adj cluster provision
Provision a cluster's data plane in YOUR AWS account (async)
Provision a data-plane cluster end to end from the CLI, in your own AWS account, with your own credentials (a named --aws-profile, or ambient AWS_PROFILE / AWS_ACCESS_KEY_ID env vars). Adjoint never holds cloud credentials.
Before touching anything it verifies the AWS CLI works and simulates the IAM permissions the module needs — a definitive gap prints exactly which actions to grant, then exits.
Sizing: pass --developers N (how many people will use the cluster concurrently) and tight defaults are derived for nodes and FSx throughput/storage; individual --nodes/--node-type/--fsx-* flags override.
The 20–30 minute apply runs DETACHED by default: the command returns immediately and 'adj cluster status <id>' reports running/succeeded/failed (use --foreground to stream it instead). On success the cluster kubeconfig is written to the adj-owned path (~/.config/adj/kubeconfigs/<context>.yaml, 0600) — your default ~/.kube/config is not touched.
This bootstraps the cluster first, ROTATING its agent join token.
Requires: tofu, aws. (--module-dir dev runs also need kustomize, plus docker unless --skip-build.)
Usage
adj cluster provision <id|name> [flags]
Flags
| Flag | Shorthand | Default | Description |
|---|---|---|---|
--agent-image |
— |
full adjoint-agent image ref (default: current published image from the control plane) | |
--aws-profile |
— |
AWS profile for tofu + aws (default: ambient env credentials / AWS_PROFILE) | |
--developers |
3 |
expected concurrent developers — sizes nodes + FSx with tight defaults | |
--foreground |
false |
stream the apply in this terminal instead of detaching | |
--fsx-storage-gib |
0 |
override the derived FSx SSD storage (GiB, min 64) | |
--fsx-throughput |
0 |
override the derived FSx throughput (MB/s: 64|128|256|512|1024|2048|3072|4096) | |
--module-dir |
— |
path to a local OpenTofu module checkout (developer override; default: use the module embedded in adj, which also forces --skip-build) | |
--node-type |
— |
override the derived node instance type | |
--nodes |
0 |
override the derived EKS node count | |
--operator-image |
— |
full adjoint-operator image ref (default: current published image from the control plane) | |
--registry-password |
— |
private-registry password (or set ADJ_REGISTRY_PASSWORD) | |
--skip-build |
false |
skip docker build+push (images must already be pushed) | |
--yes |
false |
skip the confirmation prompt |
Global flags
| Flag | Shorthand | Default | Description |
|---|---|---|---|
--context |
— |
config context to use (overrides current-context) | |
--output |
-o | table |
output format: table|json|yaml |
--server |
— |
server base URL (overrides the active context) | |
--token |
— |
access token (overrides the active context) | |
--verbose |
-v | false |
log requests to stderr |