Install the Agent Router management plane (manage-helm umbrella) on an existing cluster.
The management plane needs a reachable PostgreSQL instance: the bootstrapper
subchart runs as a Helm pre-install hook to migrate and seed the database, so
the install fails fast if --database-url is unreachable.
Unlike the data-plane chart, manage-helm is not embedded in the tare binary —
pass --chart-version (fetched from --chart-registry, default registry.tetrate.ai)
or a local --chart-path.
Secrets (--admin-key, --api-key, --api-key-secret, --hmac-key-secret,
--auth-secret, --playground-key, --cron-secret) are rendered only when set;
supply any remainder via a --values overlay.
Before touching the cluster, a KEK preflight checks that the key-encryption
key each tier's --secret-manager-type will read actually resolves in the
target secret store (GCP Secret Manager / AWS Secrets Manager / Azure Key
Vault, as applicable). This exists because the KEK is per-deployment and
never travels with the data: a fresh install against an empty store, or a
cross-cloud move that did not copy the KEK material under the same key name,
fails at first decrypt instead -- possibly long after this command exits.
Pass --skip-preflight to bypass it (not recommended).
--deployment-mode saas installs the multi-tenant SaaS management plane: it defaults
--customer to "saas" (the chart derives DEPLOYMENT_PRODUCT and the public,
un-prefixed service domains from customer=="saas") and turns corporate login off.
Enterprise (the default) keeps corporate SSO on and uses per-organization domains.
Examples:
# Render values without touching the cluster
tare manage install --customer acme --database-url "$DB_URL" \
--chart-version v0.1.0 --print-helm-values
# SaaS management plane (--customer defaults to "saas", corporate login off)
tare manage install --deployment-mode saas \
--database-url "$DB_URL" \
--gcp-project-id my-project --secret-manager-type valet --enable-archival \
--chart-version v0.1.0
# Install from an OCI chart version into tars-release-acme
tare manage install --customer acme \
--database-url "postgres://user:pass@db:5432/fraser?sslmode=disable" \
--image-registry gcr.io/acme --image-tag v1.2.3 \
--serve-url https://proxy.acme.example.com \
--chart-version v0.1.0
Usage:
tare manage install [flags]
Flags:
--admin-key string global.adminKey.
--api-image-repository string Override api.image.repository (e.g. "valet") so --image-registry does not double-prefix the api image.
--api-key string global.apiKey.
--api-key-secret string global.apiKeySecret.
--app-image-repository string Override app.image.repository (e.g. "app") for mirrored registries.
--archival-bucket string archival.env.LOG_ARCHIVAL_BUCKET. A bare name selects GCS (default); s3://bucket or az://account/container select S3/Azure Blob.
--auth-image-repository string Override auth.image.repository (e.g. "auth") for mirrored registries.
--auth-secret string global.auth.secret.
--aws-region string AWS region for the AWS Secrets Manager/KMS backends (api.env.AWS_REGION, app.env.AWS_REGION). Required when --secret-manager-type is aws.
--aws-role-arn string IRSA role ARN (eks.amazonaws.com/role-arn) for the api/app/archival/auth/dashboard/bootstrapper ServiceAccounts. Optional; leave unset to rely on node-level IAM instead of per-pod identity.
--azure-vault-url string Azure Key Vault URL, e.g. https://myvault.vault.azure.net (api.env.AZURE_VAULT_URL, app.env.AZURE_KEY_VAULT_URL). Required when --secret-manager-type is azure.
--azure-workload-identity-client-id string Azure Workload Identity client id (azure.workload.identity/client-id) for the api/app/archival/auth/dashboard/bootstrapper ServiceAccounts. Also labels the api, app and archival pods with azure.workload.identity/use=true, which AKS's mutating webhook requires alongside the annotation before it will inject the federated token. Those three reach an Azure SDK: api via the valet secret store, app via getKMS(), and archival via the blob storage abstraction when its bucket is an az:// URI. auth, dashboard and bootstrapper carry the annotation but make no Azure SDK call today. Optional.
