diff --git a/charts/mcp-stack/RDS_CONFIGURATION_PLAN.md b/charts/mcp-stack/RDS_CONFIGURATION_PLAN.md
new file mode 100644
index 0000000000..77780c9dd3
--- /dev/null
+++ b/charts/mcp-stack/RDS_CONFIGURATION_PLAN.md
@@ -0,0 +1,304 @@
+# RDS Configuration Plan for MCP Stack Helm Chart
+
+## Overview
+
+This document outlines the approach to enable external RDS database configuration in the MCP Stack Helm chart, allowing users to provide a full `DATABASE_URL` connection string instead of using the in-cluster PostgreSQL deployment.
+
+## Current Architecture Analysis
+
+### Current PostgreSQL Setup
+
+1. **In-cluster PostgreSQL Deployment** ([`deployment-postgres.yaml`](charts/mcp-stack/templates/deployment-postgres.yaml:18))
+   - Conditionally deployed when `postgres.enabled: true`
+   - Uses auto-generated service name: `<release>-mcp-stack-postgres`
+   - Credentials stored in Secret: `postgres-secret` (or `postgres.existingSecret`)
+
+2. **Database Connection in Gateway** ([`deployment-mcpgateway.yaml`](charts/mcp-stack/templates/deployment-mcpgateway.yaml:54-99))
+   - Individual env vars: `POSTGRES_HOST`, `POSTGRES_PORT`, `POSTGRES_DB`, `POSTGRES_USER`, `POSTGRES_PASSWORD`
+   - `DATABASE_URL` constructed at runtime using shell variable expansion: `postgresql://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/$(POSTGRES_DB)`
+
+3. **Migration Job** ([`job-migration.yaml`](charts/mcp-stack/templates/job-migration.yaml:47-66))
+   - Uses same pattern as gateway deployment
+   - Runs as Helm hook: `post-install,pre-upgrade`
+
+## Proposed Solution
+
+### Design Principles
+
+1. **Backward Compatibility**: Existing configurations continue to work without changes
+2. **Simplicity**: Single `DATABASE_URL` for external databases
+3. **Security**: Sensitive connection strings stored in Kubernetes Secrets
+4. **Flexibility**: Support both in-cluster and external databases
+
+### Configuration Structure
+
+Add new section to [`values.yaml`](charts/mcp-stack/values.yaml:619):
+
+```yaml
+postgres:
+  enabled: true                    # Set to false when using external database
+  
+  # External database configuration (RDS, Cloud SQL, etc.)
+  external:
+    enabled: false                 # Set to true to use external database
+    databaseUrl: ""                # Full connection string (stored in secret)
+    # Example: "postgresql://user:pass@my-rds.us-east-1.rds.amazonaws.com:5432/mydb"
+    
+  # Existing in-cluster configuration (unchanged)
+  image:
+    repository: postgres
+    tag: "17"
+  # ... rest of existing config
+```
+
+### Implementation Changes
+
+#### 1. Update [`deployment-mcpgateway.yaml`](charts/mcp-stack/templates/deployment-mcpgateway.yaml:52-99)
+
+**Current Approach:**
+```yaml
+env:
+  - name: POSTGRES_HOST
+    value: {{ printf "%s-postgres" (include "mcp-stack.fullname" .) }}
+  # ... other POSTGRES_* vars
+  - name: DATABASE_URL
+    value: >-
+      postgresql://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/$(POSTGRES_DB)
+```
+
+**New Approach (with conditional logic):**
+```yaml
+env:
+  {{- if .Values.postgres.external.enabled }}
+  # External database: use provided DATABASE_URL directly
+  - name: DATABASE_URL
+    valueFrom:
+      secretKeyRef:
+        name: {{ include "mcp-stack.fullname" . }}-external-db-secret
+        key: DATABASE_URL
+  {{- else }}
+  # In-cluster database: construct DATABASE_URL from components
+  - name: POSTGRES_HOST
+    value: {{ printf "%s-postgres" (include "mcp-stack.fullname" .) }}
+  - name: POSTGRES_PORT
+    value: "{{ .Values.mcpContextForge.env.postgres.port }}"
+  - name: POSTGRES_DB
+    value: "{{ .Values.mcpContextForge.env.postgres.db }}"
+  - name: POSTGRES_USER
+    valueFrom:
+      secretKeyRef:
+        name: {{ include "mcp-stack.postgresSecretName" . | trim }}
+        key: POSTGRES_USER
+  - name: POSTGRES_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: {{ include "mcp-stack.postgresSecretName" . | trim }}
+        key: POSTGRES_PASSWORD
+  - name: DATABASE_URL
+    value: >-
+      postgresql://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/$(POSTGRES_DB)
+  {{- end }}
+```
+
+#### 2. Update [`job-migration.yaml`](charts/mcp-stack/templates/job-migration.yaml:45-66)
+
+Apply the same conditional logic as the gateway deployment:
+
+```yaml
+env:
+  {{- if .Values.postgres.external.enabled }}
+  # External database
+  - name: DATABASE_URL
+    valueFrom:
+      secretKeyRef:
+        name: {{ include "mcp-stack.fullname" . }}-external-db-secret
+        key: DATABASE_URL
+  {{- else }}
+  # In-cluster database (existing logic)
+  - name: POSTGRES_HOST
+    value: {{ printf "%s-postgres" (include "mcp-stack.fullname" .) }}
+  # ... rest of existing env vars
+  {{- end }}
+```
+
+#### 3. Create New Secret Template: `secret-external-db.yaml`
+
+```yaml
+{{- if .Values.postgres.external.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "mcp-stack.fullname" . }}-external-db-secret
+  labels:
+    {{- include "mcp-stack.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  DATABASE_URL: {{ .Values.postgres.external.databaseUrl | quote }}
+{{- end }}
+```
+
+#### 4. Update [`deployment-postgres.yaml`](charts/mcp-stack/templates/deployment-postgres.yaml:18)
+
+Ensure PostgreSQL deployment is skipped when using external database:
+
+```yaml
+{{- if and .Values.postgres.enabled (not .Values.postgres.external.enabled) }}
+# ... existing PostgreSQL deployment
+{{- end }}
+```
+
+#### 5. Update [`secret-postgres.yaml`](charts/mcp-stack/templates/secret-postgres.yaml:2)
+
+Update condition to skip when using external database:
+
+```yaml
+{{- if and .Values.postgres.enabled (not .Values.postgres.external.enabled) (not .Values.postgres.existingSecret) }}
+# ... existing secret
+{{- end }}
+```
+
+## Usage Examples
+
+### Example 1: Using AWS RDS
+
+```yaml
+# my-rds-values.yaml
+postgres:
+  enabled: false                   # Disable in-cluster PostgreSQL
+  external:
+    enabled: true
+    databaseUrl: "postgresql://admin:MySecurePass123@my-app.abc123.us-east-1.rds.amazonaws.com:5432/mcpgateway"
+
+mcpContextForge:
+  replicaCount: 3
+  # ... other gateway config
+```
+
+Deploy with:
+```bash
+helm install my-release ./charts/mcp-stack -f my-rds-values.yaml
+```
+
+### Example 2: Using Google Cloud SQL
+
+```yaml
+postgres:
+  enabled: false
+  external:
+    enabled: true
+    databaseUrl: "postgresql://postgres:password@10.1.2.3:5432/mcpdb?sslmode=require"
+```
+
+### Example 3: Keep In-Cluster PostgreSQL (No Changes)
+
+```yaml
+# Existing configuration continues to work
+postgres:
+  enabled: true
+  credentials:
+    database: postgresdb
+    user: admin
+    password: changeme
+```
+
+## Security Considerations
+
+1. **Secret Management**: The `DATABASE_URL` is stored in a Kubernetes Secret, not in plain text
+2. **SSL/TLS**: Users should include SSL parameters in the connection string (e.g., `?sslmode=require`)
+3. **Credential Rotation**: Update the secret and restart pods to rotate credentials
+4. **Network Security**: Ensure proper network policies and security groups allow pod-to-RDS communication
+
+## Migration Path
+
+### From In-Cluster to RDS
+
+1. **Backup existing data** from in-cluster PostgreSQL
+2. **Create RDS instance** and restore data
+3. **Update values.yaml**:
+   ```yaml
+   postgres:
+     enabled: false
+     external:
+       enabled: true
+       databaseUrl: "postgresql://..."
