--agent-image string kubox-agent image every cluster the plane builds runs; pinned the same way
--agent-pull-secret string Secret the plane copies into each cluster it builds, so the agent image can be pulled there
--artifact-key-provider string Key sealed artifacts are protected by, as a provider URL
--concurrency int Builds to run at once; this sizes the cluster, because builds are what consume it
--context string Context within the kubeconfig (default: its current context)
--crds-only Install the custom resource definitions and stop
--database-driver string database/sql driver for the record store (default "postgres")
--database-url string Record store connection string (env: KUBOX_DATABASE_URL)
--dry-run Report the steps and apply nothing
-f, --file string Cluster document supplying the root domain, region and ingress shape
-h, --help help for install
--image string kubox image the plane runs as
--image-pull-secret stringArray Pull secret for a private registry; repeatable
--kubeconfig string Path to a kubeconfig (default: $KUBECONFIG, then ~/.kube/config)
--namespace string Namespace to install into (default "kubox-system")
--oidc-issuer string Issuer whose published keys verify console tokens
--plane-url string URL a managed cluster's agent dials (default: the API's own service)
--platform-account-id string Cloud account customers are asked to trust; discovered from the current credentials when unset
--region string Region applied to clusters that do not name one
--registry string OCI registry host; required only for air-gapped installs
--root-domain string Domain every hostname this plane serves derives from
--runner-image string kubox image a run Job executes; a released plane pins its own release's digest in this repository, so a tag here is the development override
--spire-server string The SPIRE server the agents dial, as host:port
--stack-key-provider string Key Pulumi state is encrypted with; must be a DIFFERENT key
--state-backend string Pulumi state backend, for example s3://bucket/prefix
--token-public-key-key string Key within that secret (default "publicKey")
--token-public-key-secret string Secret holding the PUBLIC half of the console's signing key
--trust-bundle-url string Where the agents bootstrap the server's bundle from
--trust-domain string The SPIFFE trust domain (default: the root domain)
--workload-issuer string The identity plane's public OIDC issuer, e.g. https://oidc-exp.kubox.cloud (required)
