Profiles

Nine curated value sets for the situations people actually install into. A profile is a starting point, not a lock — every key it sets can still be overridden.

Using a profile#

Extract the signed chart package first; its profiles/ directory contains the value sets shown here.

tar -xzf agentfleet-<version>.tgz

helm install agentfleet ./agentfleet \
  --namespace agentfleet-system --create-namespace \
  -f agentfleet/profiles/enterprise-baseline.yaml \
  -f agentfleet-images.values.json \
  --set gateway.config.auth.mode=entra_app \
  --set gateway.config.auth.entraApp.directoryID=<directory-id> \
  --set gateway.config.auth.entraApp.requiredRole=<app-role> \
  --set gateway.config.auth.oidcJwt.issuer=https://login.microsoftonline.com/<directory-id>/v2.0 \
  --set 'gateway.config.auth.oidcJwt.audience[0]=<token-audience>' \
  --set gateway.config.auth.oidcJwt.jwksURL=https://login.microsoftonline.com/<directory-id>/discovery/v2.0/keys \
  --set gateway.config.auth.entraApp.bindings.existingSecret=<identity-db-secret> \
  --set gateway.config.auth.entraApp.auditDigest.existingSecret=<audit-digest-secret>

Profiles compose. Layer a second file to extend a base — later files win:

helm install agentfleet ./agentfleet \
  -f agentfleet/profiles/enterprise-baseline.yaml \
  -f agentfleet/profiles/enterprise-postgres.yaml \
  -f agentfleet-images.values.json \
  --set gateway.config.auth.mode=entra_app \
  --set gateway.config.auth.entraApp.directoryID=<directory-id> \
  --set gateway.config.auth.entraApp.requiredRole=<app-role> \
  --set gateway.config.auth.oidcJwt.issuer=https://login.microsoftonline.com/<directory-id>/v2.0 \
  --set 'gateway.config.auth.oidcJwt.audience[0]=<token-audience>' \
  --set gateway.config.auth.oidcJwt.jwksURL=https://login.microsoftonline.com/<directory-id>/discovery/v2.0/keys \
  --set gateway.config.auth.entraApp.bindings.existingSecret=<identity-db-secret> \
  --set gateway.config.auth.entraApp.auditDigest.existingSecret=<audit-digest-secret> \
  --set migrations.secrets.identity.existingSecret=<identity-schema-owner-dsn-secret>

Render any profile without installing it:

helm template agentfleet ./agentfleet \
  -f agentfleet/profiles/enterprise-baseline.yaml \
  -f agentfleet-images.values.json \
  --set gateway.config.auth.mode=entra_app \
  --set gateway.config.auth.entraApp.directoryID=<directory-id> \
  --set gateway.config.auth.entraApp.requiredRole=<app-role> \
  --set gateway.config.auth.oidcJwt.issuer=https://login.microsoftonline.com/<directory-id>/v2.0 \
  --set 'gateway.config.auth.oidcJwt.audience[0]=<token-audience>' \
  --set gateway.config.auth.oidcJwt.jwksURL=https://login.microsoftonline.com/<directory-id>/discovery/v2.0/keys \
  --set gateway.config.auth.entraApp.bindings.existingSecret=<identity-db-secret> \
  --set gateway.config.auth.entraApp.auditDigest.existingSecret=<audit-digest-secret>

The Gateway's default auth mode, off, and header_dev and oidc_jwt admit a caller with no Registry caller record, so the caller is not checked against the Registry. off and header_dev are for local development only; oidc_jwt may run in production but does not check that a caller is registered with the Registry. The chart refuses to render the Gateway in those three unless gateway.config.auth.allowUnregisteredCallers=true acknowledges that; the three commands above choose entra_app, which needs no acknowledgement and requires an approved Registry binding for each caller. For callers of another identity provider, see the oidc_jwt flags on Install with Helm. Replace each <placeholder> with your own value: your Entra directory ID, the application role callers must hold, the audience of the tokens, and the names of the Secrets you create first: the identity-binding database DSN and the audit-digest key (every command above), and, in the second command, the DSN of the schema owner of the identity database (migrations.secrets.identity.existingSecret), which the migration Job uses. The values reference lists every gateway.config.auth.entraApp key. local-light, local-durable and demo-observability set the acknowledgement themselves (they are local profiles). secure-production ships oidc_jwt, so it refuses to render without the acknowledgement; add the entra_app flags after it to use entra_app instead.

secure-production refuses to render until your own values set a Gateway tenant membership source (gateway.config.tenantAuthz.static.memberships, or enabled idpGroups mappings); see the chart README.

