Skip to main content

Retrieve Agent Router data plane Kubernetes resources for review or GitOps

This guide renders the Kubernetes resources that tare install would deploy, without applying them to a cluster. Use this workflow to review the manifest, run a server-side dry run, or commit the rendered YAML to a GitOps repository before deployment.

Prerequisites​

  • A data plane credential file from the dashboard, saved locally as data-plane-credentials.json.
  • The tare CLI installed and available on PATH.
  • helm and kubectl available locally. Recent tare releases can download their own tool bundle, but most enterprise workstations manage these tools directly.

Install the CLI if needed:

curl -sSL https://tare.tetrate.ai/tools/install.sh | bash
export PATH="$PATH:$HOME/.tare/bin"
tare --version

The sections below describe two different options for retrieving the resource definitions:

  • Option 1, Rendering the manifest as a single file (YAML format)
  • Option 2, Rendering the manifest using an Artifact Registry

Option 1: render the manifest​

Run tare install with --print-resources:

tare install ./data-plane-credentials.json --print-resources > tare-data-plane.yaml

The command writes the rendered Kubernetes YAML to stdout. Progress and preflight messages go to stderr, so redirecting stdout produces a clean manifest file.

The rendered file contains the same Kubernetes resources tare install would deploy through Helm: namespaces, CRDs, service accounts, RBAC, secrets, config maps, services, deployments, autoscaling resources, gateway resources, and install jobs.

When several data planes share one cluster, add --post-renderer <executable> (0.3.0 and later) to pipe the rendered manifest through an executable before it is applied, which is the place to give the chart's fixedly named cluster-scoped RBAC objects distinct names. The same executable applies to --print-resources, so the rendered file matches what an install would apply. See Post-renderer in the tare install reference.

tip

The gateway URL can be set later from the dashboard after the gateway and DNS are ready:

  • Log in the Admin Console.
  • Navigate to System → Settings
  • Select tab Data planes.
  • Click the Edit action icon.
  • Locate item URL.
  • Update the URL.
  • Click button Save changes.

Option 2: render with an artifact registry​

When the cluster pulls from a mirrored registry, set the image registry in the rendered Helm values:

tare install ./data-plane-credentials.json \
  --image-registry us-central1-docker.pkg.dev/acme-prod/tare \
  --print-resources > tare-data-plane.yaml

When the registry requires an image pull secret that already exists in the target namespaces, reference it:

tare install ./data-plane-credentials.json \
  --image-registry us-central1-docker.pkg.dev/acme-prod/tare \
  --image-pull-secret-name tare-registry-pull \
  --print-resources > tare-data-plane.yaml

To render the pull-secret object from credentials on stdin:

printf '%s\n' 'user:password' | tare install ./data-plane-credentials.json \
  --image-registry us-central1-docker.pkg.dev/acme-prod/tare \
  --image-pull-secret-stdin \
  --print-resources > tare-data-plane.yaml
Proxy configuration never prompts in a pipeline

The tare install proxy wizard runs only on an interactive terminal. In CI, in pipes, and whenever stdin was consumed by --image-pull-secret-stdin, it is skipped silently, so a rendered manifest carries no proxy configuration unless the flags say otherwise. Where outbound traffic must leave through a corporate proxy, pass --http-proxy, --https-proxy, --no-proxy, and the forward-proxy flags explicitly; see Route outbound traffic through a corporate proxy.

Validate before applying​

Run a server-side dry run against the target cluster:

kubectl apply --dry-run=server -f tare-data-plane.yaml

Apply once the manifest has been reviewed:

kubectl apply -f tare-data-plane.yaml

For GitOps, commit tare-data-plane.yaml to the repository managed by Argo CD, Flux, or the internal deployment system instead of applying it directly.

Common issues​

Error message: tare: command not found​

The installer places the binary in ~/.tare/bin by default. Add it to PATH:

export PATH="$PATH:$HOME/.tare/bin"

Error message: unknown command "cli" for "tare"​

Use tare install, not tare cli:

tare install ./data-plane-credentials.json --print-resources

If an older CLI requires a URL, upgrade tare first. When an immediate upgrade is not possible, --serve-url can be included to satisfy the older CLI for rendering only:

tare install ./data-plane-credentials.json \
  --serve-url https://proxy.acme.example.com \
  --print-resources

Error message: Missing serve URL​

Upgrade tare and retry. Current releases allow --print-resources without a data plane Proxy URL:

curl -sSL https://tare.tetrate.ai/tools/install.sh | bash
tare install ./data-plane-credentials.json --print-resources

When an immediate upgrade is not possible, pass a valid planned public hostname:

tare install ./data-plane-credentials.json \
  --serve-url https://proxy.acme.example.com \
  --print-resources

The hostname does not need to resolve while rendering. After the gateway and DNS are live, set or update the gateway URL in the dashboard.

Never carry --serve-url into a live install

Registering the gateway URL is a management-plane action, and the registration API refuses a data-plane service account. On an older CLI, a live tare install run with --serve-url fails at the Register data plane URL step, before Helm runs, with permission_denied: insufficient permissions: requires scopes [dataplane_operator]; on 0.3.0 and later the flag is deprecated and ignored. The workaround above is for rendering manifests only. See the error reference.

Where to go next

Data plane installation

Apply the rendered resources by running a full data plane installation on AWS, Azure, or GCP.

Gateway installation

Install the gateway components that manage inbound access to the data plane.