Skip to main content
logoTetrate Patch ServiceVersion: alpha

Upgrades with Terraform

This page finishes connecting your repository when a pipeline runs Terraform from it. You change each helm_release that installs a Tetrate product, and install the agent from the repository. The setup guide in the console shows the exact lines for your account; this page explains them.

With Terraform, a merged upgrade reaches your clusters when your pipeline next runs terraform apply, as any other change to the repository does.

Step 1: Change Each Product's helm_release​

Merge these lines into the helm_release that installs the product, here Tetrate Enterprise Gateway in the default environment. ${path.root} is your root module: adjust the paths so they reach the repository's .tetrate/ directory.

resource "helm_release" "teg" {
  # ...
  chart   = "oci://docker.io/tetrate/teg-envoy-gateway-helm"
  version = jsondecode(file("${path.root}/.tetrate/teg/envs/default/chart-version.json")).chart_version

  values = [
    # ...your own values, then the labels and the versions, last:
    yamlencode(merge({ commonLabels = local.labels }, { "gateway-helm" = { commonLabels = local.labels } })),
    file("${path.root}/.tetrate/teg/envs/default/values-versions.yaml"),
  ]
}

locals {
  labels = {
    "patch.tetrate.io/product"     = "teg"
    "patch.tetrate.io/environment" = "default"
  }
}

What each part does:

  • version is read from chart-version.json, next to the versions file. Upgrades change the version there, so your Terraform code never needs editing.
  • The versions file is the last of values, so its image pins win over any image your own values set.
  • The labels go on the product's workloads through the chart's commonLabels. With no GitOps controller in the cluster, they are how the agent knows which product and environment the workloads belong to.

Step 2: Install the Agent from Your Repository​

The download includes a Terraform module for the agent, in .tetrate/patch-service-agent/envs/default/, so agent upgrades arrive as pull requests too. Use it as a root module, or call it from yours, with the helm provider configured for the cluster as you do today. Its settings, in .tetrate/patch-service-agent/values-customer.yaml, are already filled in for your account. Nothing secret is in either.

  • If the cluster already runs the agent from Connect a cluster, uninstall that copy first, or import it into your Terraform state, since the module installs a release of the same name. The Secret and ConfigMap it uses stay in place:

    helm uninstall patch-service-agent -n tetrate-dataplane-system

  • The agent's chart is in Tetrate's private registry. When your account pulls with credentials, the module takes them as the pull_credentials variable: the Tetrate Hub username and key that the secrets file from Connect a cluster holds.

Step 3: Check the Result​

Once your pipeline has applied:

  1. In the console's Clusters view, the cluster shows a chip for each product, such as teg · default. Hover over it: it says it was found from the product labels on the workloads.
  2. Run the Tetrate upgrades workflow once from the repository's Actions tab.

Nothing in the cluster records which repository Terraform applied from, so Patch Service upgrades a product found this way whenever your repository's manifest declares it.

Next Steps​