### Terrakube Helm Chart Configuration Example

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/examples/AzureAuthentication-Example3.md

This YAML configuration is for the Terrakube Helm chart. Replace placeholder values (<<CHANGE_THIS>>) with your specific Azure and Terrakube settings. Ensure you have a working ingress setup before applying.

```yaml
## Global Name
name: "terrakube"

## Terrakube Security
security:
  adminGroup: "<<CHANGE_THIS>>" # This should be your Entra ID (formerly Azure AD) group name
  patSecret: "<<CHANGE_THIS>>"  # Sample Key 32 characters z6QHX!y@Nep2QDT!53vgH43^PjRXyC3X
  internalSecret: "<<CHANGE_THIS>>" # Sample Key 32 characters Kb^8cMerPNZV6hS!9!kcD*KuUPUBa^B3
  dexClientId: "microsoft"
  dexClientScope: "email openid profile offline_access groups"

## Terraform Storage
storage:
  defaultStorage: false
  azure:
    storageAccountName: "<<CHANGE_THIS>>"
    storageAccountResourceGroup: "<<CHANGE_THIS>>"
    storageAccountAccessKey: "<<CHANGE_THIS>>"

## Dex
dex:
  config:
    issuer: https://<<CHANGE_THIS>>/dex # Change this to your terrakube api url for example terrakube-api.com
    storage:
      type: memory
    oauth2:
      responseTypes: ["code", "token", "id_token"]
      skipApprovalScreen: true
    web:
      allowedOrigins: ['*']
  
    staticClients:
    - id: microsoft
      redirectURIs:
      - 'https://<<CHANGE_THIS>>' # Change this to your Terrakube UI URL for example terrakube.example.com
      - 'http://localhost:10001/login'
      - 'http://localhost:10000/login'
      - '/device/callback'
      name: 'microsoft'
      public: true

    connectors:
    - type: microsoft
      id: microsoft
      name: microsoft
      config:
        clientID: "<<CHANGE_THIS>>"
        clientSecret: "<<CHANGE_THIS>>"
        redirectURI: "https://<<CHANGE_THIS>>/dex/callback" # Change this to your terrakube api url for example terrakube-api.com
        tenant: "<<CHANGE_THIS>>"

## API properties
api:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  properties:
    databaseType: "POSTGRESQL"
    databaseHostname: "<<CHANGE_THIS>>" #Change with the real value for example terrakubedb.database.azure.com
    databaseName: "<<CHANGE_THIS>>"
    databaseUser: "<<CHANGE_THIS>>"
    databasePassword: "<<CHANGE_THIS>>"

## Ingress properties
ingress:
  useTls: true
  ui:
    enabled: true
    domain: "<<CHANGE_THIS>>" # Change this to your Terrakube UI URL for example terrakube.example.com
    path: "/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      cert-manager.io/cluster-issuer: letsencrypt
  api:
    enabled: true
    domain: "<<CHANGE_THIS>>" # Change this to your terrakube api url for example terrakube-api.com
    path: "/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: letsencrypt
  registry:
    enabled: true
    domain: "<<CHANGE_THIS>>" # Change this to your terrakube registry url for example terrakube-registry.example.com
    path: "/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: letsencrypt
  dex:
    enabled: true
    path: "/dex/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: letsencrypt

```

--------------------------------

### Helm Chart Installation and Testing

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Commands for performing a dry run to test installation without deploying, and for creating a namespace and installing Terrakube.

```bash
helm install --debug --dry-run terrakube terrakube/terrakube -n terrakube -f values.yaml
kubectl create namespace terrakube
helm install terrakube terrakube/terrakube -n terrakube -f values.yaml
```

--------------------------------

### Basic Terrakube Helm Installation

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Installs the Terrakube Helm chart with default configurations. Ensure you have added the repository first.

```bash
helm install terrakube terrakube/terrakube
```

--------------------------------

### Local Helm Chart Installation

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Instructions for installing the Terrakube Helm chart from a local clone of the repository, useful for development.

```bash
git clone https://github.com/terrakube-io/terrakube-helm-chart.git
helm install terrakube ./terrakube-helm-chart/charts/terrakube -n terrakube -f values.yaml
```

