model-gateway Helm chart

Proof-bound model admission and streaming proxy. Source chart version 0.1.0. Published OCI artifacts use the immutable version from the deployment release record:

helm install model-gateway oci://<your-registry>/charts/model-gateway \
  --version "${PUBLISHED_CHART_VERSION:?set to the immutable OCI version for this release}"

Values

Keys marked * are required. Defaults are the chart’s values.yaml; per-environment overlays (values-onprem.yaml) and the deployment set the rest.

Key	Type	Default	Description
`affinity`	`object`	`{}`
`containerSecurityContext`	`object`	`{"privileged": false, "allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "capabilities": {"drop": ["ALL"]}}`
`enabled`	`boolean`	—	Umbrella condition flag (the hiloop chart’s Chart.yaml condition model-gateway.enabled). Has no effect in a standalone install.
`fullnameOverride`	`string`	`""`
`gatewayConfig.admission_timeout_millis` *	`integer`	`30000`	Hard end-to-end admission deadline, from workload proof through the provider credential decision. (min 1, max 60000)
`gatewayConfig.audience` *		`"hiloop-model-gateway"`
`gatewayConfig.aws_region`	`string` \| `null`	`null`
`gatewayConfig.max_concurrent_requests` *	`integer`	`16`	(min 1, max 256)
`gatewayConfig.max_concurrent_streams` *	`integer`	`16`	HTTP proxy stream ceiling. This does not configure Envoy. (min 1, max 10000)
`gatewayConfig.max_request_bytes` *	`integer`	`8388608`	(min 1, max 268435456)
`gatewayConfig.max_response_bytes` *	`integer`	`33554432`	HTTP proxy response ceiling. This does not configure Envoy. (min 1, max 268435456)
`gatewayConfig.policies` *	`array`	`[]`
`gatewayConfig.providers` *	`array`	`[]`
`gatewayConfig.request_body_timeout_millis` *	`integer`	`30000`	HTTP proxy request-body timeout. This does not configure Envoy. (min 1, max 60000)
`gatewayConfig.response_stream_timeout_seconds` *	`integer`	`900`	HTTP proxy response-stream timeout. This does not configure Envoy. (min 1, max 3600)
`gatewayConfig.version` *		`1`
`gatewayConfig.workload_namespace` *		`"hiloop-sandboxes"`
`global.imagePullSecrets`	`array`	`[]`
`global.imageRegistry`	`string`	`""`
`image.digest` *	`string`	`""`
`image.pullPolicy` *	`Always` \| `IfNotPresent` \| `Never`	`"IfNotPresent"`
`image.repository` *	`string`	`"ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/model-gateway"`	(non-empty)
`image.tag` *	`string`	`""`
`nameOverride`	`string`	`""`
`networkPolicy.dns.namespaceSelector` *	`object`	`{"kubernetes.io/metadata.name": "kube-system"}`
`networkPolicy.dns.podSelector` *	`object`	`{"k8s-app": "kube-dns"}`
`networkPolicy.enabled` *		`true`
`networkPolicy.envoyPodSelector` *	`object`	`{"hiloop.ai/model-gateway-fleet": "isolated"}`	Same-namespace pod labels admitted only to the gRPC authorization port.
`networkPolicy.kubernetesApiCIDRs` *		`[]`
`networkPolicy.kubernetesApiPort` *	`integer`	`443`	(min 1, max 65535)
`networkPolicy.podIdentity.ipv4CIDR` *		`"169.254.170.23/32"`
`networkPolicy.podIdentity.ipv6CIDR` *	“ \| `fd00:ec2::23/128`	`""`
`networkPolicy.podIdentity.port` *		`80`
`networkPolicy.providerCIDRs` *		`[]`	Control-service credential backend and HTTP proxy provider egress. This does not configure Envoy.
`nodeSelector`	`object`	`{}`
`podAnnotations`	`object`	`{}`
`podLabels`	`object`	`{}`
`podSecurityContext`	`object`	`{"runAsNonRoot": true, "runAsUser": 65532, "runAsGroup": 65532, "fsGroup": 65532, "fsGroupChangePolicy": "OnRootMismatch", "seccompProfile": {"type": "RuntimeDefault"}}`
`priorityClassName`	`string`	`""`
`providerCredentials.existingSecret` *	`string`	`""`
`providerRouting.enabled` *	`boolean`	`false`
`providerRouting.legacyAuthorityProviderId` *	`string`	`""`
`providerRouting.namespace` *	`string`	`""`
`providerTLS`	`object`	—	Provider trust for the HTTP proxy. This does not configure Envoy.
`providerTLS.caKey` *	`string`	`"ca.crt"`
`providerTLS.existingConfigMap` *	`string`	`""`
`rbac.create` *		`true`
`replicaCount`		`1`
`resources`	`object`	`{"requests": {"cpu": "250m", "memory": "256Mi"}, "limits": {"memory": "512Mi"}}`
`service.authorizationPort` *	`integer`	`9191`	mTLS gRPC ext_auth service port used only by the isolated Envoy data plane. (min 1, max 65535)
`service.port` *	`integer`	`8080`	HTTP model proxy port. (min 1, max 65535)
`serviceAccount.annotations` *	`object`	`{}`
`serviceAccount.create` *	`boolean`	`true`
`serviceAccount.name` *	`string`	`""`
`terminationGracePeriodSeconds`	`integer`	`30`	(min 1)
`tls`	`object`	—	Mandatory mTLS identity for the gRPC admission service. Create these Secrets before release reconciliation; hosted installations use the isolated controller.
`tls.clientCaSecretName` *	`string`	`"model-gateway-server-tls"`	Secret containing the public ca.crt for the Envoy client issuer. The default reuses the cert-manager-produced server leaf Secret, which is already mounted by this pod and carries that same issuer certificate. (non-empty)
`tls.envoyClientUriSan` *	`string`	`"spiffe://hiloop.ai/model-gateway-envoy"`	Exact URI SAN required on the isolated Envoy client certificate.
`tls.serverSecretName` *	`string`	`"model-gateway-server-tls"`	Secret containing the admission service tls.crt and tls.key. (non-empty)
`tolerations`	`array`	`[]`

​Values

Values