NeuralTrust | Platform for Agent Security.

Pick the topology first — it changes what you install, what you must create beforehand, and whether you need the NeuralTrust console at all.

	Hybrid	External
Control plane	Hosted by NeuralTrust	Yours, in-cluster
In your cluster	The data path: TrustGate, TrustGuard, Firewall, data-plane API, DataAgent	Everything, plus the console, ClickHouse, DataCore, and AlertEngine
Console setup first?	Yes — each product issues tokens you need at install	No
Typical size	3–4 workers at 8 vCPU / 16–32 GiB	4–5 workers of the same class

Both paths assume you already have the maintained neuraltrust-platform chart and credentials for the NeuralTrust image registry. <chart> below is the chart reference your NeuralTrust contact provided. On OpenShift the install is the same but ingress differs — see OpenShift before you start.

Hybrid
External

Step 3 is where most installs fail. Those four Secrets are never generated by the chart. If your values file does not reference them, the install stops at render time with a validation error.

Check prerequisites

A Kubernetes cluster with an ingress controller, and Helm 3.8+
Capacity for your topology — Cluster sizing
A base domain you can point at the cluster ingress, for example platform.example.com
Outbound TCP 443 to the NeuralTrust config-sync, DataBridge, and telemetry hosts, plus inbound from the NeuralTrust source IP — Network
A reachable PostgreSQL and Redis. The chart deploys both in-cluster by default; managed stores are recommended for production — sizes

kubectl get nodes
kubectl get storageclass
kubectl get ingressclass

Create the namespace and image pull secret

kubectl create namespace neuraltrust

NeuralTrust images are private, and NeuralTrust sends you a registry key when your account is provisioned. Turn it into the pull Secret every component expects — the chart repository ships a script that fills in the registry server for you:

GCR_KEY_FILE=./neuraltrust-registry-key.json \
  ./create-image-pull-secret.sh --namespace neuraltrust

If your cluster cannot reach the NeuralTrust registry, mirror the images into your own instead and set global.imageRegistry. Both paths, and the two collector images that imageRegistry does not rewrite, are covered in Container images.

Create the four operator-supplied Secrets

Create TrustGate and TrustGuard in the console first. Each issues a config-sync token and a DataAgent enrollment JWT. You generate the LKG key yourself. Full walkthrough: Console setup.

# One LKG key per product — these encrypt the cached configuration snapshot
openssl rand -base64 32   # for TrustGate
openssl rand -base64 32   # for TrustGuard

# Config sync — pulls runtime configuration from the hosted control plane
kubectl create secret generic agentgateway-config-sync -n neuraltrust \
  --from-literal=CONFIG_SYNC_TOKEN='<trustgate-config-sync-token>' \
  --from-literal=CONFIG_SYNC_LKG_KEY='<trustgate-lkg-key>'

kubectl create secret generic trustguard-config-sync -n neuraltrust \
  --from-literal=CONFIG_SYNC_TOKEN='<trustguard-config-sync-token>' \
  --from-literal=CONFIG_SYNC_LKG_KEY='<trustguard-lkg-key>'

# DataAgent enrollment — powers DataBridge reads and product OTLP egress
kubectl create secret generic dataagent-enrolment-trustgate -n neuraltrust \
  --from-literal=ENROLMENT_TOKEN='<trustgate-enrolment-jwt>'

kubectl create secret generic dataagent-enrolment-trustguard -n neuraltrust \
  --from-literal=ENROLMENT_TOKEN='<trustguard-enrolment-jwt>'

Every other credential — JWT signing keys, the PostgreSQL password, and so on — is generated on first install and reused on upgrade. See Secrets.

The enrollment JWT already carries tenant_id and instance_id. Do not set a tenant ID in values.

Write your values file

The chart ships values-required.yaml, a full-hybrid preset that already matches the Secret names above. Copy it and change the two cluster-specific lines:

global:
  platform: "kubernetes"          # aws | gcp | azure | openshift | kubernetes
  domain: "platform.example.com"
  products:
    trustgate: true
    trustguard: true
    dataPlane: true

agentgateway:
  configSync:
    existingSecret:
      name: "agentgateway-config-sync"
  dataagent:
    enrolment:
      existingSecret:
        name: "dataagent-enrolment-trustgate"

trustguard:
  configSync:
    existingSecret:
      name: "trustguard-config-sync"
  dataagent:
    enrolment:
      existingSecret:
        name: "dataagent-enrolment-trustguard"

Product flags default to off and at least one must be true. For a subset, drop the flags you do not need and use the matching tracked slice — values-trustgate.yaml.example, values-trustguard.yaml.example, or values-red-teaming.yaml.example (data-plane API only, which needs no DataAgent and no config-sync). Every switch is listed in Feature flags.

