Skip to main content

​
Wizard-issued credentials

The console issues credentials per product instance before you deploy. Create each product you run — TrustGate under Agent Gateway and TrustGuard under Agent Runtime — and collect its own set. See Console setup for the step-by-step flow. Each private instance issues:
  • A configuration-sync token, scoped to that gateway or TrustGuard
  • A DataAgent enrollment token that authorizes OTLP metadata egress and DataBridge retrieval
The Docker command injects the configuration-sync token, DataAgent enrollment token, and a generated local cache key. The maintained Compose manifest also requires operator-supplied SERVER_SECRET_KEY, CONFIG_SYNC_GRPC_ENDPOINT, and DATABRIDGE_ADDR. The Kubernetes wizard currently writes credentials directly into generated values.yaml; it does not place them in Kubernetes Secret references. Treat the entire generated file as a secret and never commit it. For production, move the credentials into pre-created Kubernetes Secrets or an approved secret manager and map them through the current maintained chart interfaces. Manual displays only CONTROL_PLANE_JWT and DATA_AGENT_JWT. Never print credentials in logs or share them in tickets. Regenerating install configuration from Settings → Agent Gateway → Deployment issues new install credentials.

​
Chart-managed secrets

For an operator-managed Kubernetes deployment that uses a maintained Helm chart, these settings control runtime secret generation:
For GitOps, pre-create Secrets and set autoGenerateSecrets: false with preserveExistingSecrets: true. helm template cannot preserve generated values via lookup.

​
Data-plane secrets

​
Credential contracts

  • The configuration-sync token authenticates the data plane’s outbound configuration pull from the SaaS control plane.
  • The OTLP token authenticates metadata export to the generated collector endpoint.
  • The DataAgent enrollment token is separate and authorizes DataAgent and DataBridge retrieval.
  • The LLM and MCP URLs are not secrets. Configure them separately in Settings → Agent Gateway → General.

​
Regional high availability

Every regional data plane needs the gateway-scoped configuration-sync credential and a valid CONFIG_SYNC_LKG_KEY. Store the encrypted last-known-good file on persistent storage so the region can restart while the control plane is unavailable. Only the active region should run the enrolled DataAgent. Keep the enrollment token protected in passive regions and enable the DataAgent only as part of a fenced promotion. See High availability.

​
Chart references

Metadata (OTLP) — when using an existing Kubernetes Secret:
DataAgent — reference the wizard-issued enrollment token from a Secret:
Keep configuration-sync, OTLP, and DataAgent enrollment tokens out of values files and source control.

​
Registry

Create gcr-secret (or set global.imagePullSecrets) yourself — the chart does not create registry credentials. Full key lists live in the chart repository SECRETS.md.