tare manage install

Install the Agent Router management plane (manage-helm umbrella) on an existing cluster.

The management plane needs a reachable PostgreSQL instance: the bootstrapper
subchart runs as a Helm pre-install hook to migrate and seed the database, so
the install fails fast if --database-url is unreachable.

Unlike the data-plane chart, manage-helm is not embedded in the tare binary —
pass --chart-version (fetched from --chart-registry, default registry.tetrate.ai)
or a local --chart-path.

Secrets (--admin-key, --api-key, --api-key-secret, --hmac-key-secret,
--auth-secret, --playground-key, --cron-secret) are rendered only when set;
supply any remainder via a --values overlay.

--deployment-mode saas installs the multi-tenant SaaS management plane: it defaults
--customer to "saas" (the chart derives DEPLOYMENT_PRODUCT and the public,
un-prefixed service domains from customer=="saas") and turns corporate login off.
Enterprise (the default) keeps corporate SSO on and uses per-organization domains.

Examples:
  # Render values without touching the cluster
  tare manage install --customer acme --database-url "$DB_URL" \
    --chart-version v0.1.0 --print-helm-values

  # SaaS management plane (--customer defaults to "saas", corporate login off)
  tare manage install --deployment-mode saas \
    --database-url "$DB_URL" \
    --corporate-admin-email admin@tetrate.io --corporate-email-domains tetrate.io \
    --gcp-project-id my-project --secret-manager-type valet --enable-archival \
    --chart-version v0.1.0

  # Install from an OCI chart version into tars-release-acme
  tare manage install --customer acme \
    --database-url "postgres://user:pass@db:5432/fraser?sslmode=disable" \
    --image-registry gcr.io/acme --image-tag v1.2.3 \
    --serve-url https://proxy.acme.example.com \
    --chart-version v0.1.0

Usage:
  tare manage install [flags]

Flags:
      --admin-key string                    global.adminKey.
      --api-image-repository string         Override api.image.repository (e.g. "valet") so --image-registry does not double-prefix the api image.
      --api-key string                      global.apiKey.
      --api-key-secret string               global.apiKeySecret.
      --app-image-repository string         Override app.image.repository (e.g. "app") for mirrored registries.
      --auth-image-repository string        Override auth.image.repository (e.g. "auth") for mirrored registries.
      --auth-secret string                  global.auth.secret.
      --chart-no-cache                      Bypass the ~/.tare/charts cache when fetching --chart-version.
      --chart-path string                   Local path or oci:// reference to the manage-helm chart. Overrides --chart-version.
      --chart-registry string               OCI registry for --chart-version (default: registry.tetrate.ai, or --image-registry when set).
      --chart-version string                manage-helm chart version to fetch from --chart-registry. Required unless --chart-path is a local path.
      --corporate-admin-email string        global.corporate.adminEmail (chart-mandated). Required.
      --corporate-email-domains string      global.corporate.emailDomains, comma-separated (chart-mandated). Required.
      --corporate-login-enabled             global.corporateLoginEnabled: corporate SSO gate. Default true (enterprise); --deployment-mode saas turns it off. (default true)
      --cron-secret string                  global.cronSecret (OAuth-refresh CronJob auth).
      --customer string                     Organization (customer) identifier (drives namespace names and service domains). Required (defaults to "saas" with --deployment-mode saas).
      --dashboard-image-repository string   Override dashboard.image.repository (e.g. "dashboard") for mirrored registries.
      --database-url string                 PostgreSQL connection string for the management plane. Required.
      --deployment-mode string              Deployment mode: enterprise or saas. saas defaults --customer to "saas" (the chart derives DEPLOYMENT_PRODUCT + public domains from customer=="saas") and turns corporate login off. (default "enterprise")
      --enable-archival                     Enable the request-log archival CronJob (archival.enabled; SaaS-only, needs a GCS bucket + workload identity via --values).
      --environment string                  Deployment environment (empty = production); selects the service-domain suffix.
      --gcp-project-id string               global.gcpProjectId (archival/usage-rollup + secret-manager valet).
      --hmac-key-secret string              global.hmacKeySecret.
      --image-registry string               Registry for management-plane images (global.imageRegistry).
      --image-tag string                    Tag for management-plane images (global.imageTag; also applied to auth/dashboard tags).
      --namespace string                    Helm release namespace (default: tars-release-{customer}).
      --no-bootstrap                        Disable the bootstrapper subchart (skip DB migrate + seed). The DB must already be migrated.
      --no-wait                             Return after Helm finishes; do not wait for resources to become ready (overrides --wait).
      --playground-key string               global.playgroundKey.
      --print-helm-values                   Print the generated values and exit without touching the cluster.
      --release-name string                 Helm release name (default: tars-{customer}).
      --secret-manager-type string          global.env.common.SECRET_MANAGER_TYPE. Default "none" (keys passed as plaintext flags); set to "valet" only when keys are secret-manager refs. (default "none")
      --serve-url string                    Data plane URL (global.serveUrl). Optional; chart computes proxy.{customer}.… when empty.
      --timeout string                      Timeout for --wait and the bootstrapper hook. (default "10m")
      --values string                       Extra Helm values file merged after the generated values (-f).
      --wait                                Wait for all release resources to become ready (helm --wait; default true; use --no-wait to disable). (default true)

Global Flags:
  -q, --quiet     Suppress progress output; only errors and the final summary go to stderr
  -v, --verbose   Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr