> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/agentic-access/agentic-gateway/gateway/deploy/chart-values/batteries-included-chart.md). # Batteries-included chart values Every value in the p0security/ai-gateway-stack Helm chart, with whether it is required and its default. This page lists the values of the `p0security/ai-gateway-stack` chart, which deploys the gateway together with everything it depends on. The gateway's own values go under the `ai-gateway` key, and are listed in [Gateway chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/gateway-chart.md). ## Required values A minimal values file sets these: ```yaml letsEncrypt: env: prod email: postgresql: storageClass: victorialogs: storageClass: valkey: storageClass: ai-gateway: gateway: className: host: authServer: oidcClientId: p0Url: https://api.p0.app/o/ p0Audience: accessProxy: p0Url: https://api.p0.app/o/ p0Audience: manageAllowedEmails: braekhus: orgSlug: gatewayId: ``` The console installer generates these for you (see [Install from the P0 console](/agentic-access/agentic-gateway/gateway/deploy/install-from-the-p0-console.md)). `letsEncrypt.env` defaults to `staging`, and browsers reject a staging certificate, so set it to `prod`. `manageAllowedEmails` is required because this chart enables P0's access to the gateway's management API by default, and the `braekhus` values identify the gateway's [Gateway chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/gateway-chart.md#management-tunnel) to P0. ## Bundled components {% hint style="info" %} A value marked **Conditional** is required only in some situations; see the field description for details. An empty default means the value is unset. {% endhint %} Each bundled component can be turned off so you can use your own. | Value | Required | Default | Description | | ----------------------- | -------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `cert-manager.enabled` | No | `true` | Installs cert-manager. Set to `false` if the cluster already runs cert-manager; see [Deploying the gateway](/agentic-access/agentic-gateway/gateway/deploy.md#what-the-chart-installs-cluster-wide). | | `envoy-gateway.enabled` | No | `true` | Installs Envoy Gateway. Set to `false` if the cluster already runs it. The chart's `GatewayClass` always uses the Envoy Gateway controller, so Envoy Gateway must be present either way. | | `postgresql.enabled` | No | `true` | Installs a single-instance PostgreSQL database. Set to `false` to use your own database, and set `ai-gateway.postgresql.host` to its address. | | `valkey.enabled` | No | `true` | Installs a single-instance Valkey cache. Set to `false` to use your own Redis-compatible cache, and update the `valkey.url` in `ai-gateway.authServer.caches`. | | `victorialogs.enabled` | No | `true` | Installs VictoriaLogs, which stores the gateway's activity logs for P0 to read. Set to `false` to send logs only to Google Cloud or your own collector. | | `collector.enabled` | No | `true` | Installs an OpenTelemetry collector that forwards the gateway's logs to VictoriaLogs and, optionally, Google Cloud. It requires `victorialogs.enabled` or `collector.gcpProjectId`. | The bundled PostgreSQL, Valkey, and VictoriaLogs each run as a single pod with no replication or backups. For production, consider managed services instead. The chart sets a few cert-manager and Envoy Gateway values that the gateway depends on. Leave `cert-manager.crds.enabled` and `envoy-gateway.crds.enabled` at `false`, since the chart installs the CRDs itself. Setting `envoy-gateway.crds.enabled` to `true` also installs experimental-channel Gateway API CRDs, which clusters that enforce the standard channel reject. If you change `cert-manager.extraArgs` or `cert-manager.featureGates`, keep `--enable-gateway-api=true` and `ExperimentalGatewayAPISupport=true` in them. For every other cert-manager and Envoy Gateway value, see the [cert-manager Helm documentation](https://cert-manager.io/v1.16-docs/installation/helm/) and the [Envoy Gateway v1.9 Helm values](https://gateway.envoyproxy.io/v1.9/install/gateway-helm-api/). ### Certificates and load balancer The chart obtains the gateway's TLS certificate from Let's Encrypt, and exposes the gateway through a load balancer that Envoy Gateway creates. | Value | Required | Default | Description | | ------------------------------- | -------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `letsEncrypt.email` | Yes | Empty | Contact email for the Let's Encrypt account that issues the gateway's certificate. Let's Encrypt uses it for renewal notices and account recovery, and does not publish it. | | `letsEncrypt.env` | No | `staging` | `staging` or `prod`. Staging certificates aren't trusted by browsers but aren't rate-limited; production certificates are trusted and limited to five duplicate certificates per domain per week. Any value other than `prod` uses staging. | | `envoyProxy.serviceAnnotations` | No | `service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing` | Annotations for the gateway's load balancer Service. The default makes the load balancer public on EKS Auto Mode, which otherwise makes it internal, and has no effect on GKE or AKS. Annotations you add are merged with the default; set the value to `null` to remove the default. | | `envoyProxy.serviceType` | No | Empty | Type of the gateway's Service: `LoadBalancer`, `NodePort`, or `ClusterIP`. When empty, Envoy Gateway's default, `LoadBalancer`, applies. Use `NodePort` on clusters with no load balancer integration, such as bare metal. | | `envoyProxy.nodePorts` | No | Empty | Fixed node ports for the gateway's listeners, as `http` and `https`, such as `{http: 30080, https: 30443}`. A port left unset gets a random one from the cluster's node port range. Requires `envoyProxy.serviceType: NodePort`, and `http` also requires `ai-gateway.gateway.httpsRedirect: true`; otherwise the install fails. | ### PostgreSQL These values apply when `postgresql.enabled` is `true`. | Value | Required | Default | Description | | ---------------------------------- | ----------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `postgresql.storageClass` | Conditional | Empty | Required unless `postgresql.persistence.enabled` is `false`. The `StorageClass` for the database volume, such as `gp3` on EKS, `standard-rwo` on GKE, or `managed-csi` on AKS. See [Deploying the gateway](/agentic-access/agentic-gateway/gateway/deploy.md#eks-auto-mode-storage). | | `postgresql.storageSize` | No | `8Gi` | Size of the database volume. | | `postgresql.persistence.enabled` | No | `true` | Set to `false` only for a proof of concept on a cluster with no `StorageClass`. The database is then lost whenever its pod restarts or moves. | | `postgresql.database` | No | `mcp` | Name of the database. It must match `ai-gateway.postgresql.database`. | | `postgresql.username` | No | `mcp` | Database user. It must match `ai-gateway.postgresql.username`. | | `postgresql.credentialsSecretName` | No | `app-secrets` | Secret the database reads its password from. It must match `ai-gateway.secretsName`. | | `postgresql.image` | No | `postgres:16-alpine` | PostgreSQL image. | The database sets its password only when it first starts. If you delete the `app-secrets` Secret, also delete the database's volume claim, `data-postgresql-0`, or the next install generates a password the database rejects. ### Valkey These values apply when `valkey.enabled` is `true`. | Value | Required | Default | Description | | --------------------- | ----------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `valkey.storageClass` | Conditional | Empty | Required unless `valkey.enabled` is `false`. The `StorageClass` for the Valkey volume. Use an encrypted class, because the volume holds users' credentials for SaaS MCP servers. On EKS, use a class with `encrypted: "true"`, such as the `gp3` class in [Deploying the gateway](/agentic-access/agentic-gateway/gateway/deploy.md#standard-eks-storage). GKE and AKS encrypt disks by default. The install fails with `storageClass is required` if you leave it empty. On a cluster with no `StorageClass`, see [Deploying the gateway](/agentic-access/agentic-gateway/gateway/deploy.md#evaluating-without-a-storage-class). | | `valkey.storageSize` | No | `1Gi` | Size of the Valkey volume. | | `valkey.image` | No | `valkey/valkey:8-alpine` | Valkey image. | Snapshots and backups of the Valkey volume also hold those credentials, so protect them the same way. If you use your own cache instead, it must accept connections without TLS or a password, so allow only the Auth Server to reach it. To change `valkey.storageClass` on a running gateway, first delete the Valkey volume claim and its pod. Kubernetes can't change the class of an existing claim, so `helm upgrade` fails until you do: ```bash kubectl -n delete pvc data-valkey-primary-0 --wait=false kubectl -n delete pod valkey-primary-0 ``` Then run `helm upgrade` again. Valkey starts empty on the new volume. Users sign in to their SaaS MCP servers again, and admins register any headless agent credentials again, as in [OAuth servers from a headless agent](/agentic-access/using-the-gateway/headless-oauth-credentials.md). If the old class keeps volumes after their claim is deleted (a `Retain` reclaim policy), delete the old volume and any snapshots of it, since they still hold credentials. ### VictoriaLogs These values apply when `victorialogs.enabled` is `true`. | Value | Required | Default | Description | | ---------------------------------- | ----------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `victorialogs.storageClass` | Conditional | Empty | Required unless `victorialogs.persistence.enabled` is `false`. The `StorageClass` for the log volume. The same classes work as for `postgresql.storageClass`. | | `victorialogs.storageSize` | No | `20Gi` | Size of the log volume. This is the volume that grows with gateway use. | | `victorialogs.retentionPeriod` | No | `30d` | How long logs are kept, such as `7d`, `30d`, or `1y`. | | `victorialogs.persistence.enabled` | No | `true` | Set to `false` only for a proof of concept on a cluster with no `StorageClass`. Logs are then lost whenever the pod restarts or moves, and the oldest logs are dropped once they fill 80% of `storageSize`, which must be at least `13Mi`. | | `victorialogs.image` | No | `victoriametrics/victoria-logs:v1.52.0` | VictoriaLogs image. | ### OpenTelemetry collector These values apply when `collector.enabled` is `true`. | Value | Required | Default | Description | | -------------------------------------- | -------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `collector.gcpProjectId` | No | Empty | A Google Cloud project to also send logs and traces to, through Cloud Logging and Cloud Trace. When you set it, also set `ai-gateway.observability.tracesExporter` to an empty string so that traces are exported. | | `collector.serviceAccount.create` | No | `true` | Creates a service account for the collector. Set to `false` to use an existing one, named by `collector.serviceAccount.name`. | | `collector.serviceAccount.name` | No | `-otel-collector` | Name of the collector's service account. | | `collector.serviceAccount.annotations` | No | Empty | Annotations for the collector's service account. On GKE, set `iam.gke.io/gcp-service-account` to a Google service account with the `roles/logging.logWriter` role, and `roles/cloudtrace.agent` for traces. | | `collector.image` | No | `otel/opentelemetry-collector-contrib:0.121.0` | Collector image. | ### Defaults the batteries-included chart changes The chart sets these [Gateway chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/gateway-chart.md) so that the gateway uses the bundled components. Change them if you replace a component with your own. | Value | Default in this chart | When to change it | | ----------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | `ai-gateway.imageRegistry` | `p0security` | When you mirror P0's images into your own registry. | | `ai-gateway.postgresql.host` | `postgresql` | When you use your own database. | | `ai-gateway.authServer.caches` | Uses the bundled Valkey at `redis://valkey-primary:6379` | When you use your own cache. | | `ai-gateway.accessProxy.victorialogsUrl` | `http://victorialogs:9428` | When you disable or replace the bundled VictoriaLogs. Set it to an empty string if P0 should not read activity logs. | | `ai-gateway.accessProxy.manageGcpIssuers` | `https://accounts.google.com` | Leave it unchanged. P0 uses Google identity tokens to call the gateway's management API. | | `ai-gateway.observability.otlpEndpoint` | The bundled collector | When you disable the bundled collector. Point it at your own collector, or set it to an empty string to turn off export. | | `ai-gateway.observability.tracesExporter` | `none` | When you set `collector.gcpProjectId`, or point `otlpEndpoint` at a collector that accepts traces. |