Deploy with Helm

Install Tero Edge on Kubernetes with the official Helm chart

The tero-edge Helm chart deploys Edge as a DaemonSet, renders config.json and policies.json into a ConfigMap, and (optionally) wires up HTTP policy sync with API-key auth. The chart is published two ways — an OCI registry and a classic HTTP Helm repository — pick whichever your tooling prefers.

Install

OCI (GHCR)

No helm repo add needed — reference the chart by its OCI URL:

helm upgrade --install tero-edge oci://ghcr.io/usetero/charts/tero-edge \
  --version <chart-version> \
  -n tero-system --create-namespace \
  -f values.yaml

List available versions:

helm show chart oci://ghcr.io/usetero/charts/tero-edge --version <chart-version>

OCI support is built into Helm 3.8+. Older clients need export HELM_EXPERIMENTAL_OCI=1.

Helm repository (HTTP)

For HTTP Helm support, please contact [e-mail].

Both sources publish identical charts from the same release, so values.yaml and every flag below behave the same regardless of which you choose.

Configure

Create a values.yaml with the policy-sync connection and the service identity the control plane uses to scope policies:

Pick the tab for your Datadog region — the upstreamUrl and metricsUrl change per region; everything else is identical.

US1

values.yaml

tero:
  url: https://sync.usetero.com
  apiKey: "" # it is recommended to use an existing secret instead
  existingSecret:
    name: ""
    key: ""

config:
  upstreamUrl: https://agent-http-intake.logs.datadoghq.com
  metricsUrl: https://api.datadoghq.com

  # Service identity sent on every policy sync. The control plane scopes and
  # matches policies to this service, so set name/namespace/version.
  service:
    name: edge
    namespace: production
    version: 1.0.0
    resourceAttributes:
      - key: deployment.environment
        value: production
    labels:
      - key: team
        value: platform

US3

values.yaml

tero:
  url: https://sync.usetero.com
  apiKey: "" # it is recommended to use an existing secret instead
  existingSecret:
    name: ""
    key: ""

config:
  upstreamUrl: https://agent-http-intake.logs.us3.datadoghq.com
  metricsUrl: https://api.us3.datadoghq.com

  service:
    name: edge
    namespace: production
    version: 1.0.0
    resourceAttributes:
      - key: deployment.environment
        value: production
    labels:
      - key: team
        value: platform

US5

values.yaml

tero:
  url: https://sync.usetero.com
  apiKey: "" # it is recommended to use an existing secret instead
  existingSecret:
    name: ""
    key: ""

config:
  upstreamUrl: https://agent-http-intake.logs.us5.datadoghq.com
  metricsUrl: https://api.us5.datadoghq.com

  service:
    name: edge
    namespace: production
    version: 1.0.0
    resourceAttributes:
      - key: deployment.environment
        value: production
    labels:
      - key: team
        value: platform

EU1

values.yaml

tero:
  url: https://sync.usetero.com
  apiKey: "" # it is recommended to use an existing secret instead
  existingSecret:
    name: ""
    key: ""

config:
  upstreamUrl: https://agent-http-intake.logs.datadoghq.eu
  metricsUrl: https://api.datadoghq.eu

  service:
    name: edge
    namespace: production
    version: 1.0.0
    resourceAttributes:
      - key: deployment.environment
        value: production
    labels:
      - key: team
        value: platform

AP1

values.yaml

tero:
  url: https://sync.usetero.com
  apiKey: "" # it is recommended to use an existing secret instead
  existingSecret:
    name: ""
    key: ""

config:
  upstreamUrl: https://agent-http-intake.logs.ap1.datadoghq.com
  metricsUrl: https://api.ap1.datadoghq.com

  service:
    name: edge
    namespace: production
    version: 1.0.0
    resourceAttributes:
      - key: deployment.environment
        value: production
    labels:
      - key: team
        value: platform

Authentication

Setting tero.url automatically configures the HTTP policy provider. Provide the API key one of two ways — never both:

Method	Values
Inline (chart-managed Secret)	tero.apiKey: <key>
Existing Secret	tero.existingSecret.name + tero.existingSecret.key

# Reference a Secret you manage instead of an inline key:
tero:
  url: https://sync.usetero.com
  existingSecret:
    name: tero-edge-api
    key: api-key

Without tero.url, Edge loads policies only from the local file provider — no remote policy sync.

Values

The keys you’ll touch most. For every chart value (image, scheduling, service account, ingress), see the chart’s README.md.

Key	Default	Description
tero.url	""	Control plane base URL; setting it enables HTTP policy sync
tero.apiKey	""	Inline API key (chart creates the Secret)
tero.existingSecret.name	""	Name of a Secret you manage instead of tero.apiKey
tero.existingSecret.key	api-key	Key within that Secret holding the API key
config.upstreamUrl	https://agent-http-intake.logs.datadoghq.com	Logs intake endpoint (set per Datadog region)
config.metricsUrl	https://api.datadoghq.com	Metrics endpoint (set per Datadog region)
config.logLevel	info	Edge log level
config.maxBodySize	1048576	Max request body in bytes
config.maxConnections	256	Max concurrent connections; dominant memory cap (≈ maxConnections × maxBodySize)
config.maxDecodedBytes	null	Post-decompression body ceiling; defaults to maxBodySize
config.workerCount	null	httpz event-loop workers (null = default 1)
config.threadPoolCount	null	httpz handler threads (null = default 32; scales per-thread memory)
config.service.name	""	Service name sent on policy sync (omitted if empty)
config.service.namespace	""	Service namespace sent on policy sync
config.service.version	""	Service version sent on policy sync
config.service.resourceAttributes	[]	OTel resource attributes ({key, value}) sent on policy sync
config.service.labels	[]	Free-form labels ({key, value}) sent on policy sync
policiesJSON	[]	Local policies rendered to the file provider (raw JSON objects)

Verify

kubectl -n tero-system rollout status ds/tero-edge
kubectl -n tero-system port-forward ds/tero-edge 8080:8080 &
curl http://localhost:8080/_health

A 200 OK from /_health confirms Edge is running. Edge’s own Prometheus metrics are available at /_edge/metrics.

Upgrade and uninstall

# Upgrade to a new chart version (re-uses your values.yaml)
helm upgrade tero-edge <source> --version <chart-version> \
  -n tero-system -f values.yaml

# Uninstall
helm uninstall tero-edge -n tero-system

See the Configuration reference for every config.* field, and Operations for probes, resource sizing, and graceful shutdown.

Next Steps

Configuration

Full configuration reference

Operations

Probes, resources, and shutdown