---
layout: commands
page_title: 'Commands: K8s bootstrap'
sidebar_title: 'k8s bootstrap'
description: 'Post-Helm-install bootstrapping'
---

# Waypoint K8s bootstrap

Command: `waypoint k8s bootstrap`

Post-Helm-install bootstrapping

@include "commands/k8s-bootstrap_desc.mdx"

## Usage

Usage: `waypoint k8s bootstrap [options]`

Bootstrap a Waypoint installation from the Waypoint Helm chart.
This is an internal command and not expected to be manually executed.
This command only works with in-cluster Kubernetes authentication and
will not work with out-of-cluster kubectl configuration.

This command will do a number of things:

1. Equivalent of "waypoint server bootstrap"
2. Write a bootstrap token to the given Kubernetes secret
3. Create a token for a static runner and write it to the configured
   Kubernetes secret.
4. Configure Kubernetes on-demand runners.

This command will only run if the server hasn't already been bootstrapped.
If the server is bootstrapped, this will not run again. This doesn't handle
partial failures well: if the server bootstrap succeeds but writing the
secret fails, then the Waypoint installation should be fully uninstalled
and then reinstalled. This is only use for fresh installations so there
should be no concern of data loss in the event of a bootstrap failure.

#### Global Options

- `-plain` - Plain output: no colors, no animation. The default is false.
- `-app=<string>` (`-a`) - App to target. Certain commands require a single app target for Waypoint configurations with multiple apps. If you have a single app, then this can be ignored.
- `-project=<string>` (`-p`) - Project to target.
- `-workspace=<string>` (`-w`) - Workspace to operate in.

#### Connection Options

- `-server-addr=<string>` - Address for the server.
- `-server-tls` - True if the server should be connected to via TLS. The default is true.
- `-server-tls-skip-verify` - True to skip verification of the TLS certificate advertised by the server. The default is false.

#### Command Options

- `-root-token-secret=<string>` - The name of the Kubernetes secret to write the root token to.
- `-runner-token-secret=<string>` - The name of the Kubernetes secret to write the runner token to.
- `-odr-image=<string>` - The name and label of the container image to use for ODR.
- `-odr-service-account=<string>` - The name of the Kubernetes service account to use for ODR.
- `-odr-image-pull-policy=<string>` - The pull policy to use for the container image.
- `-advertise-service=<string>` - The name of the service to advertise.
- `-advertise-tls` - True if the advertise addr supports TLS. The default is true.
- `-advertise-tls-skip-verify` - True if the advertise addr TLS shouldn't be verified. The default is false.

@include "commands/k8s-bootstrap_more.mdx"
