GCP - Portkey Docs

Components and Sizing Recommendations

Component	Options	Sizing Recommendations
AI Gateway	Deploy in your GKE cluster using Helm charts.	Use GKE worker nodes, each providing at least 2 vCPUs and 4 GiB of memory. For high availability, deploy them across multiple Availability Zones.
Logs Store (optional)	Google Cloud Storage or S3-compatible Storage	Each log document is ~10kb in size (uncompressed)
Cache (Prompts, Configs & Providers)	Built-in Redis, Google Memorystore Redis or Valkey	Deployed within the same VPC as the AI Gateway.

Prerequisites

Ensure that following tools and resources are installed and available:

A running GKE cluster with at least 2 worker nodes. ( Best Practice: Use 2 nodes, with 1 node in each Availability Zone, to ensure high availability.)
VPC which host GKE cluster must have ACTIVE subnet with purpose REGIONAL_MANAGED_PROXY.
gcloud CLI
Kubectl
Helm (v3 or above)

Create a Strata Cloud Manager account

Go to the the AI Gateway website.
Sign up for a Strata Cloud Manager account.
Once logged in, locate and save your Organisation ID for future reference. You can find it in the browser URL: https://stratacloudmanager.paloaltonetworks.com/<organisation_id>/
Contact the Palo Alto Networks team and provide your Organisation ID and the email address used during signup.
The Palo Alto Networks team will share the following information with you:
- Docker credentials for the Gateway images (username and password).
- License: Client Auth Key.

Setup Project Environment

CLUSTER_NAME=<GKE_CLUSTER_NAME>       # Specify the name of the GKE cluster where the gateway will be deployed.
NAMESPACE=<NAMESPACE>                 # Specify the namespace where the gateway should be deployed (for example, portkeyai).
KSA=<KSA>                             # Provide a name for the Service Account to be associated with Gateway Pod (for example, gateway-sa)

mkdir portkey-gateway
cd portkey-gateway
touch values.yaml

Image Credentials Configuration

# Update the values.yaml file
imageCredentials:
  - name: portkey-enterprise-registry-credentials
    create: true
    registry: https://index.docker.io/v1/
    username: <PROVIDED BY PORTKEY>
    password: <PROVIDED BY PORTKEY>

images:
  gatewayImage:
    repository: "docker.io/portkeyai/gateway_enterprise"
    pullPolicy: Always
    tag: "latest"
  dataserviceImage:
    repository: "docker.io/portkeyai/data-service"
    pullPolicy: Always
    tag: "latest"
  redisImage:
    repository: "docker.io/redis"
    pullPolicy: IfNotPresent
    tag: "7.2-alpine"
environment:
  create: true
  secret: true
  data:
    ANALYTICS_STORE: control_plane
    SERVICE_NAME: <SERVICE_NAME>                       # Specify a name for the service
    PORTKEY_CLIENT_AUTH: <PROVIDED BY PORTKEY>
    ORGANISATIONS_TO_SYNC: <ORGANISATION_ID>           # This is obtained after signing up for a Portkey account.

Configure Components

Based on the choice of components and their configuration update the values.yaml.

MCP Gateway (Optional)

By default, only the AI Gateway is enabled in the deployment. To enable the MCP Gateway, add the following configuration to values.yaml:

environment:
  data:
    SERVER_MODE: "mcp/all"
    MCP_PORT: "8788"
    MCP_GATEWAY_BASE_URL: "<This must be set to MCP LoadBalancer URL or Domain pointing to MCP Service>"

Note:

MCP_GATEWAY_BASE_URL must include the protocol prefix — either http:// or https://.
This value is not required for the initial deployment. After the first deployment, once the MCP Load Balancer is provisioned and a hostname is mapped to the MCP Service, set this value and redeploy.

Server Modes

"" (empty or not provided): Deploys only the AI Gateway. This is the default configuration.
"mcp": Deploys only the MCP Gateway.
"all": Deploys both the AI Gateway and MCP Gateway.

Cache Store

The AI Gateway deployment includes a Redis instance pre-installed by default. You can either use this built-in Redis or connect to an external cache like Google Memorystore Redis or Valkey.

Built-in Redis

No additional permissions or network configurations are required.

