> ## Documentation Index > Fetch the complete documentation index at: https://langchain-5e9cc07a-preview-docsby-1791319236-3be7a15.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Azure Terraform variables reference > Complete reference of Terraform variables for LangSmith self-hosted on Azure AKS. Complete reference for every input variable exposed by the [Azure Terraform modules](https://github.com/langchain-ai/terraform/tree/main/modules/azure). Use it while filling in `terraform.tfvars` for the first time or tuning an existing deployment. Variables come in two categories: * **Non-sensitive** (region, sizing, feature flags): set in `infra/terraform.tfvars`. * **Sensitive** (license key, passwords, encryption keys): set with `make setup-env`, which writes them to `infra/secrets.auto.tfvars` (gitignored, auto-loaded by Terraform) and stores them in Azure Key Vault. For the end-to-end install, refer to the [deploy guide](/langsmith/self-host-terraform-azure-deploy). For how the modules fit together, refer to the [architecture reference](/langsmith/self-host-terraform-azure-architecture). ## Core | Variable | Default | Required | Description | | - | - | - | - | | `subscription_id` | — | yes | Azure subscription ID for the deployment. | | `location` | `eastus` | no | Azure region for the deployment. | | `identifier` | `""` | no | Suffix appended to every resource name to distinguish environments (for example, `-prod`, `-staging`). Must start with a hyphen or be empty. | | `environment` | `dev` | no | Environment tag applied to all resources. | | `owner` | `""` | no | Email or team name of the resource owner. Applied as a tag. | | `cost_center` | `""` | no | Cost center or billing code. Applied as a tag. | ## Networking | Variable | Default | Required | Description | | - | - | - | - | | `create_vnet` | `true` | no | Create a new VNet. Set `false` to bring your own VNet and subnets. | | `vnet_id` | `""` | when `!create_vnet` | Existing VNet resource ID. | | `aks_subnet_id` | `""` | when `!create_vnet` | Existing subnet ID for the AKS cluster. | | `postgres_subnet_id` | `""` | when `!create_vnet` | Existing subnet ID for the PostgreSQL server. | | `redis_subnet_id` | `""` | when `!create_vnet` | Existing subnet ID for the Redis instance. | | `postgres_subnet_address_prefix` | `["10.0.32.0/20"]` | no | CIDR prefix for the PostgreSQL subnet. Can be disjoint ranges. | | `redis_subnet_address_prefix` | `["10.0.48.0/20"]` | no | CIDR prefix for the Redis subnet. Can be disjoint ranges. | | `aks_authorized_ip_ranges` | `[]` | no | External CIDRs permitted to reach the AKS API server. Empty leaves the API server publicly reachable so Terraform-driven Helm and `kubectl` steps work from any apply host. Populate with operator and CI egress CIDRs for production. | ## AKS | Variable | Default | Required | Description | | - | - | - | - | | `default_node_pool_vm_size` | `Standard_D8s_v3` | no | VM size for the default node pool. `Standard_D8s_v3` (8 vCPU / 32 GiB) is the recommended baseline for the core platform with external Postgres and Redis. Use `Standard_D4s_v3` (4 vCPU / 16 GiB) only for light or demo deployments with in-cluster databases. | | `default_node_pool_min_count` | `1` | no | Minimum node count for the default pool. The autoscaler never scales below this floor. Set to 3 for production (the core platform needs about 14.4 vCPU, which three `Standard_D8s_v3` nodes cover). Set to 1 for minimum or dev deployments. | | `default_node_pool_max_count` | `10` | no | Maximum node count for the default pool. Core platform uses 4 to 6 nodes; add headroom as you enable add-ons (LangSmith Deployment \~6, Agent Builder \~8, Insights 10 to 12). Raising this takes effect immediately with no node restarts. | | `default_node_pool_max_pods` | `60` | no | Maximum pods per node in the default pool. The Azure CNI default of 30 is too low for LangSmith; 60 fits a full deployment on a single node. Immutable: changing it recreates the node pool. | | `additional_node_pools` | `large: Standard_D16s_v3, 0–2` | no | Additional node pools. The default `large` pool (`Standard_D16s_v3`, 16 vCPU / 64 GiB) is required for ClickHouse (requests 3.5 vCPU / 15 GiB) and LangSmith Deployment agent pods. `min_count = 0` scales it to zero when idle. Raise `max_count` to 3 or more for Agent Builder with multiple simultaneous deployments. | | `aks_service_cidr` | `10.0.64.0/20` | no | Kubernetes service CIDR. Must not overlap the VNet. | | `aks_dns_service_ip` | `10.0.64.10` | no | CoreDNS service IP. Must be within `aks_service_cidr`. | | `aks_deletion_protection` | `true` | no | Prevent accidental AKS cluster deletion. Set `false` for dev/test. | | `availability_zones` | `["1"]` | no | Availability zones to deploy into. Use `["1", "2", "3"]` for zone-redundant HA. | ## Data