NeuralTrust | Platform for Agent Security.

This is the values reference the model guides link into. Start from your model’s page — Hybrid, External, or Central — and come here for the individual settings. The exhaustive list, with every default, is values.yaml in the chart.

Values cheat sheet

The switches that matter most. global.products applies to Hybrid only — External and Central ignore it and always deploy the full stack.

Value	Guidance	Effect
`global.deploymentMode`	`hybrid` \| `external` \| `saas`	Selects the topology. `saas` is a Central control plane that you run.
`global.controlPlane.domain`	Empty for NeuralTrust SaaS	A bare DNS suffix enrols this data plane into your own central control plane instead.
`global.products.trustgate`	`true` to run TrustGate	Renders the TrustGate proxy and MCP data plane. Defaults to `false`; select at least one product.
`global.products.trustguard`	`true` to run TrustGuard	Renders the TrustGuard data plane. Firewall follows.
`global.products.dataPlane`	`true` for the red-teaming shim	Renders the data-plane API. Needs no DataAgent and no config sync.
`global.postgresql.deploy`	`false` in production	`true` runs an in-cluster store, which is the proof-of-concept default.
`global.redis.deploy`	`false` in production	Same for Redis.
`agentgateway.configSync.existingSecret`	Reference your Secret	TrustGate config-sync token. Config sync is on by default in Hybrid — do not restate `enabled: true`.
`trustguard.configSync.existingSecret`	Reference your Secret	TrustGuard config-sync token.
`agentgateway.dataagent.enrolment.existingSecret`	Reference your Secret	TrustGate DataAgent enrollment token (OTLP egress and DataBridge).
`trustguard.dataagent.enrolment.existingSecret`	Reference your Secret	TrustGuard DataAgent enrollment token.
`agentgateway.mcp.enabled`	`true`	TrustGate MCP entry point.
`global.platform`	`aws` \| `gcp` \| `azure` \| `openshift` \| `kubernetes`	Selects provider-specific ingress and storage behaviour.
`global.imageRegistry`	Your mirror	Rewrites the registry prefix — see Container images.
`global.autoGenerateSecrets`	`true`	Chart owns the credentials it can generate.
`global.preserveExistingSecrets`	`false`	For GitOps: pre-create every Secret and set `true`.

Leave watchdog.enabled off unless NeuralTrust asks you to enable it.

Product telemetry export is mandatory in Hybrid and always on — there is no global.clickstack.enabled: false opt-out. TrustGate and TrustGuard send OTLP to a co-located, enrollment-backed egress collector, which is why the enrollment tokens are required. For a deployment with no NeuralTrust dependency at all, use External.

Managed stores

Managed PostgreSQL and Redis are the usual production choice in every self-hosted model. Pre-create the database, role, and Redis credentials on the managed instance — Helm never issues CREATE USER against a store it does not own. The chart can still run both in-cluster with deploy: true for evaluation; in External and Central mode from chart 2.7.0 that path also bootstraps the per-service roles automatically.

global:
  postgresql:
    deploy: false
    host: postgres.example.com
    port: 5432
    user: neuraltrust
    database: neuraltrust
    sslMode: require
    existingSecret:
      name: hybrid-postgresql
  redis:
    deploy: false
    host: redis.example.com
    port: 6379
    tls: "true"
    existingSecret:
      name: hybrid-redis

How you supply credentials depends on the topology:

Topology	Endpoints	Credentials
Hybrid	`global.postgresql` / `global.redis` (one shared role)	Chart-built `postgresql-secrets`, or `global.postgresql.existingSecret` with the `DB_*` key contract
External / Central	The same global blocks — per-service hosts inherit since chart 2.6.0	Control-plane password via `global.postgresql.passwordSecret` (chart 2.8.0+); runtime roles via per-service `existingSecret` hooks

A Secret you supply through postgresql.existingSecret is consumed with envFrom and never renamed, so it must hold DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME, DB_SSL_MODE and, in Hybrid, SENSIBLE_PG_DSN — not the POSTGRES_* names the chart uses in its own Secret. In External prefer the narrower global.postgresql.passwordSecret, which keeps the chart’s Secret and replaces only the password. See Bringing your own Secret.

Store	Minimum for production
PostgreSQL	2 vCPU, 4 GiB RAM, 20 GiB storage
Redis	1 GiB memory

Provider	PostgreSQL	Redis
AWS	RDS/Aurora `db.t4g.medium`, 20 GiB+	ElastiCache `cache.t4g.small`
GCP	Cloud SQL `db-custom-2-4096`, 20 GiB+	Memorystore 1 GiB
Azure	Flexible Server 2 vCores / 4 GiB, 20 GiB+	Cache for Redis C1 (1 GiB)+

Reach both over private networking from the cluster. When you run two clusters active/passive across regions, they share one writable PostgreSQL primary with a cross-region read replica, and each region gets its own Redis — see Hybrid → High availability.

