Customer-hosted gateway (pilot)

The intertrace-gateway chart (Kubernetes 1.27 or later) deploys, in each pod:

• Agentgateway as the transport. The bundled config is deliberately small (an OpenAI route on /v1); supply your own ConfigMap for the MCP, Service, A2A and Inference planes.
• The Intertrace enforcer, which decides every request through the gateway's external authorization hook (block mode by default).
• A workload supervisor. Process, network and credential containment is off by default; commands it cannot carry out are reported as NOT_ENFORCED, never claimed.

Defaults: 2 replicas with autoscaling to 20, a pod disruption budget, non-root read-only containers, a NetworkPolicy, and metadata-only telemetry (content is not captured). An optional private OpenTelemetry collector and a ServiceMonitor can be turned on.

Before production traffic:

• An existing Secret for the enforcer (enforcer.secretRef.name). The chart never creates a Secret.
• Egress rules (networkPolicy.egressCIDRs, or a CNI FQDN policy).
• An external Redis (required).
• Asymmetric execution-permit keys and scoped workload tokens, mounted from Secrets.
• Residency settings (residency.region, residency.endpointsJSON); residency fails closed by default.

Model providers on your own servers (for example Ollama) are reachable only from a customer-hosted gateway. See Models.