--------------------------------

### Install Terrakube Helm Chart

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Commands to add the Terrakube Helm repository, update it, install the chart with default values, verify the installation, and uninstall.

```bash
# Add the Terrakube Helm repository
helm repo add terrakube https://terrakube-io.github.io/terrakube-helm-chart
helm repo update

# Create namespace and install with default values (Minikube/development)
kubectl create namespace terrakube
helm install terrakube terrakube/terrakube -n terrakube

# Verify the installation
kubectl get pods -n terrakube

# Uninstall when needed
helm delete terrakube -n terrakube
```

--------------------------------

### Production Configuration Example

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

A comprehensive production-ready configuration including Azure AD authentication, external PostgreSQL, and Azure Storage.

```yaml
name: "terrakube"

# Security configuration
security:
  adminGroup: "TerrakubeAdmins"
  patSecret: "z6QHX!y@Nep2QDT!53vgH43^PjRXyC3X"
  internalSecret: "Kb^8cMerPNZV6hS!9!kcD*KuUPUBa^B3"
  dexClientId: "microsoft"
  dexClientScope: "email openid profile offline_access groups"

# External Azure Storage
storage:
  defaultStorage: false
  azure:
    storageAccountName: "terrakubeprod"
    storageAccountResourceGroup: "terrakube-prod-rg"
    storageAccountAccessKey: "your-storage-key"

# Dex authentication with Azure AD
dex:
  enabled: true
  config:
    issuer: https://terrakube-api.prod.example.com/dex
    storage:
      type: memory
    oauth2:
      responseTypes: ["code", "token", "id_token"]
      skipApprovalScreen: true
    web:
      allowedOrigins: ['*']
    staticClients:
    - id: microsoft
      redirectURIs:
      - 'https://terrakube.prod.example.com'
      - 'http://localhost:10001/login'
      - 'http://localhost:10000/login'
      - '/device/callback'
      name: 'microsoft'
      public: true
    connectors:
    - type: microsoft
      id: microsoft
      name: microsoft
      config:
        clientID: "azure-app-client-id"
        clientSecret: "azure-app-client-secret"
        redirectURI: "https://terrakube-api.prod.example.com/dex/callback"
        tenant: "azure-tenant-id"

# API with external PostgreSQL
api:
  enabled: true
  replicaCount: "3"
  serviceType: ClusterIP
  defaultDatabase: false
  defaultRedis: true
  resources:
    limits:
      cpu: 500m
      memory: 1024Mi
    requests:
      cpu: 200m
      memory: 256Mi
  properties:
    databaseType: "POSTGRESQL"
    databaseHostname: "terrakube-db.postgres.database.azure.com"
    databaseName: "terrakube"
    databaseUser: "terrakube_admin@terrakube-db"
    databasePassword: "secure-db-password"
    databaseSslMode: "require"

# Executor configuration
executor:
  enabled: true
  replicaCount: "2"
  serviceType: ClusterIP
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 512Mi

# Registry configuration
registry:
  enabled: true
  replicaCount: "2"
  serviceType: ClusterIP
```

--------------------------------

### Install Terrakube Helm Chart with Namespace

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Installs the Terrakube Helm chart into a specified Kubernetes namespace. It's recommended to create the namespace first.

```bash
kubectl create namespace terrakube
helm install terrakube terrakube-repo/terrakube -n terrakube
```

--------------------------------

### Install Terrakube using Helm Chart

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Install the Terrakube Helm chart into the 'terrakube' namespace using your custom values.yaml file. This command applies the configuration and deploys Terrakube to your Kubernetes cluster.

```bash
helm install --debug --values ./values.yaml terrakube ./terrakube-helm-chart/charts/terrakube/ -n terrakube
```

--------------------------------

### Terrakube Helm Chart Configuration Example

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/examples/GoogleAuthentication-Example3.md

