# `azure-gateway.json` schema (`tare gateway install --type azure`)

> Reference for the azure-gateway.json config file consumed by tare gateway install --type azure through the --config flag.

# `azure-gateway.json` schema (`tare gateway install --type azure`)

  The JSON config file accepted by <Link to="/reference/tare-cli/install-gateway"><code>tare gateway install --type azure</code></Link>, consumed through the <code>--config</code> flag.

This document describes the JSON config file accepted by:

```bash
tare gateway install identity.json --type azure --config azure-gateway.json
```

The Azure path covers AKS clusters on traditional Azure CNI. The install
enables the AGIC ingress-appgw addon (which provisions an Application
Gateway in the cluster's `MC_<rg>_<cluster>_<region>` resource group) and
applies an Ingress in `tars-dataplane` with AGIC's required health-probe
annotations. See [`tare gateway install`](./install-gateway.mdx) for the
end-to-end flow.

> **Tip:** Use [`tare gateway config init --type azure`](./gateway-config-init.mdx)
> to bootstrap a starter file from prompts or flags. The remaining
> fields documented below are pre-filled with resolver defaults that you
> can edit in place.

## Supported keys

All keys are optional at the JSON level. Required-ness is enforced at
install time by the resolver and the Azure pre-flight.

| Key | Type | Used for | Required when |
|---|---|---|---|
| `customer` | string | Identifies the customer in the management plane | unless provided by identity / `--customer` |
| `environment` | string | Optional environment label | required when customer is `saas` |
| `serveDomain` | string | DNS host the customer points at the AGIC frontend IP | optional but recommended (drives the DNS hint output) |
| `serveUrl` | string | Public URL the data plane reports to the MP | optional (falls back to identity fields) |
| `azure.subscriptionId` | string | Azure subscription scoping every `az` call | required for `--apply-prereqs` and the AGIC compat pre-flight |
| `azure.resourceGroup` | string | Resource group holding the AKS cluster | required for `--apply-prereqs` and the AGIC compat pre-flight |
| `azure.aksClusterName` | string | AKS cluster name | required for `--apply-prereqs` and the AGIC compat pre-flight |
| `azure.appGateway.name` | string | Application Gateway name AGIC creates | optional (default: `<aksClusterName>-appgw`) |
| `azure.appGateway.subnetCidr` | string | Address range for the App Gateway subnet | optional (default: `10.225.0.0/24`) |
| `azure.skipExisting` | bool | Continue when `az aks enable-addons` reports "already enabled" | optional (`false` default) |
| `namespaces.dataplane` | string | Dataplane namespace the Ingress lives in | optional (default `tars-dataplane`) |
| `lint` | object | Per-config rule overrides (shared with the GCP schema) | optional |

## Example

```json
{
  "customer": "acme",
  "serveDomain": "proxy.acme.tetrate.ai",
  "serveUrl": "https://proxy.acme.tetrate.ai",
  "azure": {
    "subscriptionId": "00000000-0000-0000-0000-000000000000",
    "resourceGroup": "acme-aks-rg",
    "aksClusterName": "acme-aks",
    "appGateway": {
      "name": "acme-aks-appgw",
      "subnetCidr": "10.225.0.0/24"
    },
    "skipExisting": true
  }
}
```

## Field precedence

For most values, precedence is:

1. explicit CLI flag (`--azure-subscription-id`, `--azure-resource-group`,
   `--aks-cluster-name`, `--appgw-name`, `--appgw-subnet-cidr`)
2. `azure-gateway.json` (`--config`)
3. resolver defaults (`<aksClusterName>-appgw`, `10.225.0.0/24`)

## Why no `staticIpName` / `certificateMap` / `dnsAuthorization`?

These are GCP-specific concepts. On Azure:

- **Static IP**: AGIC auto-provisions the Application Gateway's frontend
  IP. No name to pin; customer DNS is updated to the dynamically-assigned
  address surfaced in the Ingress status.
- **Certificate map / managed certificates**: The runbook AGIC path is
  HTTP-only on port 80 by default. HTTPS termination via AGIC listener
  TLS is configured separately and is not in scope of this config.
- **DNS authorization**: GCP cert-manager mechanic; no equivalent.

## Minimal config (with `--apply-prereqs`)

```json
{
  "customer": "acme",
  "serveDomain": "proxy.acme.tetrate.ai",
  "azure": {
    "subscriptionId": "00000000-0000-0000-0000-000000000000",
    "resourceGroup": "acme-aks-rg",
    "aksClusterName": "acme-aks"
  }
}
```

Then run:

```bash
tare gateway install identity.json \
  --type azure \
  --config azure-gateway.json \
  --apply-prereqs --wait
```

## Cluster compatibility

`tare gateway install --type azure` requires AGIC-compatible AKS networking:

```bash
az aks show -n <cluster> -g <rg> \
  --query 'networkProfile.{plugin: networkPlugin, mode: networkPluginMode, dataplane: networkDataplane}'
```

The compatible combination is `{plugin: "azure", mode: null, dataplane: "azure"}`.
Anything else (mode `overlay`, dataplane `cilium`) is rejected by the
pre-flight. AGC (Application Gateway for Containers) is the path for
those clusters; `tare` support for it is planned.

## Required Azure roles

The signed-in identity needs:

- `Azure Kubernetes Service Contributor Role` on the AKS resource group:
  for `az aks enable-addons`
- `Network Contributor` on the cluster's `MC_<rg>_<cluster>_<region>`
  node-RG: for AGIC to manage the Application Gateway

`tare gateway install --type azure` checks these and prints the exact
`az role assignment create` commands when a role is missing. When the
signed-in identity cannot read its own role assignments (Forbidden), the
pre-flight degrades gracefully: prints what's required, proceeds, and
lets `az aks enable-addons` surface AuthorizationFailed if applicable.

Where to go next

  <Link to="/reference/tare-cli/install-gateway" className="tare-nav-card">
    tare gateway install
    Consume this config to enable AGIC and deploy the Azure gateway.
  </Link>
  <Link to="/reference/tare-cli/gcp-gateway-config" className="tare-nav-card">
    gcp-gateway.json schema
    The equivalent config file for the GCP gateway flow.
  </Link>