Skip to content
TruthVouch Docs

Firewall: Kubernetes

Deploy the TruthVouch Governance Gateway on Kubernetes for production-grade, highly available AI governance.

Prerequisites

  • Kubernetes 1.24+ cluster
  • kubectl configured
  • Helm 3.0+ installed
  • PostgreSQL Operator (optional)
  • 4GB RAM minimum per Gateway pod

Helm Installation

1. Add Helm Repository

Terminal window
helm repo add truthvouch https://charts.truthvouch.io
helm repo update

2. Create Namespace

Terminal window
kubectl create namespace truthvouch

3. Create Secrets

Terminal window
kubectl create secret generic gateway-secrets \
  --from-literal=db-password=YourSecurePassword123! \
  --from-literal=openai-api-key=sk-... \
  --from-literal=anthropic-api-key=sk-ant-... \
  -n truthvouch

4. Install Chart

Terminal window
helm install truthvouch truthvouch/governance-gateway \
  --namespace truthvouch \
  --values values.yaml

Values File

Create values.yaml:

replicaCount: 3


image:
  repository: truthvouch/governance-gateway
  tag: latest
  pullPolicy: IfNotPresent


imagePullSecrets: []


serviceAccount:
  create: true
  name: gateway


service:
  type: ClusterIP
  port: 50052
  annotations:
    cloud.google.com/neg: '{"ingress": true}'


ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: gateway.yourcompany.local
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: gateway-tls
      hosts:
        - gateway.yourcompany.local


resources:
  limits:
    cpu: 2000m
    memory: 4Gi
  requests:
    cpu: 1000m
    memory: 2Gi


autoscaling:
  enabled: true
  minReplicas: 3
  maxReplicas: 10
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 80


database:
  enabled: true
  type: postgresql
  host: postgres.truthvouch.svc.cluster.local
  port: 5432
  name: truthvouch_gateway
  user: gateway_user
  existingSecret: gateway-secrets
  existingSecretPasswordKey: db-password


redis:
  enabled: true
  host: redis.truthvouch.svc.cluster.local
  port: 6379


monitoring:
  enabled: true
  prometheus:
    enabled: true
    port: 9090


nodeSelector: {}
tolerations: []
affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: app
                operator: In
                values:
                  - gateway
          topologyKey: kubernetes.io/hostname

Manual Kubernetes Manifests

If not using Helm, deploy with raw manifests:

1. ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: gateway-config
  namespace: truthvouch
data:
  config.yaml: |
    server:
      host: 0.0.0.0
      port: 50052
      workers: 4
    scanning:
      stages:
        - name: pii_scanner
          enabled: true
        - name: injection_scanner
          enabled: true

2. Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: gateway
  namespace: truthvouch
spec:
  replicas: 3
  selector:
    matchLabels:
      app: gateway
  template:
    metadata:
      labels:
        app: gateway
    spec:
      serviceAccountName: gateway
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app
                      operator: In
                      values:
                        - gateway
                topologyKey: kubernetes.io/hostname
      containers:
      - name: gateway
        image: truthvouch/governance-gateway:latest
        ports:
        - containerPort: 50052
          name: grpc
        - containerPort: 9090
          name: metrics
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: gateway-secrets
              key: database-url
        - name: OPENAI_API_KEY
          valueFrom:
            secretKeyRef:
              name: gateway-secrets
              key: openai-api-key
        resources:
          requests:
            cpu: 1000m
            memory: 2Gi
          limits:
            cpu: 2000m
            memory: 4Gi
        livenessProbe:
          grpc:
            port: 50052
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          grpc:
            port: 50052
          initialDelaySeconds: 10
          periodSeconds: 5
        volumeMounts:
        - name: config
          mountPath: /app/config
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: gateway-config

3. Service

apiVersion: v1
kind: Service
metadata:
  name: gateway
  namespace: truthvouch
spec:
  type: ClusterIP
  selector:
    app: gateway
  ports:
  - name: grpc
    port: 50052
    targetPort: 50052
  - name: metrics
    port: 9090
    targetPort: 9090

4. Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: gateway
  namespace: truthvouch
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - gateway.yourcompany.local
    secretName: gateway-tls
  rules:
  - host: gateway.yourcompany.local
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: gateway
            port:
              number: 50052

HorizontalPodAutoscaler

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: gateway-hpa
  namespace: truthvouch
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: gateway
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
    scaleUp:
      stabilizationWindowSeconds: 0

PodDisruptionBudget

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: gateway-pdb
  namespace: truthvouch
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: gateway

Monitoring with Prometheus

ServiceMonitor

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: gateway
  namespace: truthvouch
spec:
  selector:
    matchLabels:
      app: gateway
  endpoints:
  - port: metrics
    interval: 30s

PostgreSQL with CloudSQL Proxy

For managed databases (Google Cloud SQL, AWS RDS):

apiVersion: apps/v1
kind: Deployment
metadata:
  name: gateway
  namespace: truthvouch
spec:
  template:
    spec:
      serviceAccountName: gateway
      containers:
      - name: gateway
        image: truthvouch/governance-gateway:latest
        env:
        - name: DATABASE_URL
          value: postgresql://gateway_user:password@127.0.0.1:5432/truthvouch_gateway
      - name: cloud-sql-proxy
        image: gcr.io/cloudsql-docker/cloud-sql-proxy:1.33
        command:
          - "/cloud_sql_proxy"
          - "-instances=project:region:instance=tcp:5432"
        securityContext:
          runAsNonRoot: true

Checking Deployment Status

Terminal window
# Check rollout status
kubectl rollout status deployment/gateway -n truthvouch


# View pod logs
kubectl logs -f deployment/gateway -n truthvouch


# Check resource usage
kubectl top pods -n truthvouch


# View events
kubectl get events -n truthvouch --sort-by='.lastTimestamp'

Upgrades

Terminal window
# Update Helm chart
helm repo update
helm upgrade truthvouch truthvouch/governance-gateway \
  --namespace truthvouch \
  --values values.yaml


# Monitor rolling update
kubectl rollout status deployment/gateway -n truthvouch

Troubleshooting

Pods not starting

Terminal window
# Check pod status
kubectl describe pod gateway-xxxx -n truthvouch


# Check events
kubectl get events -n truthvouch

Database connection issues

Terminal window
# Verify secret exists
kubectl get secret gateway-secrets -n truthvouch


# Test database connectivity
kubectl run -it postgres-client --image=postgres:16 --rm -- \
  psql postgresql://gateway_user:password@postgres:5432/truthvouch_gateway

High latency

Terminal window
# Check node resources
kubectl top nodes


# Check pod resource limits
kubectl describe deployment gateway -n truthvouch

Cost Optimization

Reduce replicas for non-prod

# In values.yaml
replicaCount: 1  # Development/staging
autoscaling:
  minReplicas: 1
  maxReplicas: 3

Use spot/preemptible instances

affinity:
  nodeAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
    - weight: 100
      nodeSelector:
        cloud.google.com/gke-preemptible: "true"

See Docker deployment for configuration details.