This YAML configuration is for the Terrakube Helm chart. Replace placeholder values like '<<CHANGE_THIS>>' with your specific environment details, including security settings, GCP project and bucket information, Dex configuration, and API/Ingress properties.

```yaml
## Global Name
name: "terrakube"

## Terrakube Security
security:
  adminGroup: "<<CHANGE_THIS>>" # The value should be a gcp group (format: group_name@terrakube.io example: terrakube_admin@terrakube.io)
  patSecret: "<<CHANGE_THIS>>"  # Sample Key 32 characters z6QHX!y@Nep2QDT!53vgH43^PjRXyC3X
  internalSecret: "<<CHANGE_THIS>>" # Sample Key 32 characters Kb^8cMerPNZV6hS!9!kcD*KuUPUBa^B3
  dexClientId: "google"
  dexClientScope: "email openid profile offline_access groups"
  gcpCredentials: |
    ## GCP JSON CREDENTIALS for service account with API Scope https://www.googleapis.com/auth/admin.directory.group.readonly
    {
      "type": "service_account",
      "project_id": "",
      "private_key_id": "",
      "private_key": "",
      "client_email": "",
      "client_id": "",
      "auth_uri": "",
      "token_uri": "",
      "auth_provider_x509_cert_url": "",
      "client_x509_cert_url": ""
    }


## Terraform Storage
storage:
  defaultStorage: false
  gcp:
    projectId: "<<CHANGE_THIS>>"
    bucketName: "<<CHANGE_THIS>>"
    credentials: |
      ## GCP JSON CREDENTIALS for service account with access to read/write to the storage bucket
      {
        "type": "service_account",
        "project_id": "",
        "private_key_id": "",
        "private_key": "",
        "client_email": "",
        "client_id": "",
        "auth_uri": "",
        "token_uri": "",
        "auth_provider_x509_cert_url": "",
        "client_x509_cert_url": ""
      }


## Dex
dex:
  enabled: true
  config:
    issuer: https://terrakube-api.yourdomain.com/dex #<<CHANGE_THIS>>
    storage:
      type: memory
    oauth2:
      responseTypes: ["code", "token", "id_token"]
    web:
      allowedOrigins: ["*"]

    staticClients:
    - id: google
      redirectURIs:
      - 'https://terrakube-ui.yourdomain.com' #<<CHANGE_THIS>>
      - 'http://localhost:3000'
      - 'http://localhost:10001/login'
      - 'http://localhost:10000/login'
      - '/device/callback'
      name: 'google'
      public: true

    connectors:
    - type: google
      id: google
      name: google
      config:
        clientID: "<<CHANGE_THIS>>"
        clientSecret: "<<CHANGE_THIS>>"
        redirectURI: "https://terrakube-api.yourdomain.com/dex/callback"
        serviceAccountFilePath: "/etc/gcp/secret/gcp-credentials" # GCP CREDENTIAL FILE WILL BE IN THIS PATH
        adminEmail: "<<CHANGE_THIS>>"

## API properties
api:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  properties:
    databaseType: "MYSQL"
    databaseHostname: "terrakubedb.database.com" #Change with the real value
    databaseName: "<<CHANGE_THIS>>"
    databaseUser: "<<CHANGE_THIS>>"
    databasePassword: "<<CHANGE_THIS>>"

## Ingress properties
ingress:
  useTls: true
  ui:
    enabled: true
    domain: "terrakube-ui.yourdomain.com"
    path: "/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      cert-manager.io/cluster-issuer: letsencrypt
  api:
    enabled: true
    domain: "terrakube-api.yourdomain.com"
    path: "/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: letsencrypt
  registry:
    enabled: true
    domain: "terrakube-reg.yourdomain.com"
    path: "/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: letsencrypt
  dex:
    enabled: true
    path: "/dex/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: letsencrypt

```

--------------------------------

### Add Terrakube Helm Repository (Alternative)

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Adds the Terrakube Helm repository using an alternative URL. This is useful if the primary repository URL changes or for specific setups.

```bash
helm repo add terrakube-repo https://terrakube-io.github.io/terrakube-helm-chart
```

--------------------------------

### Add Terrakube Helm Repository

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Adds the Terrakube Helm chart repository to your local Helm configuration. Run this before installing or updating charts.

```bash
helm repo add terrakube https://terrakube-io.github.io/terrakube-helm-chart
helm repo update
```

--------------------------------

### Test Terrakube Helm Chart Installation

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Perform a dry run of the Helm chart installation to test the configuration and ensure there are no errors before applying changes. This command uses the specified values.yaml file and targets the 'terrakube' namespace.

```bash
helm install --debug --dry-run --values ./values.yaml terrakube ./terrakube-helm-chart/charts/terrakube/ -n terrakube
```

