crypt, canasta)		✓	Both

Flags

Flag	Shorthand	Description	Default	Orchestrator
`--cp-host`		Name of the registered control-plane host (k8s-worker only). Canasta SSHs to this host to fetch the join token and the cluster's internal API URL. The host must already be registered via 'canasta host add'.		Both
`--docker-host`		Docker API socket on the target. Set this when the target uses rootless podman or rootless Docker (e.g. `unix:///run/user/1000/podman/podman.sock`). Defaults to system Docker's `/var/run/docker.sock`.		Both
`--host`	`-H`	Target host (default: localhost)		Both
`--id`	`-i`	Canasta instance ID — install on the host where this instance is registered. Mutually exclusive with --host; --host wins if both are given. Useful after `canasta create` to add dependencies (e.g. git-crypt) to the instance's host.	*	Both
`--public-ip`		Public IP or hostname of the cluster node, added to the k3s API server's TLS cert (k8s-cp only). Required when canasta runs on a different machine than the control plane — any multi-node cluster, plus single-node setups where canasta is on a separate host. Repeat the flag to add multiple addresses.		Both

* Defaults to the Canasta instance matching the current directory, if any.

Global flags

Flag	Shorthand	Description	Default	Required	Orchestrator
`--help`	`-h`	Show help message and exit			Both
`--verbose`	`-v`	Enable verbose output			Both