## To use the built-in Redis, add the following configuration to the values.yaml file.
environment:
  data:
    CACHE_STORE: redis
    REDIS_URL: "redis://redis:6379"
    REDIS_TLS_ENABLED: "false"

Google Memorystore

To enable the gateway to work with a Memorystore cache, ensure that network access from GKE cluster on required port.

No Auth
AUTH String
Workload Identity Federation

## To use Google Memorystore Redis or Valkey, add the following configuration in the values.yaml file.
environment:
  data:
    CACHE_STORE: gcp-memory-store
    REDIS_URL: "redis://<GCP_MEMORY_STORE_IP>:<Port>"
    REDIS_TLS_ENABLED: "false"                            ## "true"/"false"
    REDIS_MODE: cluster                                   ## Add this parameter only if cluster mode is enabled on Memorystore

environment:
  data:
    CACHE_STORE: gcp-memory-store
    REDIS_URL: "redis://<MEMORY_STORE_IP>:<Port>"
    REDIS_TLS_ENABLED: "false"                             ## "true"/"false"
    REDIS_MODE: cluster                                   ## Add this parameter only if cluster mode is enabled on Memorystore
    REDIS_PASSWORD: <MEMORY_STORE_AUTH_STRING>

To set up IAM-based authentication for AI Gateway to GCP Memorystore, follow the steps and add the following configuration to values.yaml.

serviceAccount:
  create: true
  automount: true
  name: <KSA>
  annotations:
    iam.gke.io/gcp-service-account: <GSA>@<PROJECT_ID>.iam.gserviceaccount.com

environment:
  data:
    CACHE_STORE: gcp-memory-store
    GCP_REDIS_AUTH_MODE: workload
    REDIS_URL: "redis://<MEMORY_STORE_IP>:<Port>"
    REDIS_TLS_ENABLED: "false"                             ## "true"/"false"
    REDIS_MODE: cluster                                   ## Add this parameter only if cluster mode is enabled on Memorystore

TLS (Optional) If TLS is enabled on your GCP Memorystore Redis instance, you must provide the self-signed certificate to the Gateway to enable SSL/TLS connections.

Download the certificate file server-ca.pem from your GCP Memorystore Redis cluster.

Create a Kubernetes secret to store the Memorystore certificate:

kubectl create secret generic memorystore-tls-certs  --from-file=server-ca.pem -n $NAMESPACE

Add the following configuration to values.yaml:

environment:
  data:
    REDIS_TLS_CERTS: /etc/ssl/certs/server-ca.pem
    REDIS_TLS_ENABLED: "true"
volumes:
  - name: memorystore-tls-certs
    secret:
      secretName: memorystore-tls-certs

volumeMounts:
  - name: memorystore-tls-certs
    mountPath: /etc/ssl/certs/server-ca.pem
    subPath: server-ca.pem

Log Store

Google Cloud Storage

Create a GCS bucket for storing LLM access logs.

Set up access to the log store. The Gateway supports the following methods for connecting to GCS bucket for log storage:

Workload Identity Federation
HMAC

Depending on the chosen GCS access method, update values.yaml with the following configuration.

Workload Identity Federation
HMAC Keys

To set up IAM-based authentication for AI Gateway to GCP bucket, follow the steps and add following configuration in values.yaml.

## To enable `Workload Identity Federation` update values.yaml with the following details:-
serviceAccount:
  create: true
  automount: true
  # Provide the name of service account. Must be same as the name you provide while binding GSA and KSA during workload identity permission setup.
  name: <KSA>
  annotations:
  # Replace <GSA> and <PROJECT_ID_A> with Google Service Account name and Project ID of service account respectively.
    iam.gke.io/gcp-service-account: <GSA>@<PROJECT_ID_A>.iam.gserviceaccount.com

environment:
  data:
    LOG_STORE: gcs_assume
    GCP_AUTH_MODE: workload
    LOG_STORE_REGION: <GCS_BUCKET_REGION>                     # Specify the GCP region where the GCS log bucket resides (e.g., us-east1).
    LOG_STORE_GENERATIONS_BUCKET: <GCS_BUCKET_NAME>           # Specify the name of GCS log bucket.

