Kubernetes Deployment Guide
This guide walks through deploying the AgentSuite-Blue protection stack on a Kubernetes cluster using a Helm chart. This guide covers integrating the target agent through Virtue Gateway. Hook-based integration is simpler and requires fewer Docker images.
Prerequisites
| Requirement | Details |
|---|---|
| Kubernetes | A working cluster (v1.25+) with kubectl configured against it |
| Helm | Helm 3.x on the workstation running the install |
| Docker | Used locally to authenticate against the image registry |
| RAM | 16 GB minimum across cluster nodes (32 GB recommended) |
| Disk | ~20 GB of node storage available for image pulls and PVCs |
| NVIDIA GPU node | Required for Action Guard (16 GB+ VRAM). Without a GPU node, disable Action Guard in values-prod.yaml — the rest of the platform will still run. |
| Registry credentials | A GCP service-account key file provided by your Virtue AI representative |
Container Images
All images are hosted in us-docker.pkg.dev/customer-docker-virtueai/<your-tenant>/ and fall into two categories.
Protection Service
Core product images that secure agent tool calls:
| Image | Description |
|---|---|
protection/mcp-gateway | Agent gateway API and MCP endpoint |
protection/mcp-gateway-worker | Background task worker |
protection/mcp-gateway-scheduler | Scheduled task runner |
protection/action-guard | Tool-call safety evaluator |
protection/action-guard-worker | Action Guard background worker |
protection/action-guard-scheduler | Action Guard scheduler |
protection/virtue-auth | Authentication and user management |
protection/dashboard | VirtueGuard management UI |
protection/vllm-topicguard | Local LLM server backing Action Guard (requires GPU) |
protection/postgres | PostgreSQL for gateway and auth databases |
protection/redis | Redis for the gateway task queue |
Test Suite Sandbox (optional)
Only deployed via the optional demo Helm chart:
| Image | Description |
|---|---|
test-suite/attack-manager | Test orchestrator |
test-suite/sandbox-api | Sandbox backend APIs |
test-suite/sandbox-postgres | Jira database |
test-suite/atlassian-api | Jira API backend |
test-suite/mailpit | Email server for the Gmail sandbox |
gitlab/gitlab-ce | GitLab CE instance |
Deployment process
Step 1: Extract the Code Bundle
Your Virtue AI representative will provide a bundle (e.g. agentsuite-k8s.zip) containing the Helm charts and helper scripts.
unzip agentsuite-k8s.zip
cd agentsuite-k8s
Step 2: Authenticate to the Image Registry
Log in to the GCP Artifact Registry using the service-account credentials provided with your bundle:
docker login -u _json_key --password-stdin https://us-docker.pkg.dev < serviceaccount.json
The same serviceaccount.json is reused by the Helm chart to create an imagePullSecret in the target namespace.
For details on the credential format, see the GCP Artifact Access Guide.
Step 3: Configure Deployment Values
Copy the example values file and edit it for your environment:
cp helm-gateway/values-example.yaml helm-gateway/values-prod.yaml
Generate Required Secrets
DB_PASS=$(openssl rand -hex 16) && echo "DB password : $DB_PASS"
SECRET=$(openssl rand -hex 32) && echo "JWT key : $SECRET"
Open helm-gateway/values-prod.yaml and apply the following changes:
| Field | What to Set |
|---|---|
gateway-db.secretEnv.POSTGRES_PASSWORD | DB_PASS from above |
mcp-gateway.secretEnv.DATABASE_URL | Replace the password placeholder with DB_PASS |
virtue-auth.secretEnv.DATABASE_URL | Replace the password placeholder with DB_PASS |
mcp-gateway.secretEnv.SECRET_KEY | SECRET from above |
virtue-auth.secretEnv.SECRET_KEY | Same SECRET (must match mcp-gateway) |
virtue-auth.secretEnv.BOOTSTRAP_ADMIN_PASSWORD | Choose an admin password |
Optional Overrides
| Field | When to Change | Default |
|---|---|---|
mcp-gateway.ingress.enabled | Set true to expose the gateway via a domain name with an ingress controller (HAProxy, NGINX, Traefik) | false |
dashboard.ingress.enabled | Same as above, for the dashboard | false |
mcp-gateway.ingress.className | Your ingress controller name (e.g. nginx, haproxy, traefik) | — |
dashboard.ingress.className | Same as above | — |
gateway-db.enabled | Set false to use your own external PostgreSQL instead of the bundled one | true |
gateway-db.persistence.size | PoC environments can use 5–10G | 20G |
Step 4: Deploy the Protection Stack
REGISTRY_KEY_FILE=serviceaccount.json \
VALUE_FILE=helm-gateway/values-prod.yaml \
bash helm-gateway/deploy.sh install
This installs:
- MCP Gateway
- Virtue Auth
- Dashboard
- PostgreSQL
- Redis
- (Optional) Action Guard and vLLM
Verify the deployment:
kubectl get pods -n virtue-gateway
kubectl get svc -n virtue-gateway
All pods should report Running / Ready. The dashboard is exposed on port 23000 by default — either via the ingress you configured or via kubectl port-forward.
Step 5: Deploy the Demo Sandbox (Optional)
For demo or evaluation environments, the bundled sandbox can be installed with a separate Helm chart:
REGISTRY_KEY_FILE=serviceaccount.json bash helm-demo/deploy.sh install
This installs the attack manager, Jira and Gmail sandboxes, Mailpit, and GitLab CE.
⚠️ Only required for demo/test scenarios — do not run this in production.
Step 6: Initialize Local Test Access
If you do not have an ingress configured and want to reach the dashboard locally, run:
bash setup-k8s.sh
The script:
- Port-forwards the gateway and sandbox services to
localhost - Initializes the gateway
- Injects test data into the sandbox (if installed)
- Prepares the local test environment
Local endpoints once it finishes:
- Dashboard: http://localhost:23000
- MCP Gateway: http://localhost:22001
Connecting Your Agent
After the gateway and guard model are running, point your agent at the gateway's MCP endpoint instead of the upstream MCP servers — see the Hook Integration docs for framework-specific examples (Google ADK, OpenAI Agents SDK, Claude Agent SDK, LangChain, Strands, Microsoft 365). The required values (GATEWAY_SERVER_URL, ACCESS_TOKEN) are visible in the dashboard under Gateways → <your gateway>.