Azure Terraform variables reference

Complete reference of Terraform variables for LangSmith self-hosted on Azure AKS.

Complete reference for every input variable exposed by the Azure Terraform modules. Use it while filling in terraform.tfvars for the first time or tuning an existing deployment.

Variables come in two categories:

• Non-sensitive (region, sizing, feature flags): set in infra/terraform.tfvars.
• Sensitive (license key, passwords, encryption keys): set with make setup-env, which writes them to infra/secrets.auto.tfvars (gitignored, auto-loaded by Terraform) and stores them in Azure Key Vault.

For the end-to-end install, refer to the deploy guide. For how the modules fit together, refer to the architecture reference.

Core

Variable	Default	Required	Description
subscription_id	—	yes	Azure subscription ID for the deployment.
location	eastus	no	Azure region for the deployment.
identifier	""	no	Suffix appended to every resource name to distinguish environments (for example, -prod, -staging). Must start with a hyphen or be empty.
environment	dev	no	Environment tag applied to all resources.
owner	""	no	Email or team name of the resource owner. Applied as a tag.
cost_center	""	no	Cost center or billing code. Applied as a tag.

Networking

Variable	Default	Required	Description
create_vnet	true	no	Create a new VNet. Set false to bring your own VNet and subnets.
vnet_id	""	when !create_vnet	Existing VNet resource ID.
aks_subnet_id	""	when !create_vnet	Existing subnet ID for the AKS cluster.
postgres_subnet_id	""	when !create_vnet	Existing subnet ID for the PostgreSQL server.
redis_subnet_id	""	when !create_vnet	Existing subnet ID for the Redis instance.
postgres_subnet_address_prefix	["10.0.32.0/20"]	no	CIDR prefix for the PostgreSQL subnet. Can be disjoint ranges.
redis_subnet_address_prefix	["10.0.48.0/20"]	no	CIDR prefix for the Redis subnet. Can be disjoint ranges.
aks_authorized_ip_ranges	[]	no	External CIDRs permitted to reach the AKS API server. Empty leaves the API server publicly reachable so Terraform-driven Helm and kubectl steps work from any apply host. Populate with operator and CI egress CIDRs for production.

AKS

Variable	Default	Required	Description
default_node_pool_vm_size	Standard_D8s_v3	no	VM size for the default node pool. Standard_D8s_v3 (8 vCPU / 32 GiB) is the recommended baseline for the core platform with external Postgres and Redis. Use Standard_D4s_v3 (4 vCPU / 16 GiB) only for light or demo deployments with in-cluster databases.
default_node_pool_min_count	1	no	Minimum node count for the default pool. The autoscaler never scales below this floor. Set to 3 for production (the core platform needs about 14.4 vCPU, which three Standard_D8s_v3 nodes cover). Set to 1 for minimum or dev deployments.
default_node_pool_max_count	10	no	Maximum node count for the default pool. Core platform uses 4 to 6 nodes; add headroom as you enable add-ons (LangSmith Deployment ~6, Agent Builder ~8, Insights 10 to 12). Raising this takes effect immediately with no node restarts.
default_node_pool_max_pods	60	no	Maximum pods per node in the default pool. The Azure CNI default of 30 is too low for LangSmith; 60 fits a full deployment on a single node. Immutable: changing it recreates the node pool.
additional_node_pools	large: Standard_D16s_v3, 0–2	no	Additional node pools. The default large pool (Standard_D16s_v3, 16 vCPU / 64 GiB) is required for ClickHouse (requests 3.5 vCPU / 15 GiB) and LangSmith Deployment agent pods. min_count = 0 scales it to zero when idle. Raise max_count to 3 or more for Agent Builder with multiple simultaneous deployments.
aks_service_cidr	10.0.64.0/20	no	Kubernetes service CIDR. Must not overlap the VNet.
aks_dns_service_ip	10.0.64.10	no	CoreDNS service IP. Must be within aks_service_cidr.
aks_deletion_protection	true	no	Prevent accidental AKS cluster deletion. Set false for dev/test.
availability_zones	["1"]	no	Availability zones to deploy into. Use ["1", "2", "3"] for zone-redundant HA.

Data sources

Variable	Default	Required	Description
postgres_source	external	no	external provisions Azure Database for PostgreSQL Flexible Server (private VNet). in-cluster uses the chart-managed Postgres pod (dev/demo only).
redis_source	external	no	external provisions Azure Managed Redis (private VNet). in-cluster uses the chart-managed Redis pod (dev/demo only).
clickhouse_source	in-cluster	no	in-cluster (dev/POC only) or external for LangChain Managed ClickHouse, recommended for production.

PostgreSQL

Variable	Default	Required	Description
postgres_admin_username	langsmith	no	PostgreSQL administrator username.
postgres_admin_password	""	when external	PostgreSQL administrator password. Set via make setup-env.
postgres_database_name	langsmith	no	Name of the database LangSmith connects to. Must match the database that exists on the server.
postgres_deletion_protection	true	no	Prevent accidental PostgreSQL server deletion. Set false for dev/test.
postgres_geo_redundant_backup	false	no	Enable geo-redundant backups for PostgreSQL.
postgres_standby_availability_zone	""	no	Standby AZ for PostgreSQL zone-redundant HA. Empty disables the HA standby.

