> ## Documentation Index > Fetch the complete documentation index at: https://docs.kubox.ai/llms.txt > Use this file to discover all available pages before exploring further. # kubox plane deployment reference > The plane.yaml document a management plane is built from -- the -f file of kubox plane create The `plane.yaml` document a management plane is built from -- the `-f` file of `kubox plane create`. Its shape is `internal/application/plane.Deployment`. Every field, from `internal/application/plane.Deployment`'s `yaml` tags and doc comments. A field this document does not list is refused, so a misspelled name is caught rather than ignored. ## Deployment Deployment is one management plane, as an operator describes it. Name is what this plane is called. It becomes the cluster's name and the name its state is stored under, so it must not collide with another deployment that shares a state backend. MaxConcurrentBuilds is how many builds run at once. Profile names a shape: small, medium or large. Mode is "external" today and only external: the plane stores no data itself, so a managed database would have nowhere to live. Secret names the Kubernetes Secret holding the DSN. Certificates is production or staging. Empty is production, because a plane that nobody chose an answer for is one in service. Root is the zone that must already be delegated, e.g. kubox.cloud. Subdomain is the label under it that this deployment owns. Environment is what this deployment's resources are TAGGED as, which is what cost reports group by. Empty takes metadata.name. Workload names the identity plane the plane's own workloads federate through. Required: without it the plane's pods have no identity of their own. The identity plane is created out of band, before any plane exists. Issuer is the public OIDC issuer AWS validates the tokens against. SpireServer is what the agent on each node dials, as host:port. TrustBundleURL is where an agent bootstraps the server's bundle from. TrustDomain is the SPIFFE trust domain. Empty takes spec.domain.root, which is what it has always been for kubox.cloud. AppRepository is where a built cluster's apps come from. Empty takes the public one, which is right outside an air-gapped install. PublicRegistry is where the two PUBLIC images come from: kubox, which a build Job runs, and kubox-agent, which every built cluster runs. Anyone can pull them, so a customer's nodes need no credential and no registry extension to run the agent. Only kubox-plane, the licensed image, comes from Registry. Empty takes the default public registry; set it to mirror them somewhere else. Registry is where the OPERATOR image is pulled from -- an ECR host in production, because the plane's nodes authenticate to it with their instance role. Empty takes the public one. Version is the image tag, e.g. v0.4.2. Required: a plane built from whatever `latest` meant that afternoon is a plane nobody can reproduce. Backend is the s3:// URL, required when Mode is external. Mode is "managed" -- kubox admin creates and owns the bucket -- or "external", where Backend names one that already exists. Project is the name the plane's state is stored under, and it is also the path the state lives at within the backend. Empty derives it from metadata.name. ## All types Every type in the document, in the order the root reaches them. Each is also linked from the field that uses it above. ### Metadata Metadata names the deployment. Name is what this plane is called. It becomes the cluster's name and the name its state is stored under, so it must not collide with another deployment that shares a state backend. ### Spec Spec is what an operator decides. See [Capacity](#capacity). See [Database](#database). See [Domain](#domain). Environment is what this deployment's resources are TAGGED as, which is what cost reports group by. Empty takes metadata.name. See [Identity](#identity). See [Provider](#provider). See [Release](#release). See [State](#state). ### Capacity Capacity is how big the plane is. MaxConcurrentBuilds is how many builds run at once. Profile names a shape: small, medium or large. ### Database Database is the record store. Mode is "external" today and only external: the plane stores no data itself, so a managed database would have nowhere to live. Secret names the Kubernetes Secret holding the DSN. ### Domain Domain is what the plane is reachable at. Certificates is production or staging. Empty is production, because a plane that nobody chose an answer for is one in service. Root is the zone that must already be delegated, e.g. kubox.cloud. Subdomain is the label under it that this deployment owns. ### Identity Identity is who this plane trusts, and who vouches for it. Workload names the identity plane the plane's own workloads federate through. Required: without it the plane's pods have no identity of their own. The identity plane is created out of band, before any plane exists. See [WorkloadIdentity](#workloadidentity). ### Provider Provider is where the plane runs. See [AWSProvider](#awsprovider). ### Release Release is what version to run, and where it comes from. AppRepository is where a built cluster's apps come from. Empty takes the public one, which is right outside an air-gapped install. PublicRegistry is where the two PUBLIC images come from: kubox, which a build Job runs, and kubox-agent, which every built cluster runs. Anyone can pull them, so a customer's nodes need no credential and no registry extension to run the agent. Only kubox-plane, the licensed image, comes from Registry. Empty takes the default public registry; set it to mirror them somewhere else. Registry is where the OPERATOR image is pulled from -- an ECR host in production, because the plane's nodes authenticate to it with their instance role. Empty takes the public one. Version is the image tag, e.g. v0.4.2. Required: a plane built from whatever `latest` meant that afternoon is a plane nobody can reproduce. ### State State is where the plane's infrastructure state is stored. Backend is the s3:// URL, required when Mode is external. Mode is "managed" -- kubox admin creates and owns the bucket -- or "external", where Backend names one that already exists. Project is the name the plane's state is stored under, and it is also the path the state lives at within the backend. Empty derives it from metadata.name. ### WorkloadIdentity WorkloadIdentity is the identity plane this deployment's pods attest to. Issuer is the public OIDC issuer AWS validates the tokens against. SpireServer is what the agent on each node dials, as host:port. TrustBundleURL is where an agent bootstraps the server's bundle from. TrustDomain is the SPIFFE trust domain. Empty takes spec.domain.root, which is what it has always been for kubox.cloud. ### AWSProvider AWSProvider is the AWS half. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.