> ## Documentation Index > Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt > Use this file to discover all available pages before exploring further. # Quick start > The shortest working install path for a Hybrid data plane or a fully self-hosted External deployment. Pick the topology first — it changes what you install, what you must create beforehand, and whether you need the NeuralTrust console at all. | | **Hybrid** | **External** | | :------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------- | | Control plane | Hosted by NeuralTrust | Yours, in-cluster | | In your cluster | The data path: TrustGate, TrustGuard, Firewall, data-plane API, DataAgent | Everything, plus the console, ClickHouse, DataCore, and AlertEngine | | Console setup first? | Yes — each product issues tokens you need at install | No | | Typical size | 3–4 workers at 8 vCPU / 16–32 GiB | 4–5 workers of the same class | Both paths assume you already have the maintained `neuraltrust-platform` chart and credentials for the NeuralTrust image registry. `` below is the chart reference your NeuralTrust contact provided. On OpenShift the install is the same but ingress differs — see [OpenShift](/neuraltrust/deployment/openshift/overview) before you start. Step 3 is where most installs fail. Those four Secrets are **never** generated by the chart. If your values file does not reference them, the install stops at render time with a validation error. * A Kubernetes cluster with an ingress controller, and Helm 3.8+ * Capacity for your topology — [Cluster sizing](/neuraltrust/deployment/sizing) * A base domain you can point at the cluster ingress, for example `platform.example.com` * Outbound TCP 443 to the NeuralTrust config-sync, DataBridge, and telemetry hosts, plus inbound from the NeuralTrust source IP — [Network](/neuraltrust/deployment/network) * A reachable PostgreSQL and Redis. The chart deploys both in-cluster by default; managed stores are recommended for production — [sizes](/neuraltrust/deployment/configuration#managed-stores) ```bash theme={null} kubectl get nodes kubectl get storageclass kubectl get ingressclass ``` ```bash theme={null} kubectl create namespace neuraltrust ``` NeuralTrust images are private, and NeuralTrust sends you a registry key when your account is provisioned. Turn it into the pull Secret every component expects — the chart repository ships a script that fills in the registry server for you: ```bash theme={null} GCR_KEY_FILE=./neuraltrust-registry-key.json \ ./create-image-pull-secret.sh --namespace neuraltrust ``` If your cluster cannot reach the NeuralTrust registry, mirror the images into your own instead and set `global.imageRegistry`. Both paths, and the two collector images that `imageRegistry` does not rewrite, are covered in [Container images](/neuraltrust/deployment/images). Create TrustGate and TrustGuard in the console first. Each issues a **config-sync token** and a **DataAgent enrollment JWT**. You generate the **LKG key** yourself. Full walkthrough: [Console setup](/neuraltrust/deployment/console-setup). ```bash theme={null} # One LKG key per product — these encrypt the cached configuration snapshot openssl rand -base64 32 # for TrustGate openssl rand -base64 32 # for TrustGuard ``` ```bash theme={null} # Config sync — pulls runtime configuration from the hosted control plane kubectl create secret generic agentgateway-config-sync -n neuraltrust \ --from-literal=CONFIG_SYNC_TOKEN='' \ --from-literal=CONFIG_SYNC_LKG_KEY='' kubectl create secret generic trustguard-config-sync -n neuraltrust \ --from-literal=CONFIG_SYNC_TOKEN='' \ --from-literal=CONFIG_SYNC_LKG_KEY='' # DataAgent enrollment — powers DataBridge reads and product OTLP egress kubectl create secret generic dataagent-enrolment-trustgate -n neuraltrust \ --from-literal=ENROLMENT_TOKEN='' kubectl create secret generic dataagent-enrolment-trustguard -n neuraltrust \ --from-literal=ENROLMENT_TOKEN='' ``` Every other credential — JWT signing keys, the PostgreSQL password, and so on — is generated on first install and reused on upgrade. See [Secrets](/neuraltrust/deployment/secrets). The enrollment JWT already carries `tenant_id` and `instance_id`. Do not set a tenant ID in values. The chart ships `values-required.yaml`, a full-hybrid preset that already matches the Secret names above. Copy it and change the two cluster-specific lines: ```yaml theme={null} global: platform: "kubernetes" # aws | gcp | azure | openshift | kubernetes domain: "platform.example.com" products: trustgate: true trustguard: true dataPlane: true agentgateway: configSync: existingSecret: name: "agentgateway-config-sync" dataagent: enrolment: existingSecret: name: "dataagent-enrolment-trustgate" trustguard: configSync: existingSecret: name: "trustguard-config-sync" dataagent: enrolment: existingSecret: name: "dataagent-enrolment-trustguard" ``` Product flags default to **off** and at least one must be `true`. For a subset, drop the flags you do not need and use the matching tracked slice — `values-trustgate.yaml.example`, `values-trustguard.yaml.example`, or `values-red-teaming.yaml.example` (data-plane API only, which needs no DataAgent and no config-sync). Every switch is listed in [Feature flags](/neuraltrust/deployment/feature-flags). ```bash theme={null} helm upgrade --install neuraltrust-platform \ --namespace neuraltrust --create-namespace \ -f values-required.yaml ``` To inspect the manifests first, render them locally. The chart validates your values at template time, so most configuration mistakes surface here: ```bash theme={null} helm template neuraltrust-platform \ --namespace neuraltrust -f values-required.yaml > /tmp/rendered.yaml ``` ```bash theme={null} kubectl get pods -n neuraltrust kubectl get ingress -n neuraltrust ``` With all three products enabled you should see `agentgateway-proxy`, `agentgateway-mcp`, `trustguard-data-plane`, `data-plane-api`, `firewall` and its workers, `dataagent`, `dataagent-trustguard`, `control-plane-postgresql`, and `redis`. Hostnames derive from `global.domain`: | Service | Host | | --------------------- | --------------------------------------- | | TrustGate LLM gateway | `gateway.