## To enable HMAC based access update values.yaml with following details:-
serviceAccount:
  create: true
  automount: true
  name: <KSA>

environment:
  data:
    LOG_STORE: gcs
    LOG_STORE_REGION: <GCS_BUCKET_REGION>                     # Specify the GCP region where the GCS log bucket resides (e.g., us-east1).
    LOG_STORE_GENERATIONS_BUCKET: <GCS_BUCKET_NAME>           # Specify the name of GCS log bucket.
    LOG_STORE_ACCESS_KEY: <HMAC_ACCESS_KEY>                   # Specify the HMAC access key of service account.
    LOG_STORE_SECRET_KEY: <HMAC_SECRET_KEY>                   # Specify the HMAC secret key of service account.

(Optional) Configure log path format using LOG_STORE_FILE_PATH_FORMAT. See Log Object Path Format for details.

Data Service (Optional)

The Data Service is a component of the AI Gateway deployment responsible for batch processing, fine-tuning, and log exports. To enable Data Service, add the following configuration to the values.yaml file.

dataservice:
  name: "dataservice"
  enabled: true
  env:
    DEBUG_ENABLED: false
    SERVICE_NAME: "portkeyenterprise-dataservice"
  serviceAccount:
    create: true
    name: <KSA>

Network Configuration

Set Up External Access

To make the Gateway service accessible externally, you can set up either of the following:

GCS Application Load Balancer with Kubernetes Ingress
GCS Network Load Balancer with Kubernetes Service

Prerequisites

GKE cluster must have HTTP Load Balancing add-on enabled.
Load Balancers require an active subnet with purpose REGIONAL_MANAGED_PROXY. If you don’t have one, create it:

  # Replace <GKE_CLUSTER_REGION> with the region in which GKE cluster is created.
  # Replace <VPC_NAME> with name of vpc in which your GKE cluster is created.
  # Replace <SUBNET_CIDR> with CIDR to associate with subnet. CIDR MUST be part of VPC CIDR e.g., 10.0.2.0/23 etc

  gcloud compute networks subnets create lb-subnet \
    --purpose=REGIONAL_MANAGED_PROXY \
    --role=ACTIVE \
    --region=<GKE_CLUSTER_REGION> \
    --network=<VPC_NAME> \
    --range=<SUBNET_CIDR>

GCP Load Balancer Ingress

To create Application Load Balancer Ingress update the values.yaml file with following configuration:

ingress:
  enabled: true
  ingressClassName: gce                                           # 'gce-internal' for creating internal ALB
  # hostname: "<AI Gateway Hostname>"
  # hostBased: true
  # mcpHostname: "<MCP Gateway Hostname>"
  annotations:
    kubernetes.io/ingress.class : gce                             # 'gce-internal' for creating internal ALB
    ingress.gcp.kubernetes.io/healthcheck-path: /v1/health

Note: If SERVER_MODE is set to all (i.e., both AI Gateway and MCP Gateway are enabled), you must enable host-based routing by setting hostBased to true and provide the hostname on which the AI Gateway and MCP Gateway will be accessible. GCP Load Balancer Controller provides additional annotations (like TLS, custom health checks etc ) for managing Ingress Load Balancer. For a comprehensive list of available annotations, refer to the GCP Ingress Load Balancer.

GCP Load Balancer Service

To create Load Balancer update the values.yaml with following configuration:

service:
  type: LoadBalancer
  port: 80                                                                                          # NLB listener port
  containerPort: 8787
  annotations:
    cloud.google.com/l4-rbs: "enabled"                              # Use this annotation for creating external Load Balancer.
    # networking.gke.io/load-balancer-type: "Internal"              # Use this annotation for creating internal Load Balancer.
    spec.loadBalancerSourceRanges: "<X.X.X.X/Y>"

GCP Load Balancer Controller provides additional annotations (like TLS, custom health checks etc ) for managing Service Load Balancer. For a comprehensive list of available annotations, refer to the GCP Service Load Balancer.

Deploying AI Gateway

# Add the Portkey AI Gateway helm repository
helm repo add portkey-ai https://portkey-ai.github.io/helm
helm repo update

# Install the chart
helm upgrade --install portkey-ai portkey-ai/gateway -f ./values.yaml -n ${NAMESPACE} --create-namespace

Verify the deployment

To confirm that the deployment was successful, follow these steps:

Verify that all pods are running correctly.

