We re-architected the generally available, managed Expanso Cloud service on Kubernetes with a cell-based architecture, custom operators, and orchestrator provisioning that takes under ten seconds.
We are also validating a customer-operated, private control-plane package with a small number of qualified enterprise design partners. That package is not generally available and is not a self-service deployment option.
Why this matters
If you use Expanso Cloud as a managed service, the orchestrator coordinates what your Edge nodes run and where. Pipeline payloads are processed by Edge on customer-controlled infrastructure. Data leaves that infrastructure only through outputs you configure; the control plane still receives the operational metadata required to coordinate and monitor the fleet.
But for some organizations, that’s not enough. If you’re in a regulated industry, operating in air-gapped environments, or have data sovereignty requirements that extend to the control plane itself: you need everything running inside your perimeter.
We are working with qualified design partners to validate that operating model before making broader availability claims. The program uses our managed production architecture as its starting point, while customer packaging, installation, upgrades, support, and security controls are hardened separately.
What design partners are validating
The private control-plane preview is based on the Kubernetes components that run Expanso Cloud today:
-
A custom operator that provisions and manages orchestrator instances through a CRD called
ExpansoCloudNetworkInstance. It handles the full lifecycle: creation, updates, health checks, and teardown, using the same level-triggered reconciliation that keeps our managed cells running. -
Helm charts derived from our managed-cell deployment and adapted for the qualified customer’s supported environment.
-
Cell-based isolation: each orchestrator gets its own namespace, service accounts, secrets, and network routing. Multiple teams can share a cluster without stepping on each other.
-
Direct connectivity: your Edge nodes talk to the orchestrator over NATS with no intermediate routing layer. CLI and API access goes straight to your cluster’s ingress.
What didn’t change
The core data-plane model stays the same. Edge nodes run on customer-controlled infrastructure, process pipeline payloads there, and connect outbound to the orchestrator. You deploy logging pipelines, data extraction jobs, and fleet management through supported APIs and tools.
The orchestrator handles coordination, versioning, rollouts, rollbacks, and monitoring. It is not in the pipeline-payload path, but it does receive operational metadata needed to manage those functions.
For design partners, the principal architectural difference is where the orchestrator runs. The preview also has a qualified support envelope and assisted installation and upgrade process; it is not equivalent to a generally available self-service product.
We run what we ship
One thing we’re particular about: developers at Expanso test the cell-based architecture locally, including the operator, Helm charts, and provisioning flow. When we make changes to the platform, we test against the same topology that runs in our managed production service.
The private-control-plane program narrows each design partner to a qualified Kubernetes environment. Fixes are validated for the managed service first and promoted to a design-partner package only after the customer-operated deployment path passes its own release checks.
What’s improved for everyone
The re-architecture also made managed Expanso Cloud better:
-
Provisioning in under 10 seconds: spinning up a new orchestrator used to take minutes. The custom operator and cell architecture got that down to single-digit seconds.
-
Cell isolation: problems in one cell don’t cascade to others. Each cell is self-sufficient once provisioned.
-
Rolling updates: we can update hundreds of orchestrators across cells without coordinated downtime, and the same applies to your config changes.
-
Direct-to-cell routing: no global proxy between you and your orchestrator. Our control plane can go down for maintenance and your running orchestrators don’t notice.
We wrote up the full technical details in a separate post: the operator design, the controller that manages orchestrator lifecycles across cells, and the direct-to-cell networking model.
Get started
If you’re already on Expanso Cloud, nothing changes. Managed Expanso Cloud is the generally available way to provision and operate an Expanso control plane.
If a private, customer-operated control plane is a hard requirement, book a demo to discuss qualification for the enterprise design-partner program. Participation requires joint environment review and assisted delivery. It is not a generally available or self-service offer.
We will share broader availability only after the design-partner deployment, upgrade, security, and support gates have passed.
