> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/dsx-exchange/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/dsx-exchange/_mcp/server. # Configuration Reference Use this reference for settings owned by the DSX Agent Gateway chart, including Model Context Protocol (MCP) upstreams. The checked-in [`values.yaml`](https://github.com/NVIDIA/dsx-exchange/blob/main/deploy/dsx-agent-gateway/values.yaml) contains the exhaustive setting list and current defaults. Settings under `agentgateway` and `valkey` can also pass through values to their pinned subcharts. ## Gateway The following settings control the gateway dataplane and its Service: | Setting | Default or Requirement | Purpose and Constraints | | -------------------------- | ---------------------- | ----------------------------------------------------------------------------- | | `runtimeClassName` | `""` | Selects a Kubernetes RuntimeClass for gateway, rate-limit, and bridge Pods. | | `gateway.replicaCount` | `3` | Sets the dataplane replica count. | | `gateway.resources` | `{}` | Sets dataplane Pod resource requests and limits. | | `gateway.nodeSelector` | `{}` | Selects nodes for dataplane Pods. | | `gateway.tolerations` | `[]` | Adds tolerations to dataplane Pods. | | `gateway.service.type` | `ClusterIP` | Accepts `ClusterIP` or `NodePort`. The chart does not support `LoadBalancer`. | | `gateway.service.nodePort` | `null` | Is required when the Service type is `NodePort`. | | `gateway.ipv6.enabled` | `true` | Enables or disables IPv6 in the dataplane. | The dataplane listens for plaintext HTTP on port `80`. An operator-owned edge provides external routing and Transport Layer Security termination. ## Authentication and Tenant Access `auth.jwt.providers` must contain at least one provider. Each provider name must be a lowercase DNS label with no more than 56 characters. The following settings define one provider and the shared tenant policy: | Setting | Default or Requirement | Purpose and Constraints | | ---------------------------------------------- | ---------------------- | -------------------------------------------------------------------------------------------------------------- | | `auth.jwt.providers..issuer` | Required | Identifies the token issuer and must be unique across providers. | | `auth.jwt.providers..audiences` | At least one value | Contains the accepted token audiences. | | `auth.jwt.providers..jwksUrl` | Required | Specifies a complete HTTP or HTTPS JSON Web Key Set URL with a host and path. | | `auth.jwt.providers..tenantIdExpression` | Required | Derives a nonempty tenant ID from verified `jwt.*` claims. Expressions that read request headers are rejected. | | `auth.cel.operatorTenantId` | Required | Identifies the tenant that can access every configured MCP target. | | `auth.cel.unprivilegedTenantMCPs` | `[]` | Lists targets available to every other authenticated tenant. | The gateway accepts a token when at least one token audience matches the provider configuration. The selected MCP server receives the caller's original bearer token and remains responsible for operation-level authorization. ## MCP Upstreams Each key under `upstreams` identifies a selector or static upstream. The chart reserves the `bridge` key for an enabled hub bridge. The following settings define upstream discovery and transport: | Setting | Default or Requirement | Purpose and Constraints | | ------------------------------------------ | --------------------------------- | ---------------------------------------------------------------------------------------------------------- | | `upstreams..mode` | `selector` | Accepts `selector` or `static`. | | `upstreams..namespace` | Required for `selector` | Identifies the Service namespace. | | `upstreams..serviceLabels` | Required for `selector` | Matches labels on Services. Selected ports must set `appProtocol: agentgateway.dev/mcp`. | | `upstreams..address` | Required for `static` | Specifies the complete HTTP or HTTPS endpoint. Credentials, query strings, and fragments are not accepted. | | `upstreams..protocol` | `StreamableHTTP` | Accepts `StreamableHTTP` or `SSE` (Server-Sent Events) for a static upstream. | | `upstreamRequestTimeout` | `5s` | Sets the default upstream response-header deadline. | | `upstreams..requestTimeout` | Inherits `upstreamRequestTimeout` | Overrides the response-header deadline for one upstream. | | `agentgateway.discoveryNamespaceSelectors` | Not set by this chart | Restricts the namespaces watched for selector upstreams. | Streaming response bodies can continue after the response-header deadline. An HTTPS static