#
kubectl get pods -n ${NAMESPACE}
# You should see all pods with a 'STATUS' of 'Running'.

Note: If pods are in a Pending, CrashLoopBackOff, or other error state, inspect the pod logs and events to diagnose potential issues.

Test Gateway by sending a cURL request.

Port-forward the Gateway pod

  kubectl port-forward  <POD_NAME> -n ${NAMESPACE} 9000:8787       # Replace <POD_NAME> with your Gateway pod's actual name.

Once port forwarding is active, open a new terminal window or tab and send a test request by running:

# Specify LLM provider and Gateway API keys
OPENAI_API_KEY=<OPENAI_API_KEY>                           # Replace <OPENAI_API_KEY> with an actual API key
PORTKEY_API_KEY=<PORTKEY_API_KEY>                         # Replace <PORTKEY_API_KEY> with Gateway API Key which can be created from Strata Cloud Manager(https://stratacloudmanager.paloaltonetworks.com/).

# Configure and send the curl request
curl 'http://localhost:9000/v1/chat/completions' \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $OPENAI_API_KEY"  \
-H "x-portkey-provider: openai" \
-H "x-portkey-api-key: $PORTKEY_API_KEY"  \
-d '{
    "model": "gpt-4o-mini",
    "messages": [{"role": "user","content": "What is a fractal?"}]
}'

Test gateway service integration with Load Balancer.

# Replace <LOAD_BALANCER_IP> and <LB_LISTENER_PORT_NUMBER> with the DNS name and listener port of the created load balancer, respectively.
curl 'http://<LOAD_BALANCER_IP>:<LB_LISTENER_PORT_NUMBER>/v1/chat/completions' \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $OPENAI_API_KEY"  \
-H "x-portkey-provider: openai" \
-H "x-portkey-api-key: $PORTKEY_API_KEY"  \
-d '{
    "model": "gpt-4o-mini",
    "messages": [{"role": "user","content": "What is a fractal?"}]
}'

Integrating Gateway with Management Plane

Outbound Connectivity (Data Plane to Management Plane) The Data Plane integrates with the Management Plane over the internet. Ensure Outbound Network Access By default, Kubernetes allows full outbound access, but if your cluster has NetworkPolicies that restrict egress, configure them to allow outbound traffic. Example NetworkPolicy for Outbound Access:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-egress
  namespace: portkeyai
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: <X.X.X.X/Y>

This allows the gateway to access LLMs hosted both within your VPC and externally. This also enables connection for the sync service to the Management Plane.

Over the Internet

Ensure Gateway has access to following endpoints over the internet.

https://aigw.portkey.ai
https://albus.portkey.ai

Inbound Connectivity (Management Plane to Data Plane)

IP Whitelisting

Allows management plane to access the Data Plane over the internet by restricting inbound traffic to specific IP address of Management Plane. This method requires the Data Plane to have a publicly accessible endpoint. To whitelist, add an inbound rule to the VPC Firewall allowing connections from the AI Gateway Management Plane’s IPs on Load Balancer listner port. Contact the Palo Alto Networks team for the current address list. To integrate the Management Plane with the Data Plane, contact the Palo Alto Networks team and provide the Public Endpoint of the Data Plane.

Verifying Gateway Integration with the Management Plane

Send a test request to Gateway using curl.
Go to the AI Gateway website -> Logs.
Verify that the test request appears in the logs and that you can view its full details by selecting the log entry.

Uninstalling AI Gateway

helm uninstall portkey-ai -n ${NAMESPACE}

Setting up IAM Permission

Follow the steps below to configure permissions based on your chosen access method.

Create Google Service Account

Specify the details:

PROJECT_ID_A=<SERVICE_ACCOUNT_PROJECT_ID>     # Specify id of project in which service account is to be created
GSA=<GSA_NAME>                                # Specify name of Google Service Account to be created

Create a Google Service Account.

gcloud iam service-accounts create ${GSA} \
  --display-name="Portkey Gateway Service Account"

Create an IAM Policy binding to bind GSA to Gateway’s KSA (Workload Identity).

gcloud iam service-accounts \
  add-iam-policy-binding ${GSA}@${PROJECT_ID_A}.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser  \
  --member "serviceAccount:${PROJECT_ID_A}.svc.id.goog[${NAMESPACE}/${KSA}]"

Attach Permissions to GSA

Once the Google Service Account is created and bound to the KSA, grant the required permissions based on the GCP services your gateway needs to access.