--------------------------------

### Configure Microsoft Entra ID (Azure AD) Authentication

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

YAML values for installing Terrakube with Microsoft Entra ID authentication. Includes Dex configuration and static client setup for Azure AD.

```yaml
# azure-auth-values.yaml
name: "terrakube"

security:
  adminGroup: "TerrakubeAdmins"  # Azure AD group name
  patSecret: "z6QHX!y@Nep2QDT!53vgH43^PjRXyC3X"
  internalSecret: "Kb^8cMerPNZV6hS!9!kcD*KuUPUBa^B3"
  dexClientId: "microsoft"
  dexClientScope: "email openid profile offline_access groups"

dex:
  enabled: true
  config:
    issuer: https://terrakube-api.example.com/dex
    storage:
      type: memory
    oauth2:
      responseTypes: ["code", "token", "id_token"]
      skipApprovalScreen: true
    web:
      allowedOrigins: ['*']

    staticClients:
    - id: microsoft
      redirectURIs:
      - 'https://terrakube-ui.example.com'
      - 'http://localhost:10001/login'
      - 'http://localhost:10000/login'
      - '/device/callback'
      name: 'microsoft'
      public: true

    connectors:
    - type: microsoft
      id: microsoft
      name: microsoft
      config:
        clientID: "your-azure-app-client-id"
        clientSecret: "your-azure-app-client-secret"
        redirectURI: "https://terrakube-api.example.com/dex/callback"
        tenant: "your-azure-tenant-id"

# Install with Azure AD authentication
# helm install terrakube terrakube/terrakube -n terrakube -f azure-auth-values.yaml
```

--------------------------------

### Helm Repository Management

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Commands to add, update, and search for the Terrakube Helm chart repository. Ensure you have the latest chart information before installation.

```bash
helm repo add terrakube https://terrakube-io.github.io/terrakube-helm-chart
helm repo update
helm search repo terrakube
```

--------------------------------

### Terrakube Helm Chart Values Configuration

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Example configuration for the Terrakube Helm chart, specifying UI, ingress, and API settings. Customize domains, paths, and TLS secrets for your environment.

```yaml
ui:
  enabled: true
  replicaCount: "2"
  serviceType: ClusterIP

# NGINX ingress with TLS
ingress:
  controller: "generic"
  useTls: true
  ui:
    enabled: true
    domain: "terrakube.prod.example.com"
    path: "/(.*)"
    pathType: "Prefix"
    ingressClassName: "nginx"
    useTls: true
    tlsSecretName: "terrakube-ui-tls"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      cert-manager.io/cluster-issuer: "letsencrypt-prod"
  api:
    enabled: true
    domain: "terrakube-api.prod.example.com"
    path: "/(.*)"
    pathType: "Prefix"
    ingressClassName: "nginx"
    useTls: true
    tlsSecretName: "terrakube-api-tls"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: "letsencrypt-prod"
  registry:
    enabled: true
    domain: "terrakube-registry.prod.example.com"
    path: "/(.*)"
    pathType: "Prefix"
    ingressClassName: "nginx"
    useTls: true
    tlsSecretName: "terrakube-registry-tls"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: "letsencrypt-prod"
  dex:
    enabled: true
    path: "/dex/(.*)"
    pathType: "Prefix"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
```

--------------------------------

### Configure Dynamic Credentials

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Enable dynamic credentials by providing public/private keys and mounting them as secrets.

```yaml
api:
  dynamicCredentials:
    enabled: true
    publicKey: |
      -----BEGIN PUBLIC KEY-----
      REDACTED
      -----END PUBLIC KEY-----
    privateKey: |
      -----BEGIN PRIVATE KEY-----
      REDACTED
      -----END PRIVATE KEY-----
  volumes:
    - name: dynamic-credentials
      secret:
        secretName: terrakube-dynamic-credentials
        items:
          - key: public-key.pem
            path: public-key.pem
          - key: private-key.pem
            path: private-key.pem
  volumeMounts:
  - name: dynamic-credentials
    mountPath: /etc/terrakube/credentials
    readOnly: true
```

--------------------------------

### Enable OpenTelemetry (OTEL)

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Configure OTEL metrics and tracing endpoints for Terrakube components.

```yaml
## API properties
api:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  otel:
    enabled: true
    metrics:
      port: 8081
      host: 
    traces:
      type: jaeger # or zipkin
      endpoint: http://jaeger-collector:14268/api/traces


## Executor properties
executor:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  otel:
    enabled: true
    metrics:
      port: 8081
      host: 
    traces:
      type: zupkin # or jaeger
      endpoint: zipkin:9411/api/v2/spans

## Registry properties
registry:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  otel:
    enabled: false # or true
    metrics:
      port: 8081
      host: 
    traces:
      type: zupkin # or jaeger
      endpoint: zipkin:9411/api/v2/spans
```

