Batteries-included chart values
Every value in the p0security/ai-gateway-stack Helm chart, with whether it is required and its default.
This page lists the values of the p0security/ai-gateway-stack chart, which deploys the gateway together with everything it depends on. The gateway's own values go under the agentic-gateway key, and are listed in Gateway chart values.
Required values
A minimal values file sets these:
letsEncrypt:
email: <your-email>
postgresql:
storageClass: <your-storage-class-name>
victorialogs:
storageClass: <your-storage-class-name>
agentic-gateway:
gateway:
className: <your-gateway-name>
host: <your-gateway-hostname>
agenticAuthServer:
oidcClientId: <your-oauth-client-id>
p0Url: https://api.p0.app/o/<your-org>
p0Audience: <your-p0-audience>
gatewayIss: https://<your-gateway-hostname>
agenticGatewayServer:
p0Url: https://api.p0.app/o/<your-org>
p0Audience: <your-p0-audience>
manageAllowedEmails: <p0-service-account-email>
braekhus:
orgSlug: <your-org>
gatewayId: <your-gateway-identifier>The console installer generates these for you. manageAllowedEmails is required because this chart enables P0's access to the gateway's management API by default, and the braekhus values identify the gateway's management tunnel to P0.
Bundled components
Each bundled component can be turned off so you can use your own.
cert-manager.enabled
No
true
Installs cert-manager. Set to false if the cluster already runs cert-manager; see What the chart installs cluster-wide.
envoy-gateway.enabled
No
true
Installs Envoy Gateway. Set to false if the cluster already runs it. The chart's GatewayClass always uses the Envoy Gateway controller, so Envoy Gateway must be present either way.
postgresql.enabled
No
true
Installs a single-instance PostgreSQL database. Set to false to use your own database, and set agentic-gateway.postgresql.host to its address.
valkey.enabled
No
true
Installs a single-instance Valkey cache. Set to false to use your own Redis-compatible cache, and update the valkey.url in agentic-gateway.agenticAuthServer.caches.
victorialogs.enabled
No
true
Installs VictoriaLogs, which stores the gateway's activity logs for P0 to read. Set to false to send logs only to Google Cloud or your own collector.
collector.enabled
No
true
Installs an OpenTelemetry collector that forwards the gateway's logs to VictoriaLogs and, optionally, Google Cloud. It requires victorialogs.enabled or collector.gcpProjectId.
The bundled PostgreSQL, Valkey, and VictoriaLogs each run as a single pod with no replication or backups. For production, consider managed services instead.
The chart sets a few cert-manager and Envoy Gateway values that the gateway depends on. Leave cert-manager.crds.enabled and envoy-gateway.crds.enabled at false, since the chart installs the CRDs itself. Setting envoy-gateway.crds.enabled to true also installs experimental-channel Gateway API CRDs, which clusters that enforce the standard channel reject. If you change cert-manager.extraArgs or cert-manager.featureGates, keep --enable-gateway-api=true and ExperimentalGatewayAPISupport=true in them. For every other cert-manager and Envoy Gateway value, see the cert-manager Helm documentation and the Envoy Gateway v1.9 Helm values.
Certificates and load balancer
The chart obtains the gateway's TLS certificate from Let's Encrypt, and exposes the gateway through a load balancer that Envoy Gateway creates.
letsEncrypt.email
Yes
Empty
Contact email for the Let's Encrypt account that issues the gateway's certificate. Let's Encrypt uses it for renewal notices and account recovery, and does not publish it.
letsEncrypt.env
No
staging
staging or prod. Staging certificates aren't trusted by browsers but aren't rate-limited; production certificates are trusted and limited to five duplicate certificates per domain per week. Any value other than prod uses staging.
envoyProxy.serviceAnnotations
No
service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
Annotations for the gateway's load balancer Service. The default makes the load balancer public on EKS Auto Mode, which otherwise makes it internal, and has no effect on GKE or AKS. Annotations you add are merged with the default; set the value to null to remove the default.
envoyProxy.serviceType
No
Empty
Type of the gateway's Service: LoadBalancer, NodePort, or ClusterIP. When empty, Envoy Gateway's default, LoadBalancer, applies. Use NodePort on clusters with no load balancer integration, such as bare metal.
envoyProxy.nodePorts
No
Empty
Fixed node ports for the gateway's listeners, as http and https, such as {http: 30080, https: 30443}. A port left unset gets a random one from the cluster's node port range. Requires envoyProxy.serviceType: NodePort, and http also requires agentic-gateway.gateway.httpsRedirect: true; otherwise the install fails.
