Gateway chart values
Every value in the p0security/ai-gateway Helm chart, with whether it is required and its default.
This page lists the values of the p0security/ai-gateway chart, which deploys the gateway and its Auth Server.
If you deploy with the batteries-included chart, set these values under its agentic-gateway key. That chart already sets several of them for you; see Defaults the batteries-included chart changes.
Top-level values
imageRegistry
No
Empty
Registry prefix for the gateway and Auth Server images, such as gcr.io/my-project. Set this when you mirror P0's images into your own registry. It doesn't apply to the management tunnel image, which you set with braekhus.image.name.
clusterRoleBindingName
No
oauthed-mcp-server-token-reviewer
Name of the cluster-wide role binding that lets the gateway verify Kubernetes service account tokens. Give each release in the same cluster its own name.
secretsName
No
app-secrets
Name of the Kubernetes Secret that holds the gateway's credentials. See The credentials Secret.
caBundle
No
Empty
Extra certificates, as PEM text, that the gateway, the Auth Server, and the management tunnel trust for outbound connections. See TLS-inspecting proxies.
Gateway routing
These values configure the Gateway API Gateway, as well as routes that expose the gateway and its Auth Server under a single public hostname.
gateway.className
Yes
Empty
The GatewayClass the gateway's Gateway uses, such as eg for Envoy Gateway or gke-l7-global for GKE. With the batteries-included chart, this is also the name of the GatewayClass that chart creates, so it must be unique in the cluster.
gateway.host
Yes
Empty
The public hostname of the gateway, such as gateway.example.com. Both MCP traffic and the OAuth endpoints are served from this host.
gateway.tlsSecretName
No
gateway-tls
Name of the kubernetes.io/tls Secret that holds the certificate for gateway.host. The chart does not create this Secret, and the value must not be empty.
gateway.httpsRedirect
No
true
Adds a port 80 listener that redirects HTTP requests to HTTPS. Keep this enabled with the batteries-included chart, which uses the same listener to obtain its certificate.
gateway.annotations
No
Empty
Annotations to add to the Gateway resource, for implementation-specific settings such as Cloud Armor or IAP.
gateway.requestTimeout
No
0s
Request timeout for gateway traffic. 0s disables it on Envoy Gateway. On GKE's built-in gateway classes, set this to an empty string and configure a GCPBackendPolicy timeout instead.
gateway.streamIdleTimeout
No
Empty
How long Envoy Gateway keeps an idle streaming connection open, such as 20m. When unset, Envoy's own 5-minute limit applies. Set this only with Envoy Gateway.
gateway.oauthPaths
No
The standard OAuth and OpenID Connect endpoints
Exact paths routed to the Auth Server. Change this only if you have changed the Auth Server's routes; setting it replaces the whole list.
gateway.oauthPathPrefixes
No
/authorize, /public
Path prefixes routed to the Auth Server. As with oauthPaths, setting it replaces the whole list.
Auth Server
These values configure the Auth Server, which authenticates people through your identity provider, binds their identity to the agent making the request, and issues the tokens the gateway accepts.
Connection, issuers, and image
agenticAuthServer.p0Url
Yes
Empty
Your organization's P0 API URL, https://api.p0.app/o/<your-org>.
agenticAuthServer.p0Audience
Yes
Empty
The audience for tokens exchanged with P0. The console installer provides this value; it is usually the same as p0Url.
agenticAuthServer.gatewayIss
Yes
Empty
The gateway's public URL, https://<gateway.host>. It is also the issuer of the tokens the gateway mints for agents.
agenticAuthServer.caches
Yes
Empty
Cache configuration as a JSON string, such as {"valkey":{"url":"redis://valkey-primary:6379"},"defaults":[{"type":"memory"},{"type":"valkey"}]}. Agent authentication with federated credentials, such as JWT-SVIDs, requires a Valkey or Redis tier.