Evaluation#

Profile	Storage	Policy	Use it when
local-light	memory	off	Fastest path on a disposable Kubernetes evaluation cluster. Nothing survives a restart and modules stay off, so you see the routing path with the least moving parts.
local-durable	bundled PostgreSQL	enforce	Local evaluation that survives restarts, with policy actually enforcing. Ships sample rules covering the demo agents so traffic flows.
demo-observability	in-memory	off	Adds Prometheus, Grafana, and a ClickHouse audit sink so you can see dashboards and query evidence — see Operations. Ships policy rules but does not turn policy on at the gateway; layer with local-durable for enforcement and Postgres together.

The bundled database is not a production database

local-durable runs a single-replica PostgreSQL StatefulSet for convenience. It is not an HA shape and is not meant to be one. Point production installs at a managed database.

Production#

Profile	Storage	Policy	Use it when
enterprise-baseline	memory	enforce	The starting point for a real cluster: two replicas, resource requests, policy enforcing. Add storage and rules on top.
enterprise-postgres	external PostgreSQL	inherited	Layer over `enterprise-baseline` to make registry and context durable against your own database.
secure-production	external PostgreSQL	enforce	The hardened preset: tenant authorization enforced, auto-migration off, no bundled database, no sample rules.
mesh-ready	inherited	inherited	Layer on when running under Istio with strict mTLS. Adds mesh labels, annotations, and the conformance assets.
context-audit	inherited	inherited	Layer on to turn on conversation history and request audit emission without changing anything else.
protected-path	inherited	enforce	Layer on for managed agent namespaces that require workload identity, router-only model egress, server-side provider credentials, optional Guard inspection, suspension, and protected-path evidence. Requires an enforcing CNI.

Applied agents are pending on the production profiles

An applied agent is pending in the Registry and does not route until it is approved (the approval routes of issue #727 are only a first slice in the Registry: off by default, not enabled by the chart, and not called by the Console or the command line) or, on a profile that sets registry.operatorWritesAreApprovals=true, until an operator write is taken as the approval. That setting records no person’s decision, and with Registry write authentication off, the default, any caller that can reach the write API can make a record routable. local-light, local-durable, demo-observability and demo-registration set it when their file is passed (not for an older release upgraded with --reuse-values: see Install with Helm); the chart default, enterprise-baseline, enterprise-postgres and secure-production do not. On PostgreSQL storage, turning it on later affects agents created afterwards, not one that is already pending; on memory storage the restart that turning it on causes loses the Registry’s records, and the Operator’s next republish creates each agent again as registered (read from the chart and the Registry code; not run on a cluster).

Production profiles ship no policy rules

enterprise-baseline and secure-production set policy.rules to an empty map on purpose, so they fail closed. A profile that shipped a working allow list would be shipping somebody else's authorization decisions. Author your own before sending traffic.

Checking what a profile does#

Profiles are plain values files in the extracted chart's agentfleet/profiles/ directory. To see exactly what one changes, diff its rendered output against the defaults. This is a local inspection, so both renders acknowledge the Gateway's default auth mode (the diff shows no change from the acknowledgement, which only gates the render):

helm template agentfleet ./agentfleet \
  -f agentfleet-images.values.json \
  --set gateway.config.auth.allowUnregisteredCallers=true > /tmp/default.yaml

helm template agentfleet ./agentfleet \
  -f agentfleet/profiles/enterprise-baseline.yaml \
  -f agentfleet-images.values.json \
  --set gateway.config.auth.allowUnregisteredCallers=true > /tmp/baseline.yaml

diff /tmp/default.yaml /tmp/baseline.yaml