kit/install.sh · audience: customer
When you use this
Install the station itself — the Argo subscription that follows a channel position, plus the admission policy that pins the channel key. Prod gets an Application only when you set--prod-pin, because moving that pin is the operator’s gate and not ours to pre-press.
Usage
Emitted fromkit/install.sh --help.
usage: install.sh --provider <name> --registry <host[:port]> --channel <name> \
--channel-pubkey <path> [options]
required
--provider one of: aws-eks azure-aks gcp-gke generic lke openshift
--registry channel registry host[:port]
--channel channel name, e.g. acme-stable
--channel-pubkey cosign public key the admission policy pins
options
--customer-values customer-local values file injected into the subscription
(default: profiles/vexa/customer-values.example.yaml)
--staging-ns namespace the staging Application deploys into
(default vexa-staging)
--prod-ns namespace the production Application deploys into
(default vexa-prod)
--prod-pin channel position prod follows. The production Application
is created either way; with no pin it is parked at
'UNPINNED', a position that resolves to nothing, so it
syncs nothing until you move the pin. Moving it is YOUR
gate.
--signature-repository OCI repo where cosign signatures live (default:
alongside each image)
--registry-user username for an AUTHENTICATED channel registry. The
password is read from the VEXA_CHANNEL_PASS environment
variable, never from argv. Required whenever your channel
registry needs credentials to pull: without it Argo CD's
repo-server gets 401 and the subscription never syncs.
Kyverno also receives it; against channel.vexa.ai the
signature read paths are anonymous so it is not needed
for admission, but it is needed if you mirror the channel
into your own authenticated registry.
--chart-name NAME chart to install from the channel (default: vexa). An
estate channel serves the vexa-platform chart.
--release-name N Helm release name (default: vexa). MUST match the existing
release when adopting a live cluster — Helm keys its release
Secret on this and a mismatch installs a second copy.
--registry-ca PEM file of the registry's CA (corporate/self-signed):
mounted into Kyverno as a trust bundle
--registry-insecure registry TLS cert is not trusted by Argo CD (self-signed
test rigs): marks the Argo repo secrets insecure. Argo has
no CA-bundle path for OCI repos, so --registry-ca alone
covers Kyverno but not Argo; without this flag a self-signed
registry fails repo-server with "x509: certificate signed by
unknown authority" (M2 receipt §3)
--verifier-image station verifier image; setting it turns the chart-side
PreSync verify gate on (default: off)
--kubeconfig kubeconfig path (default: ambient)
--plain-http registry is plain HTTP (test rigs only; implies insecure)
--skip-preflight do not run the conformance preflight (NOT recommended)
--dry-run render everything, apply nothing