+   ```
+4. **Upgrade Helm release**: `helm upgrade my-release ./charts/mcp-stack -f values.yaml`
+5. **Verify migration job** completes successfully
+6. **Test application** connectivity
+
+### From RDS to In-Cluster (Rollback)
+
+1. **Backup RDS data**
+2. **Update values.yaml**:
+   ```yaml
+   postgres:
+     enabled: true
+     external:
+       enabled: false
+   ```
+3. **Upgrade Helm release**
+4. **Restore data** to in-cluster PostgreSQL
+
+## Testing Checklist
+
+- [ ] Deploy with in-cluster PostgreSQL (existing behavior)
+- [ ] Deploy with external RDS using full `DATABASE_URL`
+- [ ] Verify migration job runs successfully with external database
+- [ ] Test gateway connectivity to external database
+- [ ] Verify backward compatibility with existing configurations
+- [ ] Test upgrade path from in-cluster to external
+- [ ] Test rollback from external to in-cluster
+- [ ] Validate secret creation and mounting
+- [ ] Check that PostgreSQL deployment is skipped when `external.enabled: true`
+
+## Files to Modify
+
+1. [`charts/mcp-stack/values.yaml`](charts/mcp-stack/values.yaml:619) - Add `postgres.external` section
+2. [`charts/mcp-stack/templates/deployment-mcpgateway.yaml`](charts/mcp-stack/templates/deployment-mcpgateway.yaml:52) - Add conditional DATABASE_URL logic
+3. [`charts/mcp-stack/templates/job-migration.yaml`](charts/mcp-stack/templates/job-migration.yaml:45) - Add conditional DATABASE_URL logic
+4. [`charts/mcp-stack/templates/deployment-postgres.yaml`](charts/mcp-stack/templates/deployment-postgres.yaml:18) - Update condition
+5. [`charts/mcp-stack/templates/secret-postgres.yaml`](charts/mcp-stack/templates/secret-postgres.yaml:2) - Update condition
+6. **NEW**: `charts/mcp-stack/templates/secret-external-db.yaml` - Create new secret template
+
+## Alternative Approaches Considered
+
+### Alternative 1: Override in `mcpContextForge.secret`
+
+**Approach**: Allow users to set `DATABASE_URL` directly in [`mcpContextForge.secret`](charts/mcp-stack/values.yaml:571):
+```yaml
+mcpContextForge:
+  secret:
+    DATABASE_URL: "postgresql://user:pass@rds-host:5432/db"
+```
+
+**Pros**: 
+- Simpler, no new configuration section
+- Already documented in values.yaml comments
+
+**Cons**:
+- Still need to disable PostgreSQL deployment manually
+- Less explicit about external database usage
+- Doesn't prevent construction of unused POSTGRES_* env vars
+
+**Decision**: Rejected in favor of explicit `postgres.external` section for clarity
+
+### Alternative 2: Separate DATABASE_URL from POSTGRES_* vars
+
+**Approach**: Always check for `DATABASE_URL` first, fall back to constructed URL
+
+**Cons**:
+- More complex template logic
+- Harder to understand which configuration is active
+
+**Decision**: Rejected in favor of clear conditional logic
+
+## Conclusion
+
+The proposed solution provides a clean, secure, and backward-compatible way to use external RDS databases with the MCP Stack Helm chart. The key changes are:
+
+1. Add `postgres.external.enabled` and `postgres.external.databaseUrl` to values.yaml
+2. Use conditional logic in deployment templates to choose between external and in-cluster database
+3. Create a new secret template for external database credentials
+4. Ensure PostgreSQL deployment is skipped when using external database
+
+This approach maintains full backward compatibility while providing a straightforward path for users who want to use managed database services like AWS RDS, Google Cloud SQL, or Azure Database for PostgreSQL.
\ No newline at end of file
diff --git a/charts/mcp-stack/RDS_IMPLEMENTATION_SUMMARY.md b/charts/mcp-stack/RDS_IMPLEMENTATION_SUMMARY.md
new file mode 100644
index 0000000000..ce12e08732
--- /dev/null
+++ b/charts/mcp-stack/RDS_IMPLEMENTATION_SUMMARY.md
@@ -0,0 +1,197 @@
+# RDS Implementation Summary
+
+## Overview
+
+Successfully implemented external database support for the MCP Stack Helm chart, allowing users to connect to managed database services like AWS RDS, Google Cloud SQL, or Azure Database for PostgreSQL instead of using the in-cluster PostgreSQL deployment.
