kubox admin aws bootstrap

Create the AWS resources a management plane cannot create for itself

Synopsis

Creates the keys, the state bucket and the five IAM identities, and checks the hosted zone. Idempotent in the sense of touch: it makes absent things exist, leaves present ones alone, and says what it did. Run by an administrator, once per account. NOT by CI — creating IAM roles requires iam:CreateRole and PutRolePolicy, which together are the ability to grant yourself anything, and a deploy role holding those means compromising the pipeline compromises the account. CI runs kubox admin aws verify, which needs only iam:SimulatePrincipalPolicy. Use —dry-run first. It performs every read, no writes, and prints a plan: what must already be true, and what would change. Works on an EMPTY account, where the policies cannot be previewed because they are scoped to keys that do not exist yet — the plan says which identities would be made and that their documents are not previewable, rather than refusing. --dry-run -o json is reviewable by somebody who is not at the terminal.

kubox admin aws bootstrap [flags]

Options

      --allow-region stringArray    a region these identities may act in; repeatable (default: --region alone)
      --artifact-key string         KMS key ARN protecting sealed artifacts; the runner writes it, the unsealer reads it
      --artifact-key-alias string   KMS alias for the key that seals artifacts; created if absent (default "alias/kubox-artifacts")
      --ci-role string              GitHub OIDC role that builds the plane's own cluster on day zero (trust policy only)
      --dry-run                     read everything, write nothing, and print the plan; works with -o json
      --external-id string          binds a target-account role to one tenant (trust policy only)
  -h, --help                        help for bootstrap
      --hosted-zone string          Route53 zone the build may publish records in
      --operator stringArray        ARN of a user or role that may assume the build role directly, for a laptop build; repeatable (trust policy only)
      --plane-account string        AWS account the management plane runs in
      --region string               primary region, substituted into resource ARNs
      --root-domain string          domain the plane serves; its hosted zone is what the DNS grant is scoped to
      --stack-key string            KMS key ARN protecting the Pulumi checkpoint; the build both writes and reads it
      --stack-key-alias string      KMS alias for the key that encrypts Pulumi state; must be a different key (default "alias/kubox-stacks")
      --state-backend string        Pulumi state backend, e.g. s3://bucket/prefix
      --target-account string       AWS account a cluster is built into (default: the plane's own)
      --tenant stringArray          a tenant the artifact roles seal for: the cloud connection's namespace (kubox-system for Kubox's own account); repeatable, and required for the tenant artifact identities
      --workload-issuer string      the identity plane's issuer, e.g. https://oidc-exp.kubox.cloud; required

Global options

See global options.

CLI Reference

kubox admin aws bootstrap

Synopsis

Options

Global options

SEE ALSO

​Synopsis

​Options

​Global options

​SEE ALSO

Synopsis

Options

Global options

SEE ALSO