Skip to main content
The chart ships a small set of values files that cover the most common deployment topologies. Pick the file closest to your target environment, copy it to my-values.yaml, and override only what you need.
FilePurpose
values-required.yamlMinimal starting template — recommended for first-time setup. All other values use chart defaults.
values.yamlComplete reference with every option and inline comments.
values-openshift.yamlPre-configured for OpenShift with Routes.
values-openshift-ingress.yaml.exampleOpenShift using Kubernetes Ingress instead of Routes.
values-external-services.yaml.exampleExternal ClickHouse, Kafka, and PostgreSQL.
values-dataplane-gpu.yaml.exampleData Plane + GPU firewall workers, no TrustGate.
values-all-deployed.yaml.exampleEverything enabled — useful as a “what does the full stack look like” reference.
All files live in the chart repository. Fetch any of them with: 
curl -sLO https://raw.githubusercontent.com/NeuralTrust/neuraltrust-platform/main/values-required.yaml

​
Quick reference

ScenarioValues filePlatformIngressRoutesSecrets
Zero-configNone (defaults)AnyNoNoAuto
Kubernetes (cloud)values-required.yamlaws / gcp / azure / kubernetesYesNoAuto
OpenShift (Routes)values-openshift.yamlopenshiftNoYesAuto
OpenShift (Ingress)values-openshift-ingress.yaml.exampleopenshiftYesNoPre-gen
Everything onvalues-all-deployed.yaml.exampleConfigurableYesConfigurableAuto
External infravalues-external-services.yaml.exampleConfigurableYesConfigurableAuto
GPU firewallvalues-dataplane-gpu.yaml.exampleConfigurableYesConfigurableExplicit

​
Common scenarios

​
Kubernetes with Ingress

global:
  platform: "aws"        # or "gcp", "azure", "kubernetes"
  domain: "platform.example.com"
Use values-required.yaml and override global.platform + global.domain. The chart picks the right ingress flavor for the cloud automatically.

​
OpenShift with Routes

global:
  platform: "openshift"
  domain: "apps.mycluster.example.com"
Start from values-openshift.yaml. Routes are created automatically; Ingress is disabled. See OpenShift.

​
OpenShift with Ingress

global:
  platform: "openshift"
  domain: "apps.mycluster.example.com"
  ingress:
    provider: "openshift"

trustgate:
  ingress:
    enabled: true

neuraltrust-control-plane:
  controlPlane:
    components:
      api:
        ingress:
          enabled: true
      app:
        ingress:
          enabled: true
Start from values-openshift-ingress.yaml.example.

​
External infrastructure only

NeuralTrust services in-cluster, ClickHouse / Kafka / PostgreSQL provided externally: 
infrastructure:
  clickhouse:
    deploy: false
    external:
      host: "clickhouse.example.com"
      port: "8123"
      user: "neuraltrust"
      password: ""        # inject via --set or pre-created secret
      database: "neuraltrust"

  kafka:
    deploy: false
    external:
      bootstrapServers: "kafka.example.com:9092"

neuraltrust-control-plane:
  infrastructure:
    postgresql:
      deploy: false
  controlPlane:
    components:
      postgresql:
        secrets:
          host: "postgres.example.com"
          port: "5432"
          user: "neuraltrust"
          password: ""    # inject via --set or pre-created secret
          database: "neuraltrust"
Start from values-external-services.yaml.example.

​
Services-only (no TrustGate)

trustgate:
  enabled: false

neuraltrust-control-plane:
  controlPlane:
    enabled: true

neuraltrust-data-plane:
  dataPlane:
    enabled: true

​
Pre-generated secrets (CI/CD, Vault)

global:
  autoGenerateSecrets: false
  preserveExistingSecrets: true
All required secrets must exist in the namespace before deployment. See Secrets management › Pre-generated secrets.

​
Zero-config

helm upgrade --install neuraltrust-platform \
  oci://europe-west1-docker.pkg.dev/neuraltrust-app-prod/helm-charts/neuraltrust-platform \
  --version <VERSION> \
  --namespace neuraltrust --create-namespace
Defaults to global.platform: "gcp", in-cluster infrastructure, auto-generated secrets, and self-signed TLS. Useful for rapid evaluation; not suitable for production.

​
How infrastructure resolves

ComponentIn-cluster service nameExternal config path
ClickHouse<release>-clickhouseinfrastructure.clickhouse.external.host
Kafka<release>-kafka:9092infrastructure.kafka.external.bootstrapServers
PostgreSQLcontrol-plane-postgresqlneuraltrust-control-plane.controlPlane.components.postgresql.secrets.host
The chart’s _helpers.tpl resolves the right hostname automatically based on deploy: true / false. You don’t typically need to override these directly.

​
Component toggles

Every component can be flipped independently: 
neuraltrust-data-plane:
  dataPlane:
    enabled: true       # Data Plane API + workers

neuraltrust-control-plane:
  controlPlane:
    enabled: true       # Control Plane API + UI + scheduler

trustgate:
  enabled: true         # TrustGate AI gateway

neuraltrust-firewall:
  firewall:
    enabled: false      # Firewall gateway + workers (off by default)
Disabling the Control Plane while keeping the Data Plane is a supported pattern — the Data Plane runs against the NeuralTrust SaaS Control Plane.

​
Ingress vs Routes

FeatureIngressRoutes (OpenShift)
PlatformAny KubernetesOpenShift only
ControllerRequired (NGINX, ALB, GCE, etc.)Built-in
TLSkubernetes.io/tls secrets or cloud-managedOpenShift router
Enableingress.enabled: true per componentDefault when platform: "openshift"

​
Secret management modes

ModeFlagBehaviorBest for
Auto-generatedautoGenerateSecrets: trueHelm creates and preserves secretsDev, staging, quick starts
Explicit valuesautoGenerateSecrets: true + values setYour values override auto-generationControlled environments
Pre-generatedpreserveExistingSecrets: trueHelm never touches secretsVault, Sealed Secrets, compliance
Full reference: Secrets management.

​
Firewall: CPU and GPU

ComponentImageSchedulingCUDA MPS
Gatewayfirewall-cpuCPU onlyN/A
Workers (default)firewall-cpuCPU onlyOmit MPS keys
Workers (GPU)firewall-gpuGPU nodes with nvidia.com/gpu, nodeSelector, tolerations, hostIPCSet both cudaMpsActiveThreadPercentage and cudaMpsPinnedDeviceMemLimit
CUDA MPS env vars are only rendered into the worker ConfigMap when both keys are set. Reference files: values-dataplane-gpu.yaml.example, values.yaml. Detailed setup: Firewall deployment.