> ## Documentation Index
> Fetch the complete documentation index at: https://neuraltrust-92b43583-develop.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Console setup
> Before installing, create TrustGate and TrustGuard in the console and collect the tokens the Hybrid data plane needs.
A Hybrid data plane runs in **your** cluster but is configured and observed by the
NeuralTrust SaaS control plane. To connect the two, each runtime authenticates to
SaaS with **tokens issued by the console** at [app.neuraltrust.ai](https://app.neuraltrust.ai/en/v2/).
Tokens are issued **per product instance**. TrustGate and TrustGuard are separate
console objects, so a Hybrid install that runs both must create **both** and
collect **two token sets** — one per product.
## One product, four names
The same product is spelled differently in the console, in `global.products`,
and in the values block that configures it. Keeping them straight avoids the
most common install failure:
| Product | In the console | `global.products` key | Values block | Workloads |
| -------------- | -------------- | --------------------- | --------------- | ---------------------------------------- |
| **TrustGate** | Agent Gateway | `trustgate` | `agentgateway:` | `agentgateway-proxy`, `agentgateway-mcp` |
| **TrustGuard** | Agent Runtime | `trustguard` | `trustguard:` | `trustguard`, `firewall` |
TrustGate is the only one where the two chart keys differ. `global.products`
is keyed by product id (`trustgate`), while the values block matches the chart's
dependency name (`agentgateway`).
## What the console issues
When you create a **Private** TrustGate or TrustGuard, the console generates two
credentials for that instance:
| Token | Purpose | Chart key (`CONFIG_SYNC_TOKEN` / `ENROLMENT_TOKEN`) |
| ------------------------------ | -------------------------------------------------------------------------------------- | --------------------------------------------------- |
| **Config-sync token** | Authenticates the runtime's outbound pull of compiled configuration from SaaS. | `CONFIG_SYNC_TOKEN` |
| **DataAgent enrollment token** | Authorizes the co-located DataAgent for OTLP metadata egress and DataBridge retrieval. | `ENROLMENT_TOKEN` |
Both are JWTs scoped to the specific gateway or TrustGuard instance. The enrollment
JWT already carries the tenant and instance identifiers — you do not set them
separately.
## Create a private TrustGate
1. Open [app.neuraltrust.ai](https://app.neuraltrust.ai/en/v2/) and go to **TrustGate → Agent Gateway → Getting started**.
2. Choose **New Gateway**, enter a name, and select **Private** (*High stakes* — fixed capacity, no cold starts).
3. Under **Where do you want to run your gateway?** choose **Kubernetes** (recommended for production). Creating the gateway issues its **config-sync token** and **DataAgent enrollment token**.
4. Copy the two tokens from the generated `values.yaml`. Treat the whole file as a secret — see [Secrets](/neuraltrust/deployment/secrets).
5. Leave the wizard open. After the data plane is running you return here to set the **Dataplane URL** — see [Register the URLs](#register-the-urls).
Older consoles emit `global.products.agentgateway: true` in the generated
`values.yaml`. The chart rejects it:
```
Error: global.products supports only trustgate, trustguard, and dataPlane (got "agentgateway")
```
Rename that one key to `trustgate`. The `agentgateway:` block further down the
file is correct and should be left alone — see
[One product, four names](#one-product-four-names). TrustGuard is unaffected.
**Docker** and **Manual** are also offered. Docker is for local evaluation of the
LLM/proxy path only (no MCP). Manual returns `CONTROL_PLANE_JWT` and
`DATA_AGENT_JWT` for fully custom manifests. Use **Kubernetes** for production.
## Create a private TrustGuard
1. Go to **TrustGuard → Agent Runtime → Getting started**.
2. Choose **New TrustGuard**, enter a name, and select **Private**.
3. Choose **Kubernetes**. Creating the TrustGuard issues **its own** config-sync token and DataAgent enrollment token — distinct from TrustGate's.
4. Copy both tokens.
The TrustGuard wizard offers **Kubernetes** and **Manual** only (no Docker). In a
combined install, TrustGate and TrustGuard each keep independent tokens; never
reuse one product's token for the other.
