NeuralTrust | Platform for Agent Security.

Firewall is an optional data-plane component (enabled by default). TrustGuard in your cluster calls its in-cluster service for prompt and response classifiers. It is not part of the SaaS control plane.

Default CPU deployment

firewall:
  enabled: true
  firewall:
    enabled: true

trustguard:
  firewall:
    enabled: true

The chart renders two gateway replicas and one replica for each default worker: toxicity, toolguard, prompt-jailbreak, prompt-moderation, and response-jailbreak. Gateway and workers use firewall-cpu:v2.14.0. Default worker requests are 1 CPU and 3 GiB, with 2 CPU and 4 GiB limits. prompt-moderation overrides memory to 4 GiB requested and 6 GiB limited. Official images bundle their models; HUGGINGFACE_TOKEN is optional.

GPU workers

Chart defaults remain CPU. GPU mode requires a NeuralTrust-provided firewall-gpu image plus explicit GPU resources and scheduling. Keep the gateway on the CPU image:

firewall:
  firewall:
    gateway:
      image:
        repository: registry.example.com/neuraltrust/firewall-cpu
    workerDefaults:
      image:
        repository: registry.example.com/neuraltrust/firewall-gpu
      resources:
        requests:
          cpu: "1"
          memory: 4Gi
          nvidia.com/gpu: "1"
        limits:
          cpu: "2"
          memory: 8Gi
          nvidia.com/gpu: "1"
      nodeSelector:
        accelerator: nvidia
      tolerations:
        - key: nvidia.com/gpu
          operator: Exists
          effect: NoSchedule
      hostIPC: true
    config:
      cudaMpsActiveThreadPercentage: "25"
      cudaMpsPinnedDeviceMemLimit: "6000M"

This matches values-dataplane-gpu.yaml.example. Install the vendor device plugin and validate node labels first. CUDA MPS and hostIPC may require extra security approval, especially on OpenShift.

TrustGuard integration

TrustGuard derives NEURAL_TRUST_FIREWALL_BASE_URL as http://firewall.<namespace>.svc.cluster.local and maps firewall-secrets/JWT_SECRET to its client secret. If Firewall is disabled, disable both switches:

firewall:
  enabled: false

trustguard:
  firewall:
    enabled: false

Verify

kubectl get pods -n neuraltrust \
  -l app.kubernetes.io/name=firewall
kubectl get service firewall -n neuraltrust
kubectl logs -n neuraltrust \
  -l app.kubernetes.io/name=firewall,app.kubernetes.io/component=gateway

If GPU pods remain pending, inspect resource availability, taints, node labels, and the NVIDIA device plugin with kubectl describe pod. See Secrets for the shared JWT and Images for chart pins.

Platform

Organization

Identity & Access

Telemetry

Audit & Compliance

Infrastructure

Firewall

Default CPU deployment

GPU workers

TrustGuard integration

Verify

​Default CPU deployment

​GPU workers

​TrustGuard integration

​Verify

Default CPU deployment

GPU workers

TrustGuard integration

Verify