Redis

Variable	Default	Required	Description
amr_sku	Balanced_B0	no	Azure Managed Redis SKU. Balanced_B0 is the smallest. Move up (Balanced_B1, Balanced_B3, and so on) if the region reports AllocationFailed. Replaces the classic redis_capacity.

Blob storage

Variable	Default	Required	Description
blob_ttl_enabled	true	no	Enable lifecycle TTL rules on the blob container.
blob_ttl_short_days	14	no	TTL in days for short-lived trace blobs.
blob_ttl_long_days	400	no	TTL in days for long-lived trace blobs.
storage_allowed_ips	[]	no	Public IPs or CIDRs allowed through the storage account default-deny firewall. AKS pod traffic is allowlisted automatically via the Microsoft.Storage service endpoint. Add only external clients (operator workstations, CI runners) that need the blob data plane.

Key Vault

Variable	Default	Required	Description
keyvault_name	""	no	Key Vault name. Must be globally unique, 3 to 24 characters. When empty, main.tf computes langsmith-kv<identifier>. Override to avoid naming conflicts.
keyvault_purge_protection	true	no	Enable purge protection. Set false for dev/test to allow immediate name reuse after destroy.
keyvault_default_action	Allow	no	Default action for the Key Vault data-plane firewall. Allow keeps the first apply (which creates secrets via the data plane) working. Production sets Deny and populates keyvault_allowed_ips.
keyvault_allowed_ips	[]	no	Public IPs or CIDRs allowed through the Key Vault firewall when keyvault_default_action = "Deny". The AKS subnet is allowlisted automatically via the Microsoft.KeyVault service endpoint.

Ingress

Variable	Default	Required	Description
ingress_controller	nginx	no	Ingress controller: nginx, istio (self-managed Helm), istio-addon (Azure managed Istio, recommended on Azure), agic (Application Gateway Ingress Controller), envoy-gateway (Gateway API), or none. See INGRESS_CONTROLLERS.md for the TLS compatibility matrix.
istio_version	1.29.1	no	Istio Helm chart version. Used only when ingress_controller = "istio".
istio_addon_revision	asm-1-27	no	Azure Service Mesh revision (asm-1-<minor>). List available revisions with az aks mesh get-upgrades. Used only when ingress_controller = "istio-addon".
agic_subnet_address_prefix	["10.0.96.0/24"]	no	CIDR for the Application Gateway dedicated subnet. Must be /24 or larger. Used only when ingress_controller = "agic".
agw_sku_tier	Standard_v2	no	Application Gateway SKU tier: Standard_v2 or WAF_v2 (enables WAF). Used only when ingress_controller = "agic".
envoy_gateway_version	v1.2.0	no	Envoy Gateway Helm chart version. Used only when ingress_controller = "envoy-gateway".
ingress_ip	""	no	Public IP of the ingress load balancer, used by the DNS module for the A record. Get it with kubectl get svc -n ingress-nginx.

DNS and TLS

Variable	Default	Required	Description
dns_label	""	no	Azure Public IP DNS label for the ingress load balancer. Results in <label>.<region>.cloudapp.azure.com. Works with nginx, istio, istio-addon, and envoy-gateway. Empty skips it.
langsmith_domain	""	no	Custom hostname for LangSmith (for example, langsmith.example.com). Used in Helm values and ingress TLS. Takes priority over dns_label.
tls_certificate_source	letsencrypt	no	letsencrypt (HTTP-01 via cert-manager), dns01 (DNS-01 via cert-manager), existing (bring your own cert), or none (HTTP only, demo/dev).
letsencrypt_email	""	when letsencrypt or dns01	Email for Let’s Encrypt certificate notifications.
create_dns_zone	false	no	Create an Azure DNS zone and A record for the LangSmith domain. Required for DNS-01 issuance.

LangSmith application

Variable	Default	Required	Description
langsmith_namespace	langsmith	no	Kubernetes namespace for LangSmith. Used to scope Workload Identity for blob storage.
langsmith_release_name	langsmith	no	Helm release name. Used for Workload Identity federated credential subjects.
langsmith_domain	""	no	See DNS and TLS.
langsmith_helm_chart_version	""	no	Pin a chart version for reproducible deploys. The deploy script precedence is the CHART_VERSION environment variable, then this variable, then the pinned line default ~0.15.1 (latest 0.15.x patch).
langsmith_admin_email	""	no	Initial org admin email (initialOrgAdminEmail in Helm values). Set via make setup-env.

Sizing and add-on flags

init-values.sh and deploy.sh read these flags; Terraform ignores them. They control which Helm overlays the scripts generate.

