Kubernetes (Helm)

For: Platform engineers deploying Axemere Gateway on Kubernetes using the Helm chart.

Helm chart coming soon. A publicly installable Helm chart is a tracked fast-follow after launch. The install commands below are not yet available to external users. Contact us if Kubernetes deployment is a launch blocker for your team.

The reference material below (Helm values, CA certificate setup) documents the chart's behaviour for teams evaluating the deployment model.

Key Helm Values
Record Log Persistence
Trusting the CA Certificate
- Per-workload bypass
See Also

Key Helm Values

Key	Default	Description
`replicaCount`	`2`	Number of gateway pods
`autoscaling.enabled`	`false`	Enable HPA (min 2, max 10, 70% CPU)
`podDisruptionBudget.enabled`	`true`	PDB with `minAvailable: 1`
`ingress.enabled`	`false`	Enable Kubernetes Ingress
`serviceMonitor.enabled`	`false`	Enable Prometheus ServiceMonitor (requires prometheus-operator)
`distributed.enabled`	`false`	Enable Control Plane-connected mode; also set `distributed.cpAddr` (Control Plane gRPC address)
`policies`	`{}`	Policy YAML files mounted as a ConfigMap at `/configs/policies`
`credentials`	`{}`	Credential seed files mounted as a ConfigMap at `/configs/credentials`
`workloads`	`{}`	Workload seed files mounted as a ConfigMap at `/configs/workloads`
`persistence.enabled`	`true`	Mount a PVC at `/data` for execution record log and keys
`persistence.size`	`1Gi`	PVC size
`signing.keyDir`	`/var/lib/mvgc/keys`	Ed25519 key storage path
`signing.policyVerifyKey`	`""`	Path to public key PEM for bundle signature verification
`signing.policyRequireSigned`	`"false"`	Reject unsigned policy bundles when `"true"`
`extraEnv`	`[]`	Extra env vars injected into the container (secretKeyRef, plain values, etc.)
`nameOverride`	`""`	Override chart name component of resource names
`fullnameOverride`	`""`	Override full resource name

The full values reference will be published alongside the chart.

Record Log Persistence

Set persistence.enabled: true (the default) in your Helm values to mount a PersistentVolumeClaim at /data. The execution record log is written to /data/records.jsonl inside the container.

Trusting the CA Certificate

When using SSL MITM proxy mode in Kubernetes, mount the CA cert as a ConfigMap and set SSL_CERT_FILE (or the equivalent env var for the runtime) to the mounted path. Most AI SDK clients respect the system CA bundle or SSL_CERT_FILE.

# Retrieve the CA cert
curl http://<gateway-service>:7080/v1/proxy/ca.crt > mvgc-proxy-ca.crt

# Create a ConfigMap
kubectl create configmap mvgc-proxy-ca \
  --namespace mvgc \
  --from-file=ca.crt=mvgc-proxy-ca.crt

Then in your workload deployment:

spec:
  containers:
    - name: my-app
      env:
        - name: HTTPS_PROXY
          value: "http://mvgc-gateway.mvgc.svc:7080"   # port 7080 = developer traffic
        - name: SSL_CERT_FILE
          value: "/etc/ssl/certs/mvgc-proxy-ca.crt"
      volumeMounts:
        - name: proxy-ca
          mountPath: /etc/ssl/certs/mvgc-proxy-ca.crt
          subPath: ca.crt
          readOnly: true
  volumes:
    - name: proxy-ca
      configMap:
        name: mvgc-proxy-ca

Per-workload bypass

Policy YAML bundles can exclude specific domains from interception using the bypass_domains key:

proxy:
  managed_domains:
    - api.openai.com
  bypass_domains:
    - internal-model.corp.example.com

Domains in bypass_domains always receive transparent TCP passthrough, even if they appear in the gateway-level MVGC_MANAGED_DOMAINS list.

Kubernetes (Helm)

Table of Contents

Key Helm Values

Record Log Persistence

Trusting the CA Certificate

Per-workload bypass

See Also