tetrate/agentrouter/dataplane/ingress/install
tetrate agentrouter dataplane ingress install
Install ingress exposure for the data plane. Provider selection
via --type (gcp|azure|aws).
GCP (--type gcp):
Installs the Gateway Helm chart. Prerequisites (must be prepared or
applied via --apply-prereqs before the chart install):
1. Wildcard DNS is created and points to the Gateway static IP
2. TLS certificate and certificate map are provisioned and ready
3. Gateway static IP and related cloud policies are prepared
--apply-prereqs runs the equivalent gcloud commands automatically.
Azure (--type azure):
Covers AKS clusters on traditional Azure CNI. Enables the AGIC addon
(provisioning an Application Gateway, ~5min) and applies an Ingress
with the required AGIC health-probe annotations to tars-dataplane.
Pre-flights:
- AKS networkProfile is AGIC-compatible (plugin=azure, mode=null,
dataplane=azure). Fails fast otherwise.
- The signed-in identity has the required Azure roles (AKS Service
Contributor on the AKS RG, Network Contributor on the MC_ node-RG).
Prints the exact az-role-assignment-create commands when a role is
missing; degrades gracefully when role-list read is denied.
- The current kubeconfig can create Ingress in tars-dataplane.
AGC (Cilium/Overlay clusters) is a separate path tracked as a follow-up
to fraser#3687.
AWS (--type aws):
Exposes the data plane's egress as a Network Load Balancer by setting
envoyService.type=LoadBalancer plus the in-tree EKS cloud provider's
service.beta.kubernetes.io/aws-load-balancer-type=nlb annotation on the
egress EnvoyProxy (no AWS Load Balancer Controller, no aws CLI). The egress
Service is Envoy-Gateway-managed, so driving the LB through the EnvoyProxy
keeps the NLB across EG restarts and tetrate upgrades (a direct Service patch
reverts to ClusterIP on the next reconcile). --aws-internal provisions an
internal NLB. Ingress only — credential-less upstream identity is a
separate step (fraser#4813 IRSA, fraser#4816 Pod Identity).
TLS passthrough at the load balancer (--lb-tls-passthrough, with any --type):
Installs egress-lb, an L4 LoadBalancer Service that passes TCP/443
through to the egress Envoy. TLS is terminated at Envoy (the listeners
are mode Terminate), for the hostnames in serve's
egress.gateway.httpsListeners. It goes in its own Helm release
(tars-egress-lb) and replaces none of the cloud's existing path above,
which keeps serving until DNS moves. --type selects the cloud's
defaults, kept in the chart: an internal L4 load balancer with
externalTrafficPolicy Local. Values passed with --helm-values replace
those defaults rather than merging with them.
Examples:
# Print generated values from config
tetrate agentrouter dataplane ingress install identity.json --type gcp --config gcp-gateway.json --print-helm-values
# Preview prerequisite gcloud commands
tetrate agentrouter dataplane ingress install identity.json --type gcp --config gcp-gateway.json --dry-run-prereqs
# Apply prerequisites then install
tetrate agentrouter dataplane ingress install identity.json --type gcp --config gcp-gateway.json --apply-prereqs
# Wait until Gateway reports an address
tetrate agentrouter dataplane ingress install identity.json --type gcp --config gcp-gateway.json --wait
# Azure: dry-run the AGIC enable-addons + Ingress apply
tetrate agentrouter dataplane ingress install identity.json --type azure --config azure-gateway.json --dry-run-prereqs
# Azure: apply prerequisites then install, waiting for the Ingress address
tetrate agentrouter dataplane ingress install identity.json --type azure --config azure-gateway.json --apply-prereqs --wait
# AWS: expose the egress Service as an NLB and wait for the hostname
tetrate agentrouter dataplane ingress install identity.json --type aws --wait
# AWS: provision an internal NLB
tetrate agentrouter dataplane ingress install identity.json --type aws --aws-internal --wait
# Publish the HTTPS listeners through egress-lb, an internal L4 load
# balancer that passes TLS through to Envoy
tetrate agentrouter dataplane ingress install identity.json --type aws --lb-tls-passthrough --wait
# Replace egress-lb's defaults, e.g. an internet-facing LB
tetrate agentrouter dataplane ingress install identity.json --type azure --lb-tls-passthrough --helm-values egress-lb.yaml --wait
Safe to re-run: yes, with conditions -- safe for --type aws, which makes a
single idempotent EnvoyProxy patch, and for gcp or azure with --ack-prereqs.
With --apply-prereqs a re-run fails on the cloud resources the first run
already created, unless gcloud.skipExisting (or azure.skipExisting) is true
in --config; re-run with --ack-prereqs instead.
Usage:
tetrate agentrouter dataplane ingress install <identity-file> [flags]
Flags:
Main:
--ack-prereqs Confirm wildcard DNS/cert map/static IP prerequisites are already handled
--apply-prereqs Apply supported GCP prerequisites using gcloud before install
--certificate-map-name string GCP certificate map name (recommended)
--certificate-name string Certificate resource name used for cert-map entry automation
--config string Path to gcp-gateway.json configuration file
--dns-authorization-name string DNS authorization name for managed certificate workflow
--dry-run-prereqs Print prerequisite gcloud commands and continue
--project-id string GCP project ID for prerequisite automation
--security-policy string Optional GCP security policy name
--serve-domain string Serve wildcard domain used by prerequisite workflow
--serve-url string Data plane host (default: cfg.serveUrl, then cfg.serveDomain)
--static-ip-name string GCP static IP name (recommended)
--type string Gateway provider type: gcp, azure, or aws (default "gcp")
--wait Wait for Gateway to report an address after deploy
Azure:
--aks-cluster-name string AKS cluster name (or set azure.aksClusterName in --config)
--appgw-name string Application Gateway name AGIC creates (default: <aks-cluster-name>-appgw)
--appgw-subnet-cidr string App Gateway subnet CIDR (default: 10.225.0.0/24)
--azure-resource-group string Azure resource group containing the AKS cluster (or set azure.resourceGroup in --config)
--azure-subscription-id string Azure subscription ID (or set azure.subscriptionId in --config)
AWS:
--aws-envoyproxy string Egress EnvoyProxy resource to drive the NLB through (default "tars-egress-proxy")
--aws-internal Provision an internal NLB (adds the aws-load-balancer-internal annotation)
--aws-service string Egress Service Envoy Gateway exposes as an NLB (default "egress")
LB TLS passthrough:
--lb-tls-passthrough Install egress-lb, an L4 load balancer that passes TCP/443 through to the egress Envoy, which terminates TLS for the hostnames in serve's egress.gateway.httpsListeners
Plan:
--accept-warnings Proceed even when lint warnings are present (errors still block)
--output string Plan output format: text or json (default "text")
--plan-only Render the install Plan and exit without applying changes
-y, --yes Skip the confirmation prompt; required when there is no terminal to prompt on
Inspect:
--print-helm-values Print generated Helm values to stdout without deploying
--print-resources Print all Kubernetes resource manifests via helm template to stdout without applying
Other:
--context string kubeconfig context to act on (default: the current context)
--customer string Organization (customer) label (default: inferred from identity file)
--environment string Environment label (required when --customer is saas)
--kubeconfig string Path to the kubeconfig file (default: $KUBECONFIG, then ~/.kube/config)