The llmgw control plane is starting as {{ include "llmgw.fullname" . }}.

The admin API listens on the pod's loopback only. To reach it from here:

  kubectl -n {{ .Release.Namespace }} port-forward statefulset/{{ include "llmgw.fullname" . }} 9090:9090 &
  export LLMGW_ADMIN_TOKEN=$(kubectl -n {{ .Release.Namespace }} get secret {{ include "llmgw.adminSecret" . }} \
    -o jsonpath='{.data.{{ if .Values.adminToken.existingSecret }}{{ .Values.adminToken.secretKey }}{{ else }}admin-token{{ end }}}' | base64 -d)
  llmgw ctl status

The first administrator:

  kubectl -n {{ .Release.Namespace }} exec -it statefulset/{{ include "llmgw.fullname" . }} -- \
    llmgw users create you@example.com --password '<a password>'
  kubectl -n {{ .Release.Namespace }} exec -it statefulset/{{ include "llmgw.fullname" . }} -- \
    llmgw users role you@example.com admin

Agents connect to the {{ include "llmgw.fullname" . }}-agents Service on port {{ .Values.agentService.port }}:

  kubectl -n {{ .Release.Namespace }} get service {{ include "llmgw.fullname" . }}-agents

Its address must be in the certificate in {{ .Values.agentTLS.existingSecret }}. Nodes join from
the machine holding llmgw's authority:

  sudo llmgw node add ubuntu@gpu01 --server https://<that address>:{{ .Values.agentService.port }} \
    --pki ./pki --admin 127.0.0.1:9090

docs/kubernetes.md has the rest, and why the nodes stay outside Kubernetes.
