NeuralTrust | The leading security platform for generative AI

This guide walks you end-to-end through a fully self-hosted deployment on OpenShift — Control Plane API, UI, and Scheduler run in your cluster alongside the Data Plane, TrustGate, and Firewall. For the SaaS-hosted Control Plane alternative, see OpenShift hybrid.

What you’ll end up with

Component	Location	Replicas
Control Plane API, UI, Scheduler	Your OpenShift cluster	2, 2, 1
Data Plane API, worker, Kafka Connect	Your OpenShift cluster	2, 1, 1
TrustGate admin / gateway / actions	Your OpenShift cluster	2 each
Firewall gateway + 5 workers	Your OpenShift cluster	2 + 5
ClickHouse, Kafka, PostgreSQL, Redis	Your OpenShift cluster (or external)	1 each

Sizing baseline: ~21–23 vCPU / 45–50 GiB RAM / 80 GiB PVC. See Image catalog.

Prerequisites

Resource	Recommended
OpenShift version	4.10+
CPU pool node spec	8 vCPU / 32 GiB
Min CPU nodes	≥ 5 across 3 AZs. Drop to 4 if Firewall workers run on GPU nodes.
GPU pool (optional, for GPU Firewall)	4 vCPU / 16 GiB + 1 × NVIDIA GPU — 5 nodes (one per default Firewall worker)
Sizing baseline	~23.1 vCPU / 61.8 GiB requests / 80 GiB PVC (defaults, CPU Firewall)
Storage	Cluster default; for ClickHouse + Postgres prefer fast SSD
Custom domain	A domain you control (e.g. `platform.example.com`)
Certificates	Custom Route TLS or cert-manager
Image pull	`gcr-keys.json` from NeuralTrust

Step 1 — Project setup

Same as hybrid — see OpenShift hybrid › Step 1 and Step 2. Self-hosted has identical project/SCC requirements aside from slightly higher CPU/memory budget for CP components.

Step 2 — Write your values overlay

Save as my-values.yaml:

# Self-hosted deployment on OpenShift
global:
  platform: "openshift"
  domain: "platform.example.com"          # custom domain or apps.<cluster>.openshift.com
  storageClass: ""                         # use cluster default
  autoGenerateSecrets: true
  security:
    allowInsecureImages: true

# Control Plane in your cluster
neuraltrust-control-plane:
  controlPlane:
    enabled: true                          # ← key difference from hybrid
    components:
      api:
        enabled: true
      app:
        enabled: true
      scheduler:
        enabled: true
  infrastructure:
    postgresql:
      deploy: true

# Data Plane
neuraltrust-data-plane:
  dataPlane:
    enabled: true

# TrustGate
trustgate:
  enabled: true
  global:
    env:
      SERVER_BASE_DOMAIN: "platform.example.com"

# Firewall
neuraltrust-firewall:
  firewall:
    enabled: true

# Infrastructure
infrastructure:
  clickhouse:
    deploy: true
  kafka:
    deploy: true

The chart will create Routes for every public component (see Step 4).

Custom Route TLS (recommended for production)

neuraltrust-control-plane:
  controlPlane:
    components:
      app:
        ingress:
          route:
            tls:
              termination: edge
              certificate: |
                -----BEGIN CERTIFICATE-----
                ...
              key: |
                -----BEGIN PRIVATE KEY-----
                ...
      api:
        ingress:
          route:
            tls:
              termination: edge
              certificate: |
                -----BEGIN CERTIFICATE-----
                ...
              key: |
                -----BEGIN PRIVATE KEY-----
                ...

In production, prefer storing certs in OpenShift Secrets and referencing them via your secret-management workflow.

Using external managed services

neuraltrust-control-plane:
  infrastructure:
    postgresql:
      deploy: false
  controlPlane:
    components:
      postgresql:
        secrets:
          host: "<managed-postgres>.example.com"
          port: "5432"
          user: "neuraltrust"
          password: ""
          database: "neuraltrust"

infrastructure:
  clickhouse:
    deploy: false
    external:
      host: "your-tenant.clickhouse.cloud"
      port: "8443"
      user: "neuraltrust"
      password: ""
      database: "neuraltrust"
  kafka:
    deploy: false
    external:
      bootstrapServers: "<bootstrap>:9092"

For ClickHouse Cloud, see the native-port caveat. For external Kafka with SASL, see Authentication for external Kafka.

Step 3 — Install

helm upgrade --install neuraltrust-platform \
  oci://europe-west1-docker.pkg.dev/neuraltrust-app-prod/helm-charts/neuraltrust-platform \
  --version <VERSION> \
  --namespace neuraltrust \
  -f my-values.yaml

oc get pods -n neuraltrust -w

Initial install takes 4–6 minutes. After install, link gcr-secret to component service accounts (see OpenShift hybrid › Step 7).

