Hybrid
Focus
Focus
Prisma AIRS

Hybrid

Table of Contents


Hybrid

Deploy AI Gateway in Hybrid mode to keep LLM traffic within your environment by hosting the data plane on your own Kubernetes cluster.
Hybrid deployment hosts the AI Gateway data plane on a Kubernetes cluster that you manage. LLM request and response payloads are processed within your environment and never transmitted to Palo Alto Networks. The management plane — workspace configuration, guardrail policies, and observability dashboards — continues to run in Strata Cloud Manager.
Before you begin, ensure your Kubernetes cluster is provisioned and that Helm 3 is installed and configured to communicate with your cluster.
  1. In Strata Cloud Manager, select AI SecurityHome.
  2. On the AI Gateway tile, click Deploy Hybrid.
  3. In Name, enter a name for this Hybrid deployment instance, then click Next.
  4. Select the workspaces to associate with this Hybrid deployment, then click Next.
    You can associate all workspaces or select specific ones. Requests from selected workspaces will be routed through your on-premises data plane.
  5. Click Download values.yaml to save the Helm configuration file, then click Done.
    The values.yaml file contains your registration token and all configuration settings required for the Helm deployment. Keep this file secure.
  6. Add the AI Gateway Helm repository:
    helm repo add airs-gw https://portkey-ai.github.io/airs-gw-helm helm repo update
  7. Install the AI Gateway chart using the downloaded configuration file:
    helm upgrade --install airs-gw airs-gw/airs-gw \ -f ./values.yaml \ -n airs-gw \ --create-namespace
  8. Verify that the gateway pods are running:
    kubectl get pods -n airs-gw
    All pods should show a status of Running within a few minutes of installation.
  9. Confirm that the deployment shows as Connected in Strata Cloud Manager under AI SecurityAI GatewaySettings.
  10. Click Commit to apply the configuration.
    The Hybrid AI Gateway data plane is running in your Kubernetes cluster and connected to Strata Cloud Manager. LLM request and response payloads for the associated workspaces are processed within your environment.
    If the deployment does not show as Connected after 10 minutes, verify that your cluster has outbound connectivity to Strata Cloud Manager and that the registration token in values.yaml matches the one shown in Strata Cloud Manager.