> ## Documentation Index
> Fetch the complete documentation index at: https://delivery.vexa.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# install.sh

> Install the station: Argo subscription plus admission policy.

Source: `kit/install.sh` · audience: customer

## When you use this

Install the station itself — the Argo subscription that follows a channel position, plus the admission policy that pins the channel key. Prod gets an Application only when you set `--prod-pin`, because moving that pin is the operator's gate and not ours to pre-press.

## Usage

Emitted from `kit/install.sh --help`.

```text theme={null}
usage: install.sh --provider <name> --registry <host[:port]> --channel <name> \
                  --channel-pubkey <path> [options]

required
  --provider        one of: aws-eks azure-aks gcp-gke generic lke openshift 
  --registry        channel registry host[:port]
  --channel         channel name, e.g. acme-stable
  --channel-pubkey  cosign public key the admission policy pins

options
  --customer-values customer-local values file injected into the subscription
                    (default: profiles/vexa/customer-values.example.yaml)
  --staging-ns      namespace the staging Application deploys into
                    (default vexa-staging)
  --prod-ns         namespace the production Application deploys into
                    (default vexa-prod)
  --prod-pin        channel position prod follows. The production Application
                    is created either way; with no pin it is parked at
                    'UNPINNED', a position that resolves to nothing, so it
                    syncs nothing until you move the pin. Moving it is YOUR
                    gate.
  --signature-repository  OCI repo where cosign signatures live (default:
                    alongside each image)
  --registry-user   username for an AUTHENTICATED channel registry. The
                    password is read from the VEXA_CHANNEL_PASS environment
                    variable, never from argv. Required whenever your channel
                    registry needs credentials to pull: without it Argo CD's
                    repo-server gets 401 and the subscription never syncs.
                    Kyverno also receives it; against channel.vexa.ai the
                    signature read paths are anonymous so it is not needed
                    for admission, but it is needed if you mirror the channel
                    into your own authenticated registry.
  --chart-name NAME  chart to install from the channel (default: vexa). An
                    estate channel serves the vexa-platform chart.
  --release-name N  Helm release name (default: vexa). MUST match the existing
                    release when adopting a live cluster — Helm keys its release
                    Secret on this and a mismatch installs a second copy.
  --registry-ca     PEM file of the registry's CA (corporate/self-signed):
                    mounted into Kyverno as a trust bundle
  --registry-insecure  registry TLS cert is not trusted by Argo CD (self-signed
                    test rigs): marks the Argo repo secrets insecure. Argo has
                    no CA-bundle path for OCI repos, so --registry-ca alone
                    covers Kyverno but not Argo; without this flag a self-signed
                    registry fails repo-server with "x509: certificate signed by
                    unknown authority" (M2 receipt §3)
  --verifier-image  station verifier image; setting it turns the chart-side
                    PreSync verify gate on (default: off)
  --kubeconfig      kubeconfig path (default: ambient)
  --plain-http      registry is plain HTTP (test rigs only; implies insecure)
  --skip-preflight  do not run the conformance preflight (NOT recommended)
  --dry-run         render everything, apply nothing
```