GCP Terraform variables reference

Complete reference of Terraform variables for LangSmith self-hosted on GCP GKE.

Reference for every input variable exposed by the GCP Terraform modules. Set non-sensitive variables in infra/terraform.tfvars. For sensitive variables (license key, passwords, encryption keys), make setup-env writes them to Secret Manager and the deploy script wires them into the cluster.

Core

Variable	Default	Required	Description
project_id	—	yes	GCP project ID.
region	us-west2	no	GCP region.
zone	us-west2-a	no	GCP zone for zonal resources.
environment	prod	no	Environment: dev, staging, prod, test, uat.
name_prefix	ls	no	Resource name prefix (1 to 11 chars).
unique_suffix	true	no	Append a random suffix to resource names.
owner	platform-team	no	Owner label applied to all resources.
cost_center	""	no	Cost center label for billing attribution.
labels	{}	no	Additional labels applied to all resources.

Networking

Variable	Default	Required	Description
subnet_cidr	10.0.0.0/20	no	CIDR for the GKE subnet.
pods_cidr	10.4.0.0/14	no	CIDR for GKE pods.
services_cidr	10.8.0.0/20	no	CIDR for GKE services.

GKE

Variable	Default	Required	Description
gke_use_autopilot	false	no	Use GKE Autopilot mode.
gke_node_count	2	no	Initial node count per zone (Standard mode).
gke_min_nodes	2	no	Minimum nodes per zone for autoscaling.
gke_max_nodes	10	no	Maximum nodes per zone for autoscaling.
gke_machine_type	e2-standard-4	no	GKE node machine type.
gke_disk_size	100	no	Node disk size in GB.
gke_release_channel	REGULAR	no	GKE release channel: RAPID, REGULAR, STABLE.
gke_deletion_protection	true	no	Enable deletion protection on the GKE cluster.
gke_network_policy_provider	DATA_PLANE_V2	no	Network policy: CALICO or DATA_PLANE_V2.

PostgreSQL (Cloud SQL)

Variable	Default	Required	Description
postgres_source	external	no	external (Cloud SQL) or in-cluster (Helm).
postgres_version	POSTGRES_15	no	PostgreSQL version for Cloud SQL.
postgres_tier	db-custom-2-8192	no	Cloud SQL machine tier.
postgres_disk_size	50	no	Cloud SQL disk size in GB.
postgres_high_availability	true	no	Enable Cloud SQL HA (regional standby).
postgres_deletion_protection	true	no	Enable deletion protection on Cloud SQL.
postgres_password	""	when external	PostgreSQL password. Use TF_VAR_postgres_password.

Redis (Memorystore)

Variable	Default	Required	Description
redis_source	external	no	external (Memorystore) or in-cluster (Helm).
redis_version	REDIS_7_0	no	Redis version for Memorystore.
redis_memory_size	5	no	Memorystore Redis memory size in GB.
redis_high_availability	true	no	Enable Memorystore HA tier (Standard HA).
redis_prevent_destroy	false	no	Prevent accidental Terraform destroy of Redis.

ClickHouse

Variable	Default	Required	Description
clickhouse_source	in-cluster	no	in-cluster, langsmith-managed, or external.
clickhouse_host	""	when external	ClickHouse host (external or managed only).
clickhouse_port	9440	no	ClickHouse native protocol port.
clickhouse_http_port	8443	no	ClickHouse HTTP port.
clickhouse_user	default	no	ClickHouse username.
clickhouse_tls	true	no	Enable TLS for ClickHouse connections.

GCS storage

Variable	Default	Required	Description
storage_ttl_short_days	14	no	GCS TTL for ttl_s/ prefix.
storage_ttl_long_days	400	no	GCS TTL for ttl_l/ prefix.
storage_force_destroy	false	no	Allow bucket deletion with objects inside.

LangSmith application

Variable	Default	Required	Description
langsmith_namespace	langsmith	no	Kubernetes namespace for LangSmith.
langsmith_domain	langsmith.example.com	no	Fully qualified domain name.
langsmith_license_key	""	no	License key. Use TF_VAR_langsmith_license_key.
langsmith_helm_chart_version	""	no	Pin Helm chart version (empty = latest).

Ingress and TLS

Variable	Default	Required	Description
install_ingress	true	no	Install Envoy Gateway via Terraform.
ingress_type	envoy	no	Ingress type: envoy, istio, or other.
tls_certificate_source	none	no	none, letsencrypt, or existing.
letsencrypt_email	""	when letsencrypt	Email for Let’s Encrypt notifications.
tls_secret_name	langsmith-tls	no	Name for the TLS secret in Kubernetes.

Add-on pass flags

Variable	Default	Required	Description
enable_langsmith_deployment	true	no	Enable LangSmith Deployment. Installs KEDA automatically.

Optional GCP modules

Variable	Default	Description
enable_gcp_iam_module	true	Wires modules/iam for Workload Identity and bucket IAM binding.
enable_secret_manager_module	false	Wires modules/secrets for Secret Manager bootstrap secret.
enable_dns_module	false	Wires modules/dns for Cloud DNS and managed cert.
dns_create_zone	true	Create a DNS zone when the DNS module is enabled.
dns_existing_zone_name	""	Existing zone to use when dns_create_zone = false.
dns_create_certificate	true	Create a Google-managed cert when the DNS module is enabled.

Sensitive variables (set with setup-env.sh)

make setup-env writes these to Secret Manager. Never set these inline in terraform.tfvars.

Variable	Description
langsmith_license_key	LangSmith enterprise license key.
langsmith_admin_password	Initial org admin password.
langsmith_api_key_salt	Salt for hashing API keys. Must stay stable after first deploy.
langsmith_jwt_secret	JWT secret for Basic Auth sessions.
langsmith_deployments_encryption_key	Fernet key for LangSmith Deployment. Must never change.
langsmith_agent_builder_encryption_key	Fernet key for Agent Builder. Must never change.
langsmith_insights_encryption_key	Fernet key for Insights. Must never change.
langsmith_polly_encryption_key	Fernet key for Polly. Must never change.

---

Connect these docs to Claude, VSCode, and more via MCP for real-time answers.

Edit this page on GitHub or file an issue.