> ## Documentation Index
> Fetch the complete documentation index at: https://www.edgee.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes & Helm

> Install the Edgee AI Gateway on Kubernetes with the public Helm chart.

Install the gateway on Kubernetes with the public Helm chart `edgee-ai/gateway`.

* **Requirements**: Kubernetes 1.24+ and Helm 3.8+.
* **Chart**: `edgee-ai/gateway` (chart `0.2.0`, appVersion `1.9.0`).
* **Image**: `ghcr.io/edgee-ai/gateway` (public, anonymous pull — no image pull secrets).
* The container listens on `8080`, runs non-root (uid `65534`) with a read-only root filesystem and a `/tmp` `emptyDir`. Health: `GET /status`.

## Install

The commands are the same in both modes — the chart is public. Author a `values.yaml` (see below), then:

```bash theme={"dark"}
helm repo add edgee-ai https://edgee-ai.github.io/helm-charts
helm repo update
helm upgrade --install gateway edgee-ai/gateway \
  --namespace edgee --create-namespace \
  -f values.yaml
```

## Values

Pick the mode that matches your deployment. Get `licenseKey` (and, in connected mode, `signatureKey`) from the Edgee Console under **Org settings → On-Premise → Reveal deployment secrets**.

<Tabs>
  <Tab title="Connected">
    The gateway pulls its configuration from the Edgee API and keeps it in sync (`apiSync.enabled: true`), and reports telemetry.

    ```yaml values.yaml theme={"dark"}
    gateway:
      # Connected: pull config from the Edgee API and keep it in sync.
      apiSync:
        enabled: true
        intervalSecs: 15
      telemetry:
        enabled: true
        otlpEndpoint: https://onprem-logs.edgee.ai/v1/logs
      # Reveal these in the console; keep them secret (or use gateway.existingSecret).
      licenseKey: ""    # -> LICENSE_KEY
      signatureKey: ""  # -> EDGEE_SIGNATURE_KEY
    ```
  </Tab>

  <Tab title="Headless">
    Air-gapped. No config fetch, no telemetry (`apiSync.enabled: false`). You provide the configuration inline; it is rendered into a Secret and mounted at `/etc/edgee/gateway.toml`. The license is still required.

    ```yaml values.yaml theme={"dark"}
    gateway:
      # Headless / air-gapped: no config fetch, no telemetry.
      apiSync:
        enabled: false
      telemetry:
        enabled: false
      licenseKey: ""  # -> LICENSE_KEY
      # Bring your own config — rendered into a Secret, mounted at /etc/edgee/gateway.toml.
      configContent: |
        # contents of your gateway.toml
      # Optional: provider keys, if you route through your own provider accounts.
      # providerKeysEnabled: true
      # providerKeysContent: |
      #   # contents of your provider keys file
    ```

    The full `gateway.toml` config schema lives in the open-source repo: [`edgee-ai/edgee`](https://github.com/edgee-ai/edgee).
  </Tab>
</Tabs>

### Common values

| Path                                                                                    | Purpose                                                                                                                        |
| --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| `image.{repository,tag,pullPolicy}`                                                     | Optional — override the chart's default image and tag. Not needed for a normal install.                                        |
| `gateway.apiSync.{enabled,intervalSecs}`                                                | Connected-mode config sync.                                                                                                    |
| `gateway.telemetry.{enabled,otlpEndpoint}`                                              | Telemetry export.                                                                                                              |
| `gateway.usage.{otlpEndpoint,otlpHeaders}`                                              | Usage metering export. Connected mode defaults to `https://onprem-logs.edgee.ai/v1/logs`, authenticated with your license key. |
| `gateway.licenseKey` / `gateway.signatureKey`                                           | Deployment secrets (env `LICENSE_KEY` / `EDGEE_SIGNATURE_KEY`).                                                                |
| `gateway.configContent` / `gateway.providerKeysContent` / `gateway.providerKeysEnabled` | Headless config and provider keys.                                                                                             |
| `gateway.existingSecret` / `gateway.existingConfigSecret`                               | Reference pre-created Secrets instead of inline values.                                                                        |
| `service.type`                                                                          | Service type (defaults to `ClusterIP`).                                                                                        |
| `ingress.enabled`                                                                       | Optional ingress.                                                                                                              |

<Warning>
  For production, do not put `licenseKey` or `signatureKey` in plaintext `values.yaml`. Create a Kubernetes Secret out of band and reference it with `gateway.existingSecret` (and `gateway.existingConfigSecret` for headless config). This keeps secrets out of your values files and version control.
</Warning>

## Secrets

Create the credentials Secret out of band with `kubectl` and point `values.yaml` at it via `gateway.existingSecret` — the chart never sees the plaintext. Required keys:

| Key                   | Required                                    | Notes                                                                                                        |
| --------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| `LICENSE_KEY`         | Always                                      | From the Console — see [Values](#values).                                                                    |
| `EDGEE_SIGNATURE_KEY` | Connected mode only                         | Optional at the Secret level — the chart mounts it as an optional env var, so a headless Secret can omit it. |
| `provider_keys.toml`  | Only if `gateway.providerKeysEnabled: true` | Contents of your provider keys file (flat TOML).                                                             |

```bash theme={"dark"}
kubectl -n edgee create secret generic gateway-secret \
  --from-literal=LICENSE_KEY='<license key from console>' \
  --from-literal=EDGEE_SIGNATURE_KEY='<signature key from console>'
```

```yaml values.yaml theme={"dark"}
gateway:
  existingSecret: gateway-secret
```

## Ingress

The Service defaults to `ClusterIP`. To expose the gateway outside the cluster, either front it with your own ingress controller or set `ingress.enabled: true` and configure the chart's `ingress` values. The gateway serves traffic on port `8080`.

## Verify

Confirm the pod is running and healthy:

```bash theme={"dark"}
kubectl -n edgee get pods
kubectl -n edgee port-forward svc/gateway 8080:8080
curl http://localhost:8080/status
```

## Upgrading

New gateway versions ship as new chart releases. Pull the latest chart and re-run the same install command — `helm upgrade --install` applies the change in place:

```bash theme={"dark"}
helm repo update
helm upgrade --install gateway edgee-ai/gateway \
  --namespace edgee \
  -f values.yaml
```

To pin a specific release, pass `--version <chart-version>`.