--------------------------------

### Create Kubernetes Namespace for Terrakube

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Create the 'terrakube' Kubernetes namespace. This namespace will host all Terrakube-related resources.

```bash
kubectl create namespace terrakube
```

--------------------------------

### Configure Dynamic Credentials

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Enable dynamic credentials using RSA key pairs and mount them as Kubernetes secrets.

```yaml
api:
  dynamicCredentials:
    enabled: true
    publicKeyPath: "/etc/terrakube/credentials/public-key.pem"
    privateKeyPath: "/etc/terrakube/credentials/private-key.pem"
    publicKey: |
      -----BEGIN PUBLIC KEY-----
      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
      -----END PUBLIC KEY-----
    privateKey: |
      -----BEGIN PRIVATE KEY-----
      MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEA...
      -----END PRIVATE KEY-----

  volumes:
    - name: dynamic-credentials
      secret:
        secretName: terrakube-dynamic-credentials
        items:
          - key: public-key.pem
            path: public-key.pem
          - key: private-key.pem
            path: private-key.pem

  volumeMounts:
  - name: dynamic-credentials
    mountPath: /etc/terrakube/credentials
    readOnly: true
```

--------------------------------

### Configure External PostgreSQL Database

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Use an external PostgreSQL database for production deployments. Redis can also be configured externally if required.

```yaml
# postgresql-values.yaml
api:
  enabled: true
  replicaCount: "2"
  serviceType: "ClusterIP"
  defaultDatabase: false  # Disable built-in PostgreSQL
  defaultRedis: true      # Use built-in Redis or set false for external

  properties:
    databaseType: "POSTGRESQL"
    databaseHostname: "terrakube-db.postgres.database.azure.com"
    databaseName: "terrakube"
    databaseUser: "terrakube_admin"
    databasePassword: "your-secure-password"
    databasePort: "5432"
    databaseSchema: "public"
    databaseSslMode: "require"  # Options: disable, allow, prefer, require, verify-ca, verify-full

# For external Redis:
# api:
#   properties:
#     redisHostname: "terrakube-redis.redis.cache.windows.net"
#     redisPassword: "your-redis-password"
#     redisPort: "6380"
```

--------------------------------

### Configure Terrakube Helm Values for GCP

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/examples/GoogleAuthentication-Example2.md

