terraform.tfvars for the first time or tuning an existing deployment.
Variables come in two categories:
- Non-sensitive (region, sizing, feature flags): set in
infra/terraform.tfvars. - Sensitive (license key, passwords, encryption keys): set with
make setup-env, which writes them toinfra/secrets.auto.tfvars(gitignored, auto-loaded by Terraform) and stores them in Azure Key Vault.
Core
| Variable | Default | Required | Description |
|---|---|---|---|
subscription_id | — | yes | Azure subscription ID for the deployment. |
location | eastus | no | Azure region for the deployment. |
identifier | "" | no | Suffix appended to every resource name to distinguish environments (for example, -prod, -staging). Must start with a hyphen or be empty. |
environment | dev | no | Environment tag applied to all resources. |
owner | "" | no | Email or team name of the resource owner. Applied as a tag. |
cost_center | "" | no | Cost center or billing code. Applied as a tag. |
Networking
| Variable | Default | Required | Description |
|---|---|---|---|
create_vnet | true | no | Create a new VNet. Set false to bring your own VNet and subnets. |
vnet_id | "" | when !create_vnet | Existing VNet resource ID. |
aks_subnet_id | "" | when !create_vnet | Existing subnet ID for the AKS cluster. |
postgres_subnet_id | "" | when !create_vnet | Existing subnet ID for the PostgreSQL server. |
redis_subnet_id | "" | when !create_vnet | Existing subnet ID for the Redis instance. |
postgres_subnet_address_prefix | ["10.0.32.0/20"] | no | CIDR prefix for the PostgreSQL subnet. Can be disjoint ranges. |
redis_subnet_address_prefix | ["10.0.48.0/20"] | no | CIDR prefix for the Redis subnet. Can be disjoint ranges. |
aks_authorized_ip_ranges | [] | no | External CIDRs permitted to reach the AKS API server. Empty leaves the API server publicly reachable so Terraform-driven Helm and kubectl steps work from any apply host. Populate with operator and CI egress CIDRs for production. |
AKS
| Variable | Default | Required | Description |
|---|---|---|---|
default_node_pool_vm_size | Standard_D8s_v3 | no | VM size for the default node pool. Standard_D8s_v3 (8 vCPU / 32 GiB) is the recommended baseline for the core platform with external Postgres and Redis. Use Standard_D4s_v3 (4 vCPU / 16 GiB) only for light or demo deployments with in-cluster databases. |
default_node_pool_min_count | 1 | no | Minimum node count for the default pool. The autoscaler never scales below this floor. Set to 3 for production (the core platform needs about 14.4 vCPU, which three Standard_D8s_v3 nodes cover). Set to 1 for minimum or dev deployments. |
default_node_pool_max_count | 10 | no | Maximum node count for the default pool. Core platform uses 4 to 6 nodes; add headroom as you enable add-ons (LangSmith Deployment ~6, Agent Builder ~8, Insights 10 to 12). Raising this takes effect immediately with no node restarts. |
default_node_pool_max_pods | 60 | no | Maximum pods per node in the default pool. The Azure CNI default of 30 is too low for LangSmith; 60 fits a full deployment on a single node. Immutable: changing it recreates the node pool. |
additional_node_pools | large: Standard_D16s_v3, 0–2 | no | Additional node pools. The default large pool (Standard_D16s_v3, 16 vCPU / 64 GiB) is required for ClickHouse (requests 3.5 vCPU / 15 GiB) and LangSmith Deployment agent pods. min_count = 0 scales it to zero when idle. Raise max_count to 3 or more for Agent Builder with multiple simultaneous deployments. |
aks_service_cidr | 10.0.64.0/20 | no | Kubernetes service CIDR. Must not overlap the VNet. |
aks_dns_service_ip | 10.0.64.10 | no | CoreDNS service IP. Must be within aks_service_cidr. |
aks_deletion_protection | true | no | Prevent accidental AKS cluster deletion. Set false for dev/test. |
availability_zones | ["1"] | no | Availability zones to deploy into. Use ["1", "2", "3"] for zone-redundant HA. |
