diff --git a/assets/agw-docs/pages/reference/api/api-main.md b/assets/agw-docs/pages/reference/api/api-main.md
index 8167bede7..ad6f1d74c 100644
--- a/assets/agw-docs/pages/reference/api/api-main.md
+++ b/assets/agw-docs/pages/reference/api/api-main.md
@@ -129,7 +129,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `mode` _[APIKeyAuthenticationMode](#apikeyauthenticationmode)_ | `mode` is the validation mode for API key authentication. | Strict | Enum: [Strict Optional]
Optional: \{\}
|
-| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core)_ | `secretRef` references a Kubernetes `Secret` storing a set of API keys.
If there are many keys, `secretSelector` can be used instead.
Each entry in the `Secret` represents one API key. The key is an
arbitrary identifier. The value can either be:
* A string representing the API key.
* A JSON object with two fields, `key` and `metadata`. `key` contains
the API key. `metadata` contains arbitrary JSON metadata associated
with the key, which may be used by other policies. For example, you
may write an authorization policy allowing `apiKey.group == 'sales'`.
Example:
apiVersion: v1
kind: Secret
metadata:
name: api-key
stringData:
client1: \|
\{
"key": "k-123",
"metadata": \{
"group": "sales",
"created_at": "2024-10-01T12:00:00Z"
\}
\}
client2: "k-456" | | Optional: \{\}
|
+| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core)_ | `secretRef` references a Kubernetes `Secret` storing a set of API keys.
If there are many keys, `secretSelector` can be used instead.
Each entry in the `Secret` represents one API key. The key is an
arbitrary identifier. The value can either be:
* A string representing the API key.
* A JSON object with two fields, `key` and `metadata`. `key` contains
the API key. `metadata` contains arbitrary JSON metadata associated
with the key, which may be used by other policies. For example, you
may write an authorization policy allowing `apiKey.group == 'sales'`.
Example:
apiVersion: v1
kind: Secret
metadata:
name: api-key
stringData:
client1: \|
\{
"key": "k-123",
"metadata": \{
"group": "sales",
"created_at": "2024-10-01T12:00:00Z"
\}
\}
client2: "k-456" | | Optional: \{\}
|
| `secretSelector` _[SecretSelector](#secretselector)_ | `secretSelector` selects multiple `Secret` resources containing API
keys. If the same key is defined in multiple secrets, the behavior is
undefined.
Each entry in the `Secret` represents one API key. The key is an
arbitrary identifier. The value can either be:
* A string representing the API key.
* A JSON object with two fields, `key` and `metadata`. `key` contains
the API key. `metadata` contains arbitrary JSON metadata associated
with the key, which may be used by other policies. For example, you
may write an authorization policy allowing `apiKey.group == 'sales'`.
Example:
apiVersion: v1
kind: Secret
metadata:
name: api-key
stringData:
client1: \|
\{
"key": "k-123",
"metadata": \{
"group": "sales",
"created_at": "2024-10-01T12:00:00Z"
\}
\}
client2: "k-456" | | Optional: \{\}
|
@@ -260,7 +260,7 @@ _Appears in:_
| `kind` _string_ | `AgentgatewayBackend` | | |
| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | Optional: \{\}
|
| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | Optional: \{\}
|
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
|
+| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
|
| `spec` _[AgentgatewayBackendSpec](#agentgatewaybackendspec)_ | spec defines the desired state of AgentgatewayBackend. | | ExactlyOneOf: [ai static dynamicForwardProxy mcp aws]
Required: \{\}
|
| `status` _[AgentgatewayBackendStatus](#agentgatewaybackendstatus)_ | status defines the current state of AgentgatewayBackend. | | Optional: \{\}
|
@@ -300,7 +300,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
-| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#condition-v1-meta) array_ | Conditions is the list of conditions for the backend. | | MaxItems: 8
Optional: \{\}
|
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#condition-v1-meta) array_ | Conditions is the list of conditions for the backend. | | MaxItems: 8
Optional: \{\}
|
#### AgentgatewayParameters
@@ -322,7 +322,7 @@ https://gateway-api.sigs.k8s.io/reference/spec/#gatewayinfrastructure
| `kind` _string_ | `AgentgatewayParameters` | | |
| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | Optional: \{\}
|
| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | Optional: \{\}
|
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
|
+| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
|
| `spec` _[AgentgatewayParametersSpec](#agentgatewayparametersspec)_ | spec defines the desired state of AgentgatewayParameters. | | Required: \{\}
|
| `status` _[AgentgatewayParametersStatus](#agentgatewayparametersstatus)_ | status defines the current state of AgentgatewayParameters. | | Optional: \{\}
|
@@ -341,10 +341,10 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `logging` _[AgentgatewayParametersLogging](#agentgatewayparameterslogging)_ | `logging` configuration for Agentgateway. By default, all logs are set to
`info` level. | | Optional: \{\}
|
-| `rawConfig` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#json-v1-apiextensions-k8s-io)_ | `rawConfig` provides an opaque mechanism to configure the `agentgateway`
config file. The `agentgateway` binary has a `-f` option to specify a
config file, and this field supplies that file. This will be merged with
configuration derived from typed fields like `logging.format`, and those
typed fields will take precedence.
