Configuration Reference

Use this reference for settings owned by the DSX Agent Gateway chart, including Model Context Protocol (MCP) upstreams. The checked-in values.yaml contains the exhaustive setting list and current defaults. Settings under agentgateway and valkey can also pass through values to their pinned subcharts.

Gateway

The following settings control the gateway dataplane and its Service:

Setting	Default or Requirement	Purpose and Constraints
`runtimeClassName`	`""`	Selects a Kubernetes RuntimeClass for gateway, rate-limit, and bridge Pods.
`gateway.replicaCount`	`3`	Sets the dataplane replica count.
`gateway.resources`	`{}`	Sets dataplane Pod resource requests and limits.
`gateway.nodeSelector`	`{}`	Selects nodes for dataplane Pods.
`gateway.tolerations`	`[]`	Adds tolerations to dataplane Pods.
`gateway.service.type`	`ClusterIP`	Accepts `ClusterIP` or `NodePort`. The chart does not support `LoadBalancer`.
`gateway.service.nodePort`	`null`	Is required when the Service type is `NodePort`.
`gateway.ipv6.enabled`	`true`	Enables or disables IPv6 in the dataplane.

The dataplane listens for plaintext HTTP on port 80. An operator-owned edge provides external routing and Transport Layer Security termination.

Authentication and Tenant Access

auth.jwt.providers must contain at least one provider. Each provider name must be a lowercase DNS label with no more than 56 characters.

The following settings define one provider and the shared tenant policy:

Setting	Default or Requirement	Purpose and Constraints
`auth.jwt.providers.<name>.issuer`	Required	Identifies the token issuer and must be unique across providers.
`auth.jwt.providers.<name>.audiences`	At least one value	Contains the accepted token audiences.
`auth.jwt.providers.<name>.jwksUrl`	Required	Specifies a complete HTTP or HTTPS JSON Web Key Set URL with a host and path.
`auth.jwt.providers.<name>.tenantIdExpression`	Required	Derives a nonempty tenant ID from verified `jwt.*` claims. Expressions that read request headers are rejected.
`auth.cel.operatorTenantId`	Required	Identifies the tenant that can access every configured MCP target.
`auth.cel.unprivilegedTenantMCPs`	`[]`	Lists targets available to every other authenticated tenant.

The gateway accepts a token when at least one token audience matches the provider configuration. The selected MCP server receives the caller’s original bearer token and remains responsible for operation-level authorization.

MCP Upstreams

Each key under upstreams identifies a selector or static upstream. The chart reserves the bridge key for an enabled hub bridge.

The following settings define upstream discovery and transport:

Setting	Default or Requirement	Purpose and Constraints
`upstreams.<name>.mode`	`selector`	Accepts `selector` or `static`.
`upstreams.<name>.namespace`	Required for `selector`	Identifies the Service namespace.
`upstreams.<name>.serviceLabels`	Required for `selector`	Matches labels on Services. Selected ports must set `appProtocol: agentgateway.dev/mcp`.
`upstreams.<name>.address`	Required for `static`	Specifies the complete HTTP or HTTPS endpoint. Credentials, query strings, and fragments are not accepted.
`upstreams.<name>.protocol`	`StreamableHTTP`	Accepts `StreamableHTTP` or `SSE` (Server-Sent Events) for a static upstream.
`upstreamRequestTimeout`	`5s`	Sets the default upstream response-header deadline.
`upstreams.<name>.requestTimeout`	Inherits `upstreamRequestTimeout`	Overrides the response-header deadline for one upstream.
`agentgateway.discoveryNamespaceSelectors`	Not set by this chart	Restricts the namespaces watched for selector upstreams.

Streaming response bodies can continue after the response-header deadline. An HTTPS static address enables Transport Layer Security to that upstream.

Rate Limiting and Valkey

The gateway applies one request budget to each verified tenant ID. The following settings control limits and counter storage:

Setting	Default or Requirement	Purpose and Constraints
`rateLimit.tenantRequestsPerSecond`	`30`	Sets the shared tenant request rate and must be at least `1`.
`rateLimit.tenantOverrides`	`[]`	Assigns a different rate or unlimited access to a tenant. Duplicate tenant entries are invalid.
`rateLimit.failureMode`	`FailOpen`	Accepts `FailOpen` or `FailClosed`. `FailOpen` serves requests without limit enforcement when rate limiting fails.
`rateLimit.replicaCount`	`2`	Sets the rate-limit service replica count.
`rateLimit.resources`	`{}`	Sets rate-limit Pod resource requests and limits.
`rateLimit.nodeSelector`	`{}`	Selects nodes for rate-limit Pods.
`rateLimit.tolerations`	`[]`	Adds tolerations to rate-limit Pods.
`valkey.enabled`	`true`	Enables bundled counter storage. Disable it when using an external Valkey service.
`valkey.external`	`{}`	Identifies an external Valkey destination by Kubernetes Service coordinates or by host and port. Do not mix both forms.

Bridge

Enable the bridge only when the deployment must route MCP traffic across DSX Event Bus shards. The following settings define one bridge role:

Setting	Default or Requirement	Purpose and Constraints
`bridge.enabled`	`false`	Enables the optional bridge workload.
`bridge.role`	`hub`	Accepts `hub` or `leaf` when the bridge is enabled.
`bridge.shardId`	Required for `leaf`	Identifies one leaf shard and must be one valid NATS subject token.
`bridge.nats.endpoint`	Required when enabled	Identifies the in-cluster NATS Service and port.
`bridge.nats.auth.mode`	`noauth`	Accepts `noauth` or `oauth`. OAuth requires an issuer, scope, and client credentials Secret reference.
`bridge.nats.tls`	`{}`	Configures NATS server-name and certificate-authority validation.
`bridge.http.requestTimeout`	`5m`	Limits the lifetime of a hub HTTP request.
`bridge.http.writeTimeout`	`30s`	Limits how long one hub response write can block.

Observability

The following settings enable chart-managed observability integrations:

Setting	Default or Requirement	Purpose and Constraints
`observability.metrics.enabled`	`true`	Controls chart-managed metric export and Prometheus Operator monitor resources.
`observability.metrics.scrapeNamespaces`	`[dsx-obs]`	Permits metrics traffic from selected namespaces through chart-owned network policies.
`observability.metrics.interval`	`30s`	Sets the shared metrics scrape interval.
`observability.metrics.scrapeTimeout`	`10s`	Sets the shared metrics scrape timeout.
`observability.tracing.enabled`	`true`	Enables tracing for the dataplane, rate-limit service, and bridge.
`observability.tracing.instrumentationRef`	`dsx-obs/default-instrumentation`	Identifies the required OpenTelemetry Operator `Instrumentation` resource.
`observability.tracing.sidecarRef`	`dsx-obs/default-sidecar`	Identifies the required OpenTelemetry sidecar Collector resource.
`observability.tracing.exporter`	`{}`	Overrides the injected endpoint and protocol when both values are set. Protocol accepts `grpc` or `http/protobuf`.
`observability.tracing.sampleRatio`	`"1.0"`	Sets the trace sampling ratio from `0.0` through `1.0`.
`observability.alerts.enabled`	`false`	Enables chart-provided Prometheus alert rules.

The bundled Agent Gateway controller and Valkey do not have chart-supported tracing integrations. The Valkey subchart controls its own metrics exporter and monitor.

Use the deployment guide for an installation workflow. The operations guide explains how to monitor and troubleshoot the configured deployment. Refer to supported capabilities for the direct and bridge method profiles.