For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.
AgentgatewayBackend
Use AgentgatewayBackends to configure the target services that agentgateway routes traffic to.
Explore the configuration reference by clicking on a property name or expanding the property types. Use the in-field search bar to search for a property. The reference is also available as a table.- apiVersionstring
- kindstring
- metadataobject
- *spec
- a2a
- *hoststring
- *portinteger
- ai
- groups
- *providers
- anthropic
- modelstring
- azure
- apiVersionstring
- modelstring
- projectNamestring
- *resourceNamestring
- *resourceTypestring
- azureopenai
- apiVersionstring
- deploymentNamestring
- *endpointstring
- bedrock
- guardrail
- *identifierstring
- *versionstring
- modelstring
- regionstring
- custom
- backendRef
- groupstring
- kindstring
- *namestring
- portinteger
- *formats
- pathstring
- *typestring
- modelstring
- gemini
- modelstring
- hoststring
- *namestring
- openai
- modelstring
- pathstring
- pathPrefixstring
- policies
- ai
- defaults
- *fieldstring
- *valueobject
- modelAliasesobject
- overrides
- *fieldstring
- *valueobject
- prompt
- append
- *contentstring
- *rolestring
- prepend
- *contentstring
- *rolestring
- promptCaching
- cacheMessageOffsetinteger
- cacheMessagesboolean
- cacheSystemboolean
- cacheToolsboolean
- minTokensinteger
- promptGuard
- request
- bedrockGuardrails
- *identifierstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- *regionstring
- *versionstring
- googleModelArmor
- locationstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- *projectIdstring
- *templateIdstring
- openAIModeration
- modelstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- regex
- actionstring
- builtinsstring[]
- matchesstring[]
- response
- messagestring
- statusCodeinteger
- webhook
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- failureModestring
- forwardHeaderMatches
- *namestring
- typestring
- *valuestring
- response
- bedrockGuardrails
- *identifierstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- *regionstring
- *versionstring
- googleModelArmor
- locationstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- *projectIdstring
- *templateIdstring
- regex
- actionstring
- builtinsstring[]
- matchesstring[]
- response
- messagestring
- statusCodeinteger
- webhook
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- failureModestring
- forwardHeaderMatches
- *namestring
- typestring
- *valuestring
- routesobject
- transformations
- *expressionstring
- *fieldstring
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- health
- eviction
- consecutiveFailuresinteger
- durationstring
- healthThresholdinteger
- restoreHealthinteger
- unhealthyConditionstring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- transformation
- request
- add
- *namestring
- *valuestring
- bodystring
- metadataobject
- removestring[]
- set
- *namestring
- *valuestring
- response
- add
- *namestring
- *valuestring
- bodystring
- metadataobject
- removestring[]
- set
- *namestring
- *valuestring
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- portinteger
- vertexai
- modelstring
- *projectIdstring
- regionstring
- provider
- anthropic
- modelstring
- azure
- apiVersionstring
- modelstring
- projectNamestring
- *resourceNamestring
- *resourceTypestring
- azureopenai
- apiVersionstring
- deploymentNamestring
- *endpointstring
- bedrock
- guardrail
- *identifierstring
- *versionstring
- modelstring
- regionstring
- custom
- backendRef
- groupstring
- kindstring
- *namestring
- portinteger
- *formats
- pathstring
- *typestring
- modelstring
- gemini
- modelstring
- hoststring
- openai
- modelstring
- pathstring
- pathPrefixstring
- portinteger
- vertexai
- modelstring
- *projectIdstring
- regionstring
- aws
- agentCore
- *agentRuntimeArnstring
- qualifierstring
- dynamicForwardProxyobject
- mcp
- failureModestring
- sessionRoutingstring
- *targets
- *namestring
- selector
- namespaces
- matchExpressions
- *keystring
- *operatorstring
- valuesstring[]
- matchLabelsobject
- services
- matchExpressions
- *keystring
- *operatorstring
- valuesstring[]
- matchLabelsobject
- static
- backendRef
- namestring
- hoststring
- pathstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- *portinteger
- protocolstring
- policies
- ai
- defaults
- *fieldstring
- *valueobject
- modelAliasesobject
- overrides
- *fieldstring
- *valueobject
- prompt
- append
- *contentstring
- *rolestring
- prepend
- *contentstring
- *rolestring
- promptCaching
- cacheMessageOffsetinteger
- cacheMessagesboolean
- cacheSystemboolean
- cacheToolsboolean
- minTokensinteger
- promptGuard
- request
- bedrockGuardrails
- *identifierstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- *regionstring
- *versionstring
- googleModelArmor
- locationstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- *projectIdstring
- *templateIdstring