Data sources
| Variable | Default | Required | Description |
|---|---|---|---|
postgres_source | external | no | external provisions Azure Database for PostgreSQL Flexible Server (private VNet). in-cluster uses the chart-managed Postgres pod (dev/demo only). |
redis_source | external | no | external provisions Azure Managed Redis (private VNet). in-cluster uses the chart-managed Redis pod (dev/demo only). |
clickhouse_source | in-cluster | no | in-cluster (dev/POC only) or external for LangChain Managed ClickHouse, recommended for production. |
PostgreSQL
| Variable | Default | Required | Description |
|---|---|---|---|
postgres_admin_username | langsmith | no | PostgreSQL administrator username. |
postgres_admin_password | "" | when external | PostgreSQL administrator password. Set via make setup-env. |
postgres_database_name | langsmith | no | Name of the database LangSmith connects to. Must match the database that exists on the server. |
postgres_deletion_protection | true | no | Prevent accidental PostgreSQL server deletion. Set false for dev/test. |
postgres_geo_redundant_backup | false | no | Enable geo-redundant backups for PostgreSQL. |
postgres_standby_availability_zone | "" | no | Standby AZ for PostgreSQL zone-redundant HA. Empty disables the HA standby. |
Redis
| Variable | Default | Required | Description |
|---|---|---|---|
amr_sku | Balanced_B0 | no | Azure Managed Redis SKU. Balanced_B0 is the smallest. Move up (Balanced_B1, Balanced_B3, and so on) if the region reports AllocationFailed. Replaces the classic redis_capacity. |
Blob storage
| Variable | Default | Required | Description |
|---|---|---|---|
blob_ttl_enabled | true | no | Enable lifecycle TTL rules on the blob container. |
blob_ttl_short_days | 14 | no | TTL in days for short-lived trace blobs. |
blob_ttl_long_days | 400 | no | TTL in days for long-lived trace blobs. |
storage_allowed_ips | [] | no | Public IPs or CIDRs allowed through the storage account default-deny firewall. AKS pod traffic is allowlisted automatically via the Microsoft.Storage service endpoint. Add only external clients (operator workstations, CI runners) that need the blob data plane. |
Key Vault
| Variable | Default | Required | Description |
|---|---|---|---|
keyvault_name | "" | no | Key Vault name. Must be globally unique, 3 to 24 characters. When empty, main.tf computes langsmith-kv<identifier>. Override to avoid naming conflicts. |
keyvault_purge_protection | true | no | Enable purge protection. Set false for dev/test to allow immediate name reuse after destroy. |
keyvault_default_action | Allow | no | Default action for the Key Vault data-plane firewall. Allow keeps the first apply (which creates secrets via the data plane) working. Production sets Deny and populates keyvault_allowed_ips. |
keyvault_allowed_ips | [] | no | Public IPs or CIDRs allowed through the Key Vault firewall when keyvault_default_action = "Deny". The AKS subnet is allowlisted automatically via the Microsoft.KeyVault service endpoint. |
Ingress
| Variable | Default | Required | Description |
|---|---|---|---|
ingress_controller | nginx | no | Ingress controller: nginx, istio (self-managed Helm), istio-addon (Azure managed Istio, recommended on Azure), agic (Application Gateway Ingress Controller), envoy-gateway (Gateway API), or none. See INGRESS_CONTROLLERS.md for the TLS compatibility matrix. |
istio_version | 1.29.1 | no | Istio Helm chart version. Used only when ingress_controller = "istio". |
istio_addon_revision | asm-1-27 | no | Azure Service Mesh revision (asm-1-<minor>). List available revisions with az aks mesh get-upgrades. Used only when ingress_controller = "istio-addon". |
agic_subnet_address_prefix | ["10.0.96.0/24"] | no | CIDR for the Application Gateway dedicated subnet. Must be /24 or larger. Used only when ingress_controller = "agic". |
