> ## Documentation Index
> Fetch the complete documentation index at: https://www.edgee.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes & Helm

> Install the Edgee AI Gateway on Kubernetes with the public Helm chart.

Install the gateway on Kubernetes with the public Helm chart `edgee-ai/gateway`.

* **Requirements**: Kubernetes 1.24+ and Helm 3.8+.
* **Chart**: `edgee-ai/gateway` (chart `0.2.0`, appVersion `1.9.0`).
* **Image**: `ghcr.io/edgee-ai/gateway` (public, anonymous pull — no image pull secrets).
* The container listens on `8080`, runs non-root (uid `65534`) with a read-only root filesystem and a `/tmp` `emptyDir`. Health: `GET /status`.

## Install

The commands are the same in both modes — the chart is public. Author a `values.yaml` (see below), then:

```bash theme={"dark"}
helm repo add edgee-ai https://edgee-ai.github.io/helm-charts
helm repo update
helm upgrade --install gateway edgee-ai/gateway \
  --namespace edgee --create-namespace \
  -f values.yaml
```

## Values

Pick the mode that matches your deployment. Connected is the default once `licenseKey` is set. Get `licenseKey` (and, in connected mode, `signatureKey`) from the Edgee Console under **Org settings → On-Premise → Reveal deployment secrets**.

> [tab] Connected
>
> The gateway pulls its configuration from the Edgee API and keeps it in sync (`apiSync.enabled: true`), and exports usage metering automatically — see [Common values](#common-values) below.
>
> ```yaml values.yaml theme={"dark"}
> gateway:
>   # Connected: pull config from the Edgee API and keep it in sync.
>   apiSync:
>     enabled: true
>     intervalSecs: 15
>   # Reveal these in the console; keep them secret (or use gateway.existingSecret).
>   licenseKey: ""    # -> LICENSE_KEY
>   signatureKey: ""  # -> EDGEE_SIGNATURE_KEY
> ```

> [tab] Headless
>
> Air-gapped. No Edgee configuration fetch (`apiSync.enabled: false`). Disable telemetry exports separately. You provide the configuration inline; it is rendered into a Secret and mounted at `/etc/edgee/gateway.toml`. The license is still required.
>
> ```yaml values.yaml theme={"dark"}
> gateway:
>   # Headless / air-gapped: no config fetch, no telemetry.
>   apiSync:
>     enabled: false
>   telemetry:
>     enabled: false
>   licenseKey: ""  # -> LICENSE_KEY
>   # Bring your own config — rendered into a Secret, mounted at /etc/edgee/gateway.toml.
>   configContent: |
>     # contents of your gateway.toml
>   # Optional: provider keys, if you route through your own provider accounts.
>   # providerKeysEnabled: true
>   # providerKeysContent: |
>   #   # contents of your provider keys file
> ```
>
> See [Headless configuration](https://www.edgee.ai/docs/self-hosting/configuration.md) for the file structure, credentials, and verification steps.

### Common values

| Path | Purpose |
| - | - |
| `image.{repository,tag,pullPolicy}` | Optional — override the chart's default image and tag. Not needed for a normal install. |
| `gateway.apiSync.{enabled,intervalSecs}` | Connected-mode config sync. `enabled` defaults to `true`; set `false` to opt out into headless/air-gapped mode. |
| `gateway.telemetry.{enabled,otlpEndpoint}` | Telemetry export. |
| `gateway.usage.{otlpEndpoint,otlpHeaders,useLicenseAuth}` | Usage metering export. Connected mode defaults to `https://onprem-logs.edgee.ai/v1/logs`, authenticated with your license key. `useLicenseAuth` (default `true`) controls whether that auth is still sent when `otlpEndpoint` points at your own collector. |
| `gateway.licenseKey` / `gateway.signatureKey` | Deployment secrets (env `LICENSE_KEY` / `EDGEE_SIGNATURE_KEY`). |
| `gateway.configContent` / `gateway.providerKeysContent` / `gateway.providerKeysEnabled` | Headless config and provider keys. |
| `gateway.existingSecret` / `gateway.existingConfigSecret` | Reference pre-created Secrets instead of inline values. |
| `service.type` | Service type (defaults to `ClusterIP`). |
| `ingress.enabled` | Optional ingress. |

> [!WARNING]
>
> For production, do not put `licenseKey` or `signatureKey` in plaintext `values.yaml`. Create a Kubernetes Secret out of band and reference it with `gateway.existingSecret` (and `gateway.existingConfigSecret` for headless config). This keeps secrets out of your values files and version control.

## Secrets

Create the credentials Secret out of band with `kubectl` and point `values.yaml` at it via `gateway.existingSecret` — the chart never sees the plaintext. Required keys:

| Key | Required | Notes |
| - | - | - |
| `LICENSE_KEY` | Always | From the Console — see [Values](#values). |
| `EDGEE_SIGNATURE_KEY` | Connected mode only | Optional at the Secret level — the chart mounts it as an optional env var, so a headless Secret can omit it. |
| `provider_keys.toml` | Only if `gateway.providerKeysEnabled: true` | Contents of your provider keys file (flat TOML). |

```bash theme={"dark"}
kubectl -n edgee create secret generic gateway-secret \
  --from-literal=LICENSE_KEY='<license key from console>' \
  --from-literal=EDGEE_SIGNATURE_KEY='<signature key from console>'
```

```yaml values.yaml theme={"dark"}
gateway:
  existingSecret: gateway-secret
```

## Ingress

The Service defaults to `ClusterIP`. To expose the gateway outside the cluster, either front it with your own ingress controller or set `ingress.enabled: true` and configure the chart's `ingress` values. The gateway serves traffic on port `8080`.

## Verify

Confirm the pod is running and healthy:

```bash theme={"dark"}
kubectl -n edgee get pods
kubectl -n edgee port-forward svc/gateway 8080:8080
curl http://localhost:8080/status
```

## Upgrading

New gateway versions ship as new chart releases. Pull the latest chart and re-run the same install command — `helm upgrade --install` applies the change in place:

```bash theme={"dark"}
helm repo update
helm upgrade --install gateway edgee-ai/gateway \
  --namespace edgee \
  -f values.yaml
```

To pin a specific release, pass `--version <chart-version>`.

## Verify model traffic

After the health check, send an authenticated [test model request](https://www.edgee.ai/docs/self-hosting/configuration.md#verify-a-real-request). Then configure the [CLI gateway endpoint](https://www.edgee.ai/docs/cli/configuration.md) and verify an agent request. A healthy process does not prove that provider credentials or the model registry are correct.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.