Skip to main content

A TrustGate data plane is the gateway in your request path: it routes, secures and observes LLM and MCP traffic between your applications, agents and model providers. It runs in your cluster and enrols into a control plane, which configures it and receives its metadata.

TrustGate is open source under the Apache 2.0 license. This page installs it on its own — the Gateway only reference architecture — enrolled into NeuralTrust SaaS in your tenant’s region. To enrol it into a control plane you run instead, follow the same steps with the change in Connect to your own control plane. To run TrustGate and TrustGuard together, follow Hybrid instead.

​
What you are installing

This install runs agentgateway-proxy (LLM, port 8081), agentgateway-mcp (MCP, port 8082), and one dataagent. TrustGate pulls its configuration from the control plane, and DataAgent ships its metadata out and answers the console’s authorized queries; raw prompts and responses stay in your PostgreSQL. The TrustGate image and its chart values block are named agentgateway. That is the same product; see the naming map.
The TrustGate image is published to the NeuralTrust container registry. Pulling it requires a registry key, which NeuralTrust issues with an enterprise offer — contact NeuralTrust to get one.

​
Before you start

The Hybrid prerequisites apply here. For TrustGate alone, that comes down to:
  • Your tenant’s region, EU or US — see Choose your region
  • A cluster with an ingress controller and Helm 3.8+: 2 nodes of 8 vCPU / 16 GiB as the minimum of an autoscaled node pool
  • A base domain you can point at the cluster ingress, for example platform.example.com
  • Redis and PostgreSQL the cluster can reach. TrustGate refuses to start without Redis — see Check your datastores first
  • The registry key
  • The network rules below
  • Console access in your region, to create a private gateway

​
Network for TrustGate alone

Allow outbound TCP 443 to the hosts of your region. TrustGate needs no TrustGuard config-sync host, and no Firewall host unless you give it a firewall JWT for smart routing. Static IPs for the EU hosts are in Hybrid → Network. Inbound, your published :8081 and :8082 entry points must accept HTTPS from the NeuralTrust source IP in Hybrid → Inbound. Agree it with your network team before install day.

​
Install

1

Prepare the namespace and chart sources

Do step 1 of the Hybrid install to create the namespace and the image pull Secret, then get the chart sources so values-trustgate.yaml.example is on disk.
2

Create the gateway in the console

In the console of your tenant’s region, open TrustGate → New Gateway, name it, choose Private, then Kubernetes. Take the CONFIG_SYNC_TOKEN and the DataAgent enrollment JWT from the wizard output — see Console setup.
3

Create the two Secrets

4

Install

Put the cluster-specific values in their own file:
values-cluster.yaml
For a US tenant, also add saasRegion: "us" under global in that file — see Choose your region.Then install with the TrustGate slice, which turns on global.products.trustgate and wires the two Secrets:
5

Verify, expose and register both entry points

You should see agentgateway-proxy, agentgateway-mcp and dataagent. The gateway reports Ready only after it has pulled its configuration, so a pod that is Running but never Ready means config sync is failing — see Hybrid → Verify for the causes.Then expose the LLM and MCP hostnames and set both URLs in the console, as described in Expose both entry points. A single URL works for LLM traffic and quietly breaks MCP.
Before handing the gateway over, work through the validation checklist: DNS and TLS from the caller’s network, and MCP tested separately from the LLM route.

​
Connect to your own control plane

To enrol this data plane into a central control plane you run, rather than into NeuralTrust SaaS, make three changes to the steps above:
  1. Point it at your domain. Set global.controlPlane.domain in values-cluster.yaml instead of a region; it moves config sync, DataBridge and telemetry together.
  2. Take the tokens from your console, not from NeuralTrust’s. Mint one enrolment token per data plane — see Telling data planes apart.
  3. Allow egress to your central cluster instead of to NeuralTrust: agentgateway-configsync.<domain>, databridge.<domain> and telemetry.<domain> on 443. If the central cluster serves chart-generated certificates, trust its CA as in Trusting a chart-generated control plane.

​
Next steps

TrustGuard data plane

Add runtime detection in its own data plane.

High availability

Replicas across zones, and the ladder beyond one cluster.

Configuration

Managed stores, ingress, TLS, and every values switch.

Troubleshooting

Install, pod, config-sync, and telemetry failures.