agw_sku_tier | Standard_v2 | no | Application Gateway SKU tier: Standard_v2 or WAF_v2 (enables WAF). Used only when ingress_controller = "agic". |
envoy_gateway_version | v1.2.0 | no | Envoy Gateway Helm chart version. Used only when ingress_controller = "envoy-gateway". |
ingress_ip | "" | no | Public IP of the ingress load balancer, used by the DNS module for the A record. Get it with kubectl get svc -n ingress-nginx. |
DNS and TLS
| Variable | Default | Required | Description |
|---|---|---|---|
dns_label | "" | no | Azure Public IP DNS label for the ingress load balancer. Results in <label>.<region>.cloudapp.azure.com. Works with nginx, istio, istio-addon, and envoy-gateway. Empty skips it. |
langsmith_domain | "" | no | Custom hostname for LangSmith (for example, langsmith.example.com). Used in Helm values and ingress TLS. Takes priority over dns_label. |
tls_certificate_source | letsencrypt | no | letsencrypt (HTTP-01 via cert-manager), dns01 (DNS-01 via cert-manager), existing (bring your own cert), or none (HTTP only, demo/dev). |
letsencrypt_email | "" | when letsencrypt or dns01 | Email for Let’s Encrypt certificate notifications. |
create_dns_zone | false | no | Create an Azure DNS zone and A record for the LangSmith domain. Required for DNS-01 issuance. |
LangSmith application
| Variable | Default | Required | Description |
|---|---|---|---|
langsmith_namespace | langsmith | no | Kubernetes namespace for LangSmith. Used to scope Workload Identity for blob storage. |
langsmith_release_name | langsmith | no | Helm release name. Used for Workload Identity federated credential subjects. |
langsmith_domain | "" | no | See DNS and TLS. |
langsmith_helm_chart_version | "" | no | Pin a chart version for reproducible deploys. The deploy script precedence is the CHART_VERSION environment variable, then this variable, then the pinned line default ~0.15.1 (latest 0.15.x patch). |
langsmith_admin_email | "" | no | Initial org admin email (initialOrgAdminEmail in Helm values). Set via make setup-env. |
Sizing and add-on flags
init-values.sh and deploy.sh read these flags; Terraform ignores them. They control which Helm overlays the scripts generate.
| Variable | Default | Required | Description |
|---|---|---|---|
sizing_profile | production | no | Helm sizing overlay: minimum, dev, production, or production-large. |
enable_deployments | false | no | Enable LangSmith Deployment (host-backend, listener, operator). |
enable_agent_builder | false | no | Enable Agent Builder UI. Requires enable_deployments = true. |
enable_insights | false | no | Enable Insights (ClickHouse-backed analytics). Requires enable_deployments = true. |
enable_polly | false | no | Enable Polly (AI evaluation and monitoring). Requires enable_deployments = true. |
Security and audit
| Variable | Default | Required | Description |
|---|---|---|---|
create_waf | false | no | Deploy an Azure WAF policy (OWASP 3.2 plus bot protection). Attach to Application Gateway or Front Door after creation. |
waf_mode | Prevention | no | WAF enforcement mode: Detection (log only) or Prevention (block). |
create_diagnostics | false | no | Deploy a Log Analytics workspace and diagnostic settings for AKS, Key Vault, and PostgreSQL. |
log_retention_days | 90 | no | Log Analytics workspace retention in days. |
create_bastion | false | no | Deploy a jump VM for private AKS access via az ssh vm. |
bastion_vm_size | Standard_B2s | no | VM SKU for the bastion host. |
bastion_admin_ssh_public_key | "" | no | SSH public key for emergency admin access to the bastion. |
bastion_allowed_ssh_cidrs | ["0.0.0.0/0"] | no | CIDRs allowed inbound SSH to the bastion. Restrict to VPN or corporate ranges in production. |
Sensitive variables (set with setup-env.sh)
make setup-env writes these to secrets.auto.tfvars and Terraform stores them in Azure Key Vault. Never set these inline in terraform.tfvars.