- openAIModeration
- modelstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- regex
- actionstring
- builtinsstring[]
- matchesstring[]
- response
- messagestring
- statusCodeinteger
- webhook
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- failureModestring
- forwardHeaderMatches
- *namestring
- typestring
- *valuestring
- response
- bedrockGuardrails
- *identifierstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- *regionstring
- *versionstring
- googleModelArmor
- locationstring
- policies
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- http
- requestTimeoutstring
- versionstring
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- *projectIdstring
- *templateIdstring
- regex
- actionstring
- builtinsstring[]
- matchesstring[]
- response
- messagestring
- statusCodeinteger
- webhook
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- failureModestring
- forwardHeaderMatches
- *namestring
- typestring
- *valuestring
- routesobject
- transformations
- *expressionstring
- *fieldstring
- auth
- aws
- assumeRole
- *roleArnstring
- secretRef
- groupstring
- kindstring
- *namestring
- serviceNamestring
- azure
- managedIdentity
- *clientIdstring
- *objectIdstring
- *resourceIdstring
- secretRef
- groupstring
- kindstring
- *namestring
- gcp
- audiencestring
- secretRef
- groupstring
- kindstring
- *namestring
- typestring
- keystring
- location
- cookie
- *namestring
- header
- *namestring
- prefixstring
- queryParameter
- *namestring
- passthroughobject
- secretRef
- groupstring
- kindstring
- *namestring
- extAuth
- backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- cache
- *keystring[]
- maxEntriesinteger
- *ttlstring
- failureModestring
- forwardBody
- *maxSize
- grpc
- contextExtensionsobject
- requestMetadataobject
- http
- addRequestHeadersobject
- allowedRequestHeadersstring[]
- allowedResponseHeadersstring[]
- pathstring
- redirectstring
- responseMetadataobject
- health
- eviction
- consecutiveFailuresinteger
- durationstring
- healthThresholdinteger
- restoreHealthinteger
- unhealthyConditionstring
- http
- requestTimeoutstring
- versionstring
- mcp
- authentication
- audiencesstring[]
- clientIdstring
- issuerstring
- *jwks
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- cacheDurationstring
- *jwksPathstring
- modestring
- providerstring
- resourceMetadataobject
- authorization
- actionstring
- *policy
- *matchExpressionsstring[]
- tcp
- connectTimeoutstring
- keepalive
- intervalstring
- retriesinteger
- timestring
- tls
- alpnProtocolsstring[]
- caCertificateRefs
- namestring
- insecureSkipVerifystring
- keyExchangeGroupsstring[]
- mtlsCertificateRef
- groupstring
- kindstring
- *namestring
- snistring
- verifySubjectAltNamesstring[]
- transformation
- request
- add
- *namestring
- *valuestring
- bodystring
- metadataobject
- removestring[]
- set
- *namestring
- *valuestring
- response
- add
- *namestring
- *valuestring
- bodystring
- metadataobject
- removestring[]
- set
- *namestring
- *valuestring
- tunnel
- *backendRef
- groupstring
- kindstring
- *namestring
- namespacestring
- portinteger
- static
- hoststring
- portinteger
- unixPathstring
- status
- conditions
- *lastTransitionTimestring
- *messagestring
- observedGenerationinteger
- *reasonstring
- *statusstring
- *typestring
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Validation
Validation
Validation
Validation
Documentation References (23)
defines a set of LLM providers. The priority determines the priority of
the backend endpoints chosen.
Note: provider names must be unique across all providers in all priority
groups. Backend policies may target a specific provider by name using
targetRefs[].sectionName.groups:
- providers:
- azureopenai:
deploymentName: gpt-4o-mini
apiVersion: 2024-02-15-preview
endpoint: ai-gateway.openai.azure.com
- providers:
- azureopenai:
deploymentName: gpt-4o-mini-2
apiVersion: 2024-02-15-preview
endpoint: ai-gateway-2.openai.azure.com
policies:
auth:
secretRef:
name: azure-secretValidation
Documentation References (2)
with automatic weighting based on health.
Validation
Documentation References (2)
Documentation References (1)
gpt-4o-mini.If unset, the model name is taken from the request.
Validation
Documentation References (1)
Supports both Azure OpenAI and Azure AI Foundry resource types.
Validation
If unset, defaults to
v1.Validation
gpt-4o-mini.If unset, the model name is taken from the request.
Validation
resourceType is Foundry.Used to construct paths: /api/projects/{projectName}/openai/v1/...
Validation
For OpenAI: {resourceName}.openai.azure.com
For Foundry: {resourceName}.services.ai.azure.com
Note: when the Azure portal "Foundry legacy" template was used, the
generated resource name may end in "-resource" (e.g. "myproject-resource");
that suffix is part of the resource name as the user configured it, not
part of the hostname suffix agentgateway should append.