Install

helm upgrade --install neuraltrust-platform <chart> \
  --namespace neuraltrust --create-namespace \
  -f values-required.yaml

To inspect the manifests first, render them locally. The chart validates your values at template time, so most configuration mistakes surface here:

helm template neuraltrust-platform <chart> \
  --namespace neuraltrust -f values-required.yaml > /tmp/rendered.yaml

Verify

kubectl get pods -n neuraltrust
kubectl get ingress -n neuraltrust

With all three products enabled you should see agentgateway-proxy, agentgateway-mcp, trustguard-data-plane, data-plane-api, firewall and its workers, dataagent, dataagent-trustguard, control-plane-postgresql, and redis.Hostnames derive from global.domain:

Service	Host
TrustGate LLM gateway	`gateway.<domain>` and `*.llm.<domain>`
TrustGate MCP	`mcp.<domain>` and `*.mcp.<domain>`
TrustGuard	`trustguard.<domain>`
data-plane API	`data-plane-api.<domain>`

Point DNS at the ingress address, then set the LLM URL and MCP URL in Settings → Agent Gateway → General to finish console setup.

External needs no console setup, no config-sync tokens, and no DataAgent enrollment. The platform is its own configuration source.

Check prerequisites

A Kubernetes cluster with an ingress controller, and Helm 3.8+
Capacity for the console and analytics stack on top of the data path — Cluster sizing
A base domain you can point at the cluster ingress
PostgreSQL, Redis, and ClickHouse. All three deploy in-cluster by default; for managed stores, pre-create the roles and databases first — External datastores
No outbound NeuralTrust connectivity is required

kubectl get nodes
kubectl get storageclass
kubectl get ingressclass

Create the namespace and image pull secret

kubectl create namespace neuraltrust

Turn the registry key NeuralTrust sent you into the pull Secret every component expects:

GCR_KEY_FILE=./neuraltrust-registry-key.json \
  ./create-image-pull-secret.sh --namespace neuraltrust

For an air-gapped install, mirror the images into your own registry and set global.imageRegistry instead — note that two collector images are pinned in full and need separate overrides. See Container images.

Create the bootstrap administrator Secret

There is no hosted console to sign in from, so seed the first super-admin. A pre-created Secret keeps the credentials out of Helm release history:

kubectl create secret generic onprem-superadmin -n neuraltrust \
  --from-literal=ONPREM_SUPERADMIN_EMAIL='admin@example.com' \
  --from-literal=ONPREM_SUPERADMIN_PASSWORD='<strong-password>'

Set a CAPTCHA secret key too, or three failed logins will lock the console. The published console image carries a Cloudflare Turnstile site key, so the login page presents a CAPTCHA after three failed attempts — but the matching secret key is a runtime value the chart does not set, so verification fails and the sign-in is refused. See External for the TURNSTILE_SECRET_KEY override and the air-gapped caveat.

Write your values file

The chart ships values-external.yaml.example. Copy it and set your platform and domain:

global:
  deploymentMode: external
  platform: "kubernetes"          # aws | gcp | azure | openshift | kubernetes
  domain: "platform.example.com"
  superadmin:
    existingSecret:
      name: "onprem-superadmin"
  observability:
    hostedExport:
      enabled: false              # no outbound telemetry to NeuralTrust

External ignores global.products and always deploys the full stack. For managed PostgreSQL, Redis, and ClickHouse, start from values-managed-datastores.yaml.example instead.

Install and verify

helm upgrade --install neuraltrust-platform <chart> \
  --namespace neuraltrust --create-namespace \
  -f values-external.yaml.example

kubectl get pods -n neuraltrust
kubectl get ingress -n neuraltrust

Alongside the data path you should see the components Hybrid leaves in SaaS — agentgateway-admin, trustguard-control-plane, control-plane-api, and control-plane-app — plus the analytics stack: clickstack-collector, clickhouse, datacore, alertengine-api, and alertengine-worker. No dataagent pod appears in External mode.Point DNS at the ingress address, then sign in to the console with the super-admin credentials from step 3.

Install fails? Common causes

Both modes validate your values while rendering, so these appear before anything reaches the cluster.

Error	Fix
`hybrid requires at least one product`	Set at least one `global.products.*` to `true`. External ignores these flags.
`agentgateway config-sync requires CONFIG_SYNC_TOKEN and CONFIG_SYNC_LKG_KEY`	Create the config-sync Secrets in Hybrid step 3, or set `configSync.enabled: false` if you manage configuration in PostgreSQL out of band
`hybrid trustgate/trustguard requires dataagent enrolment`	Create the enrollment Secrets in Hybrid step 3
`global.clickstack.enabled is no longer supported`	Product telemetry is mandatory in Hybrid. Use External for air-gapped or local-only telemetry

A clean render still cannot see your cluster. A missing gcr-secret, a Secret you referenced but never created, or an absent ingress class will only surface as pod failures after install — check kubectl get pods -n neuraltrust and the pod events.

Next steps

Configuration

Datastores, ingress, TLS, and domains.

Secrets

What the chart generates and what you must supply.

Feature flags

Every switch that changes the deployment.

High availability

Multi-region and failover planning.

Platform

Organization

Identity & Access

Telemetry

Audit & Compliance

Infrastructure

Quick start

Install fails? Common causes

Next steps

Configuration

Secrets

Feature flags

High availability

​Install fails? Common causes

​Next steps

Configuration

Secrets

Feature flags

High availability

Install fails? Common causes

Next steps