+
+## Implementation Date
+
+December 23, 2024
+
+## Changes Made
+
+### 1. Configuration Files
+
+#### `values.yaml`
+- Added `postgres.external` section with `enabled` and `databaseUrl` fields
+- Maintains backward compatibility with existing in-cluster PostgreSQL configuration
+
+```yaml
+postgres:
+  enabled: true
+  external:
+    enabled: false
+    databaseUrl: ""
+```
+
+#### `values.schema.json`
+- Added schema validation for `postgres.external` configuration
+- Ensures type safety and provides documentation for the new fields
+
+### 2. Template Files
+
+#### `templates/deployment-mcpgateway.yaml`
+- Added conditional logic to use external DATABASE_URL when `postgres.external.enabled: true`
+- Falls back to constructing DATABASE_URL from individual components for in-cluster PostgreSQL
+- No POSTGRES_* environment variables are set when using external database
+
+#### `templates/job-migration.yaml`
+- Applied same conditional logic as gateway deployment
+- Migration job connects to external database when configured
+
+#### `templates/secret-external-db.yaml` (NEW)
+- New template that creates a Kubernetes Secret containing the external DATABASE_URL
+- Only created when `postgres.external.enabled: true`
+
+#### `templates/deployment-postgres.yaml`
+- Updated condition to skip deployment when using external database
+- Changed from `{{- if .Values.postgres.enabled }}` to `{{- if and .Values.postgres.enabled (not .Values.postgres.external.enabled) }}`
+
+#### `templates/secret-postgres.yaml`
+- Updated condition to skip secret creation when using external database
+- Changed from `{{- if and .Values.postgres.enabled (not .Values.postgres.existingSecret) }}` to include external check
+
+### 3. Documentation & Examples
+
+#### `examples/values-rds.yaml` (NEW)
+- Comprehensive example showing AWS RDS configuration
+- Includes production-ready settings for scaling, resources, and high availability
+- Documents connection string format and SSL options
+
+#### `RDS_CONFIGURATION_PLAN.md`
+- Detailed design document outlining the implementation approach
+- Includes usage examples, security considerations, and migration paths
+
+## Testing Results
+
+### Schema Validation
+✅ Helm schema validation passes with new `postgres.external` fields
+
+### Template Rendering
+✅ External database configuration:
+- Creates `external-db-secret` with DATABASE_URL
+- Skips PostgreSQL deployment
+- Skips postgres-secret creation
+- Gateway and migration job use external DATABASE_URL from secret
+
+✅ In-cluster database configuration (backward compatibility):
+- Creates PostgreSQL deployment
+- Creates postgres-secret with credentials
+- Gateway and migration job construct DATABASE_URL from components
+
+### Verification Commands
+
+```bash
+# Test with external database
+helm template test-rds ./charts/mcp-stack -f examples/values-rds.yaml
+
+# Test with in-cluster database (default)
+helm template test-default ./charts/mcp-stack
+
+# Verify schema validation
+helm template test ./charts/mcp-stack --debug
+```
+
+## Usage
+
+### Using AWS RDS
+
+```yaml
+postgres:
+  enabled: false
+  external:
+    enabled: true
+    databaseUrl: "postgresql://user:pass@my-rds.us-east-1.rds.amazonaws.com:5432/mydb?sslmode=require"
+
+mcpContextForge:
+  replicaCount: 3
+  service:
+    type: LoadBalancer
+    port: 443
+```
+
+Deploy:
+```bash
+helm install my-release ./charts/mcp-stack -f my-rds-values.yaml
+```
+
+### Using Google Cloud SQL
+
+```yaml
+postgres:
+  enabled: false
+  external:
+    enabled: true
+    databaseUrl: "postgresql://postgres:password@10.1.2.3:5432/mcpdb?sslmode=require"
+```
+
+### Keeping In-Cluster PostgreSQL (No Changes Required)
+
+```yaml
+postgres:
+  enabled: true
+  credentials:
+    database: postgresdb
+    user: admin
+    password: changeme
+```
+
+## Security Features
+
+1. **Secret Storage**: DATABASE_URL stored in Kubernetes Secret, not ConfigMap
+2. **SSL/TLS Support**: Connection string can include `sslmode=require`
+3. **No Plain Text**: Credentials never exposed in pod environment variables directly
+4. **Backward Compatible**: Existing deployments continue to work without changes
+
+## Migration Path
+
+### From In-Cluster to RDS
+
+1. Backup existing PostgreSQL data
+2. Create RDS instance and restore data
+3. Update values.yaml with external configuration
+4. Run `helm upgrade` with new values
+5. Verify migration job completes successfully
+
+### From RDS to In-Cluster (Rollback)
+
+1. Backup RDS data
+2. Update values.yaml to disable external database
+3. Run `helm upgrade`
+4. Restore data to in-cluster PostgreSQL
+
+## Files Modified
+
+- `charts/mcp-stack/values.yaml`
+- `charts/mcp-stack/values.schema.json`
+- `charts/mcp-stack/templates/deployment-mcpgateway.yaml`
+- `charts/mcp-stack/templates/job-migration.yaml`
+- `charts/mcp-stack/templates/deployment-postgres.yaml`
+- `charts/mcp-stack/templates/secret-postgres.yaml`
+
+## Files Created
+
+- `charts/mcp-stack/templates/secret-external-db.yaml`
+- `charts/mcp-stack/examples/values-rds.yaml`
+- `charts/mcp-stack/RDS_CONFIGURATION_PLAN.md`
+- `charts/mcp-stack/RDS_IMPLEMENTATION_SUMMARY.md`
+
+## Backward Compatibility
+
+✅ **100% Backward Compatible**
+- Existing deployments continue to work without any changes
+- Default behavior unchanged (in-cluster PostgreSQL)
+- No breaking changes to existing configurations
+
+## Next Steps
+
+1. Update main README.md with external database documentation
+2. Add to CHANGELOG.md
+3. Consider adding similar support for external Redis (ElastiCache)
+4. Add integration tests for external database scenarios
+
+## Related Issues
+
+- Original Helm schema validation error resolved
+- External database support implemented as planned
+- Production-ready configuration examples provided
\ No newline at end of file
diff --git a/charts/mcp-stack/examples/values-aws-nlb.yaml b/charts/mcp-stack/examples/values-aws-nlb.yaml
new file mode 100644
index 0000000000..f784c23296
--- /dev/null
+++ b/charts/mcp-stack/examples/values-aws-nlb.yaml
@@ -0,0 +1,109 @@
+# Example values for deploying mcp-stack with AWS Network Load Balancer (NLB)
+# This configuration demonstrates common AWS NLB settings
+
+mcpContextForge:
+  replicaCount: 2
+  
+  service:
+    type: LoadBalancer
+    port: 80
+    
+    # AWS NLB Configuration
+    annotations:
+      # Use Network Load Balancer
+      service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
+      
+      # Target type: "ip" for Fargate/EKS with CNI, "instance" for EC2 nodes
+      service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"
+      
+      # Internet-facing or internal
+      service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
+      
+      # Enable cross-zone load balancing for better availability
+      service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
+      
+      # Health check configuration
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: "HTTP"
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "4444"
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: "/health"
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-interval: "10"
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-timeout: "5"
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-healthy-threshold: "2"
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-unhealthy-threshold: "2"
+      
+      # Connection settings
+      service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
+      
+      # Target group attributes for better performance
+      service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: |
+        deregistration_delay.timeout_seconds=30,
+        deregistration_delay.connection_termination.enabled=true,
+        preserve_client_ip.enabled=true
+      
+      # Resource tags for cost tracking and organization
+      service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: "Environment=production,Application=mcp-gateway,ManagedBy=helm"
+      
+      # Optional: Specify subnets (replace with your subnet IDs)
+      # service.beta.kubernetes.io/aws-load-balancer-subnets: "subnet-xxxxx,subnet-yyyyy,subnet-zzzzz"
+      
+      # Optional: Specify security groups (replace with your SG IDs)
+      # service.beta.kubernetes.io/aws-load-balancer-security-groups: "sg-xxxxx"
+      
+      # Optional: Enable access logs (replace with your S3 bucket)
+      # service.beta.kubernetes.io/aws-load-balancer-access-log-enabled: "true"
+      # service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-name: "my-nlb-logs-bucket"
+      # service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-prefix: "mcp-gateway"
+    
+    # Preserve client source IP (requires externalTrafficPolicy: Local)
+    externalTrafficPolicy: "Local"
+    
+    # Optional: Restrict access to specific CIDR ranges
+    # loadBalancerSourceRanges:
+    #   - "10.0.0.0/8"
+    #   - "172.16.0.0/12"
+
+# Example with SSL/TLS termination at NLB
+# Uncomment and configure if you want HTTPS at the load balancer level
+#
+# mcpContextForge:
+#   service:
+#     type: LoadBalancer
+#     port: 443
+#     
+#     annotations:
+#       service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
+#       service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"
+#       service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
+#       
+#       # SSL certificate from ACM
+#       service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"
+#       service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
+#       service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: "ELBSecurityPolicy-TLS-1-2-2017-01"
+#       service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
+#     
+#     additionalPorts:
+#       - name: http
+#         port: 80
+#         targetPort: 4444
+#         protocol: TCP
+
+# Example with static Elastic IPs
+# Useful for whitelisting or DNS records
+#
+# mcpContextForge:
+#   service:
+#     annotations:
+#       service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
+#       service.beta.kubernetes.io/aws-load-balancer-eip-allocations: "eipalloc-xxxxx,eipalloc-yyyyy,eipalloc-zzzzz"
+
+# Example for internal NLB (private VPC only)
+#
+# mcpContextForge:
+#   service:
+#     annotations:
+#       service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
+#       service.beta.kubernetes.io/aws-load-balancer-scheme: "internal"
+#       service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"
+#       service.beta.kubernetes.io/aws-load-balancer-subnets: "subnet-private1,subnet-private2,subnet-private3"
+
+# Made with Bob
diff --git a/charts/mcp-stack/examples/values-rds.yaml b/charts/mcp-stack/examples/values-rds.yaml
new file mode 100644
index 0000000000..fb557e3e08
--- /dev/null
+++ b/charts/mcp-stack/examples/values-rds.yaml
@@ -0,0 +1,116 @@
+########################################################################
+# EXAMPLE: AWS RDS Configuration
+#
+# This example shows how to configure the MCP Stack Helm chart to use
+# an external AWS RDS PostgreSQL database instead of the in-cluster
+# PostgreSQL deployment.
+#
+# Usage:
+#   helm install my-release ./charts/mcp-stack -f examples/values-rds.yaml
+########################################################################
+
+########################################################################
+# DISABLE IN-CLUSTER POSTGRESQL
+########################################################################
+postgres:
+  enabled: false                   # Disable in-cluster PostgreSQL deployment
+  
+  # External database configuration
+  external:
+    enabled: true                  # Enable external database mode
+    databaseUrl: "postgresql://admin:MySecurePassword123@my-app.abc123.us-east-1.rds.amazonaws.com:5432/mcpgateway?sslmode=require"
+    # Connection string format:
+    # postgresql://[user]:[password]@[host]:[port]/[database]?[options]
+    #
+    # Important options for RDS:
+    # - sslmode=require: Enforce SSL/TLS connection
+    # - connect_timeout=10: Connection timeout in seconds
+    # - application_name=mcp-gateway: Identify connections in RDS logs
+    #
+    # Example with all options:
+    # "postgresql://admin:pass@host:5432/db?sslmode=require&connect_timeout=10&application_name=mcp-gateway"
+
+########################################################################
+# MCP CONTEXT-FORGE (Gateway)
+########################################################################
+mcpContextForge:
+  replicaCount: 3                  # Scale horizontally for production
+  
+  image:
+    repository: ghcr.io/ibm/mcp-context-forge
+    tag: latest
+    pullPolicy: IfNotPresent
+  
+  service:
+    type: LoadBalancer             # Expose via LoadBalancer
+    port: 443                      # HTTPS port
+  
+  ingress:
+    enabled: false                 # Using LoadBalancer instead
+  
+  # Resource limits for production
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 2Gi
+    requests:
+      cpu: 500m
+      memory: 1Gi
+  
+  # HPA for auto-scaling
+  hpa:
+    enabled: true
+    minReplicas: 3
+    maxReplicas: 10
+    targetCPUUtilizationPercentage: 80
+    targetMemoryUtilizationPercentage: 80
+
+########################################################################
+# REDIS CACHE (Optional - can also use ElastiCache)
+########################################################################
+redis:
+  enabled: true                    # Keep in-cluster Redis or use ElastiCache
+  
+  persistence:
+    enabled: true                  # Enable persistence for Redis
+    size: 5Gi
+    storageClassName: "gp3"        # AWS EBS gp3 storage class
+  
+  resources:
+    limits:
+      cpu: 500m
+      memory: 1Gi
+    requests:
+      cpu: 250m
+      memory: 512Mi
+
+########################################################################
+# DISABLE OPTIONAL COMPONENTS
+########################################################################
+pgadmin:
+  enabled: false                   # Not needed with RDS (use RDS console)
+
+redisCommander:
+  enabled: false                   # Optional Redis UI
+
+minio:
+  enabled: false                   # Use S3 instead if needed
+
+mcpFastTimeServer:
+  enabled: false                   # Optional MCP server
+
+########################################################################
+# DATABASE MIGRATION
+########################################################################
+migration:
+  enabled: true                    # Run migrations against RDS
+  
+  resources:
+    limits:
+      cpu: 500m
+      memory: 1Gi
+    requests:
+      cpu: 250m
+      memory: 512Mi
+
+# Made with Bob
diff --git a/charts/mcp-stack/templates/deployment-mcpgateway.yaml b/charts/mcp-stack/templates/deployment-mcpgateway.yaml
index a01fac8447..7950265247 100644
--- a/charts/mcp-stack/templates/deployment-mcpgateway.yaml
+++ b/charts/mcp-stack/templates/deployment-mcpgateway.yaml
@@ -50,6 +50,16 @@ spec:
           #   placeholders in the derived URL variables declared below.
           ################################################################
           env:
+            # ---------- POSTGRES ----------
+            {{- if .Values.postgres.external.enabled }}
+            # External database: use provided DATABASE_URL directly from secret
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgres.external.secretName }}
+                  key: DATABASE_URL
+            {{- else }}
+            # In-cluster database: construct DATABASE_URL from components
             # ---------- POSTGRES (via PgBouncer if enabled) ----------
             - name: POSTGRES_HOST
               {{- if .Values.pgbouncer.enabled }}
@@ -107,6 +117,7 @@ spec:
                 postgresql+psycopg://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/$(POSTGRES_DB)
             - name: REDIS_URL
               value: "redis://$(REDIS_HOST):$(REDIS_PORT)/0"
+            {{- end }}
 
           ################################################################
           # BULK ENV-VARS - pulled from ConfigMap + Secret
diff --git a/charts/mcp-stack/templates/deployment-postgres.yaml b/charts/mcp-stack/templates/deployment-postgres.yaml
index 6254190adb..ec547f41a7 100644
--- a/charts/mcp-stack/templates/deployment-postgres.yaml
+++ b/charts/mcp-stack/templates/deployment-postgres.yaml
@@ -15,7 +15,7 @@
 {{- $postgresImage = printf "%s:%s" .Values.postgres.image.repository .Values.postgres.image.tag -}}
 {{- end -}}
 
-{{- if .Values.postgres.enabled }}
+{{- if and .Values.postgres.enabled (not .Values.postgres.external.enabled) }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/charts/mcp-stack/templates/job-migration.yaml b/charts/mcp-stack/templates/job-migration.yaml
index 65a48f16aa..8700868610 100644
--- a/charts/mcp-stack/templates/job-migration.yaml
+++ b/charts/mcp-stack/templates/job-migration.yaml
@@ -44,6 +44,15 @@ spec:
 
           env:
             # ---------- POSTGRES ----------
+            {{- if .Values.postgres.external.enabled }}
+            # External database: use provided DATABASE_URL directly from secret
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgres.external.secretName }}
+                  key: DATABASE_URL
+            {{- else }}
+            # In-cluster database: construct DATABASE_URL from components
             - name: POSTGRES_HOST
               value: {{ printf "%s-postgres" (include "mcp-stack.fullname" .) }}
             - name: POSTGRES_PORT
@@ -60,10 +69,10 @@ spec:
                 secretKeyRef:
                   name: {{ include "mcp-stack.postgresSecretName" . | trim }}
                   key: POSTGRES_PASSWORD
-            # ---------- DERIVED URLS ----------
             - name: DATABASE_URL
               value: >-
                 postgresql+psycopg://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/$(POSTGRES_DB)
+            {{- end }}
             # ---------- LOGGING ----------
             - name: LOG_LEVEL
               value: "INFO"
diff --git a/charts/mcp-stack/templates/secret-postgres.yaml b/charts/mcp-stack/templates/secret-postgres.yaml
index 62969e6380..4641b3b18b 100644
--- a/charts/mcp-stack/templates/secret-postgres.yaml
+++ b/charts/mcp-stack/templates/secret-postgres.yaml
@@ -1,5 +1,5 @@
 # templates/secret-postgres.yaml
-{{- if and .Values.postgres.enabled (not .Values.postgres.existingSecret) }}
+{{- if and .Values.postgres.enabled (not .Values.postgres.external.enabled) (not .Values.postgres.existingSecret) }}
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/charts/mcp-stack/templates/service-mcp.yaml b/charts/mcp-stack/templates/service-mcp.yaml
index ad91ce6f58..5c0669a896 100644
--- a/charts/mcp-stack/templates/service-mcp.yaml
+++ b/charts/mcp-stack/templates/service-mcp.yaml
@@ -4,6 +4,10 @@ metadata:
   name: {{ include "mcp-stack.fullname" . }}-mcpgateway
   labels:
     {{- include "mcp-stack.labels" . | nindent 4 }}
+  {{- with .Values.mcpContextForge.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   type: {{ .Values.mcpContextForge.service.type }}
   selector:
diff --git a/charts/mcp-stack/values.schema.json b/charts/mcp-stack/values.schema.json
index eea3ead997..dbf3473bf3 100644
--- a/charts/mcp-stack/values.schema.json
+++ b/charts/mcp-stack/values.schema.json
@@ -121,6 +121,14 @@
               "minimum": 1,
               "maximum": 65535,
               "default": 80
+            },
+            "annotations": {
+              "type": "object",
+              "description": "Service annotations (e.g., for AWS NLB configuration)",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "default": {}
             }
           },
           "additionalProperties": false
@@ -402,7 +410,7 @@
             "CACHE_TYPE": {
               "type": "string",
               "description": "Cache backend type",
-              "enum": ["redis", "memory", "database"],
+              "enum": ["redis", "memory", "none", "database"],
               "default": "redis"
             },
             "CACHE_PREFIX": {
@@ -951,6 +959,28 @@
           "description": "Enable PostgreSQL",
           "default": true
         },
+        "external": {
+          "type": "object",
+          "description": "External database configuration (RDS, Cloud SQL, etc.)",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Use external managed database instead of in-cluster PostgreSQL",
+              "default": false
+            },
+            "databaseUrl": {
+              "type": "string",
+              "description": "Full PostgreSQL connection string (e.g., postgresql://user:pass@host:5432/db)",
+              "default": ""
+            },
+            "secretName": {
+              "type": "string",
+              "description": "k8s secret name containing the full PostgreSQL connection string )",
+              "default": ""
+            }              
+          },
+          "additionalProperties": false
+        },
         "image": {
           "type": "object",
           "description": "PostgreSQL image configuration",
diff --git a/charts/mcp-stack/values.yaml b/charts/mcp-stack/values.yaml
index dae3e828ce..f73f881cac 100644
--- a/charts/mcp-stack/values.yaml
+++ b/charts/mcp-stack/values.yaml
@@ -655,6 +655,15 @@ migration:
 postgres:
   enabled: true
 
+  # ─── External Database Configuration (RDS, Cloud SQL, etc.) ───
+  # Set external.enabled: true to use an external managed database
+  # instead of the in-cluster PostgreSQL deployment.
+  external:
+    enabled: false                   # Set to true to use external database
+    databaseUrl: ""                  # Full PostgreSQL connection string
+                                    # Example: "postgresql://user:pass@my-rds.us-east-1.rds.amazonaws.com:5432/mydb"
+                                    # Note: This value is stored in a Kubernetes Secret for security
+
   image:
     repository: postgres
     tag: "17"