` and `*.llm.` | | TrustGate MCP | `mcp.` and `*.mcp.` | | TrustGuard | `trustguard.` | | data-plane API | `data-plane-api.` | Point DNS at the ingress address, then set the **LLM URL** and **MCP URL** in **Settings → Agent Gateway → General** to finish [console setup](/neuraltrust/deployment/console-setup). External needs no console setup, no config-sync tokens, and no DataAgent enrollment. The platform is its own configuration source. * A Kubernetes cluster with an ingress controller, and Helm 3.8+ * Capacity for the console and analytics stack on top of the data path — [Cluster sizing](/neuraltrust/deployment/sizing) * A base domain you can point at the cluster ingress * PostgreSQL, Redis, and ClickHouse. All three deploy in-cluster by default; for managed stores, pre-create the roles and databases first — [External datastores](/neuraltrust/deployment/external#datastores) * No outbound NeuralTrust connectivity is required ```bash theme={null} kubectl get nodes kubectl get storageclass kubectl get ingressclass ``` ```bash theme={null} kubectl create namespace neuraltrust ``` Turn the registry key NeuralTrust sent you into the pull Secret every component expects: ```bash theme={null} GCR_KEY_FILE=./neuraltrust-registry-key.json \ ./create-image-pull-secret.sh --namespace neuraltrust ``` For an air-gapped install, mirror the images into your own registry and set `global.imageRegistry` instead — note that two collector images are pinned in full and need separate overrides. See [Container images](/neuraltrust/deployment/images#mirror-to-your-own-registry). There is no hosted console to sign in from, so seed the first super-admin. A pre-created Secret keeps the credentials out of Helm release history: ```bash theme={null} kubectl create secret generic onprem-superadmin -n neuraltrust \ --from-literal=ONPREM_SUPERADMIN_EMAIL='admin@example.com' \ --from-literal=ONPREM_SUPERADMIN_PASSWORD='' ``` **Set a CAPTCHA secret key too, or three failed logins will lock the console.** The published console image carries a Cloudflare Turnstile *site* key, so the login page presents a CAPTCHA after three failed attempts — but the matching *secret* key is a runtime value the chart does not set, so verification fails and the sign-in is refused. See [External](/neuraltrust/deployment/external#first-administrator) for the `TURNSTILE_SECRET_KEY` override and the air-gapped caveat. The chart ships `values-external.yaml.example`. Copy it and set your platform and domain: ```yaml theme={null} global: deploymentMode: external platform: "kubernetes" # aws | gcp | azure | openshift | kubernetes domain: "platform.example.com" superadmin: existingSecret: name: "onprem-superadmin" observability: hostedExport: enabled: false # no outbound telemetry to NeuralTrust ``` External ignores `global.products` and always deploys the full stack. For managed PostgreSQL, Redis, and ClickHouse, start from `values-managed-datastores.yaml.example` instead. ```bash theme={null} helm upgrade --install neuraltrust-platform \ --namespace neuraltrust --create-namespace \ -f values-external.yaml.example ``` ```bash theme={null} kubectl get pods -n neuraltrust kubectl get ingress -n neuraltrust ``` Alongside the data path you should see the components Hybrid leaves in SaaS — `agentgateway-admin`, `trustguard-control-plane`, `control-plane-api`, and `control-plane-app` — plus the analytics stack: `clickstack-collector`, `clickhouse`, `datacore`, `alertengine-api`, and `alertengine-worker`. No `dataagent` pod appears in External mode. Point DNS at the ingress address, then sign in to the console with the super-admin credentials from step 3. ## Install fails? Common causes Both modes validate your values while rendering, so these appear before anything reaches the cluster. | Error | Fix | | ----------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | `hybrid requires at least one product` | Set at least one `global.products.*` to `true`. External ignores these flags. | | `agentgateway config-sync requires CONFIG_SYNC_TOKEN and CONFIG_SYNC_LKG_KEY` | Create the config-sync Secrets in Hybrid step 3, or set `configSync.enabled: false` if you manage configuration in PostgreSQL out of band | | `hybrid trustgate/trustguard requires dataagent enrolment` | Create the enrollment Secrets in Hybrid step 3 | | `global.clickstack.enabled is no longer supported` | Product telemetry is mandatory in Hybrid. Use External for air-gapped or local-only telemetry | A clean render still cannot see your cluster. A missing `gcr-secret`, a Secret you referenced but never created, or an absent ingress class will only surface as pod failures after install — check `kubectl get pods -n neuraltrust` and the pod events. ## Next steps Datastores, ingress, TLS, and domains. What the chart generates and what you must supply. Every switch that changes the deployment. Multi-region and failover planning.