Use this YAML configuration to define security, storage, Dex, API, and ingress settings. Replace all placeholders marked with <<CHANGE_THIS>> with your specific environment details.

```yaml
## Global Name
name: "terrakube"

## Terrakube Security
security:
  adminGroup: "<<CHANGE_THIS>>" # The value should be a gcp group (format: group_name@yourdomain.com example: terrakube_admin@terrakube.io)
  patSecret: "<<CHANGE_THIS>>"  # Sample Key 32 characters z6QHX!y@Nep2QDT!53vgH43^PjRXyC3X
  internalSecret: "<<CHANGE_THIS>>" # Sample Key 32 characters Kb^8cMerPNZV6hS!9!kcD*KuUPUBa^B3
  dexClientId: "google"
  dexClientScope: "email openid profile offline_access groups"
  gcpCredentials: |
    ## GCP JSON CREDENTIALS for service account with API Scope https://www.googleapis.com/auth/admin.directory.group.readonly
    {
      "type": "service_account",
      "project_id": "",
      "private_key_id": "",
      "private_key": "",
      "client_email": "",
      "client_id": "",
      "auth_uri": "",
      "token_uri": "",
      "auth_provider_x509_cert_url": "",
      "client_x509_cert_url": ""
    }


## Terraform Storage
storage:
  defaultStorage: false
  gcp:
    projectId: "<<CHANGE_THIS>>"
    bucketName: "<<CHANGE_THIS>>"
    credentials: |
      ## GCP JSON CREDENTIALS for service account with access to read/write to the storage bucket
      {
        "type": "service_account",
        "project_id": "",
        "private_key_id": "",
        "private_key": "",
        "client_email": "",
        "client_id": "",
        "auth_uri": "",
        "token_uri": "",
        "auth_provider_x509_cert_url": "",
        "client_x509_cert_url": ""
      }


## Dex
dex:
  enabled: true
  config:
    issuer: https://terrakube-api.yourdomain.com/dex #<<CHANGE_THIS>>
    storage:
      type: memory
    oauth2:
      responseTypes: ["code", "token", "id_token"]
    web:
      allowedOrigins: ["*"]

    staticClients:
    - id: google
      redirectURIs:
      - 'https://terrakube-ui.yourdomain.com' #<<CHANGE_THIS>>
      - 'http://localhost:3000'
      - 'http://localhost:10001/login'
      - 'http://localhost:10000/login'
      - '/device/callback'
      name: 'google'
      public: true

    connectors:
    - type: google
      id: google
      name: google
      config:
        clientID: "<<CHANGE_THIS>>"
        clientSecret: "<<CHANGE_THIS>>"
        redirectURI: "https://terrakube-api.yourdomain.com/dex/callback"
        serviceAccountFilePath: "/etc/gcp/secret/gcp-credentials" # GCP CREDENTIAL FILE WILL BE IN THIS PATH
        adminEmail: "<<CHANGE_THIS>>"

## API properties
api:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  properties:
    databaseType: "POSTGRESQL"
    databaseHostname: "terrakubedb.database.com" #Change with the real value
    databaseName: "<<CHANGE_THIS>>"
    databaseUser: "<<CHANGE_THIS>>"
    databasePassword: "<<CHANGE_THIS>>"

## Ingress properties
ingress:
  useTls: true
  ui:
    enabled: true
    domain: "terrakube-ui.yourdomain.com"
    path: "/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      cert-manager.io/cluster-issuer: letsencrypt
  api:
    enabled: true
    domain: "terrakube-api.yourdomain.com"
    path: "/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: letsencrypt
  registry:
    enabled: true
    domain: "terrakube-reg.yourdomain.com"
    path: "/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: letsencrypt
  dex:
    enabled: true
    path: "/dex/(.*)"
    pathType: "Prefix"
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: letsencrypt
```

--------------------------------

### Configure OpenTelemetry for Terrakube

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Enable and configure OpenTelemetry metrics and traces for the API, executor, and registry components.

```yaml
api:
  otel:
    enabled: true
    metrics:
      port: "9464"
      host: "0.0.0.0"
    traces:
      type: jaeger  # or zipkin
      endpoint: "http://jaeger-collector.observability:14268/api/traces"

executor:
  otel:
    enabled: true
    metrics:
      port: "9464"
      host: "0.0.0.0"
    traces:
      type: zipkin
      endpoint: "http://zipkin.observability:9411/api/v2/spans"

registry:
  otel:
    enabled: true
    metrics:
      port: "9464"
      host: "0.0.0.0"
    traces:
      type: jaeger
      endpoint: "http://jaeger-collector.observability:14268/api/traces"
```

--------------------------------

### Configure Terrakube UI

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Configure the Terrakube web user interface, including image, replicas, service type, and resource limits.

```yaml
# ui-values.yaml
ui:
  enabled: true
  image: azbuilder/terrakube-ui
  version: ""  # Uses Chart.appVersion by default
  replicaCount: "2"
  serviceType: ClusterIP

  resources:
    limits:
      cpu: 100m
      memory: 128Mi
    requests:
      cpu: 50m
      memory: 64Mi

```

--------------------------------

### Configure GCP Storage for Terrakube

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Configure Google Cloud Storage by providing the project ID and service account credentials.

```yaml
# gcp-storage-values.yaml
storage:
  defaultStorage: false  # Disable built-in MinIO
  gcp:
    projectId: "your-gcp-project-id"
    bucketName: "terrakube-storage-bucket"
    credentials: |
      {
        "type": "service_account",
        "project_id": "your-gcp-project-id",
        "private_key_id": "key-id",
        "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
        "client_email": "terrakube-storage@your-project.iam.gserviceaccount.com",
        "client_id": "123456789",
        "auth_uri": "https://accounts.google.com/o/oauth2/auth",
        "token_uri": "https://oauth2.googleapis.com/token",
        "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
        "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/..."
      }
```