Ingress

global:
  platform: aws
  domain: platform.example.com
  storageClass: gp3
  ingress:
    className: alb
    aws:
      certificateArn: arn:aws:acm:region:account:certificate/id

global.domain combines with default host prefixes to render the public names. In Hybrid that is two: gateway.<domain> for the LLM/proxy Ingress and mcp.<domain> for MCP. External and Central add the console, its API, and the gateway admin surface. The chart creates separate agentgateway-gateway and agentgateway-mcp Ingress resources backed by separate Services. Each Service exposes port 80: the proxy Service targets TrustGate container port 8081 and the MCP Service targets 8082. Set the corresponding full URLs, including https://, in Settings → Agent Gateway → General — global.domain does not update those console settings. The chart can auto-add wildcard hosts (*.llm.<domain> / *.mcp.<domain>) for slug-based gateway discovery; set agentgateway.config.autoWildcardHosts: false to use exact hosts instead. Ingress class, annotations, and certificate sources are provider-specific — see Cloud notes. With two clusters active/passive, put one global LLM URL and one global MCP URL in front of both clusters’ Ingress resources and configure those stable URLs in the console.

Firewall workers

Firewall deploys with TrustGuard: no values are needed to get it. The chart renders two gateway replicas and one replica for each of the five default workers — toxicity, indirect-prompt-injections, prompt-jailbreak, prompt-moderation, and response-jailbreak — all on the firewall-cpu image pinned by your chart version. Default worker requests are 1 CPU and 3 GiB, with 2 CPU and 4 GiB limits; prompt-moderation overrides memory to 4 GiB requested and 6 GiB limited. Official images bundle their models, so HUGGINGFACE_TOKEN is optional. This is the largest memory consumer in the data path, so it is the first thing to right-size if you run a subset of detectors. TrustGuard derives NEURAL_TRUST_FIREWALL_BASE_URL as http://firewall.<namespace>.svc.cluster.local and maps firewall-secrets/JWT_SECRET to its client secret. Both sides are wired by the chart, so there is nothing to configure.

firewall.enabled, firewall.firewall.enabled, and trustguard.firewall.enabled have no effect on whether Firewall renders. Setting all three to false with TrustGuard on still produces the gateway and all five workers. To reduce its footprint, size the workers instead.

GPU Firewall workers

Chart defaults are CPU. GPU mode needs a NeuralTrust-provided firewall-gpu image plus explicit GPU resources and scheduling, and a separate GPU node pool. Keep the gateway on the CPU image:

firewall:
  firewall:
    gateway:
      image:
        repository: registry.example.com/neuraltrust/firewall-cpu
    workerDefaults:
      image:
        repository: registry.example.com/neuraltrust/firewall-gpu
      resources:
        requests:
          cpu: "1"
          memory: 4Gi
          nvidia.com/gpu: "1"
        limits:
          cpu: "2"
          memory: 8Gi
          nvidia.com/gpu: "1"
      nodeSelector:
        accelerator: nvidia
      tolerations:
        - key: nvidia.com/gpu
          operator: Exists
          effect: NoSchedule
      hostIPC: true
    config:
      cudaMpsActiveThreadPercentage: "25"
      cudaMpsPinnedDeviceMemLimit: "6000M"

This matches values-dataplane-gpu.yaml.example, which ships with the chart. Install the vendor device plugin and validate node labels first. CUDA MPS and hostIPC may require extra security approval, especially on OpenShift. If GPU pods stay Pending, inspect resource availability, taints, node labels, and the NVIDIA device plugin with kubectl describe pod.

Central control plane values

These apply only on the central cluster, under global.deploymentMode: saas. Data-plane clusters need none of them — they set global.controlPlane.domain and are otherwise ordinary Hybrid installs.