Variable	Default	Required	Description
sizing_profile	production	no	Helm sizing overlay: minimum, dev, production, or production-large.
enable_deployments	false	no	Enable LangSmith Deployment (host-backend, listener, operator).
enable_agent_builder	false	no	Enable Agent Builder UI. Requires enable_deployments = true.
enable_insights	false	no	Enable Insights (ClickHouse-backed analytics). Requires enable_deployments = true.
enable_polly	false	no	Enable Polly (AI evaluation and monitoring). Requires enable_deployments = true.

Security and audit

Variable	Default	Required	Description
create_waf	false	no	Deploy an Azure WAF policy (OWASP 3.2 plus bot protection). Attach to Application Gateway or Front Door after creation.
waf_mode	Prevention	no	WAF enforcement mode: Detection (log only) or Prevention (block).
create_diagnostics	false	no	Deploy a Log Analytics workspace and diagnostic settings for AKS, Key Vault, and PostgreSQL.
log_retention_days	90	no	Log Analytics workspace retention in days.
create_bastion	false	no	Deploy a jump VM for private AKS access via az ssh vm.
bastion_vm_size	Standard_B2s	no	VM SKU for the bastion host.
bastion_admin_ssh_public_key	""	no	SSH public key for emergency admin access to the bastion.
bastion_allowed_ssh_cidrs	["0.0.0.0/0"]	no	CIDRs allowed inbound SSH to the bastion. Restrict to VPN or corporate ranges in production.

Sensitive variables (set with setup-env.sh)

make setup-env writes these to secrets.auto.tfvars and Terraform stores them in Azure Key Vault. Never set these inline in terraform.tfvars.

make setup-env also manages postgres_admin_password and langsmith_admin_email, documented in the PostgreSQL and LangSmith application sections. This table lists only the sensitive variables that do not appear elsewhere in this reference.

Variable	Description
langsmith_license_key	LangSmith enterprise license key.
langsmith_admin_password	Initial org admin password.
langsmith_api_key_salt	Salt for hashing API keys. Must stay stable after first deploy.
langsmith_jwt_secret	JWT secret for Basic Auth sessions. Must stay stable.
langsmith_deployments_encryption_key	Fernet key for LangSmith Deployment. Must never change.
langsmith_agent_builder_encryption_key	Fernet key for Agent Builder. Must never change.
langsmith_insights_encryption_key	Fernet key for Insights. Must never change.
langsmith_polly_encryption_key	Fernet key for Polly. Must never change.

App module variables (Terraform path)

The Terraform path (make init-app then make apply-app) manages the LangSmith Helm release, its Kubernetes Secret, and the Workload Identity ServiceAccount in Terraform state instead of through the Helm shell scripts. Its variables live in app/terraform.tfvars. Use this path as an alternative to make init-values && make deploy. For when to choose this path, refer to the Azure deployment guide.

make init-app auto-populates the infrastructure passthrough variables (subscription_id, resource_group_name, cluster_name, keyvault_name, storage_account_name, storage_container_name, workload_identity_client_id, langsmith_namespace, tls_certificate_source, ingress_controller, and dns_label) from the infra module outputs. Each defaults to null and fails at plan time with a precondition error naming what is missing. Override them only when running the app module against infrastructure you provisioned separately.

Set the following in app/terraform.tfvars:

Variable	Default	Required	Description
sizing	production	no	Resource sizing profile: production, production-large, dev, or none (chart defaults).
postgres_source	external	no	external (Azure Database for PostgreSQL) or in-cluster (Helm). Mirror the infra value.
redis_source	external	no	external (Azure Managed Redis) or in-cluster (Helm). Mirror the infra value.
hostname	null	no	LangSmith hostname. Auto-detected from dns_label when unset.
admin_email	[e-mail]	no	Initial org admin email address.
release_name	langsmith	no	Helm release name.
chart_version	""	no	LangSmith Helm chart version. Empty uses the latest.
helm_timeout	1200	no	Helm install and upgrade timeout in seconds.
helm_force_update	false	no	Force a Helm upgrade on every apply, even when values are unchanged.
enable_agent_deploys	false	no	Enable LangSmith Deployment.
enable_agent_builder	false	no	Enable Agent Builder. Requires enable_agent_deploys = true.
enable_insights	false	no	Enable Insights. Requires external ClickHouse.
enable_polly	false	no	Enable Polly AI evaluation and monitoring. Requires enable_agent_deploys = true.
enable_usage_telemetry	false	no	Enable extended usage telemetry reporting.
tls_enabled_for_deploys	null	no	Whether agent deployment endpoints use HTTPS. Auto-detected from tls_certificate_source when unset.
clickhouse_host	""	when enable_insights	ClickHouse hostname or endpoint.
clickhouse_port	8123	no	ClickHouse HTTP port.
clickhouse_database	default	no	ClickHouse database name.
clickhouse_username	default	no	ClickHouse username.
clickhouse_password	""	no	ClickHouse password. Set for authenticated ClickHouse.
clickhouse_tls	true	no	Enable TLS for the ClickHouse connection.

---

Connect these docs to Claude, VSCode, and more via MCP for real-time answers.

Edit this page on GitHub or file an issue.