Install the management plane's ingress fronting the management-plane
services (api, app/router, auth, dashboard, otel-gateway).
Provider selection via --type, mirroring the data plane's 'tetrate agentrouter dataplane ingress install'.
GCP (--type gcp, default):
Renders the gcp-gateway-manage-helm chart — a GKE Gateway (gatewayClassName
gke-l7-global-external-managed) and HTTPRoutes for the management-plane
services into tars-gateway-{customer}, routing to the Services in
tars-system-{customer}. The TLS certificate map (computed
{customer}[-{environment}]-tetrate-ai) and any --static-ip-name are
prerequisites created out-of-band via Certificate Manager and a reserved
global address. The chart is not embedded in tare — pass --chart-version or
--chart-path. Run 'tetrate agentrouter manage install' first so the target Services exist.
AWS (--type aws):
Renders the aws-gateway-manage-helm chart, five Kubernetes Ingress
resources (one per service), merged by aws-load-balancer-controller into a
single ALB via a shared IngressGroup. Unlike the GCP chart, every Ingress
renders directly into tars-system-{customer} (the services' own namespace):
a Kubernetes Ingress cannot cross-namespace reference a Service the way the
GCP chart's HTTPRoute + ReferenceGrant does, so there is no separate
gateway namespace here. TLS terminates at the ALB using the wildcard ACM
certificate named by --certificate-arn (required); --wafv2-acl-arn attaches
an optional WAFv2 web ACL. Prerequisites (aws-load-balancer-controller with
its IRSA, the ACM certificate, optionally a WAFv2 web ACL and external-dns)
are NOT applied by tare, they involve account-specific IAM and DNS
validation this CLI will not perform unattended. --dry-run-prereqs prints
the exact commands; complete them, then rerun with --ack-prereqs.
--apply-prereqs is rejected here: unlike the data-plane gateway, where that
flag genuinely runs the gcloud or az commands, there is nothing on AWS tare
can safely apply for you. The chart is not embedded in tare, so pass
--chart-version or --chart-path. Run 'tetrate agentrouter manage install' first so the
target Services exist.
Azure (--type azure):
Renders the azure-gateway-manage-helm chart, five Kubernetes Ingress
resources (one per service) consolidated by the Application Gateway
Ingress Controller (AGIC) into a single Application Gateway. Like AWS,
every Ingress renders directly into tars-system-{customer} (the services'
own namespace): a Kubernetes Ingress cannot cross-namespace reference a
Service, so there is no separate gateway namespace here. TLS terminates
at the Application Gateway using exactly one of two sources, matching the
chart's own mandatory-or-fail check: --appgw-ssl-certificate names a
Key Vault-backed SSL certificate already installed on the Application
Gateway (primary, no cert-manager involved), or --tls-issuer names a
cert-manager Issuer/ClusterIssuer for ACME (e.g. DNS-01) issuance
(fallback); setting both, or neither, is rejected before any cluster
call. --tls-secret overrides the shared TLS secret name under the
cert-manager path (only valid with --tls-issuer); --waf-policy-id attaches
an optional Application Gateway WAF_v2 policy (the Cloud Armor/WAFv2
analogue). Prerequisites: an AGIC-enabled AGIC-compatible AKS cluster and
the TLS source above are required; --apply-prereqs is rejected here for a
different reason than AWS -- enabling the AGIC addon genuinely is
something tetrate can apply (install_azure.go already does it for the data
plane), but this command does not resolve the AKS cluster's
subscription/resource-group/cluster-name identity the way the data-plane
command does, so it cannot safely decide whether or where to enable it;
use 'tetrate agentrouter dataplane ingress install --type azure --apply-prereqs' for that, then
--ack-prereqs here. --dry-run-prereqs prints the exact commands.
Optionally pass --azure-subscription-id/--azure-resource-group/
--aks-cluster-name to additionally run the same AKS networkProfile and
Azure role-assignment preflight the data-plane command runs. The chart is
not embedded in tare, so pass --chart-version or --chart-path. Run
'tetrate agentrouter manage install' first so the target Services exist.
Examples:
# Preview the rendered Gateway chart values (GCP)
tetrate agentrouter manage ingress install --customer acme --chart-version v0.1.0 --print-helm-values
# Install into tars-gateway-acme with a reserved static IP
tetrate agentrouter manage ingress install --customer acme \
--static-ip-name acme-mp-ip --chart-version v0.1.0
# AWS: preview the rendered ALB Ingress values
tetrate agentrouter manage ingress install --customer acme --type aws \
--certificate-arn arn:aws:acm:us-west-2:111122223333:certificate/xxxx \
--chart-version v0.1.0 --print-helm-values
# AWS: print the required prerequisite commands
tetrate agentrouter manage ingress install --customer acme --type aws --dry-run-prereqs
# AWS: install once prerequisites are handled
tetrate agentrouter manage ingress install --customer acme --type aws \
--certificate-arn arn:aws:acm:us-west-2:111122223333:certificate/xxxx \
--chart-version v0.1.0 --ack-prereqs
# Azure: preview the rendered AGIC Ingress values (Key Vault cert)
tetrate agentrouter manage ingress install --customer acme --type azure \
--appgw-ssl-certificate acme-wildcard-cert \
--chart-version v0.1.0 --print-helm-values
# Azure: install with the cert-manager fallback once prerequisites are handled
tetrate agentrouter manage ingress install --customer acme --type azure \
--tls-issuer letsencrypt-dns01 --chart-version v0.1.0 --ack-prereqs
Safe to re-run: yes, with conditions -- the single Helm release converges and
no cloud resource is created. But values are rendered from the command line
with no carry-forward, so re-pass the same flags; --ack-prereqs is required
again on aws and azure, and --yes to skip the confirmation; and a Helm step
interrupted mid-operation leaves a stuck release to clear by hand first.
