Feature flags reference

neuraltrust-control-plane:
  infrastructure:
    postgresql:
      deploy: false
  controlPlane:
    components:
      postgresql:
        secrets:
          name: "postgresql-secrets"
          host: "<external-host>"
          port: "5432"
          user: "neuraltrust"
          password: "<password>"            # or pre-create the secret
          database: "neuraltrust"

trustgate:
  global:
    env:
      DATABASE_HOST: "<external-host>"
      DATABASE_PORT: "5432"
      DATABASE_USER: "trustgate"
      DATABASE_PASSWORD: "<password>"
      DATABASE_NAME: "trustgate"
      DATABASE_SSL_MODE: "require"          # "disable" only for in-cluster

-- as the cluster admin
CREATE USER neuraltrust WITH PASSWORD '<strong-password>';
CREATE DATABASE neuraltrust OWNER neuraltrust;
GRANT ALL PRIVILEGES ON DATABASE neuraltrust TO neuraltrust;

CREATE USER trustgate WITH PASSWORD '<strong-password>';
CREATE DATABASE trustgate OWNER trustgate;
GRANT ALL PRIVILEGES ON DATABASE trustgate TO trustgate;

-- connect to each DB and grant on public schema (Postgres 15+)
\c neuraltrust
GRANT ALL ON SCHEMA public TO neuraltrust;
\c trustgate
GRANT ALL ON SCHEMA public TO trustgate;

trustgate:
  redis:
    enabled: false                          # config-only flag (see caveat below)
  global:
    env:
      REDIS_HOST: "<external-host>"
      REDIS_PORT: "6379"
      REDIS_PASSWORD: "<password>"          # required for managed Redis
      REDIS_DB: "0"

infrastructure:
  kafka:
    deploy: false
    external:
      bootstrapServers: "kafka.example.com:9092"
      # 'brokers' (a list) is also accepted and joined with commas

neuraltrust-data-plane:
  dataPlane:
    components:
      api:
        extraEnv:
          - name: KAFKA_BOOTSTRAP_SERVERS
            value: "kafka.example.com:9093"
          - name: KAFKA_SECURITY_PROTOCOL
            value: "SASL_SSL"
          - name: KAFKA_SASL_MECHANISM
            value: "SCRAM-SHA-512"
          - name: KAFKA_SASL_USERNAME
            valueFrom:
              secretKeyRef: { name: kafka-auth, key: username }
          - name: KAFKA_SASL_PASSWORD
            valueFrom:
              secretKeyRef: { name: kafka-auth, key: password }
      worker:
        extraEnv: *kafka-auth-env             # same as api.extraEnv
      kafka:
        connect:
          bootstrapServers: "kafka.example.com:9093"

infrastructure:
  clickhouse:
    deploy: false
    external:
      host: "<external-host>"
      port: "8123"                          # HTTP port; "8443" for ClickHouse Cloud
      user: "neuraltrust"
      password: ""                          # use --set or pre-created secret
      database: "neuraltrust"
      secretName: "clickhouse"
      secretKey: "admin-password"

neuraltrust-data-plane:
  dataPlane:
    components:
      clickhouse:
        enabled: true                       # keep true to render clickhouse-secrets + migrations Job
        host: "<external-host>"
        port: "8123"
        user: "neuraltrust"
        database: "neuraltrust"

kubectl create secret docker-registry gcr-secret \
  --docker-server=europe-west1-docker.pkg.dev \
  --docker-username=_json_key \
  --docker-password="$(cat path/to/gcr-keys.json)" \
  [email protected] \
  -n neuraltrust

global:
  imageRegistry: "registry.internal.example.com/neuraltrust"

helm template neuraltrust-platform \
  oci://europe-west1-docker.pkg.dev/neuraltrust-app-prod/helm-charts/neuraltrust-platform \
  --version <VERSION> \
  -f my-values.yaml \
  | yq '.. | select(has("image")) | .image' \
  | sort -u

helm template . -f my-values.yaml | grep -E '^\s+image:' | sort -u

kubectl get storageclass
# default class is marked with (default)

global:
  storageClass: "pd-balanced"               # GKE example
  # storageClass: "gp3"                      # AWS EKS
  # storageClass: "managed-csi-premium"      # Azure AKS
  # storageClass: "longhorn"                 # bare metal

global:
  preserveExistingSecrets: true             # chart will not render any secret templates

global:
  platform: "gcp"                  # aws | gcp | azure | openshift | kubernetes
  domain: "platform.example.com"
  storageClass: ""                 # "" = cluster default
  imageRegistry: ""                # "" = NeuralTrust GCR
  autoGenerateSecrets: true        # false + preserveExistingSecrets for prod
  preserveExistingSecrets: false

neuraltrust-control-plane:
  controlPlane:
    enabled: false                 # true = self-hosted
  infrastructure:
    postgresql:
      deploy: true                 # false = external

neuraltrust-data-plane:
  dataPlane:
    enabled: true

trustgate:
  enabled: true
  redis:
    enabled: true                  # false + REDIS_HOST env = external (see Redis caveat)

neuraltrust-firewall:
  firewall:
    enabled: true                  # always on in supported topologies (CPU or GPU workers)

infrastructure:
  clickhouse:
    deploy: true                   # false = external
  kafka:
    deploy: true                   # false = external