sources | Variable | Default | Required | Description | | - | - | - | - | | `postgres_source` | `external` | no | `external` provisions Azure Database for PostgreSQL Flexible Server (private VNet). `in-cluster` uses the chart-managed Postgres pod (dev/demo only). | | `redis_source` | `external` | no | `external` provisions Azure Managed Redis (private VNet). `in-cluster` uses the chart-managed Redis pod (dev/demo only). | | `clickhouse_source` | `in-cluster` | no | `in-cluster` (dev/POC only) or `external` for [LangChain Managed ClickHouse](/langsmith/langsmith-managed-clickhouse), recommended for production. | ## PostgreSQL | Variable | Default | Required | Description | | - | - | - | - | | `postgres_admin_username` | `langsmith` | no | PostgreSQL administrator username. | | `postgres_admin_password` | `""` | when external | PostgreSQL administrator password. Set via `make setup-env`. | | `postgres_database_name` | `langsmith` | no | Name of the database LangSmith connects to. Must match the database that exists on the server. | | `postgres_deletion_protection` | `true` | no | Prevent accidental PostgreSQL server deletion. Set `false` for dev/test. | | `postgres_geo_redundant_backup` | `false` | no | Enable geo-redundant backups for PostgreSQL. | | `postgres_standby_availability_zone` | `""` | no | Standby AZ for PostgreSQL zone-redundant HA. Empty disables the HA standby. | ## Redis | Variable | Default | Required | Description | | - | - | - | - | | `amr_sku` | `Balanced_B0` | no | Azure Managed Redis SKU. `Balanced_B0` is the smallest. Move up (`Balanced_B1`, `Balanced_B3`, and so on) if the region reports `AllocationFailed`. Replaces the classic `redis_capacity`. | ## Blob storage | Variable | Default | Required | Description | | - | - | - | - | | `blob_ttl_enabled` | `true` | no | Enable lifecycle TTL rules on the blob container. | | `blob_ttl_short_days` | `14` | no | TTL in days for short-lived trace blobs. | | `blob_ttl_long_days` | `400` | no | TTL in days for long-lived trace blobs. | | `storage_allowed_ips` | `[]` | no | Public IPs or CIDRs allowed through the storage account default-deny firewall. AKS pod traffic is allowlisted automatically via the `Microsoft.Storage` service endpoint. Add only external clients (operator workstations, CI runners) that need the blob data plane. | ## Key Vault | Variable | Default | Required | Description | | - | - | - | - | | `keyvault_name` | `""` | no | Key Vault name. Must be globally unique, 3 to 24 characters. When empty, `main.tf` computes `langsmith-kv`. Override to avoid naming conflicts. | | `keyvault_purge_protection` | `true` | no | Enable purge protection. Set `false` for dev/test to allow immediate name reuse after destroy. | | `keyvault_default_action` | `Allow` | no | Default action for the Key Vault data-plane firewall. `Allow` keeps the first apply (which creates secrets via the data plane) working. Production sets `Deny` and populates `keyvault_allowed_ips`. | | `keyvault_allowed_ips` | `[]` | no | Public IPs or CIDRs allowed through the Key Vault firewall when `keyvault_default_action = "Deny"`. The AKS subnet is allowlisted automatically via the `Microsoft.KeyVault` service endpoint. | ## Ingress | Variable | Default | Required | Description | | - | - | - | - | | `ingress_controller` | `nginx` | no | Ingress controller: `nginx`, `istio` (self-managed Helm), `istio-addon` (Azure managed Istio, recommended on Azure), `agic` (Application Gateway Ingress Controller), `envoy-gateway` (Gateway API), or `none`. See [`INGRESS_CONTROLLERS.md`](https://github.com/langchain-ai/terraform/blob/main/modules/azure/INGRESS_CONTROLLERS.md) for the TLS compatibility matrix. | | `istio_version` | `1.29.1` | no | Istio Helm chart version. Used only when `ingress_controller = "istio"`. | | `istio_addon_revision` | `asm-1-27` | no | Azure Service Mesh revision (`asm-1-`). List available revisions with `az aks mesh get-upgrades`. Used only when `ingress_controller = "istio-addon"`. | | `agic_subnet_address_prefix` | `["10.0.96.0/24"]` | no | CIDR for the Application Gateway dedicated subnet. Must be `/24` or larger. Used only when `ingress_controller = "agic"`. | | `agw_sku_tier` | `Standard_v2` | no | Application Gateway SKU tier: `Standard_v2` or `WAF_v2` (enables WAF). Used only when `ingress_controller = "agic"`. | | `envoy_gateway_version` | `v1.2.0` | no | Envoy Gateway Helm chart version. Used only when `ingress_controller = "envoy-gateway"`. | | `ingress_ip` | `""` | no | Public IP of the ingress load balancer, used by the DNS module for the A record. Get it with `kubectl get svc -n ingress-nginx`. | ## DNS and TLS | Variable | Default | Required | Description | | - | - | - | - | | `dns_label` | `""` | no | Azure Public IP DNS label for the ingress load balancer. Results in `