Step 4 — Routes and DNS

oc get route -n neuraltrust

Self-hosted creates Routes for all public components:

Route	Host	Required
`control-plane-app`	`control-plane-app.<domain>`	✅
`control-plane-api`	`control-plane-api.<domain>`	✅
`control-plane-scheduler`	`control-plane-scheduler.<domain>`	✅
`data-plane-api`	`data-plane-api.<domain>`	✅
`trustgate-admin`	`trustgate-admin.<domain>`	✅
`trustgate-gateway`	`trustgate-gateway.<domain>`	✅
`trustgate-actions`	`trustgate-actions.<domain>`	✅

For a custom domain, add CNAMEs pointing each host at the OpenShift router’s canonical hostname.

Open https://control-plane-app.<domain>.

Get the bootstrap credentials:

oc logs -n neuraltrust deploy/control-plane-app -c init-db | grep -i bootstrap

Sign in, configure SSO (Platform › SSO), rotate the bootstrap admin password.
Configure LLM providers, integrations, and policies.

Step 6 — Send traffic through TrustGate

Point your AI applications at https://trustgate-gateway.<domain>. Telemetry flows through TrustGate → Data Plane → ClickHouse, surfaced by your self-hosted Control Plane UI.

Verification

oc get pods -n neuraltrust
oc get route -n neuraltrust

curl https://control-plane-api.<domain>/health
curl https://control-plane-app.<domain>
curl https://data-plane-api.<domain>/health
curl https://trustgate-gateway.<domain>/__health

Upgrading

helm upgrade neuraltrust-platform \
  oci://europe-west1-docker.pkg.dev/neuraltrust-app-prod/helm-charts/neuraltrust-platform \
  --version <NEW_VERSION> \
  --namespace neuraltrust \
  -f my-values.yaml

Watch the init-db init container of the new CP UI pod for Prisma migration errors.

Air-gapped / disconnected OpenShift

Common for sovereign-cloud and government OpenShift installs.

Mirror images to your internal registry (Red Hat Quay or any OCI registry). Use oc-mirror or helm template … | yq … (see Image catalog › Mirroring).

Override the registry:

global:
  imageRegistry: "registry.internal.example.com/neuraltrust"

Proxy egress:

global:
  proxy:
    enabled: true
    httpProxy: "http://proxy.corp.example:3128"
    httpsProxy: "http://proxy.corp.example:3128"
    noProxy: "localhost,127.0.0.1,.cluster.local,.svc"

Pre-load Firewall model weights or mirror huggingface.co if using the Firewall with HF token.
TLS: bring your own Route certificates instead of public CAs.

Migration to hybrid

neuraltrust-control-plane:
  controlPlane:
    enabled: false

Enroll the existing Data Plane with NeuralTrust SaaS — see OpenShift hybrid › Step 8.

Troubleshooting

Symptom	Likely cause	Fix
CP UI blank	API URL wrong	Verify `control-plane-api.<domain>` Route and config
Login fails	DB migration failed	`oc logs -c init-db` on CP UI pod
Scheduler not running jobs	Can’t reach Data Plane API	Verify `data-plane-api.<domain>` Route and TLS
Pods `ImagePullBackOff`	`gcr-secret` not linked to SA	Re-run `oc secrets link` for each component SA
ClickHouse `Permission denied` on PVC	SCC override	Don’t override `podSecurityContext` for CH on OpenShift

Hybrid deployment on OpenShift — Control Plane on SaaS
OpenShift overview — cluster prerequisites and OpenShift-specific defaults
Deployment models — hybrid vs self-hosted comparison
Image catalog — what runs in self-hosted mode
Secrets management — auto-generation, External Secrets Operator
Firewall deployment — GPU workers on OpenShift
Configuration scenarios — external infrastructure modes

Documentation Index

​What you’ll end up with

​Prerequisites

​Step 1 — Project setup

​Step 2 — Write your values overlay

​Custom Route TLS (recommended for production)

​Using external managed services

​Step 3 — Install

​Step 4 — Routes and DNS

​Step 5 — First login to the Control Plane

​Step 6 — Send traffic through TrustGate

​Verification

​Upgrading

​Air-gapped / disconnected OpenShift

​Migration to hybrid

​Troubleshooting

​Related guides

What you’ll end up with

Prerequisites

Step 1 — Project setup

Step 2 — Write your values overlay

Custom Route TLS (recommended for production)

Using external managed services

Step 3 — Install

Step 4 — Routes and DNS

Step 5 — First login to the Control Plane

Step 6 — Send traffic through TrustGate

Verification

Upgrading

Air-gapped / disconnected OpenShift

Migration to hybrid

Troubleshooting

Related guides