> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/agentic-access/agentic-gateway/gateway/deploy/install-the-batteries-included-chart.md).

# Install the batteries-included Helm chart

Deploy the p0security/ai-gateway-stack chart with helm instead of the Terraform the P0 console generates, then register the gateway with P0.

Use this path when your pipeline is Helm-based rather than Terraform. Only the deployment mechanism differs. The chart and its values are the same, and every other step of the console installer (see [Install from the P0 console](/agentic-access/agentic-gateway/gateway/deploy/install-from-the-p0-console.md)) applies here unchanged: starting the installer, setting the OIDC client secret, reporting the LoadBalancer address, and verifying.

The [Deploying the gateway](/agentic-access/agentic-gateway/gateway/deploy.md#prerequisites) are the same, except that you need `helm` (v3, with OCI support) instead of `terraform`.

Among the values the console generates, `p0Url` is your organization's API base URL, `https://api.p0.app/o/<your-org>`. The console fills it in for you. `<your-org>` is your organization slug, which is the segment right after `/o/` in the address bar when you're signed in to [p0.app](https://p0.app): `p0.app/o/<your-org>/...`.

Put the values from the generated module's `values` block into a `my-values.yaml`, then install the chart instead of running `terraform apply`.

Keep `letsEncrypt.env` at `prod`, as the console's values block sets it. The chart's own default is `staging`. Browsers and `curl` reject a staging certificate, so an install that leaves the value out fails the HTTPS checks in [/pages/dTpYGsFvf4WWGEvrXyvA#id-5.-verify](https://docs.p0.dev/agentic-access/agentic-gateway/gateway/deploy/pages/dTpYGsFvf4WWGEvrXyvA#id-5.-verify "mention").

```bash
helm install ai-gateway-stack \
  oci://registry-1.docker.io/p0security/ai-gateway-stack \
  --version <chart-version> \
  --namespace p0-agentic-gateway --create-namespace \
  --timeout 6m \
  -f my-values.yaml
```

Replace `<chart-version>` with a published chart version. The versions are listed on the chart's [Docker Hub tags page](https://hub.docker.com/r/p0security/ai-gateway-stack/tags). Pin one rather than leaving it off, so a later release can't change what an existing pipeline installs.

The release name (`ai-gateway-stack` above) is what the module sets from your gateway identifier. It also names the secrets job, as `job/<release-name>-ensure-secrets`, which is the log you read when setting the OIDC client secret.

The `--timeout 6m` matters. The secret-generation Job runs for up to 5 minutes, and the extra minute lets a stuck Job fail with its own log message instead of a generic Helm timeout.

{% hint style="warning" %}
Don't pass `--wait`. cert-manager can't issue the TLS certificate until the gateway's DNS record exists, so `--wait` would block and eventually time out.
{% endhint %}

To change a value afterwards, `helm upgrade` with `--reuse-values`:

```bash
helm upgrade ai-gateway-stack \
  oci://registry-1.docker.io/p0security/ai-gateway-stack \
  --namespace p0-agentic-gateway --reuse-values \
  --timeout 6m \
  --set letsEncrypt.env=prod
```

To upgrade a release installed from chart 1.0.0-beta or earlier, first see [Helm chart values reference](/agentic-access/agentic-gateway/gateway/deploy/chart-values.md#renamed-values-keys). The first upgrade to 1.1.0-beta needs your full values file in place of `--reuse-values`.

{% hint style="warning" %}
Installing the chart does not register the gateway with P0. If you don't complete the console installer, register the gateway with the P0 Terraform provider instead: [`p0_ai_gateway_staged`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/ai_gateway_staged) returns the assigned service account as `service_account_email`, which is the value `accessProxy.manageAllowedEmails` needs, and [`p0_ai_gateway`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/ai_gateway) finalizes the install once your gateway trusts it. Set its `braekhus_public_jwk` attribute to register the gateway's management tunnel (see [Gateway](/agentic-access/agentic-gateway/gateway.md#an-outbound-management-tunnel)) the same way the console installer does.
{% endhint %}