Skip to main content
hexr deploy is the final step in the Hexr deployment workflow. It reads the manifests generated by hexr build, prompts you to select a target Kubernetes cluster, applies them in dependency order — namespace first, then RBAC, then ConfigMaps, then the agent pod — and waits until all containers are running before printing the agent’s SPIFFE identity and A2A endpoint. After hexr deploy returns, your agent is live with mTLS, process-level identity, and (if enabled) an A2A discovery endpoint.

​
Usage

hexr deploy [build_dir] [options]
​
build_dir
path
default:".hexr"
Path to the build directory containing generated manifests. Defaults to .hexr in the current working directory.

​
Interactive flow

$ hexr deploy

Detected Kubernetes clusters:
  1. hexr-cloud (GKE, us-central1-a, hexr-cloud-prod)
  2. do-nyc1-hexr-demo (DigitalOcean, nyc1)

Select cluster [1]: 1

Applying manifests to tenant-acme-corp...
  ✓ Namespace: tenant-acme-corp (created)
  ✓ ServiceAccount + RBAC (applied)
  ✓ Process context ConfigMaps (3 created)
  ✓ Agent Card ConfigMap (created)
  ✓ Agent Pod (created)

Waiting for pod readiness...
  acme-research-analyst:
    ├── init: install-hexr-sdk ✓
    ├── agent ✓
    ├── envoy-sidecar ✓
    ├── a2a-sidecar ✓
    └── pid-mapper ✓
  
  4/4 containers running

✓ Agent deployed successfully
  Namespace: tenant-acme-corp
  Pod: acme-research-analyst
  SPIFFE ID: spiffe://hexr.cloud/agent/acme-corp/research-analyst/main
  A2A Endpoint: http://research-analyst-a2a.tenant-acme-corp.svc:8090

​
What gets applied

The deploy command applies manifests in this order to satisfy Kubernetes dependency requirements:
  1. namespace.yaml — creates the tenant-{name} namespace
  2. rbac.yaml — ServiceAccount, Role, and RoleBinding
  3. process-contexts/*.json — per-process SPIFFE context as ConfigMaps
  4. agent-card.yaml — Agent Card ConfigMap for A2A discovery (if A2A is enabled)
  5. agent-pod.yaml — the agent Pod with all four containers and the init container

​
Cloud deploy

For Hexr Cloud, --cloud deploys directly to the managed GKE cluster: 
$ hexr deploy --cloud

Deploying to Hexr Cloud...
  Cluster: hexr-cloud (GKE)
  Namespace: tenant-acme-corp (auto-provisioned)
  
  ✓ Agent deployed
  ✓ Dashboard: https://app.hexr.cloud/dashboard/agents
hexr deploy --cloud requires an active Hexr Cloud session. Run hexr login --key <api_key> first if you haven’t already.

​
Verify deployment

After deploying, use hexr status to confirm the agent is running: 
$ hexr status

Deployed Agents (tenant-acme-corp):
┌─────────────────────────┬─────────┬────────────┬──────────────┐
│ Agent                   │ Status  │ Containers │ Age          │
├─────────────────────────┼─────────┼────────────┼──────────────┤
│ research-analyst        │ Running │ 4/4        │ 2m           │
│ content-crew            │ Running │ 4/4        │ 1d           │
│ financial-analysis      │ Running │ 4/4        │ 3d           │
└─────────────────────────┴─────────┴────────────┴──────────────┘