Validation
Validation
Validation
For more information, see the [Azure OpenAI API version reference](https://learn.microsoft.com/en-us/azure/foundry/openai/reference).
If unset, defaults to
v1.Validation
For more information, see the [Azure OpenAI model docs](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure?view=foundry-classic).
This is required if
apiVersion is not v1. For v1, the model can beset in the request.
Validation
my-endpoint.openai.azure.com.If the scheme is included, it is stripped.
Validation
<https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html>.
If not specified, the AWS Guardrail policy will not be used.
Validation
Validation
gpt-4o-mini.If unset, the model name is taken from the request.
Validation
Defaults to
us-east-1 if not specified.Validation
Use this when the provider target and API formats should be declared
explicitly instead of inferred from a managed provider such as OpenAI or
Anthropic.
Validation
backendRef may target only a namespace-local Service or InferencePool.If unset, host and port must be set on the parent provider.
Validation
gateway.networking.k8s.io.When unspecified or empty string, core API group is inferred.
Validation
Service.Defaults to "Service" when not specified.
Validation
Validation
Required when the referenced resource is a Kubernetes Service.
Validation
Validation
If unset, agentgateway uses the default path for the format.
Validation
Validation
gpt-oss.If unset, the model name is taken from the request.
Validation
gemini-2.5-pro.If unset, the model name is taken from the request.
Validation
For custom providers without backendRef, host and port specify the target.
For managed providers, host and port override the provider default.
Validation
Validation
Documentation References (2)
Documentation References (2)
gpt-4o-mini.If unset, the model name is taken from the request.
Validation
Documentation References (2)
This is useful when you need to route requests to a different API endpoint while maintaining
compatibility with the original provider's API structure.
If not specified, the default path for the provider is used.
Validation
/v1, for upstream requests.Path translation for cross-format requests still applies using this prefix.
Only supported for OpenAI and Anthropic providers.
Validation
Policies may also be set in
AgentgatewayPolicy, or in the top-levelAgentgatewayBackend. Policies are merged on a field-level basis, withorder:
AgentgatewayPolicy < AgentgatewayBackend < AgentgatewayBackendLLM provider (this field).
Validation
Documentation References (2)
connecting to a
Backend of type ai.Validation
Validation
Validation
Validation
Example:
{"fast": "gpt-3.5-turbo", "smart": "gpt-4-turbo"}.Note: This field is only applicable when using the agentgateway data plane.
Validation
Validation
Validation
Validation
LLM providers that use the
CHAT or CHAT_STREAMING API route type.LLM provider model, such as
SYSTEM or USER in the OpenAI API.LLM provider model, such as
SYSTEM or USER in the OpenAI API.providers, currently AWS Bedrock.
Reduces API costs by caching static content like system prompts and tool definitions.
Only applicable for Bedrock Claude 3+ and Nova models.
conversation. 0 (default) places it at the second-to-last message.
Higher values move it N additional messages towards the start, clamped
to bounds.
Validation
Caches all messages in the conversation for cost savings.
Validation
Inserts a cache point after all system messages.
Validation
Inserts a cache point after all tool specifications.
Validation
before caching is enabled. Uses rough heuristic (word count × 1.3) to estimate tokens.
Bedrock requires at least 1,024 tokens for caching to be effective.
Validation
Validation
Validation
guarding.
Validation
Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
us-west-2).Validation
Validation
us-central1.Defaults to
us-central1 if not specified.Validation
Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
Validation
Validation
endpoint.
See https://developers.openai.com/api/reference/resources/moderations for more information.
omni-moderation.Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
This setting applies only to request matches.
PromptguardResponsematches are always masked by default.
Defaults to
Mask.Validation
Matches and built-ins are additive.
Matches and built-ins are additive.
The request was rejected due to inappropriate content.Validation
The request was rejected due to inappropriate content.Validation
Validation
Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
or returns an error.
FailOpen allows the request to continue.FailClosed (default) rejects the request.Validation
Request headers are used when forwarding requests and response headers
are used when forwarding responses.
By default, no headers are forwarded.
case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
entry with an equivalent name MUST be considered for a match. Subsequent
entries with an equivalent header name MUST be ignored. Due to the
case-insensitivity of header names, "foo" and "Foo" are considered
equivalent.
implementation-specific behavior as to how this is represented.
Generally, proxies should follow the guidance from the RFC:
https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding
processing a repeated header, with special handling for "Set-Cookie".
Validation
conformance, implementations can support POSIX, PCRE or any other dialects
of regular expressions. Please read the implementation's documentation to
determine the supported dialect.
