--account string the AWS account the plane is meant to build into; refused if the credentials belong elsewhere
--allow-unsealed proceed without a record store, so credentials are NOT sealed
--artifact-key-provider string key sealed artifacts are protected by (env: KUBOX_ARTIFACT_KEY_PROVIDER)
--context string context within it
--database-url string record store connection string (env: KUBOX_DATABASE_URL, KUBOX_ARTIFACT_DSN)
--export-to string where to write the registrations before the plane is destroyed (default: <name>.registrations.yaml beside the deployment)
-f, --file string the PlaneDeployment being rebuilt
-h, --help help for rebuild
--kubeconfig string the plane being replaced; its registrations are read out before it is destroyed
--namespace string namespace the plane is installed in (default "kubox-system")
--plan classify everything the rebuild touches, and change nothing
--plane-document string the document the plane's own cluster was built from; refused unless it names that cluster (default: <name>.cluster.yaml beside the deployment, written if absent)
--settle duration how long to wait for the new plane to verify every restored account (default 3m0s)
--stack-key-provider string key Pulumi state is encrypted with; must be a DIFFERENT key (env: KUBOX_STACK_KEY_PROVIDER)
--state-backend string Pulumi state backend (env: PULUMI_BACKEND_URL)
--yes perform the rebuild; without this it is refused
