> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kubox.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# kubox admin install

Install a management plane into an existing Kubernetes cluster

### Synopsis

Installs the definitions, the plane's own objects and the ManagementPlane
resource into whatever cluster your kubeconfig points at -- EKS, GKE, kind,
or one kubox built. It needs nothing installed but this binary.

Re-run it to upgrade. Every step is idempotent, so a partial failure is
fixed by running it again rather than by unpicking what succeeded.

This makes where the plane RUNS cloud-agnostic, not what it builds: the
plane still encrypts with awskms\:// and keeps state in s3://, so `kubox aws
bootstrap` is a prerequisite wherever this runs.

```
kubox admin install [flags]
```

### Options

```
      --agent-image string               kubox-agent image every cluster the plane builds runs; pinned the same way
      --agent-pull-secret string         Secret the plane copies into each cluster it builds, so the agent image can be pulled there
      --artifact-key-provider string     Key sealed artifacts are protected by, as a provider URL
      --concurrency int                  Builds to run at once; this sizes the cluster, because builds are what consume it
      --context string                   Context within the kubeconfig (default: its current context)
      --crds-only                        Install the custom resource definitions and stop
      --database-driver string           database/sql driver for the record store (default "postgres")
      --database-url string              Record store connection string (env: KUBOX_DATABASE_URL)
      --dry-run                          Report the steps and apply nothing
  -f, --file string                      Cluster document supplying the root domain, region and ingress shape
  -h, --help                             help for install
      --image string                     kubox image the plane runs as
      --image-pull-secret stringArray    Pull secret for a private registry; repeatable
      --kubeconfig string                Path to a kubeconfig (default: $KUBECONFIG, then ~/.kube/config)
      --namespace string                 Namespace to install into (default "kubox-system")
      --oidc-issuer string               Issuer whose published keys verify console tokens
      --plane-url string                 URL a managed cluster's agent dials (default: the API's own service)
      --platform-account-id string       Cloud account customers are asked to trust; discovered from the current credentials when unset
      --region string                    Region applied to clusters that do not name one
      --registry string                  OCI registry host; required only for air-gapped installs
      --root-domain string               Domain every hostname this plane serves derives from
      --runner-image string              kubox image a run Job executes; a released plane pins its own release's digest in this repository, so a tag here is the development override
      --spire-server string              The SPIRE server the agents dial, as host:port
      --stack-key-provider string        Key Pulumi state is encrypted with; must be a DIFFERENT key
      --state-backend string             Pulumi state backend, for example s3://bucket/prefix
      --token-public-key-key string      Key within that secret (default "publicKey")
      --token-public-key-secret string   Secret holding the PUBLIC half of the console's signing key
      --trust-bundle-url string          Where the agents bootstrap the server's bundle from
      --trust-domain string              The SPIFFE trust domain (default: the root domain)
      --workload-issuer string           The identity plane's public OIDC issuer, e.g. https://oidc-exp.kubox.cloud (required)
```

### Global options

See [global options](/cli-reference/kubox#global-options).

### SEE ALSO

* [kubox admin](/cli-reference/kubox_admin)	 - The primitives the plane, cloud and cluster commands are built from