Data plane installation
The data plane (the Controller and the Agent Router) is installed into a Kubernetes cluster and connected to the management plane. The tooling comes first, then the target: the same release installs through the tare CLI, through plain Helm with no CLI on the cluster path, or through a GitOps pipeline that applies rendered manifests.
Choose the install path
Three paths install the same data plane; they differ in what drives the cluster.
| Path | Fits | Guide |
|---|---|---|
| tare CLI | A managed cloud cluster (AKS, EKS, GKE) and an operator who can run a vendor binary. The CLI carries the chart, runs the preflight checks, and applies directly. | The cloud guides below |
| Helm, no CLI | A cluster where only Helm and a private registry are allowed. The chart is pulled as an OCI artifact and the release lifecycle is owned by the platform team. | Helm installation guide |
| GitOps | Flux, Argo CD, or any pipeline that reconciles committed manifests. The manifests tare install would apply are rendered for review and committed; since 0.3.0 the CRDs ship as their own chart (dataplane-crds-helm) so they can sync as a separate Application, and tare install --post-renderer covers clusters that need manifest rewrites. | Retrieve data plane resources |
A self-managed cluster (k3s, kubeadm, OpenShift) is not a fourth path: it is the Helm or GitOps path plus generic gateway exposure instead of a cloud load balancer.
Prerequisites
Every guide assumes three things are already in place:
- The prerequisites confirmed: access, accounts, cloud quotas, and network rules.
- Management plane onboarding complete through Step 5, which produces the data plane credential (
service-account.json). Once the data plane is running, that credential is rotated and revoked through the procedures in Data plane credentials. - A provisioned Kubernetes cluster meeting the Kubernetes version requirement. Cluster provisioning is not covered by Tetrate support.
The supported self-hosted model today is a dedicated cluster for Agent Router. The data plane and the gateway run in a Kubernetes cluster reserved for Agent Router, not alongside other application workloads. Every guide below assumes that shape.
Select a guide by target
Azure using tare CLI
Azure Kubernetes Service (AKS) using the tare CLI, the recommended AKS path where the CLI is available.
Azure installation guide →Azure using Helm
AKS using Helm, for environments that require a private container registry such as Azure Container Registry.
Azure Helm guide →AWS using tare CLI
Amazon Elastic Kubernetes Service (EKS) using the tare CLI.
AWS installation guide →GCP using tare CLI
Google Kubernetes Engine (GKE) using the tare CLI.
GCP installation guide →Helm (cloud-agnostic)
Any Kubernetes cluster, for platform teams that own the Helm release lifecycle and maintain a private container registry (Harbor, JFrog Artifactory, Nexus, or Google Artifact Registry).
Helm installation guide →Companion workflow
Where to go next