tare/manage/install
tare manage install
Install the Agent Router management plane (manage-helm umbrella) on an existing cluster.
The management plane needs a reachable PostgreSQL instance: the bootstrapper
subchart runs as a Helm pre-install hook to migrate and seed the database, so
the install fails fast if --database-url is unreachable.
Unlike the data-plane chart, manage-helm is not embedded in the tare binary —
pass --chart-version (fetched from --chart-registry, default registry.tetrate.ai)
or a local --chart-path.
Secrets (--admin-key, --api-key, --api-key-secret, --hmac-key-secret,
--auth-secret, --playground-key, --cron-secret) are rendered only when set;
supply any remainder via a --values overlay.
--deployment-mode saas installs the multi-tenant SaaS management plane: it defaults
--customer to "saas" (the chart derives DEPLOYMENT_PRODUCT and the public,
un-prefixed service domains from customer=="saas") and turns corporate login off.
Enterprise (the default) keeps corporate SSO on and uses per-organization domains.
Examples:
# Render values without touching the cluster
tare manage install --customer acme --database-url "$DB_URL" \
--chart-version v0.1.0 --print-helm-values
# SaaS management plane (--customer defaults to "saas", corporate login off)
tare manage install --deployment-mode saas \
--database-url "$DB_URL" \
--corporate-admin-email admin@tetrate.io --corporate-email-domains tetrate.io \
--gcp-project-id my-project --secret-manager-type valet --enable-archival \
--chart-version v0.1.0
# Install from an OCI chart version into tars-release-acme
tare manage install --customer acme \
--database-url "postgres://user:pass@db:5432/fraser?sslmode=disable" \
--image-registry gcr.io/acme --image-tag v1.2.3 \
--serve-url https://proxy.acme.example.com \
--chart-version v0.1.0
Usage:
tare manage install [flags]
Flags:
--admin-key string global.adminKey.
--api-image-repository string Override api.image.repository (e.g. "valet") so --image-registry does not double-prefix the api image.
--api-key string global.apiKey.
--api-key-secret string global.apiKeySecret.
--app-image-repository string Override app.image.repository (e.g. "app") for mirrored registries.
--auth-image-repository string Override auth.image.repository (e.g. "auth") for mirrored registries.
--auth-secret string global.auth.secret.
--chart-no-cache Bypass the ~/.tare/charts cache when fetching --chart-version.
--chart-path string Local path or oci:// reference to the manage-helm chart. Overrides --chart-version.
--chart-registry string OCI registry for --chart-version (default: registry.tetrate.ai, or --image-registry when set).
--chart-version string manage-helm chart version to fetch from --chart-registry. Required unless --chart-path is a local path.
--corporate-admin-email string global.corporate.adminEmail (chart-mandated). Required.
--corporate-email-domains string global.corporate.emailDomains, comma-separated (chart-mandated). Required.
--corporate-login-enabled global.corporateLoginEnabled: corporate SSO gate. Default true (enterprise); --deployment-mode saas turns it off. (default true)
--cron-secret string global.cronSecret (OAuth-refresh CronJob auth).
--customer string Organization (customer) identifier (drives namespace names and service domains). Required (defaults to "saas" with --deployment-mode saas).
--dashboard-image-repository string Override dashboard.image.repository (e.g. "dashboard") for mirrored registries.
--database-url string PostgreSQL connection string for the management plane. Required.
--deployment-mode string Deployment mode: enterprise or saas. saas defaults --customer to "saas" (the chart derives DEPLOYMENT_PRODUCT + public domains from customer=="saas") and turns corporate login off. (default "enterprise")
--enable-archival Enable the request-log archival CronJob (archival.enabled; SaaS-only, needs a GCS bucket + workload identity via --values).
--environment string Deployment environment (empty = production); selects the service-domain suffix.
--gcp-project-id string global.gcpProjectId (archival/usage-rollup + secret-manager valet).
--hmac-key-secret string global.hmacKeySecret.
--image-registry string Registry for management-plane images (global.imageRegistry).
--image-tag string Tag for management-plane images (global.imageTag; also applied to auth/dashboard tags).
--namespace string Helm release namespace (default: tars-release-{customer}).
--no-bootstrap Disable the bootstrapper subchart (skip DB migrate + seed). The DB must already be migrated.
--no-wait Return after Helm finishes; do not wait for resources to become ready (overrides --wait).
--playground-key string global.playgroundKey.
--print-helm-values Print the generated values and exit without touching the cluster.
--release-name string Helm release name (default: tars-{customer}).
--secret-manager-type string global.env.common.SECRET_MANAGER_TYPE. Default "none" (keys passed as plaintext flags); set to "valet" only when keys are secret-manager refs. (default "none")
--serve-url string Data plane URL (global.serveUrl). Optional; chart computes proxy.{customer}.… when empty.
--timeout string Timeout for --wait and the bootstrapper hook. (default "10m")
--values string Extra Helm values file merged after the generated values (-f).
--wait Wait for all release resources to become ready (helm --wait; default true; use --no-wait to disable). (default true)
Global Flags:
-q, --quiet Suppress progress output; only errors and the final summary go to stderr
-v, --verbose Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr