Skip to main content
logoTetrate Service BridgeVersion: next

tctl install

tctl install

Generates install manifests and applies it to a cluster

Options

  -h, --help   help for install

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
specified via TCTL_CONFIG env variable. This flag
takes precedence over the env variable.
--debug Print debug messages for all requests and responses
--disable-tctl-version-warn If set, disable the outdated tctl version warning. Can also be
specified via TCTL_DISABLE_VERSION_WARN env variable.
-p, --profile string Use specific profile (default "default")

tctl install cluster-certs

Generate cluster certs for securely communicating with the management plane

tctl install cluster-certs [flags]

Examples


# Retrieve cluster certs
tctl install cluster-certs --cluster <cluster-name>"

Options

      --cluster string           The name of the cluster to generate certs for.
-x, --context string The kube context for the management plane cluster.
-n, --controlplane string The namespace in the cluster that the control plane is installed in. (default "istio-system")
-h, --help help for cluster-certs
-k, --kubeconfig string The kubeconfig file for the management plane cluster. Must be able to manage secrets and cert-manager custom resources.
-m, --managementplane string The namespace that the management plane is installed in. (default "tsb")

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
specified via TCTL_CONFIG env variable. This flag
takes precedence over the env variable.
--debug Print debug messages for all requests and responses
--disable-tctl-version-warn If set, disable the outdated tctl version warning. Can also be
specified via TCTL_DISABLE_VERSION_WARN env variable.
-p, --profile string Use specific profile (default "default")

tctl install cluster-service-account

Generate a cluster service account key for securely communicating with the management plane

tctl install cluster-service-account [flags]

Examples


# Create a cluster service account key
tctl install cluster-service-account --cluster <cluster-name>

Options

      --cluster string   The name of the cluster to generate certs for.
--create-cluster Create a cluster object in Service Bridge if it doesn't exist (default true)
-h, --help help for cluster-service-account

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
specified via TCTL_CONFIG env variable. This flag
takes precedence over the env variable.
--debug Print debug messages for all requests and responses
--disable-tctl-version-warn If set, disable the outdated tctl version warning. Can also be
specified via TCTL_DISABLE_VERSION_WARN env variable.
-p, --profile string Use specific profile (default "default")

tctl install demo

Install a batteries-included Service Bridge into a single Kubernetes cluster.

Synopsis

Install a batteries-included Service Bridge into a single Kubernetes cluster.

The CLI will be automatically preconfigured to connect to the installed Service Bridge as an Administrator. The configuration will be saved in a profile named after the configured Kubernetes context, and the Bridge connection configuration and the user configuration will be named after the Kubernetes cluster where Service Bridge has been installed.

The Kubernetes context to deploy to is read from the environment's configured kubeconfig. See https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/ for more information on kubeconfig.

tctl install demo [flags]

Examples


tctl install demo --registry <registry-location>

Options

      --admin-password string    The password for the superuser. By default a secure password will be auto-generated.
--cluster string The name of the demo cluster. (default "demo")
-h, --help help for demo
-o, --org string The organization to configure (default "tetrate")
-r, --registry string The docker registry with the service bridge images [required]
--set stringArray set values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--set-file stringArray set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2)
--set-string stringArray set STRING values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--timeout duration Timeout to login to the management plane. (default 30s)
-f, --values strings specify values in a YAML file or a URL (can specify multiple)

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
specified via TCTL_CONFIG env variable. This flag
takes precedence over the env variable.
--debug Print debug messages for all requests and responses
--disable-tctl-version-warn If set, disable the outdated tctl version warning. Can also be
specified via TCTL_DISABLE_VERSION_WARN env variable.
-p, --profile string Use specific profile (default "default")

tctl install image-sync

Copy images from Tetrate's registry to another registry

tctl install image-sync [flags]

Examples


# Sync latest images
tctl install image-sync --username <username> --apikey <apikey> --registry <registry-location>

Options

      --accept-eula         Accept the EULA. This should be used in CI/CD pipelines where users have already read and accepted the EULA.
-k, --apikey string Tetrate Container Registry API Key [required]. Can also be
specified via stdin or TCTL_IMAGE_SYNC_APIKEY env variable. This flag
takes precedence over the env variable.
--apikey-stdin Tetrate Container Registry API Key specified from stdin.
Can also be specified via flag or TCTL_IMAGE_SYNC_APIKEY env variable. This takes precedence over
the flag and env variable.
--create-repository If set to false, disable the creation of the ECR repository if it doesn't exists. (default true)
-h, --help help for image-sync
--just-print If set, the image list will be printed to stdout, but images will not be synchronized
--mode string Sync images required for the specified control plane mode. Possible values are: , , control, observe (default "control")
--parallel If set, synchronize images in parallel. Set --parallel=false to synchronize images serially (default true)
--raw DEPRECATED, WILL BE REMOVED IN 1.7. If set, in conjunction with just-print, the output will only contain the image list (default true)
-r, --registry string The user-provided registry where images are pushed [required]
--show-eula Show the EULA.
--skip-demo-images If set to true, don't download demo images like Postgres.
--skip-optional If set to true, don't download optional third-party images like (kubegres or kube-rbac-proxy).
-u, --username string Tetrate Container Registry username [required]. Can also be
specified via TCTL_IMAGE_SYNC_USERNAME env variable. This flag
takes precedence over the env variable.

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
specified via TCTL_CONFIG env variable. This flag
takes precedence over the env variable.
--debug Print debug messages for all requests and responses
--disable-tctl-version-warn If set, disable the outdated tctl version warning. Can also be
specified via TCTL_DISABLE_VERSION_WARN env variable.
-p, --profile string Use specific profile (default "default")

tctl install manifest

Output the Kubernetes manifests for installing Service Bridge to stdout

Options

  -h, --help   help for manifest

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
specified via TCTL_CONFIG env variable. This flag
takes precedence over the env variable.
--debug Print debug messages for all requests and responses
--disable-tctl-version-warn If set, disable the outdated tctl version warning. Can also be
specified via TCTL_DISABLE_VERSION_WARN env variable.
-p, --profile string Use specific profile (default "default")

tctl install manifest cluster-operators

Output the Kubernetes manifests for installing the cluster operators (control plane and data plane) to stdout.

tctl install manifest cluster-operators [flags]

Examples


tctl install manifest cluster-operators --registry <registry-location>

Options

  -n, --controlplane string      The namespace to deploy the control plane and its operator into. (default "istio-system")
-d, --dataplane string The namespace to deploy the data plane and its operator into. (default "istio-gateway")
--exclude-controlplane Don't render the control plane operator.
--exclude-dataplane Don't render the data plane operator.
-h, --help help for cluster-operators
-r, --registry string The docker registry with the service bridge images [required]
--set stringArray set values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--set-file stringArray set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2)
--set-string stringArray set STRING values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
-f, --values strings specify values in a YAML file or a URL (can specify multiple)

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
specified via TCTL_CONFIG env variable. This flag
takes precedence over the env variable.
--debug Print debug messages for all requests and responses
--disable-tctl-version-warn If set, disable the outdated tctl version warning. Can also be
specified via TCTL_DISABLE_VERSION_WARN env variable.
-p, --profile string Use specific profile (default "default")

tctl install manifest control-plane-secrets

Output the Kubernetes manifests for installing the control plane to stdout, including the relevant secrets.

Synopsis

This command provides an easy way to generate correctly formatted secrets for installing the control plane. It should be run as part of installation or upgrade of Service Bridge to ensure the correct secret format for the new version.

Manifests are printed to stdout so that they can be committed to source control or applied directly to a Kubernetes cluster depending on deployment preference.

It automatically generates tokens for the control plane to communicate with the management plane. Therefore, you must be logged into the management plane with the correct permissions to create the tokens. This token generation is safe to run multiple times and does not revoke previously created tokens.

tctl install manifest control-plane-secrets [flags]

Examples


# Output secrets with required flags
tctl install manifest control-plane-secrets \
--cluster-service-account "$(cat cluster-service-account-key.jwk)" \
--cluster demo

# Output secrets with default values for required flags
tctl install manifest control-plane-secrets -y

# Load overlay custom resource from flag
tctl install manifest control-plane -y -f control-cr.yaml

# Load overlay custom resource from stdin
cat control-cr.yaml | tctl install manifest control-plane -y -f-

# Apply directly to Kubernetes
tctl install manifest control-plane-secrets -y | kubectl apply -f-

Options

  -y, --allow-defaults                           Use default values for required fields that aren't provided. DO NOT USE IN PRODUCTION
--cluster string The name of the cluster on which this control plane will be installed [required]. This is what Service Bridge will refer to the cluster as. (default "default")
--cluster-service-account string The cluster service account key JWK used to authenticate with the management plane
--controlplane string The namespace of the control plane (default "istio-system")
--create-cluster Create a cluster object in Service Bridge if it doesn't exist (default true)
--elastic-ca-certificate string The CA certificate to validate Elasticsearch connections when Elasticsearch is configured to present a self-signed certificate.
--elastic-password string The password Service Bridge will use to communicate with Elasticsearch.
--elastic-username string The username Service Bridge will use to communicate with Elasticsearch.
-f, --file string The custom resource file describing the control plane.
-h, --help help for control-plane-secrets
--management-plane-ca-certificate string The CA certificate to validate TSB management plane APIs if the management plane is configured to present a self-signed certificate.
--redis-password string Password for Redis which is used as the backend for the rate limit server in the control plane
--redis-tls Enable TLS between the rate limit Redis client and server.
--redis-tls-ca-cert string The CA certificate to validate the TLS connection between the rate limit Redis client and server.
--redis-tls-client-cert string The client certificate to be used when establishing a mTLS connection between the rate limit Redis client and server.
--redis-tls-client-key string The client key to be used when establishing a mTLS connection between the rate limit Redis client and server.
--xcp-central-ca-bundle string The CA bundle to validate the certificates presented by XCP Central.
--xcp-certs string The kubernetes secret yaml string for the cluster cert used to securely communicate with the management plane. Can be generated from "tctl install cluster-certs".