--chart-no-cache Bypass the ~/.tare/charts cache when fetching --chart-version.
--chart-path string Local path or oci:// reference to the manage-helm chart. Overrides --chart-version.
--chart-registry string OCI registry for --chart-version (default: registry.tetrate.ai, or --image-registry when set).
--chart-version string manage-helm chart version to fetch from --chart-registry. Required unless --chart-path is a local path.
--corporate-admin-email string global.corporate.adminEmail (chart-mandated). Required.
--corporate-email-domains string global.corporate.emailDomains, comma-separated (chart-mandated). Required.
--corporate-login-enabled global.corporateLoginEnabled: corporate SSO gate. Default true (enterprise); --deployment-mode saas turns it off. (default true)
--cron-secret string global.cronSecret (OAuth-refresh CronJob auth).
--customer string Organization (customer) identifier (drives namespace names and service domains). Required (defaults to "saas" with --deployment-mode saas).
--dashboard-image-repository string Override dashboard.image.repository (e.g. "dashboard") for mirrored registries.
--database-url string PostgreSQL connection string for the management plane. Required.
--deployment-mode string Deployment mode: enterprise or saas. saas defaults --customer to "saas" (the chart derives DEPLOYMENT_PRODUCT + public domains from customer=="saas") and turns corporate login off. (default "enterprise")
--doctor-uploads-bucket tare doctor api.env.TARE_DOCTOR_UPLOADS_BUCKET for tare doctor bundle uploads. Same scheme convention as --archival-bucket.
--enable-archival Enable the request-log archival CronJob (archival.enabled; SaaS-only, needs a bucket + workload identity -- see --archival-bucket).
--environment string Deployment environment (empty = production); selects the service-domain suffix.
--gcp-project-id string global.gcpProjectId (archival/usage-rollup + secret-manager valet).
--hmac-key-secret string global.hmacKeySecret.
--image-registry string Registry for management-plane images (global.imageRegistry).
--image-tag string Tag for management-plane images (global.imageTag; also applied to auth/dashboard tags).
--mcp-catalog bootstrapper seed --mcp-catalog Seed catalog passed to bootstrapper seed --mcp-catalog when the berglas-bypass command replaces the bootstrapper's default args (GCP-free installs only). Default "data", the chart's own default.
--namespace string Helm release namespace (default: tars-release-{customer}).
--no-bootstrap Disable the bootstrapper subchart (skip DB migrate + seed). The DB must already be migrated.
--no-wait Return after Helm finishes; do not wait for resources to become ready (overrides --wait).
--playground-key string global.playgroundKey.
--print-helm-values Print the generated values and exit without touching the cluster.
--release-name string Helm release name (default: tars-{customer}).
--secret-manager-type string global.env.common.SECRET_MANAGER_TYPE: none, valet, aws, or azure. Default "none" (keys passed as plaintext flags, no cloud secret manager). "valet" resolves keys as secret-manager refs (GCP). "aws"/"azure" additionally select AWS Secrets Manager/KMS or Azure Key Vault for the KMS_TYPE settings below and bypass every subchart's berglas ENTRYPOINT (see NodeKMSType/GCPFree); "none" does the same but with no cloud secret manager at all. (default "none")
--serve-url string Data plane URL (global.serveUrl). Optional; chart computes proxy.{customer}.… when empty.
--skip-preflight Skip the KEK-resolves preflight (also TARE_SKIP_PREFLIGHT=1). A KEK that does not actually resolve in the target secret store fails silently at first decrypt, possibly long after this install completes -- skip only if you have verified it yourself.
--timeout string Timeout for --wait and the bootstrapper hook. (default "10m")
--values string Extra Helm values file merged after the generated values (-f).
--wait Wait for all release resources to become ready (helm --wait; default true; use --no-wait to disable). (default true)
--worm-bucket string api.env.AUDIT_LOG_SEAL_WORM_BUCKET, the external WORM anchor for audit-log seal checkpoints. Same scheme convention as --archival-bucket.
Global Flags:
-q, --quiet Suppress progress output; only errors and the final summary go to stderr
-v, --verbose Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr