Skip to main content
The install is the same on every provider. Follow your model’s guide — Hybrid, Self-hosted, or Central — and use this page for the choices that differ underneath it. OpenShift has its own page, because Routes, wildcard admission, and SCCs change more than a setting. Capacity is provider-independent: with the NeuralTrust-hosted Firewall, the default, a full Hybrid install fits 2 nodes of 8 vCPU / 16 GiB and External or Central 3. With the Firewall in your cluster on CPU, Hybrid needs 3 nodes of 8 vCPU / 32 GiB and External or Central 4. Use those counts as the minimum of an autoscaled node pool; GPU options and machine types per cloud are in Capacity. Minimum managed datastore sizes are in Managed stores.
With a managed PostgreSQL, global.postgresql.authMode: iam reaches every service: each runtime service’s database.iamAuth inherits it when unset. Set agentgateway.database.iamAuth or trustguard.database.iamAuth explicitly only for a mixed-auth install. The token provider (AWS, Azure, or GCP) and the setup for each are in IAM database authentication.
Install the EBS CSI driver and the AWS Load Balancer Controller before exposing anything, and use IRSA for AWS API access.ACM certificates terminate at the load balancer, so they cover Ingress hosts but not the layer-4 endpoints a central control plane publishes — TLS terminates in those pods and ACM does not export private keys. Use cert-manager or your own PKI there, with service.beta.kubernetes.io/aws-load-balancer-type: nlb and aws-load-balancer-scheme: internal for private callers.
AKS ships no ingress controller by default — install Application Gateway or NGINX before exposing the data plane.An internal load balancer is service.beta.kubernetes.io/azure-load-balancer-internal: "true".
--num-nodes 1 in a regional cluster gives one node per zone, so three in total.For GKE Ingress set global.platform: gcp, global.ingress.gcp.staticIpName, and managedCertificates. Google-managed certificates reject wildcards, so if you rely on the chart’s wildcard hosts (*.llm.<domain> / *.mcp.<domain>) use cert-manager, or set agentgateway.config.autoWildcardHosts: false and list exact hosts.A plain LoadBalancer Service already gives a layer-4 passthrough load balancer; its private form is networking.gke.io/load-balancer-type: "Internal".
For clusters without a dedicated guide. Confirm the capabilities first:
You need a default StorageClass (or global.storageClass), an Ingress or Gateway implementation, DNS for global.domain, and TLS from cert-manager or pre-created Secrets.

​
GPU nodes

Only needed if you run Firewall on GPU, which is opt-in. It requires a separate GPU node pool, the vendor device plugin, and matching labels and taints — see GPU Firewall workers.