agenticAuthServer.defaultIssuer
No
Empty
The token audience to use when an MCP client does not request one. Set this only for clients that need an audience other than the gateway's URL.
agenticAuthServer.awsRegion
No
us-east-1
Region of the AWS STS endpoint used to obtain credentials for AWS MCP servers. Credentials work in every region, so this only selects a nearby endpoint.
agenticAuthServer.port
No
52701
Port the Auth Server listens on inside the cluster. If you change it, update agenticGatewayServer.agenticAuthServer to match.
agenticAuthServer.image.name
No
auth-server
Auth Server image name.
agenticAuthServer.image.tag
No
latest
Auth Server image tag. An empty value uses the chart's app version. Use a tag at least as new as the chart.
agenticAuthServer.image.pullPolicy
No
Always
Kubernetes image pull policy for the Auth Server: Always, IfNotPresent, or Never.
User sign-in
agenticAuthServer.loginMode chooses how users sign in. The default is 'oidc' mode, where the Auth Server redirects users to your identity provider. In gcip mode, it shows its own login form and authenticates against Google Cloud Identity Platform, which needs no OAuth client.
agenticAuthServer.loginMode
No
oidc
Either oidc or gcip.
agenticAuthServer.openIdDomain
No
Empty
Sign-in allowlist, in both modes: a regular expression matched against a person's whole email address, such as [^@]*@example[.]com. When empty, any account your identity provider authenticates can sign in.
agenticAuthServer.oidcClientId
Conditional
Empty
Required in oidc mode. The OAuth client ID registered at your identity provider. The matching client secret goes in the credentials Secret, not in values.
agenticAuthServer.oidcIssuer
No
https://accounts.google.com
Your identity provider's issuer URL, exactly as the provider publishes it. Used in oidc mode.
agenticAuthServer.oidcRedirectUrl
No
https://<gateway.host>
The sign-in callback URL registered at your identity provider. Used in oidc mode; leave it unset unless your provider requires a different value.
agenticAuthServer.oidcPrompt
No
select_account
The prompt parameter sent to your identity provider. Set it to an empty string to send none, so the provider can reuse an existing session. Used in oidc mode.
agenticAuthServer.oidcRequireEmailVerified
No
"true"
Whether sign-in requires the identity provider to mark the email address as verified. Set it to "false" for providers such as Okta and Entra ID that often omit that claim, and rely on openIdDomain instead. Used in oidc mode.
agenticAuthServer.gcipApiKey
Conditional
Empty
Required in gcip mode. Your Firebase Web API key. This key is public, so it belongs in values rather than in a Secret.
agenticAuthServer.gcipProjectId
Conditional
Empty
Required in gcip mode. The Google Cloud project that hosts your Identity Platform tenant.
agenticAuthServer.gcipTenantId
Conditional
Empty
Required in gcip mode. The Identity Platform tenant this gateway signs people in against.
agenticAuthServer.gcipAllowedSignInProviders
No
password
Comma-separated Identity Platform sign-in providers to accept. Add providers here if your tenant uses more than email and password.
agenticAuthServer.gcipRequireEmailVerified
No
"true"
Whether sign-in requires a verified email address. Set it to "false" only if your tenant verifies addresses another way.
Agent authentication with federated credentials
These values control how agents authenticate to the Auth Server with JWTs issued by an external identity provider, such as JWT-SVIDs. Agents that sign in interactively don't use them, and the defaults suit most deployments.
agenticAuthServer.federatedIssuerAllowlist
No
Empty
Comma-separated issuer URLs this gateway trusts for agent authentication. An issuer must be listed here as well as configured in P0. When empty, the gateway accepts no federated credentials.
agenticAuthServer.clientAssertionAudience
No
The gateway's URL
The audience agents must put in their JWTs.
agenticAuthServer.clientAssertionAlgorithms
No
RS256,ES256
Comma-separated signing algorithms accepted for agent JWTs.
agenticAuthServer.clientAssertionMaxLifetimeSeconds
No
300
Longest lifetime, in seconds, accepted for an agent JWT.
agenticAuthServer.clientAssertionClockSkewSeconds
No
30
Clock skew, in seconds, tolerated when checking an agent JWT's timestamps.
agenticAuthServer.federatedJwksConnectTimeoutMs
No
3000
Connection timeout, in milliseconds, when fetching an issuer's signing keys.
agenticAuthServer.federatedJwksReadTimeoutMs
No
5000
Read timeout, in milliseconds, when fetching an issuer's signing keys.
agenticAuthServer.federatedJwksResponseMaxBytes
No
1048576
Largest signing-key response accepted, in bytes.
agenticAuthServer.federatedJwksCacheMaxAgeSeconds
No
300
How long, in seconds, an issuer's signing keys are cached.
agenticAuthServer.federatedJwksStaleGraceSeconds
No
300
How long, in seconds, cached signing keys remain usable after a failed refresh.
agenticAuthServer.federatedJwksCooldownSeconds
No
30
Minimum time, in seconds, between fetches of the same issuer's signing keys.
Gateway server
These values configure the gateway itself, which authenticates requests and connects agents to MCP servers and A2A agents.
agenticGatewayServer.p0Url
Yes
Empty
Your organization's P0 API URL. Use the same value as agenticAuthServer.p0Url.
agenticGatewayServer.p0Audience
Yes
Empty
The audience for tokens exchanged with P0. Use the same value as agenticAuthServer.p0Audience.
agenticGatewayServer.agenticAuthServer
Yes
Empty
The Auth Server's address inside the cluster, normally http://agentic-auth-server:52701.
agenticGatewayServer.gatewayIss
No
The gateway's URL
Issuer of the tokens the gateway mints. If you set it, use the same value as agenticAuthServer.gatewayIss.
agenticGatewayServer.manageAllowedEmails
Conditional
Empty
Required when manageGcpIssuers is set. Comma-separated Google service account emails allowed to call the gateway's management API, normally the one P0 assigned to this gateway. See Register a gateway you deployed yourself.
agenticGatewayServer.manageGcpIssuers
No
Empty
Comma-separated token issuers accepted on the management API, normally https://accounts.google.com. When empty, the management API accepts no Google identity tokens, so P0 can't manage the gateway.
agenticGatewayServer.managementAudience
No
https://<gateway.host>/manage
The audience expected on tokens sent to the management API.
agenticGatewayServer.victorialogsUrl
No
Empty
Base URL of a VictoriaLogs instance, such as http://victorialogs:9428. When set, P0 reads the gateway's activity logs from it through the management API.
agenticGatewayServer.gcpWifPoolProvider
No
Empty
The Google Cloud workload identity pool provider that Google Cloud MCP servers use to obtain credentials. See GCP Workload Identity Federation.
agenticGatewayServer.backendImagePullPolicy
No
IfNotPresent
Image pull policy for the MCP server pods the gateway starts. The gateway starts a pod for every session, so Always pulls an image on every session. Use Always only for images tagged with a moving tag.
agenticGatewayServer.containerCredentialMinLifetimeMs
No
120000
Minimum remaining lifetime, in milliseconds, that cloud credentials must have before the gateway starts an MCP server with them.
agenticGatewayServer.mcpMetaTracePropagationEnabled
No
false
Sends OpenTelemetry trace context to the MCP servers listed in mcpMetaTracePropagationBackendIds.
agenticGatewayServer.mcpMetaTracePropagationBackendIds
No
Empty
Comma-separated IDs of the MCP servers that receive trace context when mcpMetaTracePropagationEnabled is true.
agenticGatewayServer.a2aProxyIdleTimeoutMs
No
60000
How long, in milliseconds, a streaming A2A call can be idle between the gateway and the A2A bridge before it is closed.