Validation
<gateway:experimental:description>
Must consist of printable US-ASCII characters, optionally separated
by single tabs or spaces. See: https://tools.ietf.org/html/rfc7230#section-3.2
</gateway:experimental:description>
^[!-~]+([\t ]?[!-~]+)*$>Validation
Validation
guarding.
Validation
Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
us-west-2).Validation
Validation
us-central1.Defaults to
us-central1 if not specified.Validation
Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
Validation
Validation
This setting applies only to request matches.
PromptguardResponsematches are always masked by default.
Defaults to
Mask.Validation
Matches and built-ins are additive.
Matches and built-ins are additive.
The response was rejected due to inappropriate content.Validation
The request was rejected due to inappropriate content.Validation
Validation
Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
or returns an error.
FailOpen allows the request to continue.FailClosed (default) rejects the request.Validation
Request headers are used when forwarding requests and response headers
are used when forwarding responses.
By default, no headers are forwarded.
case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
entry with an equivalent name MUST be considered for a match. Subsequent
entries with an equivalent header name MUST be ignored. Due to the
case-insensitivity of header names, "foo" and "Foo" are considered
equivalent.
implementation-specific behavior as to how this is represented.
Generally, proxies should follow the guidance from the RFC:
https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding
processing a repeated header, with special handling for "Set-Cookie".
Validation
conformance, implementations can support POSIX, PCRE or any other dialects
of regular expressions. Please read the implementation's documentation to
determine the supported dialect.
Validation
<gateway:experimental:description>
Must consist of printable US-ASCII characters, optionally separated
by single tabs or spaces. See: https://tools.ietf.org/html/rfc7230#section-3.2
</gateway:experimental:description>
^[!-~]+([\t ]?[!-~]+)*$>Validation
The keys are URL path suffixes matched using ends-with comparison, for
example
"/v1/chat/completions".The special
* wildcard matches any path.If not specified, all traffic defaults to
completions type.The expression result overwrites any existing value for that field.
This has a higher priority than
overrides if both are set for the samekey.
Validation
Validation
Validation
Validation
Documentation References (2)
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Documentation References (2)
Empty selects the core API group.
Empty defaults to
Secret.Validation
Documentation References (2)
For example, a value of 5 means the backend must receive 5 unhealthy responses in a row before being evicted.
When both consecutiveFailures and healthThreshold are set, the backend is evicted when either condition is met.
When neither is set, a single unhealthy response can trigger eviction.
Validation
Subsequent evictions use multiplicative backoff (duration * times_evicted).
If all endpoints are evicted, the load balancer falls back to returning evicted endpoints
rather than failing entirely.
If unset, defaults to
3s.Validation
When set, a backend is only evicted if its computed health drops below this value after an unhealthy response.
For example, 50 means the backend is evicted when its EWMA health falls below 50% following failures.
Unlike consecutiveFailures (which counts consecutive failures), this uses a sliding-window average
so a single success in a stream of failures can delay eviction.
When both consecutiveFailures and healthThreshold are set, the backend is evicted when either condition is met.
When neither is set, a single unhealthy response triggers eviction.
Validation
For gradual recovery, set below 100; for full recovery immediately, set 100.
If unset, the backend resumes with the health it had when evicted.
Validation
When the expression evaluates to true, the backend is considered unhealthy and may be evicted.
response.code >= 500.This default lowers the backend's health score but does not trigger eviction on its own.
Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
Validation
Validation
should be set to. If there is already a header with these values then
append the value as an extra entry.
Validation
Validation
the header.
Validation
Validation
metadata CEL variablefor subsequent policy evaluations.
metadata is evaluated before headeror body transformations.
Validation
response.
Validation
Validation
Validation
the header.
Validation
Validation
should be set to. If there is already a header with these values then
append the value as an extra entry.
Validation
Validation
the header.
Validation
Validation
metadata CEL variablefor subsequent policy evaluations.
metadata is evaluated before headeror body transformations.
Validation
response.
Validation
Validation
Validation
the header.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
Validation
gpt-4o-mini.If unset, the model name is taken from the request.
Validation
Validation
Defaults to
global if not specified.Validation
provider.
Validation
Documentation References (20)
Documentation References (1)
gpt-4o-mini.If unset, the model name is taken from the request.
Validation
Documentation References (1)
Supports both Azure OpenAI and Azure AI Foundry resource types.
Validation
Documentation References (1)
If unset, defaults to
v1.Validation
gpt-4o-mini.If unset, the model name is taken from the request.
Validation
Documentation References (1)
resourceType is Foundry.Used to construct paths: /api/projects/{projectName}/openai/v1/...
