install

Installs the application and the KOTS Admin Console directly to a cluster. The kots install command pulls Kubernetes manifests from the remote upstream, deploys the manifests to the specified cluster, installs the Admin Console, and sets up port forwarding to make the Admin Console accessible on port 8800. Alternatively, you can specify the --port flag to override the default port.

Usage

kubectl kots install [upstream uri] [flags]

• Replace [upstream-uri] with the URI for your KOTS application (required).
• If the KOTS application has been packaged by Replicated Vendor, the --license-file flag must be provided.
• Provide [flags] according to the table below

This command supports all global flags and also:

Flag	Type	Description
--airgap	bool	Set to true to run install in air gapped mode. Setting --airgap-bundle implies --airgap=true. Default: false. For more information, see Air Gap Installation in Existing Clusters.
--airgap-bundle	string	Path to the application air gap bundle where application metadata will be loaded from. Setting --airgap-bundle implies --airgap=true. For more information, see Air Gap Installation in Existing Clusters.
--app-version-label	string	The application version label to install. If not specified, the latest version is installed.
--config-values	string	Path to a manifest file containing configuration values. This manifest must be apiVersion: kots.io/v1beta1 and kind: ConfigValues. For more information, see Installing with the CLI.
--copy-proxy-env	bool	Copy proxy environment variables from current environment into all Admin Console components. Default: false
--disable-image-push	bool	Set to true to disable images from being pushed to private registry. Default: false
--ensure-rbac	bool	When false, KOTS does not attempt to create the RBAC resources necessary to manage applications. Default: true. If a role specification is needed, use the generate-manifests command.
-h, --help		Help for the command.
--http-proxy	string	Sets HTTP_PROXY environment variable in all Admin Console components.
--https-proxy	string	Sets HTTPS_PROXY environment variable in all Admin Console components.
--kotsadm-namespace	string	Set to override the registry namespace of KOTS Admin Console images. Used for air gap installations. For more information, see Air Gap Installation in Existing Clusters. Note: Replicated recommends that you use --kotsadm-registry instead of --kotsadm-namespace to override both the registry hostname and, optionally, the registry namespace with a single flag.
--kotsadm-registry	string	Set to override the registry hostname and namespace of KOTS Admin Console images. Used for air gap installations. For more information, see Air Gap Installation in Existing Clusters.
--license-file	string	Path to a license file.
--local-path	string	Specify a local-path to test the behavior of rendering a Replicated application locally. Only supported on Replicated application types.
--name	string	Name of the application to use in the Admin Console.
--no-port-forward	bool	Set to true to disable automatic port forward. Default: false
--no-proxy	string	Sets NO_PROXY environment variable in all Admin Console components.
--port	string	Override the local port to access the Admin Console. Default: 8800
--preflights-wait-duration	string	Timeout to be used while waiting for preflights to complete. Must be in Go duration format. For example, 10s, 2m. Default: 15m
--registry-password	string	Password to use to authenticate with the application registry. Used for air gap installations.
--registry-username	string	Username to use to authenticate with the application registry. Used for air gap installations.
--repo	string	Repo URI to use when installing a Helm chart.
--shared-password	string	Shared password to use when deploying the Admin Console.
--skip-compatibility-check	bool	Set to true to skip compatibility checks between the current KOTS version and the application. Default: false
--skip-preflights	bool	Set to true to skip preflight checks. Default: false. If any strict preflight checks are configured, the --skip-preflights flag is not honored because strict preflight checks must run and contain no failures before the application is deployed. For more information, see Defining Preflight Checks.
--skip-rbac-check	bool	Set to true to bypass RBAC check. Default: false
--skip-registry-check	bool	Set to true to skip the connectivity test and validation of the provided registry information. Default: false
--strict-security-context	bool	Set to true to explicitly enable strict security contexts for all KOTS Pods and containers. By default, KOTS Pods and containers are not deployed with a specific security context. When true, --strict-security-context does the following: Ensures containers run as a non-root user Sets the specific UID for the containers (1001) Sets the GID for volume ownership and permissions (1001) Applies the default container runtime seccomp profile for security Ensures the container is not run with privileged system access Prevents the container from gaining more privileges than its parent process Ensures the container's root filesystem is mounted as read-only Removes all Linux capabilities from the container The following shows the securityContext for KOTS Pods when --strict-security-context is set: securityContext: fsGroup: 1001 runAsGroup: 1001 runAsNonRoot: true runAsUser: 1001 seccompProfile: type: RuntimeDefault supplementalGroups: - 1001 Default: false note Might not work for some storage providers.
--use-minimal-rbac	bool	When set to true, KOTS RBAC permissions are limited to the namespace where it is installed. To use --use-minimal-rbac, the application must support namespace-scoped installations and the user must have the minimum RBAC permissions required by KOTS in the target namespace. For a complete list of requirements, see Namespace-scoped RBAC Requirements​ in Installation Requirements. Default: false
--wait-duration	string	Timeout to be used while waiting for individual components to be ready. Must be in Go duration format. For example, 10s, 2m. Default: 2m
--with-minio	bool	When set to true, KOTS deploys a local MinIO instance for storage and uses MinIO for host path and NFS snapshot storage. Default: true
--storage-class	string	Sets the storage class to use for the KOTS Admin Console components. Default: unset, which means the default storage class will be used

Examples

kubectl kots install sentry/unstable --license-file ~/license.yaml
kubectl kots install kots-sentry/stable --shared-password IgqG5OBc9Gp --license-file ~/sentry-license.yaml --namespace sentry-namespace --config-values ~/config-values.yaml
kubectl kots install --ensure-rbac=false