Google Memorystore (Optional)

To allow the AI Gateway to authenticate with Google Memorystore using IAM, grant roles/redis.dbConnectionUser to the GSA. Same Project Access

gcloud projects add-iam-policy-binding ${PROJECT_ID_A} \
  --member="serviceAccount:${GSA}@${PROJECT_ID_A}.iam.gserviceaccount.com" \
  --role="roles/redis.dbConnectionUser"

Cross Project Access

PROJECT_ID_B=<PROJECT_B_ACCOUNT_ID>       # Project ID in which Memorystore instance exists
gcloud projects add-iam-policy-binding ${PROJECT_ID_B} \
  --member="serviceAccount:${GSA}@${PROJECT_ID_A}.iam.gserviceaccount.com" \
  --role="roles/redis.dbConnectionUser"

GCS Bucket

To allow the AI Gateway to access a GCS bucket for log storage, grant roles/storage.objectAdmin (or a custom role with storage.objects.create and storage.objects.get) to the GSA. Same Project Access

gcloud projects add-iam-policy-binding ${PROJECT_ID_A} \
  --member="serviceAccount:${GSA}@${PROJECT_ID_A}.iam.gserviceaccount.com" \
  --role="roles/storage.objectAdmin"

Cross Project Access

PROJECT_ID_B=<PROJECT_B_ACCOUNT_ID>       # Project ID in which GCS bucket is created
gcloud projects add-iam-policy-binding ${PROJECT_ID_B} \
  --member="serviceAccount:${GSA}@${PROJECT_ID_A}.iam.gserviceaccount.com" \
  --role="roles/storage.objectAdmin"

Vertex AI (Optional)

To allow the AI Gateway to invoke Vertex AI models, grant roles/aiplatform.user to the GSA. Same Project Access

gcloud projects add-iam-policy-binding ${PROJECT_ID_A} \
  --member="serviceAccount:${GSA}@${PROJECT_ID_A}.iam.gserviceaccount.com" \
  --role="roles/aiplatform.user"

Cross Project Access

PROJECT_ID_B=<PROJECT_B_ACCOUNT_ID>       # Project ID in which Vertex AI is to be called
gcloud projects add-iam-policy-binding ${PROJECT_ID_B} \
  --member="serviceAccount:${GSA}@${PROJECT_ID_A}.iam.gserviceaccount.com" \
  --role="roles/aiplatform.user"

Examples

Built-in Redis with GCS (Workload Identity) The following sample values.yaml shows how to configure the built-in Redis cache and GCS for log storage using Workload Identity Federation.

images:
  gatewayImage:
    repository: "docker.io/portkeyai/gateway_enterprise"
    pullPolicy: Always
    tag: "latest"
  dataserviceImage:
    repository: "docker.io/portkeyai/data-service"
    pullPolicy: Always
    tag: "latest"
  redisImage:
    repository: "docker.io/redis"
    pullPolicy: IfNotPresent
    tag: "7.2-alpine"
imageCredentials:
  - name: portkeyenterpriseregistrycredentials
    create: true
    registry: https://index.docker.io/v1/
    username: <DOCKER_USERNAME>
    password: <DOCKER_PASSWORD>

serviceAccount:
  create: true
  automount: true
  name: <KSA>
  annotations:
    iam.gke.io/gcp-service-account: <GSA>@<PROJECT_ID>.iam.gserviceaccount.com

environment:
  create: true
  secret: true
  data:
    ANALYTICS_STORE: control_plane
    SERVICE_NAME: gateway
    PORTKEY_CLIENT_AUTH: <CLIENT_AUTH>
    ORGANISATIONS_TO_SYNC: <ORGANISATION_ID>
    PORT: "8787"