Validation
Documentation References (1)
For OpenAI: {resourceName}.openai.azure.com
For Foundry: {resourceName}.services.ai.azure.com
Note: when the Azure portal "Foundry legacy" template was used, the
generated resource name may end in "-resource" (e.g. "myproject-resource");
that suffix is part of the resource name as the user configured it, not
part of the hostname suffix agentgateway should append.
Validation
Documentation References (1)
Validation
Documentation References (1)
Validation
Documentation References (1)
For more information, see the [Azure OpenAI API version reference](https://learn.microsoft.com/en-us/azure/foundry/openai/reference).
If unset, defaults to
v1.Validation
Documentation References (1)
For more information, see the [Azure OpenAI model docs](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure?view=foundry-classic).
This is required if
apiVersion is not v1. For v1, the model can beset in the request.
Validation
Documentation References (1)
my-endpoint.openai.azure.com.If the scheme is included, it is stripped.
Validation
Documentation References (1)
<https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html>.
If not specified, the AWS Guardrail policy will not be used.
Validation
Validation
gpt-4o-mini.If unset, the model name is taken from the request.
Validation
Documentation References (1)
Defaults to
us-east-1 if not specified.Validation
Documentation References (1)
Use this when the provider target and API formats should be declared
explicitly instead of inferred from a managed provider such as OpenAI or
Anthropic.
Validation
Documentation References (2)
backendRef may target only a namespace-local Service or InferencePool.If unset, host and port must be set on the parent provider.
Validation
Documentation References (2)
gateway.networking.k8s.io.When unspecified or empty string, core API group is inferred.
Validation
Documentation References (2)
Service.Defaults to "Service" when not specified.
Validation
Documentation References (2)
Validation
Documentation References (2)
Required when the referenced resource is a Kubernetes Service.
Validation
Documentation References (1)
Validation
Documentation References (2)
If unset, agentgateway uses the default path for the format.
Validation
Documentation References (2)
Validation
Documentation References (2)
gpt-oss.If unset, the model name is taken from the request.
Validation
Documentation References (2)
Documentation References (2)
gemini-2.5-pro.If unset, the model name is taken from the request.
Validation
Documentation References (2)
For custom providers without backendRef, host and port specify the target.
For managed providers, host and port override the provider default.
Validation
gpt-4o-mini.If unset, the model name is taken from the request.
Validation
This is useful when you need to route requests to a different API endpoint while maintaining
compatibility with the original provider's API structure.
If not specified, the default path for the provider is used.
Validation
Documentation References (2)
/v1, for upstream requests.Path translation for cross-format requests still applies using this prefix.
Only supported for OpenAI and Anthropic providers.
Validation
Documentation References (1)
Validation
Documentation References (1)
gpt-4o-mini.If unset, the model name is taken from the request.
Validation
Documentation References (1)
Validation
Documentation References (1)
Defaults to
global if not specified.Validation
Documentation References (1)
Validation
request HTTP host header, or TLS SNI for TLS traffic.
access controls must be put in place when using this backend type.
Documentation References (1)
Documentation References (6)
become unavailable at runtime.
FailOpen skips failed targets andcontinues serving from healthy ones.
FailClosed (default) fails theentire session if any target fails.
Validation
Defaults to
Stateful if not set.Validation
Documentation References (1)
targeting MCP targets must use
targetRefs[].sectionName to selectthe target by name.
Validation
Documentation References (6)
Validation
Documentation References (6)
Service resources.If policies are needed on a per-service basis,
AgentgatewayPolicy cantarget the desired
Service.Validation
Documentation References (3)
namespace is the label selector for namespaces that Serviceresources should be selected from. If unset, only the namespace of the
AgentgatewayBackend is searched.Validation
Validation
Valid operators are In, NotIn, Exists and DoesNotExist.
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
Validation
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
services is the label selector for which Service resources should beselected.
Validation
Documentation References (3)
Validation
Valid operators are In, NotIn, Exists and DoesNotExist.
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
Validation
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
Documentation References (3)
in-cluster
Service resources, it is recommended to use selectorinstead.
Validation
Documentation References (5)
Service resource by name.When set, this replaces
host only; port, path, and protocolremain configured on this target.
Validation
Documentation References (2)
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Documentation References (2)
Validation
Documentation References (5)
Defaults to
"/sse" for the SSE protocol or "/mcp" for theStreamableHTTP protocol if not specified.Validation
Documentation References (1)
Policies may also be set in
AgentgatewayPolicy, or in the top-levelAgentgatewayBackend. Policies are merged on a field-level basis, withorder:
AgentgatewayPolicy < AgentgatewayBackend < AgentgatewayBackend MCP (this field).This field may only be used with host-based static targets, not
backendRef.Documentation References (1)
Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
Documentation References (1)
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
Documentation References (1)
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
Validation
Documentation References (5)
target.