## Translate the wizard output
The **Kubernetes** wizard hands you a complete-looking `values.yaml`. Treat it as
credential and setup **input**, not as the file you install. The maintained chart
is the source of truth; where the two disagree, the chart wins. Four differences
matter, and a file that keeps any of them installs but does not behave the way
you expect:
| In the wizard output | In the maintained chart | Your action |
| ------------------------------------ | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `global.products.agentgateway: true` | `global.products.trustgate: true` | Rename that one key. The `agentgateway:` block below it is correct — see [One product, four names](#one-product-four-names). |
| Credentials inline in `values.yaml` | `existingSecret` references | Move both tokens per product into the Secrets in [Map tokens to chart Secrets](#map-tokens-to-chart-secrets). Inline values enter Helm release history. |
| One bootstrap **Dataplane URL** | Separate **LLM URL** and **MCP URL** | Set both in **Settings → Agent Gateway → General** after install. One URL serves the proxy and quietly breaks MCP — see [Register the URLs](#register-the-urls). |
| Everything else it emits | The chart's own values interface | Take the tokens and discard the rest; datastores, ingress, TLS, and sizing come from your values file. |
The single-URL default is the one item here with no error message. Tool calls
simply never resolve, and nothing in the console or the pod logs says the MCP URL
was never set.
## Map tokens to chart Secrets
For a production Kubernetes install, pre-create the Secrets below and reference
them from values — keep the raw tokens out of `values.yaml` and source control.
Each Secret holds only what the console issued you.
| Kubernetes Secret | Keys | From |
| -------------------------------- | ------------------- | ---------------------------- |
| `agentgateway-config-sync` | `CONFIG_SYNC_TOKEN` | TrustGate config-sync token |
| `dataagent-enrolment-trustgate` | `ENROLMENT_TOKEN` | TrustGate enrollment token |
| `trustguard-config-sync` | `CONFIG_SYNC_TOKEN` | TrustGuard config-sync token |
| `dataagent-enrolment-trustguard` | `ENROLMENT_TOKEN` | TrustGuard enrollment token |
The companion `CONFIG_SYNC_LKG_KEY` is **generated by the chart** as of 2.6.0 and
does not belong in these Secrets. It encrypts a local snapshot cache, so unlike
the token it is not a shared credential the control plane has to know. If you run
with `global.autoGenerateSecrets: false` or `global.preserveExistingSecrets: true`
the chart generates nothing, and it becomes yours to supply alongside the token —
see [Secrets](/neuraltrust/deployment/secrets).
Reference them from the maintained `neuraltrust-platform` chart. Select the
products you run with `global.products`, then point each config-sync and
enrollment block at its Secret:
```yaml theme={null}
global:
deploymentMode: hybrid
products:
trustgate: true
trustguard: true
agentgateway:
configSync:
existingSecret:
name: agentgateway-config-sync
dataagent:
enrolment:
existingSecret:
name: dataagent-enrolment-trustgate
trustguard:
configSync:
existingSecret:
name: trustguard-config-sync
dataagent:
enrolment:
existingSecret:
name: dataagent-enrolment-trustguard
```
Config-sync is **on by default** in Hybrid (mode-derived) — set only
`existingSecret`; do not restate `enabled: true`. For local or evaluation
installs you may inline the raw values with `configSync.token` and
`dataagent.enrolment.token` instead of an `existingSecret`, but those values
enter Helm release history.
## Register the URLs
The console needs to reach the data plane you just installed, so finish the
wizard once TrustGate is serving traffic.
1. Expose both TrustGate entry points — LLM/proxy on port `8081` and MCP on port
`8082` — as described in
[Hybrid → Expose both entry points](/neuraltrust/deployment/hybrid#expose-both-entry-points).
2. Return to the wizard, enter the LLM/proxy URL as the bootstrap **Dataplane
URL**, and choose **Save and Finish**. The wizard initially uses this one URL
for both entry points.
3. Open **Settings → Agent Gateway → General** and set the **LLM URL** and
**MCP URL** separately.
| Method | Use it for | Wizard output |
| -------------- | -------------------------------------- | ----------------------------------------------------------- |
| **Kubernetes** | Production-grade deployments | Credential and setup input to map into the maintained chart |
| **Docker** | Local evaluation of the LLM/proxy path | A Docker Compose command; does not start MCP |
| **Manual** | Custom or operator-managed deployments | `CONTROL_PLANE_JWT` and `DATA_AGENT_JWT` |
Both URLs must be reachable by their intended clients, and NeuralTrust calls the
Dataplane URL from a single source IP that your network controls must allow — see
[Hybrid → Network](/neuraltrust/deployment/hybrid#network). **Settings → Agent
Gateway → Deployment** can regenerate the install configuration and credentials
later.
## Regenerate tokens
Issue fresh tokens any time from **Settings → Agent Gateway → Deployment** (TrustGate)
or the equivalent TrustGuard deployment settings. Regenerating invalidates the
previous install credentials, so update the corresponding Secret and roll the
runtime pods.
## Next steps
The install these tokens are for, start to finish.
Handle config-sync and enrollment tokens safely.
Managed stores, ingress, and every values switch.
Config-sync and install failures.