Skip to main content

Gateway installation overview

The tare install-gateway command installs and manages the Kubernetes Gateway API resources that expose the Tetrate Agent Router data plane.

Synopsis​

tare install-gateway <identity-file> [flags]

Description​

The tare install-gateway command deploys the gateway Helm chart required to expose Agent Router serve traffic. It manages the lifecycle of the gateway resources, from prerequisite validation to final DNS configuration guidance.

High-level workflow​

  1. Identity loading: Validates and loads the provided <identity-file>.
  2. Configuration merging: Loads the optional gcp-gateway.json via --config and resolves values across flags, config, and identity defaults.
  3. Prerequisite handling: Runs optional prerequisite workflows with --dry-run-prereqs or --apply-prereqs.
  4. Preflight validation: Verifies environment readiness.
  5. Installation: Deploys the Agent Router gateway chart through the embedded Helm engine.
  6. Finalization: Optionally waits for the Gateway address (--wait) and outputs the required DNS A-record actions.

Provider support​

ProviderStatus
Google Cloud Platform (GCP)Fully supported
Azure Kubernetes Service (AKS)Fully supported
Amazon Web Services (AWS)Fully supported
note

The AWS path is ingress-only and takes no config file. Instead of deploying the gateway chart, it exposes the data plane's egress as a Network Load Balancer by patching the egress EnvoyProxy, so no AWS Load Balancer Controller and no aws CLI are required.

TLS on the data plane​

The paths above terminate TLS in front of the data plane: at a Google Cloud load balancer, at an Application Gateway, or upstream of the AWS Network Load Balancer. From 0.8.0 the data plane can terminate TLS itself instead. Each published hostname gets a listener on 443 with its certificate from a Kubernetes Secret, and egress-lb, a layer 4 load balancer, passes 443 through to it on AWS, AKS, and GKE alike. The data plane's in-cluster port is never on the load balancer.

Choose it when the certificates should live in the cluster rather than in a cloud certificate service, or when one setup should work the same on every cloud. See Terminate TLS on the data plane.

Clusters outside AWS, GCP, and Azure​

On a self-managed cluster there is no provider for tare install-gateway to drive, and the gateway is exposed through the cluster's own edge instead, typically an Ingress controller. The full path, including the Service pinning, namespace, and NetworkPolicy details, is in Expose the gateway on a generic cluster.

Where to go next

Gateway installation on GCP

Install the Agent Router gateway in a Google Cloud project using the tare CLI.

Gateway installation on AKS

Install the Agent Router gateway on Azure Kubernetes Service using the tare CLI.

Gateway installation on EKS

Expose the data plane on Amazon EKS as a Network Load Balancer using the tare CLI.

Terminate TLS on the data plane

Publish declared hostnames on 443 with TLS terminated at the data plane, behind a layer 4 load balancer.