Validation
Documentation References (4)
with AgentgatewayPolicy. Backend policies take precedence over policy
resources when they set the same field.
Validation
connecting to a
Backend of type ai.Validation
Documentation References (3)
Validation
Validation
Validation
Example:
{"fast": "gpt-3.5-turbo", "smart": "gpt-4-turbo"}.Note: This field is only applicable when using the agentgateway data plane.
Validation
Documentation References (1)
Validation
Validation
Validation
LLM providers that use the
CHAT or CHAT_STREAMING API route type.LLM provider model, such as
SYSTEM or USER in the OpenAI API.LLM provider model, such as
SYSTEM or USER in the OpenAI API.providers, currently AWS Bedrock.
Reduces API costs by caching static content like system prompts and tool definitions.
Only applicable for Bedrock Claude 3+ and Nova models.
conversation. 0 (default) places it at the second-to-last message.
Higher values move it N additional messages towards the start, clamped
to bounds.
Validation
Caches all messages in the conversation for cost savings.
Validation
Inserts a cache point after all system messages.
Validation
Inserts a cache point after all tool specifications.
Validation
before caching is enabled. Uses rough heuristic (word count × 1.3) to estimate tokens.
Bedrock requires at least 1,024 tokens for caching to be effective.
Validation
Validation
Validation
guarding.
Validation
Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
us-west-2).Validation
Validation
us-central1.Defaults to
us-central1 if not specified.Validation
Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
Validation
Validation
endpoint.
See https://developers.openai.com/api/reference/resources/moderations for more information.
omni-moderation.Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
This setting applies only to request matches.
PromptguardResponsematches are always masked by default.
Defaults to
Mask.Validation
Matches and built-ins are additive.
Matches and built-ins are additive.
The request was rejected due to inappropriate content.Validation
The request was rejected due to inappropriate content.Validation
Validation
Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
or returns an error.
FailOpen allows the request to continue.FailClosed (default) rejects the request.Validation
Request headers are used when forwarding requests and response headers
are used when forwarding responses.
By default, no headers are forwarded.
case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
entry with an equivalent name MUST be considered for a match. Subsequent
entries with an equivalent header name MUST be ignored. Due to the
case-insensitivity of header names, "foo" and "Foo" are considered
equivalent.
implementation-specific behavior as to how this is represented.
Generally, proxies should follow the guidance from the RFC:
https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding
processing a repeated header, with special handling for "Set-Cookie".
Validation
conformance, implementations can support POSIX, PCRE or any other dialects
of regular expressions. Please read the implementation's documentation to
determine the supported dialect.
Validation
<gateway:experimental:description>
Must consist of printable US-ASCII characters, optionally separated
by single tabs or spaces. See: https://tools.ietf.org/html/rfc7230#section-3.2
</gateway:experimental:description>
^[!-~]+([\t ]?[!-~]+)*$>Validation
Validation
guarding.
Validation
Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
us-west-2).Validation
Validation
us-central1.Defaults to
us-central1 if not specified.Validation
Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
Validation
Validation
This setting applies only to request matches.
PromptguardResponsematches are always masked by default.
Defaults to
Mask.Validation
Matches and built-ins are additive.
Matches and built-ins are additive.
The response was rejected due to inappropriate content.Validation
The request was rejected due to inappropriate content.Validation
Validation
Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
or returns an error.
FailOpen allows the request to continue.FailClosed (default) rejects the request.Validation
Request headers are used when forwarding requests and response headers
are used when forwarding responses.
By default, no headers are forwarded.
case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
entry with an equivalent name MUST be considered for a match. Subsequent
entries with an equivalent header name MUST be ignored. Due to the
case-insensitivity of header names, "foo" and "Foo" are considered
equivalent.
implementation-specific behavior as to how this is represented.
Generally, proxies should follow the guidance from the RFC:
https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding
processing a repeated header, with special handling for "Set-Cookie".
Validation
conformance, implementations can support POSIX, PCRE or any other dialects
of regular expressions. Please read the implementation's documentation to
determine the supported dialect.
Validation
<gateway:experimental:description>
Must consist of printable US-ASCII characters, optionally separated
by single tabs or spaces. See: https://tools.ietf.org/html/rfc7230#section-3.2
</gateway:experimental:description>
^[!-~]+([\t ]?[!-~]+)*$>Validation
The keys are URL path suffixes matched using ends-with comparison, for
example
"/v1/chat/completions".The special
* wildcard matches any path.If not specified, all traffic defaults to
completions type.Documentation References (2)
The expression result overwrites any existing value for that field.
This has a higher priority than
overrides if both are set for the samekey.
Validation
Validation
Validation
Validation
When omitted, default AWS SDK credential discovery is used.
