Install the batteries-included Helm chart

Deploy the p0security/ai-gateway-stack chart with helm instead of the Terraform the P0 console generates, then register the gateway with P0.

Use this path when your pipeline is Helm-based rather than Terraform. Only the deployment mechanism differs. The chart and its values are the same, and every other step of the console install applies here unchanged: starting the installer, setting the OIDC client secret, reporting the LoadBalancer address, and verifying.

The AI gateway integration is available as an opt-in capability. Contact P0 to enable it for your organization.

The prerequisites are the same, except that you need helm (v3, with OCI support) instead of terraform.

Among the values the console generates, p0Url is your organization's API base URL, https://api.p0.app/o/<your-org>. The console fills it in for you. <your-org> is your organization slug, which is the segment right after /o/ in the address bar when you're signed in to p0.app: p0.app/o/<your-org>/....

Put the values from the generated module's values block into a my-values.yaml, then install the chart instead of running terraform apply:

helm install ai-gateway-stack \
  oci://registry-1.docker.io/p0security/ai-gateway-stack \
  --version <chart-version> \
  --namespace p0-agentic-gateway --create-namespace \
  --timeout 6m \
  -f my-values.yaml

Replace <chart-version> with a published chart version. The versions are listed on the chart's Docker Hub tags page. Pin one rather than leaving it off, so a later release can't change what an existing pipeline installs.

The release name (ai-gateway-stack above) is what the module sets from your gateway identifier. It also names the secrets job, as job/<release-name>-ensure-secrets, which is the log you read when setting the OIDC client secret.

The --timeout 6m matters. The secret-generation Job runs for up to 5 minutes, and the extra minute lets a stuck Job fail with its own log message instead of a generic Helm timeout.

Don't pass --wait. cert-manager can't issue the TLS certificate until the gateway's DNS record exists, so --wait would block and eventually time out.

To change a value afterwards, helm upgrade with --reuse-values:

helm upgrade ai-gateway-stack \
  oci://registry-1.docker.io/p0security/ai-gateway-stack \
  --namespace p0-agentic-gateway --reuse-values \
  --timeout 6m \
  --set letsEncrypt.env=prod

Installing the chart does not register the gateway with P0. If you don't complete the console installer, register the gateway with the P0 Terraform provider instead: p0_agentic_gateway_staged returns the assigned service account as service_account_email, which is the value agenticGatewayServer.manageAllowedEmails needs, and p0_agentic_gateway finalizes the install once your gateway trusts it. Set its braekhus_public_jwk attribute to register the gateway's management tunnel the same way the console installer does.