Usage:
tare manage gateway install [flags]
Flags:
--ack-prereqs AWS/Azure only. Confirm the provider prerequisites (controller/IRSA + ACM certificate on AWS; AGIC addon + TLS source on Azure) are already handled.
--aks-cluster-name string Azure only, optional. See --azure-subscription-id.
--appgw-ssl-certificate string Azure only. Primary TLS path: name of a Key Vault-backed SSL certificate already installed on the Application Gateway (renders the appgw-ssl-certificate annotation). Exactly one of this or --tls-issuer is required to install.
--apply-prereqs AWS/Azure only. Rejected: nothing here is safely automatable from this command. Use --dry-run-prereqs to print the commands, then --ack-prereqs.
--azure-resource-group string Azure only, optional. See --azure-subscription-id.
--azure-subscription-id string Azure only, optional. With --azure-resource-group and --aks-cluster-name, additionally runs the AKS networkProfile/AGIC-compatibility and Azure role-assignment preflight that 'tetrate agentrouter dataplane ingress install --type azure' runs.
--certificate-arn string AWS only. Wildcard ACM certificate ARN the ALB terminates TLS with. Required to install (not required for --print-helm-values).
--chart-no-cache Bypass the ~/.tetrate/charts cache when fetching --chart-version.
--chart-path string Local path or oci:// reference to the gateway chart (gcp-gateway-manage-helm, aws-gateway-manage-helm, or azure-gateway-manage-helm, per --type). Overrides --chart-version.
--chart-registry string OCI registry for --chart-version (default: registry.tetrate.ai).
--chart-version string Gateway chart version to fetch from --chart-registry. Required unless --chart-path is a local path.
--context string kubeconfig context to act on (default: the current context)
--customer string Organization (customer) identifier (drives namespaces, domain, and cert map). Required.
--dry-run-prereqs AWS/Azure only. Print the required prerequisite commands and continue.
--environment string Deployment environment (empty = production); selects the domain + cert-map suffix.
--kubeconfig string Path to the kubeconfig file (default: $KUBECONFIG, then ~/.kube/config)
--namespace string Helm release namespace (default: tars-release-{customer}).
--no-wait Return after Helm finishes; do not wait (overrides --wait).
--print-helm-values Print the generated values and exit without touching the cluster.
--release-name string Helm release name (default: tars-{customer}-gateway).
--security-policy string GCP only. Cloud Armor WAF policy name to attach to the backend policies.
--skip-preflight AWS/Azure only. Skip the Helm/kubectl/cluster/Ingress/IngressClass preflight checks (also TETRATE_SKIP_PREFLIGHT=1).
--static-ip-name string GCP only. Reserved global static IP name to bind the Gateway to (networking.gke.io/static-ip-name).
--timeout string Timeout for --wait. (default "10m")
--tls-issuer string Azure only. Fallback TLS path: cert-manager Issuer/ClusterIssuer name for ACME (e.g. DNS-01) issuance. Exactly one of this or --appgw-ssl-certificate is required to install.
--tls-issuer-kind string Azure only. Issuer or ClusterIssuer (default: ClusterIssuer). Only valid with --tls-issuer.
--tls-secret string Azure only. TLS secret name applied to every management-plane route under the --tls-issuer fallback path (default per-route: {route-name}-tls). Only valid with --tls-issuer.
--type string Gateway provider type: gcp, aws, or azure. (default "gcp")
--values string Extra Helm values file merged after the generated values (-f); use for hostname overrides / an internal Gateway.
--waf-policy-id string Azure only. Application Gateway WAF_v2 policy resource ID to attach (the Cloud Armor/WAFv2 analogue). Optional.
--wafv2-acl-arn string AWS only. WAFv2 web ACL ARN to attach to the ALB (the Cloud Armor analogue). Optional.
--wait Wait for the release to become ready (helm --wait; default true; use --no-wait to disable). (default true)
-y, --yes Skip the confirmation prompt; required when there is no terminal to prompt on
Global Flags:
-q, --quiet Suppress progress output; only errors and the final summary go to stderr
-v, --verbose Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr