Install the serve gateway for ingress exposure. Provider selection
via --type (gcp|azure|aws).
GCP (--type gcp):
Installs the gateway Helm chart. Prerequisites (must be prepared or
applied via --apply-prereqs before the chart install):
1. Wildcard DNS is created and points to the gateway static IP
2. TLS certificate and certificate map are provisioned and ready
3. Gateway static IP and related cloud policies are prepared
--apply-prereqs runs the equivalent gcloud commands automatically.
Azure (--type azure):
Covers AKS clusters on traditional Azure CNI. Enables the AGIC addon
(provisioning an Application Gateway, ~5min) and applies an Ingress
with the required AGIC health-probe annotations to tars-dataplane.
Pre-flights:
- AKS networkProfile is AGIC-compatible (plugin=azure, mode=null,
dataplane=azure). Fails fast otherwise.
- The signed-in identity has the required Azure roles (AKS Service
Contributor on the AKS RG, Network Contributor on the MC_ node-RG).
Prints the exact az-role-assignment-create commands when a role is
missing; degrades gracefully when role-list read is denied.
- The current kubeconfig can create Ingress in tars-dataplane.
AGC (Cilium/Overlay clusters) is a separate path; support is planned.
AWS (--type aws):
Exposes the data plane's egress as a Network Load Balancer by setting
envoyService.type=LoadBalancer plus the in-tree EKS cloud provider's
service.beta.kubernetes.io/aws-load-balancer-type=nlb annotation on the
egress EnvoyProxy (no AWS Load Balancer Controller, no aws CLI). The egress
Service is Envoy-Gateway-managed, so driving the LB through the EnvoyProxy
keeps the NLB across EG restarts and tare upgrades (a direct Service patch
reverts to ClusterIP on the next reconcile). --aws-internal provisions an
internal NLB. Ingress only — credential-less upstream identity is a
separate step (IRSA or EKS Pod Identity).
Examples:
# Print generated values from config
tare gateway install identity.json --type gcp --config gcp-gateway.json --print-helm-values
# Preview prerequisite gcloud commands
tare gateway install identity.json --type gcp --config gcp-gateway.json --dry-run-prereqs
# Apply prerequisites then install
tare gateway install identity.json --type gcp --config gcp-gateway.json --apply-prereqs
# Wait until Gateway reports an address
tare gateway install identity.json --type gcp --config gcp-gateway.json --wait
# Azure: dry-run the AGIC enable-addons + Ingress apply
tare gateway install identity.json --type azure --config azure-gateway.json --dry-run-prereqs
# Azure: apply prerequisites then install, waiting for the Ingress address
tare gateway install identity.json --type azure --config azure-gateway.json --apply-prereqs --wait
# AWS: expose the egress Service as an NLB and wait for the hostname
tare gateway install identity.json --type aws --wait
# AWS: provision an internal NLB
tare gateway install identity.json --type aws --aws-internal --wait
Usage:
tare gateway install <identity-file> [flags]
Flags:
Main:
--ack-prereqs Confirm wildcard DNS/cert map/static IP prerequisites are already handled
--apply-prereqs Apply supported GCP prerequisites using gcloud before install
--certificate-map-name string GCP certificate map name (recommended)
--certificate-name string Certificate resource name used for cert-map entry automation
--config string Path to gcp-gateway.json configuration file
--dns-authorization-name string DNS authorization name for managed certificate workflow
--dry-run-prereqs Print prerequisite gcloud commands and continue
--project-id string GCP project ID for prerequisite automation
--security-policy string Optional GCP security policy name
--serve-domain string Serve wildcard domain used by prerequisite workflow
--serve-url string Gateway host (default: cfg.serveUrl, then cfg.serveDomain)
--static-ip-name string GCP static IP name (recommended)
--type string Gateway provider type: gcp, azure, or aws (default "gcp")
--wait Wait for Gateway to report an address after deploy
Azure:
--aks-cluster-name string AKS cluster name (or set azure.aksClusterName in --config)
--appgw-name string Application Gateway name AGIC creates (default: <aks-cluster-name>-appgw)
--appgw-subnet-cidr string App Gateway subnet CIDR (default: 10.225.0.0/24)
--azure-resource-group string Azure resource group containing the AKS cluster (or set azure.resourceGroup in --config)
--azure-subscription-id string Azure subscription ID (or set azure.subscriptionId in --config)
AWS:
--aws-envoyproxy string Egress EnvoyProxy resource to drive the NLB through (default "tars-egress-proxy")
--aws-internal Provision an internal NLB (adds the aws-load-balancer-internal annotation)
--aws-service string Egress Service Envoy Gateway exposes as an NLB (default "egress")
Plan:
--accept-warnings Proceed even when lint warnings are present (errors still block)
--output string Plan output format: text or json (default "text")
--plan-only Render the install Plan and exit without applying changes
--yes Skip the interactive Proceed? prompt; required in non-TTY contexts
Inspect:
--print-helm-values Print generated Helm values to stdout without deploying
--print-resources Print all Kubernetes resource manifests via helm template to stdout without applying
Other:
--customer string Customer label (default: inferred from identity file)
--environment string Environment label (required when customer is saas)