> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kubox.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# kubox plane rebuild

Replace the management plane, and nothing it manages

### Synopsis

The Management Plane is cattle; managed clusters survive its replacement.

What goes is the plane's own cluster -- its nodes, its Kubernetes, the
Kubox workloads and the network they sit in -- and its own Pulumi stacks.
Every managed cluster keeps running. Every CloudAccount, with the External
ID its customer's role trusts, every cluster record and every agent
credential is exported from the plane's store before it is destroyed and
restored byte-identical into the new one, so no customer reconnects and no
cluster is rebuilt.

The order is the whole point and cannot be run otherwise: export, destroy
the plane, empty its stacks, create, restore, verify customer trust -- the
new plane assumes every restored role, and the rebuild is complete only
when every one succeeds.

Refused while a cluster is being deleted, and refused when the plane's
store cannot be read: what cannot be exported cannot be restored, and a
rebuild that went on would break every customer's trust. `--plan`
classifies everything it touches and changes nothing. Requires --yes.

```
kubox plane rebuild [flags]
```

### Options

```
      --account string                 the AWS account the plane is meant to build into; refused if the credentials belong elsewhere
      --allow-unsealed                 proceed without a record store, so credentials are NOT sealed
      --artifact-key-provider string   key sealed artifacts are protected by (env: KUBOX_ARTIFACT_KEY_PROVIDER)
      --context string                 context within it
      --database-url string            record store connection string (env: KUBOX_DATABASE_URL, KUBOX_ARTIFACT_DSN)
      --export-to string               where to write the registrations before the plane is destroyed (default: <name>.registrations.yaml beside the deployment)
  -f, --file string                    the PlaneDeployment being rebuilt
  -h, --help                           help for rebuild
      --kubeconfig string              the plane being replaced; its registrations are read out before it is destroyed
      --namespace string               namespace the plane is installed in (default "kubox-system")
      --plan                           classify everything the rebuild touches, and change nothing
      --plane-document string          the document the plane's own cluster was built from; refused unless it names that cluster (default: <name>.cluster.yaml beside the deployment, written if absent)
      --settle duration                how long to wait for the new plane to verify every restored account (default 3m0s)
      --stack-key-provider string      key Pulumi state is encrypted with; must be a DIFFERENT key (env: KUBOX_STACK_KEY_PROVIDER)
      --state-backend string           Pulumi state backend (env: PULUMI_BACKEND_URL)
      --yes                            perform the rebuild; without this it is refused
```

### Global options

See [global options](/cli-reference/kubox#global-options).

### SEE ALSO

* [kubox plane](/cli-reference/kubox_plane)	 - Describe and build a management plane from one document