agenticGatewayServer.a2aUpstreamIdleTimeoutMs
No
60000
How long, in milliseconds, a streaming A2A call can be idle between the A2A bridge and the upstream agent before it is closed.
agenticGatewayServer.a2aAgentHandlerIdleTimeoutMs
No
300000
How long, in milliseconds, an idle connection to an upstream A2A agent is kept for reuse. If you set gateway.streamIdleTimeout, set this to match it.
agenticGatewayServer.httpJsonBodyLimit
No
1mb
Largest JSON request body the gateway accepts, such as 5mb.
agenticGatewayServer.gateway.port
No
3300
Port the gateway listens on inside the cluster.
agenticGatewayServer.managementPort
No
3399
Port inside the cluster that serves only the management API.
agenticGatewayServer.p0.port
No
3301
Port the gateway's built-in P0 MCP server listens on. It is reachable only from within the gateway's pod.
agenticGatewayServer.image.name
No
access-proxy
Gateway image name.
agenticGatewayServer.image.tag
No
latest
Gateway image tag. An empty value uses the chart's app version.
agenticGatewayServer.image.pullPolicy
No
Always
Kubernetes image pull policy for the gateway. MCP server pods use backendImagePullPolicy instead.
Management tunnel
The chart runs a small client that opens an outbound connection to P0, so that P0 can reach the gateway's management API without the API being exposed publicly. The client needs no inbound port.
After installing, register the tunnel by pasting its public key into the gateway's page in the P0 admin console. The install notes print the command that reads the key:
braekhus.orgSlug
Yes
Empty
Your organization's slug in P0: the <your-org> in agenticGatewayServer.p0Url.
braekhus.gatewayId
Yes
Empty
The gateway's identifier in the P0 admin console. It must match exactly.
braekhus.tunnelHost
No
api.p0.app
Host name of the P0 API the tunnel connects to. It must not be empty.
braekhus.tunnelPort
No
443
Port of the P0 API the tunnel connects to. It must not be empty.
braekhus.secretsName
No
braekhus-client-jwk
Name of the Secret that holds the tunnel's key pair. It must differ from secretsName, so that the tunnel can't read the gateway's other credentials. See The tunnel key Secret.
braekhus.image.name
No
p0security/braekhus
Tunnel client image. imageRegistry doesn't apply, so set the full name here if you mirror images into your own registry.
braekhus.image.tag
No
sha-6f9ba9d
Tunnel client image tag.
braekhus.image.pullPolicy
No
IfNotPresent
Kubernetes image pull policy for the tunnel client.
TLS-inspecting proxies
If your cluster sends outbound traffic through a proxy that decrypts HTTPS and re-signs it with your own certificate authority, the gateway can't reach P0 until it trusts that authority. Its logs then show UNABLE_TO_GET_ISSUER_CERT_LOCALLY and server sync failed.
Set caBundle to the proxy's root certificate and any intermediates:
With the Terraform module, use version 0.6.0 or later. Save the certificates to a file next to your configuration, and add caBundle to the agentic-gateway block of the module's values:
The gateway, the Auth Server, and the management tunnel trust these certificates alongside the usual public ones, so connections that don't pass through the proxy keep working. Changing caBundle restarts their pods.
Database
This chart does not deploy a database, but both the gateway and the Auth Server require one to run. If not using the batteries-included chart, these values should point to a database both deployments share. The password comes from the POSTGRESQL_PASSWORD key of the credentials Secret.
postgresql.host
Yes
Empty
Hostname of the PostgreSQL server.
postgresql.port
No
5432
Port of the PostgreSQL server.
postgresql.database
No
mcp
Name of the database.
postgresql.username
No
mcp
User the gateway connects as.
Credentials
The gateway and Auth Server read their credentials from a Kubernetes Secret, and the management tunnel reads its key pair from a second one. By default, the chart generates both for you.
The credentials Secret
The Secret named by secretsName holds the gateway's credentials. Secrets the chart creates describes each key. If you set secretsJob.enabled: false (see Secret generation), create the Secret yourself with these keys:
JWT_PRIVATE_KEY, JWT_PUBLIC_KEY
Yes
The Auth Server's RSA signing key pair, as PEM or base64-encoded PEM. The Auth Server doesn't start without both halves.
REFRESH_TOKEN_SECRET
Yes
A base64-encoded value of at least 32 bytes, used to protect refresh tokens. The Auth Server doesn't start without it.
POSTGRESQL_PASSWORD
Yes
The password for postgresql.username. Without it, the gateway and Auth Server pods can't start.
OIDC_CLIENT_SECRET
Conditional
Required in oidc mode. The client secret for agenticAuthServer.oidcClientId. The Auth Server doesn't start without it.
KMS_LOCAL_ENCRYPTION_KEY
No
A 32-byte key, as 64 hexadecimal characters, for encrypting stored data. Set it: without it, the Auth Server generates a new key on every restart and can't read data encrypted before the restart.
The tunnel key Secret
The Secret named by braekhus.secretsName holds the management tunnel's key pair, kept apart from the credentials Secret. If you set secretsJob.enabled: false, create it yourself with these keys:
BRAEKHUS_JWK_PRIVATE, BRAEKHUS_JWK_PUBLIC
Yes
The tunnel's EC P-384 key pair, as JSON Web Keys.
Secret generation
Before installing or upgrading, the chart runs a job that creates the credentials Secret and the tunnel key Secret, and fills in any key that is missing. It never overwrites a key that already has a value.
secretsJob.enabled
No
true
Set to false to manage both Secrets yourself, for example from External Secrets or Vault. They must then exist, with every required key, before you install.
secretsJob.imagePullSecrets
No
Empty
Image pull secrets for the job, such as [{name: my-registry}]. Needed if the Auth Server image comes from a private registry, because the job doesn't use the namespace's default pull secrets.
secretsJob.activeDeadlineSeconds
No
300
How long, in seconds, the job may run before it fails. Pass Helm a longer --timeout, such as 6m, so a stuck job reports its own error.
secretsJob.resources
No
50m CPU and 64Mi memory requested; 128Mi memory limit
CPU and memory for the job's container.
secretsJob.podSecurityContext
No
Runs as non-root user and group 65532 with the RuntimeDefault seccomp profile
Pod security context for the job. Fields you set are merged with the default.
secretsJob.containerSecurityContext
No
No privilege escalation, a read-only root filesystem, and all capabilities dropped
Container security context for the job. Fields you set are merged with the default.
Observability
The gateway and Auth Server always write structured logs to standard output. These values add an export to an OpenTelemetry collector.
observability.otlpEndpoint
No
Empty
Address of an OpenTelemetry collector's gRPC receiver, such as otel-collector.observability.svc.cluster.local:4317. When empty, logs go only to standard output and no traces are exported.
observability.logsExporter
No
Empty
OpenTelemetry logs exporters, comma-separated. When empty, logs go to standard output, and also to the collector when otlpEndpoint is set. Set none to turn log export off.
observability.tracesExporter
No
Empty
OpenTelemetry traces exporters, comma-separated. When empty, traces go to the collector when otlpEndpoint is set. Set none to turn trace export off.
observability.stdoutFormat
No
json
Format of standard output logs: json, for log collectors, or text, for reading with kubectl logs.
observability.stdoutLevel
No
Empty
Lowest severity written to standard output: debug, info, warn, or error. When empty, every level is written.
observability.otlpLevel
No
Empty
Lowest severity exported to the collector. Audit records are always exported. Use warn to reduce volume on a sink that charges by volume.
observability.gcpProjectId
No
Empty
A Google Cloud project ID. When set, JSON log lines include the fields Cloud Logging uses to link each line to its Cloud Trace span.
Last updated