Validation
Documentation References (2)
Ambient AWS credentials are used as the source credentials for STS.
Validation
Secret, containing the AWS credentials. When using the default Secretresolver, the
Secret must have keys accessKey, secretKey, andoptionally
sessionToken.Validation
Documentation References (2)
Empty selects the core API group.
Empty defaults to
Secret.Validation
Documentation References (2)
bedrock, bedrock-agentcore, or execute-api). If unset, typed AWSbackends may provide this automatically.
Validation
Documentation References (1)
Secret, containing the Azure credentials. When using the default Secretresolver, the
Secret must have keys clientID, tenantID, andclientSecret.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
When omitted, default Google credential discovery is used.
Validation
aud value for the ID token. Onlyvalid with
IdToken type. If not set, the aud is automaticallyderived from the backend hostname.
Validation
Secret, containing ADC-compatible Google credential JSON. When usingthe default Secret resolver, this must be stored in the
credentials.jsonkey. When omitted, ambient credentials are used.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
generally an
AccessToken is used. To authenticate to Cloud Run, anIdToken is used.Validation
Authorization header. This option is the least secure; usage of aSecret is preferred.Validation
Documentation References (1)
If omitted, credentials are written to the
Authorization header with the Bearer prefix.This applies to
key, secretRef, and passthrough.Validation
Validation
* "Set-Cookie"
headers are not currently supported by this type.
- "/invalid" - "/ " is an invalid character
Validation
Validation
Validation
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect.
Documentation References (1)
Secret, storing the key to use as the authorization value. When usingthe default Secret resolver, this must be stored in the
Authorizationkey.
Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
sent to this backend.
Validation
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
capturing every request property that the authorization service uses to
make a decision. For example, if the service returns different results
based on both path and authorization header, both must be included in
key; otherwise, one request may incorrectly reuse another request'sauthorization result.
the request is still sent to the authorization service, but its result is
not read from or written to the cache.
to construct the cache key.
Validation
the cache. If unset, this defaults to 10000.
Validation
5m, or a CEL expression thatreturns the duration that cached authorization results may be reused, or a
timestamp when the cached authorization result expires. The expression is
evaluated after the authorization response has been applied to the request.
Validation
unavailable or returns an error. "FailOpen" allows the request to continue.
"FailClosed" (default) denies the request.
Validation
If enabled, the request body will be buffered.
and sent to the authorization server. If the body size is larger than
maxSize, then the request will be rejected with a response.Validation
[protocol](https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto) should be used.
send to the authorization server in the
context_extensions field.Validation
server. This maps to the
metadata_context.filter_metadata field of therequest, and allows dynamic CEL expressions. If unset, by default the
envoy.filters.http.jwt_authn key is set if the JWT policy is used aswell, for compatibility.
Validation
the authorization server. The authorization server must return a
200status code, otherwise the request is considered an authorization
failure.
request to the authorization server. While
allowedRequestHeaders justpasses the original headers through,
addRequestHeaders allows definingcustom headers based on CEL expressions.
Validation
will be sent to the authorization server.
Authorization.Validation
will be copied into the request to the backend.
Validation
unset, this defaults to the original request path.
This is a CEL expression, which allows customizing the path based on the
incoming request. For example, to add a prefix, use
"/prefix/" + request.path.Validation
redirect to on authorization failure. This is useful to redirect to a
sign-in page.
Validation
from the authorization response. These will be included under the
extauthz variable in future CEL expressions. Setting this is usefulfor things like logging usernames, without needing to include them as
headers to the backend, as
allowedResponseHeaders would.Validation
For example, a value of 5 means the backend must receive 5 unhealthy responses in a row before being evicted.
When both consecutiveFailures and healthThreshold are set, the backend is evicted when either condition is met.
When neither is set, a single unhealthy response can trigger eviction.
Validation
Subsequent evictions use multiplicative backoff (duration * times_evicted).
If all endpoints are evicted, the load balancer falls back to returning evicted endpoints
rather than failing entirely.
If unset, defaults to
3s.Validation
When set, a backend is only evicted if its computed health drops below this value after an unhealthy response.
For example, 50 means the backend is evicted when its EWMA health falls below 50% following failures.
Unlike consecutiveFailures (which counts consecutive failures), this uses a sliding-window average
so a single success in a stream of failures can delay eviction.
When both consecutiveFailures and healthThreshold are set, the backend is evicted when either condition is met.
When neither is set, a single unhealthy response triggers eviction.
Validation
For gradual recovery, set below 100; for full recovery immediately, set 100.
If unset, the backend resumes with the health it had when evicted.
Validation
When the expression evaluates to true, the backend is considered unhealthy and may be evicted.
response.code >= 500.This default lowers the backend's health score but does not trigger eviction on its own.