Value	Guidance	Effect
`global.controlPlane.domain`	Required	Bare DNS suffix every cross-cluster endpoint derives from. No scheme, port, or path.
`databridge.auth.mode`	`introspect`	How DataBridge identifies each data plane. `jwt` also works; `token` and `dev` are rejected because they share one credential across every agent.
`databridge.tls.existingSecret`	One of three	`kubernetes.io/tls` Secret covering `databridge.<domain>`.
`databridge.tls.certManager.enabled`	One of three	cert-manager issues it from an Issuer you already run.
`databridge.tls.autoGenerate`	One of three	Chart mints a self-signed CA and keypair. The route for a control plane on a private network; distribute the CA with `scripts/export-controlplane-ca.sh`.
`databridge.service.southbound.annotations`	Provider-specific	Free-form annotations on the LoadBalancer, for example an internal NLB on EKS.
`databridge.service.southbound.loadBalancerSourceRanges`	Set in production	Restrict to your data-plane egress ranges. Empty means anyone who can reach the load balancer can open a connection.
`agentgateway.configSync.expose.enabled`	`true`	Publishes the TrustGate config-sync listener. `false` keeps it ClusterIP behind a private link.
`agentgateway.configSync.grpcTls.existingSecret`	One of two, when exposed	Certificate for `agentgateway-configsync.<domain>` from a CA the data planes already trust.
`agentgateway.configSync.expose.selfSignedTls`	One of two, when exposed	Publish with the chart’s own certificate and distribute its CA as configuration.
`trustguard.configSync.expose.enabled`	`true`	Same for TrustGuard.
`trustguard.configSync.grpcTls.existingSecret`	One of two, when exposed	Certificate for `trustguard-configsync.<domain>`.
`trustguard.configSync.expose.selfSignedTls`	One of two, when exposed	Same for TrustGuard.
`clickstack-ingest-gateway.ingress.tls.secretName`	One of two	Certificate for `telemetry.<domain>`. This endpoint terminates at the ingress, so ACM works here.
`clickstack-ingest-gateway.ingress.tls.autoGenerate`	One of two	Chart mints a self-signed CA and leaf for the telemetry host.

The chart refuses to render an endpoint with no certificate at all, rather than publishing one nothing outside the cluster can verify. The self-signed CA it generates is not in any remote cluster’s trust store until you put it there.

Trusting a private control plane

Set these on a remote cluster when the central control plane serves chart-generated or private-PKI certificates. Each replaces the system roots for that connection, so the bundle must carry every CA that leg needs.

Value	Guidance	Effect
`global.customCaCert.enabled` / `.secretName`	Required	Mounts the bundle’s `ca.crt` into every pod, by default at `/etc/ssl/certs/custom-ca.crt`.
`dataagent.databridge.tlsCa`	Path	CA bundle DataAgent verifies DataBridge against. Also required by the binary when `tlsMode: mtls`.
`agentgateway.configSync.tlsCa`	Path	CA bundle for the TrustGate config-sync endpoint.
`trustguard.configSync.tlsCa`	Path	CA bundle for the TrustGuard config-sync endpoint.
`global.clickstack.egress.tlsCaSecretName`	Secret name	CA for the telemetry endpoint. A Secret name, not a path: the collector configures TLS from its own config and ignores the mount above.

Wizard-generated setup

The private gateway wizard’s Kubernetes output is credential and setup input, not an install-ready chart contract. Map its values into the maintained chart’s interfaces rather than applying it unchanged, and move every credential into pre-created Secrets — see Console setup and Secrets. Docker is for local evaluation of the LLM/proxy path. Its generated Compose command injects a generated CONFIG_SYNC_LKG_KEY and the two wizard-issued tokens, and needs three more values from you:

SERVER_SECRET_KEY — a random value of at least 32 bytes
CONFIG_SYNC_GRPC_ENDPOINT — the config-sync endpoint as host:port
DATABRIDGE_ADDR — the DataBridge endpoint as host:port

That path starts TrustGate’s LLM/proxy process on 8081 and does not start or expose MCP on 8082. Use Kubernetes for production MCP support. Manual returns CONTROL_PLANE_JWT and DATA_AGENT_JWT for fully custom manifests, and no deployment command. TrustGate listens on these ports by default:

Entry point	Port
Admin (External and Central only)	`8080`
LLM/proxy	`8081`
MCP	`8082`

Secrets

Key contracts for every Secret you supply.

Requirements

Dependencies, ports, and capacity.

Platform

Organization

Identity & Access

Telemetry

Audit & Compliance

Infrastructure

Configuration

Values cheat sheet

Managed stores

Ingress

Firewall workers

GPU Firewall workers

Central control plane values

Trusting a private control plane

Wizard-generated setup

Secrets

Requirements

​Values cheat sheet

​Managed stores

​Ingress

​Firewall workers

​GPU Firewall workers

​Central control plane values

​Trusting a private control plane

​Wizard-generated setup

​Related

Secrets

Requirements

Values cheat sheet

Managed stores

Ingress

Firewall workers

GPU Firewall workers

Central control plane values

Trusting a private control plane

Wizard-generated setup

Related