    # Built-in Redis
    CACHE_STORE: redis
    REDIS_URL: "redis://redis:6379"
    REDIS_TLS_ENABLED: "false"

    # GCS with Workload Identity
    LOG_STORE: gcs_assume
    GCP_AUTH_MODE: workload
    LOG_STORE_REGION: <GCS_BUCKET_REGION>
    LOG_STORE_GENERATIONS_BUCKET: <GCS_BUCKET_NAME>

service:
  type: LoadBalancer
  port: 80
  containerPort: 8787
  annotations:
    cloud.google.com/l4-rbs: "enabled"
    spec.loadBalancerSourceRanges: "<X.X.X.X/Y>"

Memorystore with GCS (Workload Identity) The following sample values.yaml shows how to configure Google Memorystore for caching, and GCS for log storage using Workload Identity Federation.

images:
  gatewayImage:
    repository: "docker.io/portkeyai/gateway_enterprise"
    pullPolicy: Always
    tag: "latest"
  dataserviceImage:
    repository: "docker.io/portkeyai/data-service"
    pullPolicy: Always
    tag: "latest"
imageCredentials:
  - name: portkeyenterpriseregistrycredentials
    create: true
    registry: https://index.docker.io/v1/
    username: <DOCKER_USERNAME>
    password: <DOCKER_PASSWORD>

serviceAccount:
  create: true
  automount: true
  name: <KSA>
  annotations:
    iam.gke.io/gcp-service-account: <GSA>@<PROJECT_ID>.iam.gserviceaccount.com

environment:
  create: true
  secret: true
  data:
    ANALYTICS_STORE: control_plane
    SERVICE_NAME: gateway
    PORTKEY_CLIENT_AUTH: <CLIENT_AUTH>
    ORGANISATIONS_TO_SYNC: <ORGANISATION_ID>
    PORT: "8787"

    # Google Memorystore
    CACHE_STORE: memory-store
    REDIS_URL: "redis://<MEMORY_STORE_IP>:<Port>"
    REDIS_TLS_ENABLED: "true"

    # GCS with Workload Identity
    LOG_STORE: gcs_assume
    GCP_AUTH_MODE: workload
    LOG_STORE_REGION: <GCS_BUCKET_REGION>
    LOG_STORE_GENERATIONS_BUCKET: <GCS_BUCKET_NAME>


dataservice:
  name: "dataservice"
  enabled: true
  env:
    DEBUG_ENABLED: false
    SERVICE_NAME: "portkeyenterprise-dataservice"

service:
  type: LoadBalancer
  port: 80
  containerPort: 8787
  annotations:
    networking.gke.io/load-balancer-type: "Internal"

Built-in Redis with GCS (HMAC) and ALB Ingress The following sample values.yaml shows how to configure the built-in Redis cache, GCS for log storage using HMAC keys, and a GCP Application Load Balancer Ingress.

images:
  gatewayImage:
    repository: "docker.io/portkeyai/gateway_enterprise"
    pullPolicy: Always
    tag: "latest"
  dataserviceImage:
    repository: "docker.io/portkeyai/data-service"
    pullPolicy: Always
    tag: "latest"
  redisImage:
    repository: "docker.io/redis"
    pullPolicy: IfNotPresent
    tag: "7.2-alpine"
imageCredentials:
  - name: portkeyenterpriseregistrycredentials
    create: true
    registry: https://index.docker.io/v1/
    username: <DOCKER_USERNAME>
    password: <DOCKER_PASSWORD>

serviceAccount:
  create: true
  automount: true
  name: <KSA>

environment:
  create: true
  secret: true
  data:
    ANALYTICS_STORE: control_plane
    SERVICE_NAME: gateway
    PORTKEY_CLIENT_AUTH: <CLIENT_AUTH>
    ORGANISATIONS_TO_SYNC: <ORGANISATION_ID>
    PORT: "8787"

    # Built-in Redis
    CACHE_STORE: redis
    REDIS_URL: "redis://redis:6379"
    REDIS_TLS_ENABLED: "false"

    # GCS with HMAC keys
    LOG_STORE: gcs
    LOG_STORE_REGION: <GCS_BUCKET_REGION>
    LOG_STORE_GENERATIONS_BUCKET: <GCS_BUCKET_NAME>
    LOG_STORE_ACCESS_KEY: <HMAC_ACCESS_KEY>
    LOG_STORE_SECRET_KEY: <HMAC_SECRET_KEY>

ingress:
  enabled: true
  ingressClassName: gce
  annotations:
    kubernetes.io/ingress.class: gce
    ingress.gcp.kubernetes.io/healthcheck-path: /v1/health

