> ## Documentation Index
> Fetch the complete documentation index at: https://arize-ax.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Install Arize AX on Rancher

> Create values.yaml, encode secrets, run arize.sh, and handle namespace ownership when installing Arize AX on Rancher-managed Kubernetes.

## Before you start

* Complete [Download and extract the distribution](/docs/ax/selfhosting/getting-started/download-and-unpack-the-distribution). Work from the extracted folder that contains `arize.sh`, `arize-operator-chart.tgz`, and your `values.yaml`.
* Align your target cluster with [Rancher cluster and storage](/docs/ax/selfhosting/installation/rancher-bare-metal/cluster-and-storage).
* Keep secrets out of git history and chat logs.

## Create `values.yaml`

Create `values.yaml` in the extracted distribution directory, next to `arize.sh`.

This minimal example is for a Rancher-managed cluster using a platform-provided S3-compatible object store:

```yaml theme={null}
helmNamespace: arize-operator
cloud: "ceph"
clusterName: "<cluster-entry-from-kubectl-config-get-clusters>"
organizationName: "<organization-name>"
clusterSizing: "<sizing-profile>"

gazetteBucket: "<gazette-bucket-name>"
druidBucket: "<adb-bucket-name>"

hubJwt: "<JWT_BASE64>"
postgresPassword: "<POSTGRES_PASSWORD_BASE64>"
cipherKey: "<CIPHER_KEY_BASE64>"
cephS3Endpoint: "<URL to the S3-compatible endpoint>"
cephS3AccessKeyId: "<S3_ACCESS_KEY_ID_BASE64>"
cephS3SecretAccessKey: "<S3_SECRET_ACCESS_KEY_BASE64>"

appBaseUrl: "https://<arize-app-domain>"

storageClassCephStandard: "<standard-storage-class>"
storageClassCephSsd: "<ssd-storage-class>"

# Set this to false if the cluster does not have a separate ArizeDB node pool.
historicalNodePoolEnabled: false
```

`hubJwt` is the runtime registry credential that Arize AI provides for pulling images from `ch.hub.arize.com` (or your mirror, if you set `pullRegistry`). It is not the same value as the JWT used for the one-time tarball download; Arize AI provides both, and `arize.sh` does not derive one from the other.

To point at a managed or customer-provided Postgres instance instead of the Postgres deployed by the operator, set `postgresHostEndpoint` to its hostname and follow [External Postgres requirements](/docs/ax/selfhosting/installation/external-postgres-requirements) for supported versions, sizing, parameters, and database initialization.

For smaller Rancher-managed clusters, ask Arize AI which sizing profile to use. Do not use `small1b` or `medium2b` unless the nodes match the sizing requirements in [Cluster sizing](/docs/ax/selfhosting/getting-started/prerequisites#cluster-sizing).

## Encoding values

The secret fields in the example must be base64-encoded. Encode a short value with:

```bash theme={null}
printf '%s' '<value>' | base64 | tr -d '\n'
```

Do not base64 encode `clusterName`, `organizationName`, bucket names, storage class names, registry hostnames, or `appBaseUrl`.

## Run the install

Run commands from the extracted distribution directory:

```bash theme={null}
./arize.sh -y -t 5400 install
```

Use a longer timeout on smaller clusters and on clusters that pull images from an external registry.

By default, the installer creates the required namespaces. If your platform team pre-creates namespaces, set `createNamespaces: false` and set `namespaceArize` or `namespaceOperator` if you are not using the defaults (`arize` and `arize-operator`). Keep those namespaces dedicated to this Arize AX install.

## Next steps

* [Restricted PodSecurity notes](/docs/ax/selfhosting/installation/rancher-bare-metal/talos-podsecurity), if your cluster enforces PodSecurity baseline.
* [Configuring ingress and endpoints](/docs/ax/selfhosting/installation/ingress/configuring-endpoints)
* [Validate and troubleshoot](/docs/ax/selfhosting/installation/rancher-bare-metal/validate-troubleshoot)