> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetero.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Deploy with Helm
> Install Tero Edge on Kubernetes with the official Helm chart
The `tero-edge` Helm chart deploys Edge as a `DaemonSet`, renders `config.json`
and `policies.json` into a ConfigMap, and (optionally) wires up HTTP policy sync
with API-key auth. The chart is published two ways — an **OCI registry** and a
classic **HTTP Helm repository** — pick whichever your tooling prefers.
## Install
No `helm repo add` needed — reference the chart by its OCI URL:
```bash theme={null}
helm upgrade --install tero-edge oci://ghcr.io/usetero/charts/tero-edge \
--version \
-n tero-system --create-namespace \
-f values.yaml
```
List available versions:
```bash theme={null}
helm show chart oci://ghcr.io/usetero/charts/tero-edge --version
```
OCI support is built into Helm 3.8+. Older clients need
`export HELM_EXPERIMENTAL_OCI=1`.
For HTTP Helm support, please contact [support@usetero.com](mailto:support@usetero.com).
Both sources publish identical charts from the same release, so `values.yaml`
and every flag below behave the same regardless of which you choose.
## Configure
Create a `values.yaml` with the policy-sync connection and the service identity
the control plane uses to scope policies:
Pick the tab for your Datadog region — the `upstreamUrl` and `metricsUrl` change
per region; everything else is identical.
```yaml values.yaml theme={null}
tero:
url: https://sync.usetero.com
apiKey: "" # it is recommended to use an existing secret instead
existingSecret:
name: ""
key: ""
config:
upstreamUrl: https://agent-http-intake.logs.datadoghq.com
metricsUrl: https://api.datadoghq.com
# Service identity sent on every policy sync. The control plane scopes and
# matches policies to this service, so set name/namespace/version.
service:
name: edge
namespace: production
version: 1.0.0
resourceAttributes:
- key: deployment.environment
value: production
labels:
- key: team
value: platform
```
```yaml values.yaml theme={null}
tero:
url: https://sync.usetero.com
apiKey: "" # it is recommended to use an existing secret instead
existingSecret:
name: ""
key: ""
config:
upstreamUrl: https://agent-http-intake.logs.us3.datadoghq.com
metricsUrl: https://api.us3.datadoghq.com
service:
name: edge
namespace: production
version: 1.0.0
resourceAttributes:
- key: deployment.environment
value: production
labels:
- key: team
value: platform
```
```yaml values.yaml theme={null}
tero:
url: https://sync.usetero.com
apiKey: "" # it is recommended to use an existing secret instead
existingSecret:
name: ""
key: ""
config:
upstreamUrl: https://agent-http-intake.logs.us5.datadoghq.com
metricsUrl: https://api.us5.datadoghq.com
service:
name: edge
namespace: production
version: 1.0.0
resourceAttributes:
- key: deployment.environment
value: production
labels:
- key: team
value: platform
```
```yaml values.yaml theme={null}
tero:
url: https://sync.usetero.com
apiKey: "" # it is recommended to use an existing secret instead
existingSecret:
name: ""
key: ""
config:
upstreamUrl: https://agent-http-intake.logs.datadoghq.eu
metricsUrl: https://api.datadoghq.eu
service:
name: edge
namespace: production
version: 1.0.0
resourceAttributes:
- key: deployment.environment
value: production
labels:
- key: team
value: platform
```
```yaml values.yaml theme={null}
tero:
url: https://sync.usetero.com
apiKey: "" # it is recommended to use an existing secret instead
existingSecret:
name: ""
key: ""
config:
upstreamUrl: https://agent-http-intake.logs.ap1.datadoghq.com
metricsUrl: https://api.ap1.datadoghq.com
service:
name: edge
namespace: production
version: 1.0.0
resourceAttributes:
- key: deployment.environment
value: production
labels:
- key: team
value: platform
```
### Authentication
Setting `tero.url` automatically configures the HTTP policy provider. Provide
the API key one of two ways — never both:
| Method | Values |
| ----------------------------- | ------------------------------------------------------ |
| Inline (chart-managed Secret) | `tero.apiKey: ` |
| Existing Secret | `tero.existingSecret.name` + `tero.existingSecret.key` |
```yaml theme={null}
# Reference a Secret you manage instead of an inline key:
tero:
url: https://sync.usetero.com
existingSecret:
name: tero-edge-api
key: api-key
```
Without `tero.url`, Edge loads policies only from the local file provider — no
remote policy sync.
### Values
The keys you'll touch most. For every chart value (image, scheduling, service
account, ingress), see the chart's `README.md`.
| Key | Default | Description |
| ----------------------------------- | ---------------------------------------------- | ---------------------------------------------------------------------------------- |
| `tero.url` | `""` | Control plane base URL; setting it enables HTTP policy sync |
| `tero.apiKey` | `""` | Inline API key (chart creates the Secret) |
| `tero.existingSecret.name` | `""` | Name of a Secret you manage instead of `tero.apiKey` |
| `tero.existingSecret.key` | `api-key` | Key within that Secret holding the API key |
| `config.upstreamUrl` | `https://agent-http-intake.logs.datadoghq.com` | Logs intake endpoint (set per Datadog region) |
| `config.metricsUrl` | `https://api.datadoghq.com` | Metrics endpoint (set per Datadog region) |
| `config.logLevel` | `info` | Edge log level |
| `config.maxBodySize` | `1048576` | Max request body in bytes |
| `config.maxConnections` | `256` | Max concurrent connections; dominant memory cap (≈ `maxConnections × maxBodySize`) |
| `config.maxDecodedBytes` | `null` | Post-decompression body ceiling; defaults to `maxBodySize` |
| `config.workerCount` | `null` | httpz event-loop workers (`null` = default 1) |
| `config.threadPoolCount` | `null` | httpz handler threads (`null` = default 32; scales per-thread memory) |
| `config.service.name` | `""` | Service name sent on policy sync (omitted if empty) |
| `config.service.namespace` | `""` | Service namespace sent on policy sync |
| `config.service.version` | `""` | Service version sent on policy sync |
| `config.service.resourceAttributes` | `[]` | OTel resource attributes (`{key, value}`) sent on policy sync |
| `config.service.labels` | `[]` | Free-form labels (`{key, value}`) sent on policy sync |
| `policiesJSON` | `[]` | Local policies rendered to the file provider (raw JSON objects) |
## Verify
```bash theme={null}
kubectl -n tero-system rollout status ds/tero-edge
kubectl -n tero-system port-forward ds/tero-edge 8080:8080 &
curl http://localhost:8080/_health
```
A `200 OK` from `/_health` confirms Edge is running. Edge's own Prometheus
metrics are available at `/_edge/metrics`.
## Upgrade and uninstall
```bash theme={null}
# Upgrade to a new chart version (re-uses your values.yaml)
helm upgrade tero-edge --version \
-n tero-system -f values.yaml
# Uninstall
helm uninstall tero-edge -n tero-system
```
See the [Configuration reference](/edge/edge-reference/config) for every
`config.*` field, and [Operations](/edge/edge-reference/operations) for probes,
resource sizing, and graceful shutdown.
## Next Steps
Full configuration reference
Probes, resources, and shutdown