PostgreSQL
These values apply when postgresql.enabled is true.
postgresql.storageClass
Conditional
Empty
Required unless postgresql.persistence.enabled is false. The StorageClass for the database volume, such as gp3 on EKS, standard-rwo on GKE, or managed-premium on AKS. See EKS Auto Mode storage.
postgresql.storageSize
No
8Gi
Size of the database volume.
postgresql.persistence.enabled
No
true
Set to false only for a proof of concept on a cluster with no StorageClass. The database is then lost whenever its pod restarts or moves.
postgresql.database
No
mcp
Name of the database. It must match agentic-gateway.postgresql.database.
postgresql.username
No
mcp
Database user. It must match agentic-gateway.postgresql.username.
postgresql.credentialsSecretName
No
app-secrets
Secret the database reads its password from. It must match agentic-gateway.secretsName.
postgresql.image
No
postgres:16-alpine
PostgreSQL image.
The database sets its password only when it first starts. If you delete the app-secrets Secret, also delete the database's volume claim, data-postgresql-0, or the next install generates a password the database rejects.
Valkey
valkey.image
No
valkey/valkey:8-alpine
Valkey image. Valkey stores nothing on disk, so it needs no volume.
VictoriaLogs
These values apply when victorialogs.enabled is true.
victorialogs.storageClass
Conditional
Empty
Required unless victorialogs.persistence.enabled is false. The StorageClass for the log volume. The same classes work as for postgresql.storageClass.
victorialogs.storageSize
No
20Gi
Size of the log volume. This is the volume that grows with gateway use.
victorialogs.retentionPeriod
No
30d
How long logs are kept, such as 7d, 30d, or 1y.
victorialogs.persistence.enabled
No
true
Set to false only for a proof of concept on a cluster with no StorageClass. Logs are then lost whenever the pod restarts or moves, and the oldest logs are dropped once they fill 80% of storageSize, which must be at least 13Mi.
victorialogs.image
No
victoriametrics/victoria-logs:v1.52.0
VictoriaLogs image.
OpenTelemetry collector
These values apply when collector.enabled is true.
collector.gcpProjectId
No
Empty
A Google Cloud project to also send logs and traces to, through Cloud Logging and Cloud Trace. When you set it, also set agentic-gateway.observability.tracesExporter to an empty string so that traces are exported.
collector.serviceAccount.create
No
true
Creates a service account for the collector. Set to false to use an existing one, named by collector.serviceAccount.name.
collector.serviceAccount.name
No
<release-name>-otel-collector
Name of the collector's service account.
collector.serviceAccount.annotations
No
Empty
Annotations for the collector's service account. On GKE, set iam.gke.io/gcp-service-account to a Google service account with the roles/logging.logWriter role, and roles/cloudtrace.agent for traces.
collector.image
No
otel/opentelemetry-collector-contrib:0.121.0
Collector image.
Defaults the batteries-included chart changes
The chart sets these gateway chart values so that the gateway uses the bundled components. Change them if you replace a component with your own.
agentic-gateway.imageRegistry
p0security
When you mirror P0's images into your own registry.
agentic-gateway.postgresql.host
postgresql
When you use your own database.
agentic-gateway.agenticAuthServer.caches
Uses the bundled Valkey at redis://valkey-primary:6379
When you use your own cache.
agentic-gateway.agenticGatewayServer.agenticAuthServer
http://agentic-auth-server:52701
When you change agentic-gateway.agenticAuthServer.port.
agentic-gateway.agenticGatewayServer.victorialogsUrl
http://victorialogs:9428
When you disable or replace the bundled VictoriaLogs. Set it to an empty string if P0 should not read activity logs.
agentic-gateway.agenticGatewayServer.manageGcpIssuers
https://accounts.google.com
Leave it unchanged. P0 uses Google identity tokens to call the gateway's management API.
agentic-gateway.observability.otlpEndpoint
The bundled collector
When you disable the bundled collector. Point it at your own collector, or set it to an empty string to turn off export.
agentic-gateway.observability.tracesExporter
none
When you set collector.gcpProjectId, or point otlpEndpoint at a collector that accepts traces.
Last updated