> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# model-gateway Helm chart

> Proof-bound model admission and streaming proxy

Proof-bound model admission and streaming proxy.

Source chart version `0.1.0`. Published OCI artifacts use the immutable version from
the deployment release record:

```bash theme={null}
helm install model-gateway oci://<your-registry>/charts/model-gateway \
  --version "${PUBLISHED_CHART_VERSION:?set to the immutable OCI version for this release}"
```

## Values

Keys marked `*` are required. Defaults are the chart's `values.yaml`; per-environment
overlays (`values-onprem.yaml`) and the deployment set the rest.

| Key                                                | Type                                  | Default                                                                                                                                                                    | Description                                                                                                                                                                                                                  |
| -------------------------------------------------- | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `affinity`                                         | `object`                              | `{}`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `containerSecurityContext`                         | `object`                              | `{"privileged": false, "allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "capabilities": {"drop": ["ALL"]}}`                                              |                                                                                                                                                                                                                              |
| `enabled`                                          | `boolean`                             | —                                                                                                                                                                          | Umbrella condition flag (the hiloop chart's Chart.yaml condition model-gateway.enabled). Has no effect in a standalone install.                                                                                              |
| `fullnameOverride`                                 | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `gatewayConfig.admission_timeout_millis` \*        | `integer`                             | `30000`                                                                                                                                                                    | Hard end-to-end admission deadline, from workload proof through the provider credential decision. (min 1, max 60000)                                                                                                         |
| `gatewayConfig.audience` \*                        |                                       | `"hiloop-model-gateway"`                                                                                                                                                   |                                                                                                                                                                                                                              |
| `gatewayConfig.aws_region`                         | `string` \| `null`                    | `null`                                                                                                                                                                     |                                                                                                                                                                                                                              |
| `gatewayConfig.max_concurrent_requests` \*         | `integer`                             | `16`                                                                                                                                                                       | (min 1, max 256)                                                                                                                                                                                                             |
| `gatewayConfig.max_concurrent_streams` \*          | `integer`                             | `16`                                                                                                                                                                       | HTTP proxy stream ceiling. This does not configure Envoy. (min 1, max 10000)                                                                                                                                                 |
| `gatewayConfig.max_request_bytes` \*               | `integer`                             | `8388608`                                                                                                                                                                  | (min 1, max 268435456)                                                                                                                                                                                                       |
| `gatewayConfig.max_response_bytes` \*              | `integer`                             | `33554432`                                                                                                                                                                 | HTTP proxy response ceiling. This does not configure Envoy. (min 1, max 268435456)                                                                                                                                           |
| `gatewayConfig.policies` \*                        | `array`                               | `[]`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `gatewayConfig.providers` \*                       | `array`                               | `[]`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `gatewayConfig.request_body_timeout_millis` \*     | `integer`                             | `30000`                                                                                                                                                                    | HTTP proxy request-body timeout. This does not configure Envoy. (min 1, max 60000)                                                                                                                                           |
| `gatewayConfig.response_stream_timeout_seconds` \* | `integer`                             | `900`                                                                                                                                                                      | HTTP proxy response-stream timeout. This does not configure Envoy. (min 1, max 3600)                                                                                                                                         |
| `gatewayConfig.version` \*                         |                                       | `1`                                                                                                                                                                        |                                                                                                                                                                                                                              |
| `gatewayConfig.workload_namespace` \*              |                                       | `"hiloop-sandboxes"`                                                                                                                                                       |                                                                                                                                                                                                                              |
| `global.imagePullSecrets`                          | `array`                               | `[]`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `global.imageRegistry`                             | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `image.digest` \*                                  | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `image.pullPolicy` \*                              | `Always` \| `IfNotPresent` \| `Never` | `"IfNotPresent"`                                                                                                                                                           |                                                                                                                                                                                                                              |
| `image.repository` \*                              | `string`                              | `"ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/model-gateway"`                                                                                                              | (non-empty)                                                                                                                                                                                                                  |
| `image.tag` \*                                     | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `nameOverride`                                     | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `networkPolicy.dns.namespaceSelector` \*           | `object`                              | `{"kubernetes.io/metadata.name": "kube-system"}`                                                                                                                           |                                                                                                                                                                                                                              |
| `networkPolicy.dns.podSelector` \*                 | `object`                              | `{"k8s-app": "kube-dns"}`                                                                                                                                                  |                                                                                                                                                                                                                              |
| `networkPolicy.enabled` \*                         |                                       | `true`                                                                                                                                                                     |                                                                                                                                                                                                                              |
| `networkPolicy.envoyPodSelector` \*                | `object`                              | `{"hiloop.ai/model-gateway-fleet": "isolated"}`                                                                                                                            | Same-namespace pod labels admitted only to the gRPC authorization port.                                                                                                                                                      |