address enables Transport Layer Security to that upstream. ## Rate Limiting and Valkey The gateway applies one request budget to each verified tenant ID. The following settings control limits and counter storage: | Setting | Default or Requirement | Purpose and Constraints | | ----------------------------------- | ---------------------- | ----------------------------------------------------------------------------------------------------------------------- | | `rateLimit.tenantRequestsPerSecond` | `30` | Sets the shared tenant request rate and must be at least `1`. | | `rateLimit.tenantOverrides` | `[]` | Assigns a different rate or unlimited access to a tenant. Duplicate tenant entries are invalid. | | `rateLimit.failureMode` | `FailOpen` | Accepts `FailOpen` or `FailClosed`. `FailOpen` serves requests without limit enforcement when rate limiting fails. | | `rateLimit.replicaCount` | `2` | Sets the rate-limit service replica count. | | `rateLimit.resources` | `{}` | Sets rate-limit Pod resource requests and limits. | | `rateLimit.nodeSelector` | `{}` | Selects nodes for rate-limit Pods. | | `rateLimit.tolerations` | `[]` | Adds tolerations to rate-limit Pods. | | `valkey.enabled` | `true` | Enables bundled counter storage. Disable it when using an external Valkey service. | | `valkey.external` | `{}` | Identifies an external Valkey destination by Kubernetes Service coordinates or by host and port. Do not mix both forms. | ## Bridge Enable the bridge only when the deployment must route MCP traffic across DSX Event Bus shards. The following settings define one bridge role: | Setting | Default or Requirement | Purpose and Constraints | | ---------------------------- | ---------------------- | ------------------------------------------------------------------------------------------------------ | | `bridge.enabled` | `false` | Enables the optional bridge workload. | | `bridge.role` | `hub` | Accepts `hub` or `leaf` when the bridge is enabled. | | `bridge.shardId` | Required for `leaf` | Identifies one leaf shard and must be one valid NATS subject token. | | `bridge.nats.endpoint` | Required when enabled | Identifies the in-cluster NATS Service and port. | | `bridge.nats.auth.mode` | `noauth` | Accepts `noauth` or `oauth`. OAuth requires an issuer, scope, and client credentials Secret reference. | | `bridge.nats.tls` | `{}` | Configures NATS server-name and certificate-authority validation. | | `bridge.http.requestTimeout` | `5m` | Limits the lifetime of a hub HTTP request. | | `bridge.http.writeTimeout` | `30s` | Limits how long one hub response write can block. | ## Observability The following settings enable chart-managed observability integrations: | Setting | Default or Requirement | Purpose and Constraints | | ------------------------------------------ | --------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | `observability.metrics.enabled` | `true` | Controls chart-managed metric export and Prometheus Operator monitor resources. | | `observability.metrics.scrapeNamespaces` | `[dsx-obs]` | Permits metrics traffic from selected namespaces through chart-owned network policies. | | `observability.metrics.interval` | `30s` | Sets the shared metrics scrape interval. | | `observability.metrics.scrapeTimeout` | `10s` | Sets the shared metrics scrape timeout. | | `observability.tracing.enabled` | `true` | Enables tracing for the dataplane, rate-limit service, and bridge. | | `observability.tracing.instrumentationRef` | `dsx-obs/default-instrumentation` | Identifies the required OpenTelemetry Operator `Instrumentation` resource. | | `observability.tracing.sidecarRef` | `dsx-obs/default-sidecar` | Identifies the required OpenTelemetry sidecar Collector resource. | | `observability.tracing.exporter` | `{}` | Overrides the injected endpoint and protocol when both values are set. Protocol accepts `grpc` or `http/protobuf`. | | `observability.tracing.sampleRatio` | `"1.0"` | Sets the trace sampling ratio from `0.0` through `1.0`. | | `observability.alerts.enabled` | `false` | Enables chart-provided Prometheus alert rules. | The bundled Agent Gateway controller and Valkey do not have chart-supported tracing integrations. The Valkey subchart controls its own metrics exporter and monitor. ## Related Guides Use the [deployment guide](/dsx-exchange/agent-gateway/deployment) for an installation workflow. The [operations guide](/dsx-exchange/agent-gateway/operations) explains how to monitor and troubleshoot the configured deployment. Refer to [supported capabilities](/dsx-exchange/agent-gateway/supported-capabilities) for the direct and bridge method profiles.