--------------------------------

### Clone Terrakube Helm Chart Repository

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Clone the official Terrakube Helm chart repository to your local machine. This is the first step before customizing and deploying Terrakube.

```bash
git clone https://github.com/terrakube-io/terrakube-helm-chart.git
```

--------------------------------

### Basic Security Configuration for Terrakube

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

YAML configuration for security settings including admin groups, secrets for token signing and internal communication, and Dex OIDC client details. Supports custom CA certificates.

```yaml
# security-config.yaml
security:
  # Admin group that can create organizations and manage team access
  # Format varies by provider:
  # - Azure AD: "TerrakubeAdmins"
  # - GitHub: "organization-name:team-name"
  # - Google: "admin-group@yourdomain.com"
  adminGroup: "TERRAKUBE_ADMIN"

  # 32-character base64-compatible secret for signing personal access tokens
  patSecret: "z6QHX!y@Nep2QDT!53vgH43^PjRXyC3X"

  # 32-character base64-compatible secret for internal service communication
  internalSecret: "Kb^8cMerPNZV6hS!9!kcD*KuUPUBa^B3"

  # Dex OIDC client configuration (must match staticClients in dex.config)
  dexClientId: "microsoft"
  dexClientScope: "email openid profile offline_access groups"
  dexIssuerUri: "https://terrakube-api.example.com/dex"

  # Optional: Use existing Kubernetes secret instead of inline values
  existingSecret: false

  # Optional: Custom CA certificates for TLS connections
  caCerts:
    custom-ca.pem: |
      -----BEGIN CERTIFICATE-----
      YOUR_CERTIFICATE_DATA_HERE
      -----END CERTIFICATE-----
```

--------------------------------

### Helm Chart Manifest Generation and Rollback

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Commands to view the generated Kubernetes manifests for the Terrakube deployment and to roll back to a previous release.

```bash
helm template terrakube terrakube/terrakube -n terrakube -f values.yaml
helm rollback terrakube 1 -n terrakube
```

--------------------------------

### Configure Azure Storage for Terrakube

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Use this configuration to disable built-in MinIO and connect to an Azure Storage account. Ensure the required containers are created before deployment.

```yaml
storage:
  defaultStorage: false  # Disable built-in MinIO
  azure:
    storageAccountName: "terrakubestorage"
    storageAccountResourceGroup: "terrakube-rg"
    storageAccountAccessKey: "your-storage-account-access-key"
```

```bash
# az group create --name terrakube-rg --location eastus
# az storage account create --name terrakubestorage --resource-group terrakube-rg --sku Standard_LRS
# az storage container create --name registry --account-name terrakubestorage --public-access blob
# az storage container create --name tfstate --account-name terrakubestorage --public-access off
# az storage container create --name tfoutput --account-name terrakubestorage --public-access off
```

--------------------------------

### Configure Terrakube API

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Basic configuration for the Terrakube API component including resource limits and scheduling constraints.

```yaml
api:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  resources:
    limits:
      cpu: 500m
      memory: 1024Mi
    requests:
      cpu: 200m
      memory: 256Mi
  tolerations: # OPTIONAL
  - key: "key1"
    operator: "Equal"
    value: "value1"
    effect: "NoSchedule"
  nodeSelector: # OPTIONAL
    disktype: ssd
  affinity:  # OPTIONAL
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: name
            operator: In
            values:
            - terrakube
  properties:
    databaseType: "H2"
```

--------------------------------

### Nginx Ingress Configuration for Terrakube

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Configure Nginx ingress controller for Terrakube UI, API, registry, and Dex. Ensure 'nginx.ingress.kubernetes.io/use-regex' is set to 'true' for path matching.

```yaml
ingress:
  controller: "generic"
  useTls: true
  includeTlsHosts: true

  ui:
    enabled: true
    domain: "terrakube-ui.example.com"
    path: "/(.*)"
    pathType: "Prefix"
    ingressClassName: "nginx"
    useTls: true
    tlsSecretName: "tls-secret-ui"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      cert-manager.io/cluster-issuer: "letsencrypt-prod"

  api:
    enabled: true
    domain: "terrakube-api.example.com"
    path: "/(.*)"
    pathType: "Prefix"
    ingressClassName: "nginx"
    useTls: true
    tlsSecretName: "tls-secret-api"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: "letsencrypt-prod"

  registry:
    enabled: true
    domain: "terrakube-registry.example.com"
    path: "/(.*)"
    pathType: "Prefix"
    ingressClassName: "nginx"
    useTls: true
    tlsSecretName: "tls-secret-registry"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
      cert-manager.io/cluster-issuer: "letsencrypt-prod"

  dex:
    enabled: true
    path: "/dex/(.*)"
    pathType: "Prefix"
    annotations:
      nginx.ingress.kubernetes.io/use-regex: "true"
      nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"

  executor:
    enabled: false  # Usually internal-only
```

