> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/agentic-access/agentic-gateway/gateway/deploy/chart-values.md).

# Helm chart values reference

Reference for the values you can set when deploying the P0 AI Gateway with its Helm charts.

The P0 AI Gateway is provided in two forms, each with their own helm chart. These pages list every value you can set in each chart, whether it's required, and its default.

| Chart                                                                                 | What it deploys                                                                                                                                                                                                                                                                                                                     | Reference                                                                                                                  |
| ------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| [`p0security/ai-gateway-stack`](https://hub.docker.com/r/p0security/ai-gateway-stack) | The "batteries-included" chart. It deploys the gateway chart below, plus Envoy Gateway, cert-manager, PostgreSQL, Valkey, VictoriaLogs, and an OpenTelemetry collector. The console installer deploys this chart. See [Install from the P0 console](/agentic-access/agentic-gateway/gateway/deploy/install-from-the-p0-console.md). | [Batteries-included chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/batteries-included-chart.md) |
| [`p0security/ai-gateway`](https://hub.docker.com/r/p0security/ai-gateway)             | The gateway and Auth Server on their own. You provide the database, cache, Gateway API controller, and TLS certificate.                                                                                                                                                                                                             | [Gateway chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/gateway-chart.md)                       |

## How the charts fit together

The batteries-included chart includes the gateway chart, so every gateway chart value can also be set through it; if using the batteries-included chart, put those values under the `ai-gateway` key. For example, the gateway chart's `gateway.host` is `ai-gateway.gateway.host` in the batteries-included chart:

```yaml
ai-gateway:
  gateway:
    host: gateway.example.com
```

The batteries-included chart changes some of the gateway chart's defaults so that the bundled components work together. [Batteries-included chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/batteries-included-chart.md#defaults-the-batteries-included-chart-changes) lists them.

If you deploy the gateway chart on its own, there is no need for an `ai-gateway` prefix-key: set every value at the top level of your values file, exactly as [Gateway chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/gateway-chart.md) lists it.

## Setting values

For a console install, set values in the generated module's `values` block. For a Helm install, set them in the values file you pass with `-f`, or with `--set` on the command line. See [Install the batteries-included Helm chart](/agentic-access/agentic-gateway/gateway/deploy/install-the-batteries-included-chart.md).

If you leave out a required value, either the install fails before anything is deployed, or the affected pod fails when it starts. Either way, the error names the missing value.

## Renamed values keys

Batteries-included chart 1.1.0-beta and gateway chart 1.1.0-beta rename several values keys. The gateway's Deployments, Services, and `Gateway` keep their names, so `helm upgrade` updates the release in place.

| Chart              | Old key                                  | New key                     |
| ------------------ | ---------------------------------------- | --------------------------- |
| Batteries-included | `agentic-gateway`                        | `ai-gateway`                |
| Gateway            | `agenticAuthServer`                      | `authServer`                |
| Gateway            | `agenticGatewayServer`                   | `accessProxy`               |
| Gateway            | `agenticGatewayServer.agenticAuthServer` | `accessProxy.authServerUrl` |

### Upgrading the batteries-included chart from 1.0.0-beta or earlier

Move everything under `agentic-gateway:` to `ai-gateway:` before you upgrade, and rename `--set agentic-gateway.*` flags to `--set ai-gateway.*`. Helm ignores a values key that matches no part of the chart, so the chart checks for the old key itself: install, upgrade, and `helm template` fail with a message naming the rename while your values set `agentic-gateway` and not `ai-gateway`. Values that set both keys are accepted, and the chart reads only `ai-gateway`.

A release installed from 1.0.0-beta or earlier stores the old key, so `helm upgrade --reuse-values` fails once. Upgrade once with your full values file, `-f my-values.yaml`, in place of `--reuse-values`. Later upgrades can use `--reuse-values` again.

For a console install, [Terraform module](https://registry.terraform.io/modules/p0-security/p0-ai-gateway-stack/kubernetes/latest) 1.1.0-beta and later deploy chart 1.1.0-beta and rewrite an `agentic-gateway` key in the module's `values` to `ai-gateway` for you. A single `values` entry that sets both keys fails at plan.

The batteries-included chart sets defaults for `authServer.caches`, `accessProxy.victorialogsUrl`, and `accessProxy.manageGcpIssuers`. Under the old component keys, rendering fails if you set any of these to `""`, or set `manageGcpIssuers` to a different value. Move these settings to `authServer` or `accessProxy` before you upgrade, even if you keep the other old component keys for now. For example, a release with `victorialogs.enabled: false` that clears `agenticGatewayServer.victorialogsUrl` now sets `ai-gateway.accessProxy.victorialogsUrl: ""`. The error names the field to move.

### Upgrading the gateway chart to 1.1.0-beta

The old component keys still work in 1.1.0-beta: the chart merges them into the new keys when it renders, and a future chart version removes them. Move to the new keys, then delete the old blocks. Where an old key and its new key both set a field, the old key's value wins. Rendering fails instead when an old field is `""`, `null` or whitespace over a non-empty value, including a chart default, or when an old access list such as `openIdDomain` or `manageAllowedEmails` differs from its new key's value.

`accessProxy.authServerUrl` now defaults to this release's own Auth Server Service, `http://agentic-auth-server:52701`, so most installs can remove it. Keep it only if your Auth Server runs elsewhere.