> ## Documentation Index > Fetch the complete documentation index at: https://langchain-5e9cc07a-preview-featse-1779998369-ad736a3.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # GCP Terraform variables reference > Complete reference of Terraform variables for LangSmith self-hosted on GCP GKE. Reference for every input variable exposed by the [GCP Terraform modules](https://github.com/langchain-ai/terraform/tree/main/modules/gcp). Set non-sensitive variables in `infra/terraform.tfvars`. For sensitive variables (license key, passwords, encryption keys), `make setup-env` writes them to Secret Manager and the deploy script wires them into the cluster. ## Core | Variable | Default | Required | Description | | --------------- | --------------- | -------- | ----------------------------------------------------- | | `project_id` | — | yes | GCP project ID. | | `region` | `us-west2` | no | GCP region. | | `zone` | `us-west2-a` | no | GCP zone for zonal resources. | | `environment` | `prod` | no | Environment: `dev`, `staging`, `prod`, `test`, `uat`. | | `name_prefix` | `ls` | no | Resource name prefix (1 to 11 chars). | | `unique_suffix` | `true` | no | Append a random suffix to resource names. | | `owner` | `platform-team` | no | Owner label applied to all resources. | | `cost_center` | `""` | no | Cost center label for billing attribution. | | `labels` | `{}` | no | Additional labels applied to all resources. | ## Networking | Variable | Default | Required | Description | | --------------- | ------------- | -------- | ------------------------ | | `subnet_cidr` | `10.0.0.0/20` | no | CIDR for the GKE subnet. | | `pods_cidr` | `10.4.0.0/14` | no | CIDR for GKE pods. | | `services_cidr` | `10.8.0.0/20` | no | CIDR for GKE services. | ## GKE | Variable | Default | Required | Description | | ----------------------------- | --------------- | -------- | -------------------------------------------------- | | `gke_use_autopilot` | `false` | no | Use GKE Autopilot mode. | | `gke_node_count` | `2` | no | Initial node count per zone (Standard mode). | | `gke_min_nodes` | `2` | no | Minimum nodes per zone for autoscaling. | | `gke_max_nodes` | `10` | no | Maximum nodes per zone for autoscaling. | | `gke_machine_type` | `e2-standard-4` | no | GKE node machine type. | | `gke_disk_size` | `100` | no | Node disk size in GB. | | `gke_release_channel` | `REGULAR` | no | GKE release channel: `RAPID`, `REGULAR`, `STABLE`. | | `gke_deletion_protection` | `true` | no | Enable deletion protection on the GKE cluster. | | `gke_network_policy_provider` | `DATA_PLANE_V2` | no | Network policy: `CALICO` or `DATA_PLANE_V2`. | ## PostgreSQL (Cloud SQL) | Variable | Default | Required | Description | | ------------------------------ | ------------------ | ------------- | ---------------------------------------------------- | | `postgres_source` | `external` | no | `external` (Cloud SQL) or `in-cluster` (Helm). | | `postgres_version` | `POSTGRES_15` | no | PostgreSQL version for Cloud SQL. | | `postgres_tier` | `db-custom-2-8192` | no | Cloud SQL machine tier. | | `postgres_disk_size` | `50` | no | Cloud SQL disk size in GB. | | `postgres_high_availability` | `true` | no | Enable Cloud SQL HA (regional standby). | | `postgres_deletion_protection` | `true` | no | Enable deletion protection on Cloud SQL. | | `postgres_password` | `""` | when external | PostgreSQL password. Use `TF_VAR_postgres_password`. | ## Redis (Memorystore) | Variable | Default | Required | Description | | ------------------------- | ----------- | -------- | ------------------------------------------------ | | `redis_source` | `external` | no | `external` (Memorystore) or `in-cluster` (Helm). | | `redis_version` | `REDIS_7_0` | no | Redis version for Memorystore. | | `redis_memory_size` | `5` | no | Memorystore Redis memory size in GB. | | `redis_high_availability` | `true` | no | Enable Memorystore HA tier (Standard HA). | | `redis_prevent_destroy` | `false` | no | Prevent accidental Terraform destroy of Redis. | ## ClickHouse | Variable | Default | Required | Description | | ---------------------- | ------------ | ------------- | ------------------------------------------------- | | `clickhouse_source` | `in-cluster` | no | `in-cluster`, `langsmith-managed`, or `external`. | | `clickhouse_host` | `""` | when external | ClickHouse host (external or managed only). | | `clickhouse_port` | `9440` | no | ClickHouse native protocol port. | | `clickhouse_http_port` | `8443` | no | ClickHouse HTTP port. | | `clickhouse_user` | `default` | no | ClickHouse username. | | `clickhouse_tls` | `true` | no | Enable TLS for ClickHouse connections. | ## GCS storage | Variable | Default | Required | Description | | ------------------------ | ------- | -------- | ------------------------------------------ | | `storage_ttl_short_days` | `14` | no | GCS TTL for `ttl_s/` prefix. | | `storage_ttl_long_days` | `400` | no | GCS TTL for `ttl_l/` prefix. | | `storage_force_destroy` | `false` | no | Allow bucket deletion with objects inside. | ## LangSmith application | Variable | Default | Required | Description | | ------------------------------ | ----------------------- | -------- | ------------------------------------------------ | | `langsmith_namespace` | `langsmith` | no | Kubernetes namespace for LangSmith. | | `langsmith_domain` | `langsmith.example.com` | no | Fully qualified domain name. | | `langsmith_license_key` | `""` | no | License key. Use `TF_VAR_langsmith_license_key`. | | `langsmith_helm_chart_version` | `""` | no | Pin Helm chart version (empty = latest). | ## Ingress and TLS | Variable | Default | Required | Description | | ------------------------ | --------------- | ------------------ | ------------------------------------------- | | `install_ingress` | `true` | no | Install Envoy Gateway via Terraform. | | `ingress_type` | `envoy` | no | Ingress type: `envoy`, `istio`, or `other`. | | `tls_certificate_source` | `none` | no | `none`, `letsencrypt`, or `existing`. | | `letsencrypt_email` | `""` | when `letsencrypt` | Email for Let's Encrypt notifications. | | `tls_secret_name` | `langsmith-tls` | no | Name for the TLS secret in Kubernetes. | ## Add-on pass flags | Variable | Default | Required | Description | | ----------------------------- | ------- | -------- | --------------------------------------------------------- | | `enable_langsmith_deployment` | `true` | no | Enable LangSmith Deployment. Installs KEDA automatically. | ## Optional GCP modules | Variable | Default | Description | | ------------------------------ | ------- | ----------------------------------------------------------------- | | `enable_gcp_iam_module` | `true` | Wires `modules/iam` for Workload Identity and bucket IAM binding. | | `enable_secret_manager_module` | `false` | Wires `modules/secrets` for Secret Manager bootstrap secret. | | `enable_dns_module` | `false` | Wires `modules/dns` for Cloud DNS and managed cert. | | `dns_create_zone` | `true` | Create a DNS zone when the DNS module is enabled. | | `dns_existing_zone_name` | `""` | Existing zone to use when `dns_create_zone = false`. | | `dns_create_certificate` | `true` | Create a Google-managed cert when the DNS module is enabled. | ## Sensitive variables (set with `setup-env.sh`) `make setup-env` writes these to Secret Manager. Never set these inline in `terraform.tfvars`. | Variable | Description | | ---------------------------------------- | --------------------------------------------------------------- | | `langsmith_license_key` | LangSmith enterprise license key. | | `langsmith_admin_password` | Initial org admin password. | | `langsmith_api_key_salt` | Salt for hashing API keys. Must stay stable after first deploy. | | `langsmith_jwt_secret` | JWT secret for Basic Auth sessions. | | `langsmith_deployments_encryption_key` | Fernet key for LangSmith Deployment. Must never change. | | `langsmith_agent_builder_encryption_key` | Fernet key for Agent Builder. Must never change. | | `langsmith_insights_encryption_key` | Fernet key for Insights. Must never change. | | `langsmith_polly_encryption_key` | Fernet key for Polly. Must never change. | ***
[Connect these docs](/use-these-docs) to Claude, VSCode, and more via MCP for real-time answers. [Edit this page on GitHub](https://github.com/langchain-ai/docs/edit/main/src/langsmith/self-host-terraform-gcp-variables.mdx) or [file an issue](https://github.com/langchain-ai/docs/issues/new/choose).