Skip to main content
The install is the same on every provider. Follow your model’s guide — Hybrid, External, or Central — and use this page for the choices that differ underneath it. OpenShift has its own page, because Routes, wildcard admission, and SCCs change more than a setting. Capacity is provider-independent: roughly 3–4 workers at 8 vCPU / 16–32 GiB for Hybrid and 4–5 for External or Central — see Capacity. Minimum managed datastore sizes are in Managed stores.
On RDS with IAM authentication, global.postgresql.authMode: iam does not reach the Go gateways in External or Central mode. Also set agentgateway.database.iamAuth: true and trustguard.database.iamAuth: true, or they attempt password authentication against an IAM-only database and fail at connection time with nothing pointing at the cause.
Install the EBS CSI driver and the AWS Load Balancer Controller before exposing anything, and use IRSA for AWS API access.ACM certificates terminate at the load balancer, so they cover Ingress hosts but not the layer-4 endpoints a central control plane publishes — TLS terminates in those pods and ACM does not export private keys. Use cert-manager or your own PKI there, with service.beta.kubernetes.io/aws-load-balancer-type: nlb and aws-load-balancer-scheme: internal for private callers.
AKS ships no ingress controller by default — install Application Gateway or NGINX before exposing the data plane.An internal load balancer is service.beta.kubernetes.io/azure-load-balancer-internal: "true".
--num-nodes 1 in a regional cluster gives one node per zone, so three in total.For GKE Ingress set global.platform: gcp, global.ingress.gcp.staticIpName, and managedCertificates. Google-managed certificates reject wildcards, so if you rely on the chart’s wildcard hosts (*.llm.<domain> / *.mcp.<domain>) use cert-manager, or set agentgateway.config.autoWildcardHosts: false and list exact hosts.A plain LoadBalancer Service already gives a layer-4 passthrough load balancer; its private form is networking.gke.io/load-balancer-type: "Internal".
For clusters without a dedicated guide. Confirm the capabilities first:
You need a default StorageClass (or global.storageClass), an Ingress or Gateway implementation, DNS for global.domain, and TLS from cert-manager or pre-created Secrets.

​
GPU nodes

Only needed if you run Firewall on GPU, which is opt-in. It requires a separate GPU node pool, the vendor device plugin, and matching labels and taints — see GPU Firewall workers.