usage: install.sh --provider <name> --registry <host[:port]> --channel <name> \
--channel-pubkey <path> [options]
required
--provider one of: aws-eks azure-aks gcp-gke generic lke openshift
--registry channel registry host[:port]
--channel channel name, e.g. acme-stable
--channel-pubkey cosign public key the admission policy pins
options
--customer-values customer-local values file injected into the subscription
(default: profiles/vexa/customer-values.example.yaml)
--manifests rendered manifests of the delivered set, handed to the
preflight so P2/P3 check EVERY workload's declared
resources against your LimitRange and quota — not just the
synthetic bot profile. Without it the installer renders the
chart itself with 'helm template'; if that is not possible
it says so and the preflight checks the bot alone.
--staging-ns namespace the staging Application deploys into
(default vexa-staging)
--prod-ns namespace the production Application deploys into
(default vexa-prod)
--prod-pin channel position prod follows. The production Application
is created either way; with no pin it is parked at
'UNPINNED', a position that resolves to nothing, so it
syncs nothing until you move the pin. Moving it is YOUR
gate.
--signature-repository OCI repo where cosign signatures live (default:
alongside each image)
--claim-code CODE claim the channel credential with the six digits read to you
on a call, INSTEAD of --registry-user plus VEXA_CHANNEL_PASS.
Written 123 456 and typed either way: 123456, or '123 456'
in quotes. The credential is fetched from the channel edge
over TLS, used for every registry secret this script writes,
and also written to the station credential Secret in
--prod-ns. It never appears on your screen, in your shell
history or in a file. The code is single-use and lives ~15
minutes.
--claim-edge URL claim endpoint (default https://<registry>/claim — the claim
service is behind the same edge as the registry, so it is
the host you already allowed through your firewall)
--station NAME your station name, which the claim is bound to
(default: the channel name)
--registry-user username for an AUTHENTICATED channel registry. The
password is read from the VEXA_CHANNEL_PASS environment
variable, never from argv. Required whenever your channel
registry needs credentials to pull: without it Argo CD's
repo-server gets 401 and the subscription never syncs.
Kyverno also receives it; against channel.vexa.ai the
signature read paths are anonymous so it is not needed
for admission, but it is needed if you mirror the channel
into your own authenticated registry. Use this OR
--claim-code, not both.
--chart-name NAME chart to install from the channel (default: vexa). An
estate channel serves the vexa-platform chart.
--release-name N Helm release name (default: vexa). MUST match the existing
release when adopting a live cluster — Helm keys its release
Secret on this and a mismatch installs a second copy.
--registry-ca PEM file of the registry's CA (corporate/self-signed):
mounted into Kyverno as a trust bundle
--registry-insecure registry TLS cert is not trusted by Argo CD (self-signed
test rigs): marks the Argo repo secrets insecure. Argo has
no CA-bundle path for OCI repos, so --registry-ca alone
covers Kyverno but not Argo; without this flag a self-signed
registry fails repo-server with "x509: certificate signed by
unknown authority" (M2 receipt §3)
--verifier-image station verifier image; setting it turns the chart-side
PreSync verify gate on (default: off)
--kubeconfig kubeconfig path (default: ambient)
--plain-http registry is plain HTTP (test rigs only; implies insecure)
--argocd MODE what to do about Argo CD: auto (default) | adopt | install |
skip. auto DETECTS an existing install first: absent ->
install the pin; present at the pinned version -> ADOPT it
and write nothing; present at another version -> REFUSE and
say so, before a single object is applied. adopt takes an
existing install whatever version it is; install always
applies the upstream manifests; skip leaves Argo entirely
alone (you install it, we subscribe to it).
--kyverno MODE the same four modes for Kyverno.
--cluster-scope who owns the cluster-scoped objects:
installer (default) this run creates them. Needs
cluster rights, which is how our own
cluster went in.
platform-pack your platform team already applied
kit/platform's platform-<provider>.yaml.
This run then does namespace-scoped work
only: it installs no Argo CD, no Kyverno
and no ClusterPolicy, and it creates no
namespace. It CHECKS the pack landed
first and refuses by name if it did not.
--skip-preflight do not run the conformance preflight (NOT recommended)
--dry-run render everything, apply nothing