make setup-env also manages postgres_admin_password and langsmith_admin_email, documented in the PostgreSQL and LangSmith application sections. This table lists only the sensitive variables that do not appear elsewhere in this reference.
| Variable | Description |
|---|---|
langsmith_license_key | LangSmith enterprise license key. |
langsmith_admin_password | Initial org admin password. |
langsmith_api_key_salt | Salt for hashing API keys. Must stay stable after first deploy. |
langsmith_jwt_secret | JWT secret for Basic Auth sessions. Must stay stable. |
langsmith_deployments_encryption_key | Fernet key for LangSmith Deployment. Must never change. |
langsmith_agent_builder_encryption_key | Fernet key for Agent Builder. Must never change. |
langsmith_insights_encryption_key | Fernet key for Insights. Must never change. |
langsmith_polly_encryption_key | Fernet key for Polly. Must never change. |
App module variables (Terraform path)
The Terraform path (make init-app then make apply-app) manages the LangSmith Helm release, its Kubernetes Secret, and the Workload Identity ServiceAccount in Terraform state instead of through the Helm shell scripts. Its variables live in app/terraform.tfvars. Use this path as an alternative to make init-values && make deploy. For when to choose this path, refer to the Azure deployment guide.
make init-app auto-populates the infrastructure passthrough variables (subscription_id, resource_group_name, cluster_name, keyvault_name, storage_account_name, storage_container_name, workload_identity_client_id, langsmith_namespace, tls_certificate_source, ingress_controller, and dns_label) from the infra module outputs. Each defaults to null and fails at plan time with a precondition error naming what is missing. Override them only when running the app module against infrastructure you provisioned separately.
Set the following in app/terraform.tfvars:
| Variable | Default | Required | Description |
|---|---|---|---|
sizing | production | no | Resource sizing profile: production, production-large, dev, or none (chart defaults). |
postgres_source | external | no | external (Azure Database for PostgreSQL) or in-cluster (Helm). Mirror the infra value. |
redis_source | external | no | external (Azure Managed Redis) or in-cluster (Helm). Mirror the infra value. |
hostname | null | no | LangSmith hostname. Auto-detected from dns_label when unset. |
admin_email | admin@example.com | no | Initial org admin email address. |
release_name | langsmith | no | Helm release name. |
chart_version | "" | no | LangSmith Helm chart version. Empty uses the latest. |
helm_timeout | 1200 | no | Helm install and upgrade timeout in seconds. |
helm_force_update | false | no | Force a Helm upgrade on every apply, even when values are unchanged. |
enable_agent_deploys | false | no | Enable LangSmith Deployment. |
enable_agent_builder | false | no | Enable Agent Builder. Requires enable_agent_deploys = true. |
enable_insights | false | no | Enable Insights. Requires external ClickHouse. |
enable_polly | false | no | Enable Polly AI evaluation and monitoring. Requires enable_agent_deploys = true. |
enable_usage_telemetry | false | no | Enable extended usage telemetry reporting. |
tls_enabled_for_deploys | null | no | Whether agent deployment endpoints use HTTPS. Auto-detected from tls_certificate_source when unset. |
clickhouse_host | "" | when enable_insights | ClickHouse hostname or endpoint. |
clickhouse_port | 8123 | no | ClickHouse HTTP port. |
clickhouse_database | default | no | ClickHouse database name. |
clickhouse_username | default | no | ClickHouse username. |
clickhouse_password | "" | no | ClickHouse password. Set for authenticated ClickHouse. |
clickhouse_tls | true | no | Enable TLS for the ClickHouse connection. |
Connect these docs to Claude, VSCode, and more via MCP for real-time answers.