Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt

Use this file to discover all available pages before exploring further.

NeuralTrust Platform runs on Google Kubernetes Engine using GCP-native primitives — GCE Ingress with managed certificates, Persistent Disk storage, and Cloud DNS. GCP is the default platform target — the chart’s defaults assume GCP unless you override global.platform. For the cross-platform install workflow, start with Install on Kubernetes.

​
Architecture

All workloads run inside your GCP project and VPC. Data never leaves your environment.

​
Cluster prerequisites

ResourceRecommended starting point
GKE version1.28 or newer
Cluster modeStandard or Autopilot (Standard recommended for GPU workloads)
Worker machine typee2-standard-4 or n2-standard-4 (4 vCPU / 16 GiB)
Min nodes3 across at least 2 zones (regional cluster)
Storagepd-balanced or pd-ssd storage class
IngressGCE Ingress (default) with Managed Certificates, or NGINX
DNSCloud DNS (or any DNS provider) for the platform base domain
For GPU Firewall workers, add a GPU node pool (nvidia-l4 or nvidia-t4) with the GKE GPU device plugin. See Firewall deployment › GPU.

​
Required cluster setup

# Create a regional GKE Standard cluster
gcloud container clusters create neuraltrust \
  --region <REGION> \
  --num-nodes 1 \
  --machine-type e2-standard-4 \
  --release-channel regular

# Get credentials
gcloud container clusters get-credentials neuraltrust --region <REGION>
GCE Ingress and Persistent Disk CSI driver are enabled by default on GKE.

​
Install the Helm chart on GKE

1

Configure kubectl for the GKE cluster

gcloud container clusters get-credentials neuraltrust --region <REGION>
kubectl get nodes
2

Create the namespace and image pull secret

kubectl create namespace neuraltrust

kubectl create secret docker-registry gcr-secret \
  --docker-server=europe-west1-docker.pkg.dev \
  --docker-username=_json_key \
  --docker-password="$(cat path/to/gcr-keys.json)" \
  [email protected] \
  -n neuraltrust
3

Install with the GCP platform selector (default)

helm upgrade --install neuraltrust-platform \
  oci://europe-west1-docker.pkg.dev/neuraltrust-app-prod/helm-charts/neuraltrust-platform \
  --version <VERSION> \
  --namespace neuraltrust \
  --set global.platform=gcp \
  --set global.domain=platform.example.com \
  --set global.storageClass=pd-balanced
global.platform=gcp is the chart default and can be omitted if you want.
4

Point DNS at the load balancer

kubectl get ingress -n neuraltrust -o wide
Get the GCE load balancer IP from each Ingress and create A records in Cloud DNS for every platform host (app.<domain>, data-plane-api.<domain>, etc.).

​
GCP-specific configuration

​
Managed certificates

GCP Managed Certificates issue and renew certs automatically against domains validated through Cloud DNS: 
trustgate:
  ingress:
    enabled: true
    annotations:
      kubernetes.io/ingress.class: "gce"
      networking.gke.io/managed-certificates: "trustgate-cert"
      networking.gke.io/v1beta1.FrontendConfig: "trustgate-fc"
Create the ManagedCertificate and FrontendConfig separately: 
apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: trustgate-cert
  namespace: neuraltrust
spec:
  domains:
    - trustgate.platform.example.com
---
apiVersion: networking.gke.io/v1beta1
kind: FrontendConfig
metadata:
  name: trustgate-fc
  namespace: neuraltrust
spec:
  redirectToHttps:
    enabled: true

​
Storage class

global:
  storageClass: "pd-balanced"   # cost / perf default
  # storageClass: "pd-ssd"      # SSD for high-throughput ClickHouse
Per-component override: 
clickhouse:
  persistence:
    storageClass: "pd-ssd"
    size: 200Gi

​
Internal-only ingress

For VPC-internal endpoints (Internal HTTP(S) Load Balancer): 
trustgate:
  ingress:
    annotations:
      kubernetes.io/ingress.class: "gce-internal"

​
Network Endpoint Groups (NEG) and Private Service Connect

For container-native load balancing or PSC-published endpoints: 
trustgate:
  service:
    annotations:
      cloud.google.com/neg: '{"ingress": true}'
PSC-specific configuration is environment-dependent — work with your Google Cloud architect to plan the producer/consumer side.

​
GPU node pool for Firewall workers

gcloud container node-pools create gpu-pool \
  --cluster neuraltrust --region <REGION> \
  --machine-type g2-standard-4 \
  --accelerator type=nvidia-l4,count=1,gpu-driver-version=latest \
  --num-nodes 1 \
  --node-taints nvidia.com/gpu=true:NoSchedule

neuraltrust-firewall:
  firewall:
    enabled: true
    workerDefaults:
      image:
        repository: "europe-west1-docker.pkg.dev/.../firewall-gpu"
      resources:
        limits:
          nvidia.com/gpu: "1"
      nodeSelector:
        cloud.google.com/gke-accelerator: "nvidia-l4"
      tolerations:
        - key: "nvidia.com/gpu"
          operator: "Exists"
          effect: "NoSchedule"
      hostIPC: true
Full reference: Firewall deployment.

​
Region availability

NeuralTrust runs in any GCP region with GKE support. Choose the region closest to your application traffic and target LLM endpoints, or one that meets your data-residency obligations. The chart and images are region-agnostic. For Assured Workloads or specific sovereign-cloud requirements, contact [email protected].

​
Backup and data lifecycle

For production, configure backups against the persistent stores rather than relying on Persistent Disk snapshots alone:
  • PostgreSQL: Use Cloud SQL for PostgreSQL externally with built-in automated backups, and set neuraltrust-control-plane.infrastructure.postgresql.deploy: false.
  • ClickHouse: Use ClickHouse BACKUP to Cloud Storage, or ClickHouse Cloud externally with infrastructure.clickhouse.deploy: false.
  • Kafka: For higher availability, use Confluent Cloud and set infrastructure.kafka.deploy: false.
Pointing the chart at managed GCP data services is documented in Configuration scenarios › External infrastructure only.

​
Verification

kubectl get pods -n neuraltrust
kubectl get ingress -n neuraltrust -o wide
kubectl get managedcertificate -n neuraltrust   # if using Managed Certificates

curl https://data-plane-api.platform.example.com/health
curl https://control-plane-api.platform.example.com/health

​
Troubleshooting

​
Ingress doesn’t get an IP

kubectl describe ingress -n neuraltrust <ingress-name>
Common causes: missing BackendConfig, NEG annotation mismatch, or quota exhausted on the project’s regional load balancer pool.

​
Managed certificate stuck Provisioning

kubectl describe managedcertificate -n neuraltrust trustgate-cert
Provisioning requires DNS to already point at the load balancer. Confirm the A record resolves before adding the cert annotation.

​
PVCs stuck in Pending

kubectl describe pvc -n neuraltrust <pvc-name>
Verify the storage class exists and the cluster has quota for the requested disk type.

​
ImagePullBackOff

Recreate gcr-secret with the JSON key from NeuralTrust. See Install on Kubernetes › Common issues.