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
specified via TCTL_CONFIG env variable. This flag
takes precedence over the env variable.
--debug Print debug messages for all requests and responses
--disable-tctl-version-warn If set, disable the outdated tctl version warning. Can also be
specified via TCTL_DISABLE_VERSION_WARN env variable.
-p, --profile string Use specific profile (default "default")

tctl install manifest management-plane-operator

Output the Kubernetes manifests for installing the management plane operator to stdout.

tctl install manifest management-plane-operator [flags]

Examples


tctl install manifest management-plane-operator --registry <registry-location>

Options

  -h, --help                     help for management-plane-operator
-m, --managementplane string The namespace to deploy the management plane and its operator into. (default "tsb")
-r, --registry string The docker registry with the service bridge images [required]
--set stringArray set values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--set-file stringArray set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2)
--set-string stringArray set STRING values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
-f, --values strings specify values in a YAML file or a URL (can specify multiple)

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
specified via TCTL_CONFIG env variable. This flag
takes precedence over the env variable.
--debug Print debug messages for all requests and responses
--disable-tctl-version-warn If set, disable the outdated tctl version warning. Can also be
specified via TCTL_DISABLE_VERSION_WARN env variable.
-p, --profile string Use specific profile (default "default")

tctl install manifest management-plane-secrets

Output the Kubernetes manifests for installing the management plane to stdout, including the relevant secrets.

Synopsis

This command provides an easy way to generate correctly formatted secrets for installing the management plane. It should be run as part of installation or upgrade of Service Bridge to ensure the correct secret format for the new version.

Manifests are printed to stdout so that they can be committed to source control or applied directly to a Kubernetes cluster depending on deployment preference.

If certificates are not passed to the command, it will automatically generate self-signed certficates using the hostname and organization you provide. If hostname and organization are also not passed, you can opt for self signed certs through ManagementPlane CR. It is not recommended to use self-signed certificates in production.

tctl install manifest management-plane-secrets [flags]

Examples


# Output secrets for all required flags
tctl install manifest management-plane-secrets \
--elastic-password

Options

  -y, --allow-defaults                        Use default values for required fields that aren't provided. DO NOT USE IN PRODUCTION.
--banyandb-etcd-root-password string The root password of BanyanDB etcd component
--elastic-ca-certificate string The CA certificate to validate Elasticsearch connections when Elasticsearch is configured to present a self-signed certificate
--elastic-password string The password Service Bridge will use to communicate with Elasticsearch. If not provided, a random password will be generated
--elastic-username string The username Service Bridge will use to communicate with Elasticsearch. If not provided, the default "tsb" username will be used
-f, --file string The custom resource file describing the management plane
-h, --help help for management-plane-secrets
--ldap-bind-dn string The DN of the user Service Bridge will use to connect to the LDAP server (default "cn=admin,dc=tetrate,dc=io")
--ldap-bind-password string The password Service Bridge will use to connect to the LDAP server (default "admin")
--ldap-ca-certificate string The CA certificate to validate LDAP connections when LDAP is configured to present a self-signed certificate
--managementplane string The namespace to deploy the management plane and secrets into (default "tsb")
--oidc-client-secret string The client secret used to connect to the OIDC server
--oidc-device-client-secret string The client secret used for device auth with the OIDC server
--postgres-ca-certificate string The CA certificate to validate Postgres connections when Postgres is configured to present a self-signed certificate
--postgres-client-certificate string The client certificate that Service Bridge needs to provide to Postgres when Postgres is configured to mutually authenticate
--postgres-client-key string The client private key that Service Bridge needs to sign requests to Postgres with when Postgres is configured to mutually authenticate
--postgres-password string The password Service Bridge will use to communicate with Postgres. If not provided, a random password will be generated
--postgres-username string The username Service Bridge will use to communicate with Postgres. If not provided, the default "tsb" username will be used
--teamsync-azure-client-secret string The client secret used to connect to Azure AD to synchronize users and groups
--tsb-admin-password string The Service Bridge admin password [required]
--tsb-certs-secret Automatically install management plane tsb-certs for secure communication with control planes. This is an alternate to setting self-signed cert issuer in the ManagementPlane CR, so set this to false if ManagementPlane CR is configured for self signed certs (default true)
--tsb-server-certificate string The certificate for the Service Bridge API server to present [required]
--tsb-server-key string The private key for the Service Bridge API server to sign requests with [required]
--tsb-tls-hostname string A comma-separated list of hostnames and IPs for self-signed certificate generation if Service Bridge server certificate/key pair is not provided (default "demo.tsb.tetrate.io")
--tsb-tls-org string The organization for self-signed certificate generation if Service Bridge server certificate/key pair is not provided (default "tetrate")
--xcp-certs Automatically install management plane certs for secure communication with control planes. Assumes cert-manager is installed in the management plane cluster

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
specified via TCTL_CONFIG env variable. This flag
takes precedence over the env variable.
--debug Print debug messages for all requests and responses
--disable-tctl-version-warn If set, disable the outdated tctl version warning. Can also be
specified via TCTL_DISABLE_VERSION_WARN env variable.
-p, --profile string Use specific profile (default "default")