AI Gateway + MCP Gateway with Host-Based Routing The following sample values.yaml shows how to deploy both AI Gateway and MCP Gateway with host-based routing using a GCP Application Load Balancer, built-in Redis, and GCS with Workload Identity.

images:
  gatewayImage:
    repository: "docker.io/portkeyai/gateway_enterprise"
    pullPolicy: Always
    tag: "latest"
  dataserviceImage:
    repository: "docker.io/portkeyai/data-service"
    pullPolicy: Always
    tag: "latest"
  redisImage:
    repository: "docker.io/redis"
    pullPolicy: IfNotPresent
    tag: "7.2-alpine"
imageCredentials:
  - name: portkeyenterpriseregistrycredentials
    create: true
    registry: https://index.docker.io/v1/
    username: <DOCKER_USERNAME>
    password: <DOCKER_PASSWORD>

serviceAccount:
  create: true
  automount: true
  name: <KSA>
  annotations:
    iam.gke.io/gcp-service-account: <GSA>@<PROJECT_ID>.iam.gserviceaccount.com

environment:
  create: true
  secret: true
  data:
    ANALYTICS_STORE: control_plane
    SERVICE_NAME: gateway
    PORTKEY_CLIENT_AUTH: <CLIENT_AUTH>
    ORGANISATIONS_TO_SYNC: <ORGANISATION_ID>
    PORT: "8787"
    SERVER_MODE: "all"
    MCP_PORT: "8788"
    MCP_GATEWAY_BASE_URL: "https://mcp.example.com"

    # Built-in Redis
    CACHE_STORE: redis
    REDIS_URL: "redis://redis:6379"
    REDIS_TLS_ENABLED: "false"

    # GCS with Workload Identity
    LOG_STORE: gcs_assume
    GCP_AUTH_MODE: workload
    LOG_STORE_REGION: <GCS_BUCKET_REGION>
    LOG_STORE_GENERATIONS_BUCKET: <GCS_BUCKET_NAME>

ingress:
  enabled: true
  hostname: "gateway.example.com"
  hostBased: true
  mcpHostname: "mcp.example.com"
  ingressClassName: gce
  annotations:
    kubernetes.io/ingress.class: gce
    ingress.gcp.kubernetes.io/healthcheck-path: /v1/health

​Components and Sizing Recommendations

​Prerequisites

​Create a Strata Cloud Manager account

​Setup Project Environment

​Image Credentials Configuration

​Configure Components

​MCP Gateway (Optional)

​Cache Store

​Built-in Redis

​Google Memorystore

​Log Store

​Google Cloud Storage

​Data Service (Optional)

​Network Configuration

​Set Up External Access

​GCP Load Balancer Ingress

​GCP Load Balancer Service

​Deploying AI Gateway

​Verify the deployment

​Integrating Gateway with Management Plane

​Over the Internet

​Inbound Connectivity (Management Plane to Data Plane)

​IP Whitelisting

​Verifying Gateway Integration with the Management Plane

​Uninstalling AI Gateway

​Setting up IAM Permission

​Create Google Service Account

​Attach Permissions to GSA

​Google Memorystore (Optional)

​GCS Bucket

​Vertex AI (Optional)

​Examples

Components and Sizing Recommendations

Prerequisites

Create a Strata Cloud Manager account

Setup Project Environment

Image Credentials Configuration

Configure Components

MCP Gateway (Optional)

Cache Store

Built-in Redis

Google Memorystore

Log Store

Google Cloud Storage

Data Service (Optional)

Network Configuration

Set Up External Access

GCP Load Balancer Ingress

GCP Load Balancer Service

Deploying AI Gateway

Verify the deployment

Integrating Gateway with Management Plane

Over the Internet

Inbound Connectivity (Management Plane to Data Plane)

IP Whitelisting

Verifying Gateway Integration with the Management Plane

Uninstalling AI Gateway

Setting up IAM Permission

Create Google Service Account

Attach Permissions to GSA

Google Memorystore (Optional)

GCS Bucket

Vertex AI (Optional)

Examples