azure-gateway.json schema (tare gateway install --type azure)

The JSON config file accepted by tare gateway install --type azure, consumed through the --config flag.

---

Example invocation:

tare gateway install identity.json --type azure --config azure-gateway.json

The Azure path covers AKS clusters on traditional Azure CNI. The install enables the AGIC ingress-appgw addon (which provisions an Application Gateway in the cluster's MC_<rg>_<cluster>_<region> resource group) and applies an Ingress in tars-dataplane with AGIC's required health-probe annotations. See tare gateway install for the end-to-end flow.

tip

Use tare gateway config init --type azure to bootstrap a starter file from prompts or flags. The remaining fields documented below are pre-filled with resolver defaults that can be edited in place.

Supported keys

All keys are optional at the JSON level. Required-ness is enforced at install time by the resolver and the Azure preflight.

Key	Type	Used for	Required when
customer	string	Identifies the customer in the management plane	unless provided by identity / --customer
environment	string	Optional environment label	required when customer is saas
serveDomain	string	DNS host the customer points at the AGIC frontend IP	optional but recommended (drives the DNS hint output)
serveUrl	string	Public URL the data plane reports to the management plane	optional (falls back to identity fields)
azure.subscriptionId	string	Azure subscription scoping every az call	required for --apply-prereqs and the AGIC compatibility preflight
azure.resourceGroup	string	Resource group holding the AKS cluster	required for --apply-prereqs and the AGIC compatibility preflight
azure.aksClusterName	string	AKS cluster name	required for --apply-prereqs and the AGIC compatibility preflight
azure.appGateway.name	string	Application Gateway name AGIC creates	optional (default: <aksClusterName>-appgw)
azure.appGateway.subnetCidr	string	Address range for the App Gateway subnet	optional (default: 10.225.0.0/24)
azure.skipExisting	bool	Continue when az aks enable-addons reports "already enabled"	optional (false default)
namespaces.dataplane	string	Dataplane namespace the Ingress lives in	optional (default tars-dataplane)
lint	object	Per-config rule overrides (shared with the GCP schema)	optional

Example

{
  "customer": "acme",
  "serveDomain": "proxy.acme.tetrate.ai",
  "serveUrl": "https://proxy.acme.tetrate.ai",
  "azure": {
    "subscriptionId": "00000000-0000-0000-0000-000000000000",
    "resourceGroup": "acme-aks-rg",
    "aksClusterName": "acme-aks",
    "appGateway": {
      "name": "acme-aks-appgw",
      "subnetCidr": "10.225.0.0/24"
    },
    "skipExisting": true
  }
}

Field precedence

For most values, precedence is:

1. explicit CLI flag (--azure-subscription-id, --azure-resource-group, --aks-cluster-name, --appgw-name, --appgw-subnet-cidr)
2. azure-gateway.json (--config)
3. resolver defaults (<aksClusterName>-appgw, 10.225.0.0/24)

Why no staticIpName / certificateMap / dnsAuthorization?

These are GCP-specific concepts. On Azure:

• Static IP: AGIC auto-provisions the Application Gateway's frontend IP. No name to pin; customer DNS is updated to the dynamically-assigned address surfaced in the Ingress status.
• Certificate map / managed certificates: The runbook AGIC path is HTTP-only on port 80 by default. HTTPS termination via AGIC listener TLS is configured separately and is not in scope of this config.
• DNS authorization: a GCP cert-manager mechanism with no Azure equivalent.

Minimal config (with --apply-prereqs)

{
  "customer": "acme",
  "serveDomain": "proxy.acme.tetrate.ai",
  "azure": {
    "subscriptionId": "00000000-0000-0000-0000-000000000000",
    "resourceGroup": "acme-aks-rg",
    "aksClusterName": "acme-aks"
  }
}

Then run:

tare gateway install identity.json \
  --type azure \
  --config azure-gateway.json \
  --apply-prereqs --wait

Cluster compatibility

tare gateway install --type azure requires AGIC-compatible AKS networking:

az aks show -n <cluster> -g <rg> \
  --query 'networkProfile.{plugin: networkPlugin, mode: networkPluginMode, dataplane: networkDataplane}'

The compatible combination is {plugin: "azure", mode: null, dataplane: "azure"}. Anything else (mode overlay, dataplane cilium) is rejected by the preflight. AGC (Application Gateway for Containers) is the path for those clusters; tare support for it is planned.

Required Azure roles

The signed-in identity needs:

• Azure Kubernetes Service Contributor Role on the AKS resource group: for az aks enable-addons
• Network Contributor on the cluster's MC_<rg>_<cluster>_<region> node-RG: for AGIC to manage the Application Gateway

tare gateway install --type azure checks these and prints the exact az role assignment create commands when a role is missing. When the signed-in identity cannot read its own role assignments (Forbidden), the preflight degrades to a warning: it prints what is required, proceeds, and lets az aks enable-addons surface AuthorizationFailed if applicable.

---

Where to go next

tare gateway install

Consume this config to enable AGIC and deploy the Azure gateway.

gcp-gateway.json schema

The equivalent config file for the GCP gateway flow.