| `networkPolicy.kubernetesApiCIDRs` \*              |                                       | `[]`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `networkPolicy.kubernetesApiPort` \*               | `integer`                             | `443`                                                                                                                                                                      | (min 1, max 65535)                                                                                                                                                                                                           |
| `networkPolicy.podIdentity.ipv4CIDR` \*            |                                       | `"169.254.170.23/32"`                                                                                                                                                      |                                                                                                                                                                                                                              |
| `networkPolicy.podIdentity.ipv6CIDR` \*            | \`\` \| `fd00:ec2::23/128`            | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `networkPolicy.podIdentity.port` \*                |                                       | `80`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `networkPolicy.providerCIDRs` \*                   |                                       | `[]`                                                                                                                                                                       | Control-service credential backend and HTTP proxy provider egress. This does not configure Envoy.                                                                                                                            |
| `nodeSelector`                                     | `object`                              | `{}`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `podAnnotations`                                   | `object`                              | `{}`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `podLabels`                                        | `object`                              | `{}`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `podSecurityContext`                               | `object`                              | `{"runAsNonRoot": true, "runAsUser": 65532, "runAsGroup": 65532, "fsGroup": 65532, "fsGroupChangePolicy": "OnRootMismatch", "seccompProfile": {"type": "RuntimeDefault"}}` |                                                                                                                                                                                                                              |
| `priorityClassName`                                | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `providerCredentials.existingSecret` \*            | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `providerRouting.enabled` \*                       | `boolean`                             | `false`                                                                                                                                                                    |                                                                                                                                                                                                                              |
| `providerRouting.legacyAuthorityProviderId` \*     | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `providerRouting.namespace` \*                     | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `providerTLS`                                      | `object`                              | —                                                                                                                                                                          | Provider trust for the HTTP proxy. This does not configure Envoy.                                                                                                                                                            |
| `providerTLS.caKey` \*                             | `string`                              | `"ca.crt"`                                                                                                                                                                 |                                                                                                                                                                                                                              |
| `providerTLS.existingConfigMap` \*                 | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `rbac.create` \*                                   |                                       | `true`                                                                                                                                                                     |                                                                                                                                                                                                                              |
| `replicaCount`                                     |                                       | `1`                                                                                                                                                                        |                                                                                                                                                                                                                              |
| `resources`                                        | `object`                              | `{"requests": {"cpu": "250m", "memory": "256Mi"}, "limits": {"memory": "512Mi"}}`                                                                                          |                                                                                                                                                                                                                              |
| `service.authorizationPort` \*                     | `integer`                             | `9191`                                                                                                                                                                     | mTLS gRPC ext\_auth service port used only by the isolated Envoy data plane. (min 1, max 65535)                                                                                                                              |
| `service.port` \*                                  | `integer`                             | `8080`                                                                                                                                                                     | HTTP model proxy port. (min 1, max 65535)                                                                                                                                                                                    |
| `serviceAccount.annotations` \*                    | `object`                              | `{}`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `serviceAccount.create` \*                         | `boolean`                             | `true`                                                                                                                                                                     |                                                                                                                                                                                                                              |
| `serviceAccount.name` \*                           | `string`                              | `""`                                                                                                                                                                       |                                                                                                                                                                                                                              |
| `terminationGracePeriodSeconds`                    | `integer`                             | `30`                                                                                                                                                                       | (min 1)                                                                                                                                                                                                                      |
| `tls`                                              | `object`                              | —                                                                                                                                                                          | Mandatory mTLS identity for the gRPC admission service. Create these Secrets before release reconciliation; hosted installations use the isolated controller.                                                                |
| `tls.clientCaSecretName` \*                        | `string`                              | `"model-gateway-server-tls"`                                                                                                                                               | Secret containing the public ca.crt for the Envoy client issuer. The default reuses the cert-manager-produced server leaf Secret, which is already mounted by this pod and carries that same issuer certificate. (non-empty) |
| `tls.envoyClientUriSan` \*                         | `string`                              | `"spiffe://hiloop.ai/model-gateway-envoy"`                                                                                                                                 | Exact URI SAN required on the isolated Envoy client certificate.                                                                                                                                                             |
| `tls.serverSecretName` \*                          | `string`                              | `"model-gateway-server-tls"`                                                                                                                                               | Secret containing the admission service tls.crt and tls.key. (non-empty)                                                                                                                                                     |
| `tolerations`                                      | `array`                               | `[]`                                                                                                                                                                       |                                                                                                                                                                                                                              |