--------------------------------

### Helm Chart Upgrade and Status Check

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Commands to upgrade an existing Terrakube deployment and check its status using Helm and kubectl.

```bash
helm upgrade terrakube terrakube/terrakube -n terrakube -f values.yaml
helm status terrakube -n terrakube
kubectl get pods -n terrakube
kubectl get ingress -n terrakube
```

--------------------------------

### Configure Terrakube Registry

Source: https://context7.com/terrakube-io/terrakube-helm-chart/llms.txt

Configure the Terrakube private module registry, specifying image, replicas, resources, and probe settings.

```yaml
# registry-values.yaml
registry:
  enabled: true
  image: azbuilder/open-registry
  version: ""  # Uses Chart.appVersion by default
  replicaCount: "2"
  serviceType: ClusterIP
  serviceAccountName: "terrakube-registry-sa"

  resources:
    limits:
      cpu: 250m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 128Mi

  startupProbe:
    failureThreshold: 30
    periodSeconds: 5
  readinessProbe:
    periodSeconds: 10
  livenessProbe:
    periodSeconds: 10

```

--------------------------------

### Configure Custom CA Certificates

Source: https://github.com/terrakube-io/terrakube-helm-chart/blob/main/README.md

Define custom CA certificates in the security configuration and mount them into Terrakube components.

```yaml
security:
  .....
  caCerts:
    terrakubeDemo1.pem: |
      -----BEGIN CERTIFICATE-----

      CERTIFICATE DATA

      -----END CERTIFICATE-----
    terrakubeDemo2.pem: |
      -----BEGIN CERTIFICATE-----

      CERTIFICATE DATA

      -----END CERTIFICATE-----
  ....
```

```yaml
## API properties
api:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  env:
  - name: SERVICE_BINDING_ROOT
    value: /mnt/platform/bindings
  volumes:
    - name: ca-certs
      secret:
        secretName: terrakube-ca-secrets
        items:
        - key: "terrakubeDemo1.pem"
          path: "terrakubeDemo1.pem"
        - key: "terrakubeDemo2.pem"
          path: "terrakubeDemo2.pem"
        - key: "type"
          path: "type"
  volumeMounts:
  - name: ca-certs
    mountPath: /mnt/platform/bindings/ca-certificates
    readOnly: true
  properties:
    databaseType: "H2"


## Executor properties
executor:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  env:
  - name: SERVICE_BINDING_ROOT
    value: /mnt/platform/bindings
  volumes:
    - name: ca-certs
      secret:
        secretName: terrakube-ca-secrets
        items:
        - key: "terrakubeDemo1.pem"
          path: "terrakubeDemo1.pem"
        - key: "terrakubeDemo2.pem"
          path: "terrakubeDemo2.pem"
        - key: "type"
          path: "type"
  volumeMounts:
  - name: ca-certs
    mountPath: /mnt/platform/bindings/ca-certificates
    readOnly: true
  properties:
    toolsRepository: "https://github.com/terrakube-io/terrakube-extensions"
    toolsBranch: "main"

## Registry properties
registry:
  enabled: true
  replicaCount: "1"
  serviceType: "ClusterIP"
  env:
  - name: SERVICE_BINDING_ROOT
    value: /mnt/platform/bindings
  volumes:
    - name: ca-certs
      secret:
        secretName: terrakube-ca-secrets
        items:
        - key: "terrakubeDemo1.pem"
          path: "terrakubeDemo1.pem"
        - key: "terrakubeDemo2.pem"
          path: "terrakubeDemo2.pem"
        - key: "type"
          path: "type"
  volumeMounts:
  - name: ca-certs
    mountPath: /mnt/platform/bindings/ca-certificates
    readOnly: true
```

```text
Added 2 additional CA certificate(s) to system truststore
```