Validation
Validation
the backend.
If not specified, the version is automatically determined:
*
Service types can specify it with appProtocol on the Serviceport.
* If traffic is identified as gRPC,
HTTP2 is used.* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS,
HTTP1 will be used. This isbecause most clients will transparently upgrade HTTPS traffic to
HTTP2, even if the backend doesn't support it.Validation
connecting to a
Backend of type mcp.Validation
jwtAuthentication.mcp, which ensures authentication runs beforeother policies such as transformation and rate limiting.
access. This corresponds to the
aud claim([RFC 7519 §4.1.3](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3)).
If unset, any audience is allowed.
Validation
If set, the gateway will not proxy registration requests to the IDP and instead return this client ID.
iss claim ([RFC 7519 §4.1.1](https://tools.ietf.org/html/rfc7519#section-4.1.1)).Validation
the JWT.
Supported types are
Service and static Backend. AnAgentgatewayPolicy containing backend TLS config can then be attachedto the
Service or Backend in order to set TLS options for aconnection to the remote
jwks source.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
Validation
jwks endpoint, relative to the root, commonly".well-known/jwks.json".Validation
Validation
Validation
unauthorized requests with a
403 error, this policy works at theMCPBackend level.list_tools, will have each item evaluated.Items that do not meet the rule will be filtered.
call_tool, will evaluate the specificitem and reject requests that do not meet the rule.
If unspecified, defaults to
Allow.Require rules are cumulative: all require rules must match.Validation
Allow: any matching allow rule allows the request.*
Require: every require rule must match for the request to be allowed.*
Deny: any matching deny rule denies the request.Requirefor deny-by-default behavior.
Allow rule is configured, requests are denied unless atleast one allow rule matches.
Validation
the destination.
Validation
connection.
If unset, this defaults to 180s.
Validation
If unset, this defaults to 9.
Validation
If unset, this defaults to 180s.
Validation
validate the server, and the SNI will automatically be set based on the destination.
Validation
Documentation References (1)
ALPN)value to use in the TLS handshake.
["h2", "http/1.1"].Validation
ConfigMap to use toverify the server certificate.
If unset, the system's trusted certificates are used.
Validation
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
WARNING: This is an insecure option that should only be used if the risks are understood.
*
All disables all TLS verification.*
Hostname verifies the CA certificate is trusted, but ignores anymismatch of hostname or SANs. Note that this method is still insecure;
prefer setting
verifySubjectAltNames to customize the valid hostnamesif possible.
Validation
For example:
X25519_MLKEM768,X25519.specified key (
tls.key) and cert (tls.crt) from the referencedcredential source, defaulting to a Kubernetes
Secret.ca.cert field, if present, will be used to verify theserver certificate. If
caCertificateRefs is also specified, thecaCertificateRefs field takes priority.Validation
Empty selects the core API group.
Empty defaults to
Secret.Validation
SNI) to use in the TLShandshake. If unset, the
SNI is automatically set based on thedestination hostname.
Validation
Documentation References (1)
SAN)to verify in the server certificate.
If not present, the destination hostname is automatically used.
Validation
Validation
Validation
should be set to. If there is already a header with these values then
append the value as an extra entry.
Validation
Validation
the header.
Validation
Validation
metadata CEL variablefor subsequent policy evaluations.
metadata is evaluated before headeror body transformations.
Validation
response.
Validation
Validation
Validation
the header.
Validation
Validation
should be set to. If there is already a header with these values then
append the value as an extra entry.
Validation
Validation
the header.
Validation
Validation
metadata CEL variablefor subsequent policy evaluations.
metadata is evaluated before headeror body transformations.
Validation
response.
Validation
Validation
Validation
the header.
Validation
HTTPS_PROXY, to the backend.Supported types:
Service and Backend.Validation
When unspecified or empty string, core API group is inferred.
Validation
"Service".
outside of the cluster and as such are difficult to reason about in
terms of conformance. They also may not be safe to forward to (see
CVE-2021-25740 for more information). Implementations SHOULD NOT
support ExternalName Services.
Validation
Validation
namespace is inferred.
a ReferenceGrant object is required in the referent namespace to allow that
namespace's owner to accept the reference. See the ReferenceGrant
documentation for details.
Validation
Port is required when the referent is a Kubernetes Service. In this
case, the port number is the service port number, not the target port.
For other resources, destination port might be derived from the referent
resource or this field.
Validation
Validation
Documentation References (3)
Validation
Documentation References (3)
Validation
Documentation References (3)
must share a volume with the target (e.g., via emptyDir sidecar pattern).
Mutually exclusive with host/port.
Validation
Validation
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
Validation
This may be an empty string.
Validation
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
Validation
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.