Example:
rawConfig:
binds:
- port: 3000
listeners:
- routes:
- policies:
cors:
allowOrigins:
- "*"
allowHeaders:
- mcp-protocol-version
- content-type
- cache-control
backends:
- mcp:
targets:
- name: everything
stdio:
cmd: npx
args: ["@modelcontextprotocol/server-everything"] | | Type: object
Optional: \{\}
|
+| `rawConfig` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#json-v1-apiextensions-k8s-io)_ | `rawConfig` provides an opaque mechanism to configure the `agentgateway`
config file. The `agentgateway` binary has a `-f` option to specify a
config file, and this field supplies that file. This will be merged with
configuration derived from typed fields like `logging.format`, and those
typed fields will take precedence.
Example:
rawConfig:
binds:
- port: 3000
listeners:
- routes:
- policies:
cors:
allowOrigins:
- "*"
allowHeaders:
- mcp-protocol-version
- content-type
- cache-control
backends:
- mcp:
targets:
- name: everything
stdio:
cmd: npx
args: ["@modelcontextprotocol/server-everything"] | | Type: object
Optional: \{\}
|
| `image` _[Image](#image)_ | The agentgateway container image. See
https://kubernetes.io/docs/concepts/containers/images
for details.
Default values, which may be overridden individually:
registry: cr.agentgateway.dev
repository: agentgateway
tag:
pullPolicy: | | Optional: \{\}
|
-| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#envvar-v1-core) array_ | The container environment variables. These override any existing
values. If you want to delete an environment variable entirely, use
`$patch: delete` with `AgentgatewayParametersOverlays` instead. Note that
[variable
expansion](https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/)
does apply, but is highly discouraged -- to set dependent environment
variables, you can use `$(VAR_NAME)`, but it's highly discouraged.
`$$(VAR_NAME)` avoids expansion and results in a literal
`$(VAR_NAME)`.
If `SESSION_KEY` is specified, it takes precedence over the
controller-managed per-`Gateway` session key `Secret`. | | Optional: \{\}
|
-| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#resourcerequirements-v1-core)_ | The compute resources required by this container. See
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
for details. | | Optional: \{\}
|
+| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envvar-v1-core) array_ | The container environment variables. These override any existing
values. If you want to delete an environment variable entirely, use
`$patch: delete` with `AgentgatewayParametersOverlays` instead. Note that
[variable
expansion](https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/)
does apply, but is highly discouraged -- to set dependent environment
variables, you can use `$(VAR_NAME)`, but it's highly discouraged.
`$$(VAR_NAME)` avoids expansion and results in a literal
`$(VAR_NAME)`.
If `SESSION_KEY` is specified, it takes precedence over the
controller-managed per-`Gateway` session key `Secret`. | | Optional: \{\}
|
+| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#resourcerequirements-v1-core)_ | The compute resources required by this container. See
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
for details. | | Optional: \{\}
|
| `shutdown` _[ShutdownSpec](#shutdownspec)_ | Shutdown delay configuration. How graceful planned or unplanned data
plane changes happen is in tension with how quickly rollouts of the data
plane complete. How long a data plane pod must wait for shutdown to be
perfectly graceful depends on how you have configured your `Gateway`
resources. | | Optional: \{\}
|
| `istio` _[IstioSpec](#istiospec)_ | Configure Istio integration. If enabled, Agentgateway can natively connect to Istio enabled pods with mTLS. | | Optional: \{\}
|
@@ -419,10 +419,10 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `logging` _[AgentgatewayParametersLogging](#agentgatewayparameterslogging)_ | `logging` configuration for Agentgateway. By default, all logs are set to
`info` level. | | Optional: \{\}
|
-| `rawConfig` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#json-v1-apiextensions-k8s-io)_ | `rawConfig` provides an opaque mechanism to configure the `agentgateway`
config file. The `agentgateway` binary has a `-f` option to specify a
config file, and this field supplies that file. This will be merged with
configuration derived from typed fields like `logging.format`, and those
typed fields will take precedence.
Example:
rawConfig:
binds:
- port: 3000
listeners:
- routes:
- policies:
cors:
allowOrigins:
- "*"
allowHeaders:
- mcp-protocol-version
- content-type
- cache-control
backends:
- mcp:
targets:
- name: everything
stdio:
cmd: npx
args: ["@modelcontextprotocol/server-everything"] | | Type: object
Optional: \{\}
|
+| `rawConfig` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#json-v1-apiextensions-k8s-io)_ | `rawConfig` provides an opaque mechanism to configure the `agentgateway`
config file. The `agentgateway` binary has a `-f` option to specify a
config file, and this field supplies that file. This will be merged with
configuration derived from typed fields like `logging.format`, and those
typed fields will take precedence.
Example:
rawConfig:
binds:
- port: 3000
listeners:
- routes:
- policies:
cors:
allowOrigins:
- "*"
allowHeaders:
- mcp-protocol-version
- content-type
- cache-control
backends:
- mcp:
targets:
- name: everything
stdio:
cmd: npx
args: ["@modelcontextprotocol/server-everything"] | | Type: object
Optional: \{\}
|
| `image` _[Image](#image)_ | The agentgateway container image. See
https://kubernetes.io/docs/concepts/containers/images
for details.
Default values, which may be overridden individually:
registry: cr.agentgateway.dev
repository: agentgateway
tag:
pullPolicy: | | Optional: \{\}
|
-| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#envvar-v1-core) array_ | The container environment variables. These override any existing
values. If you want to delete an environment variable entirely, use
`$patch: delete` with `AgentgatewayParametersOverlays` instead. Note that
[variable
expansion](https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/)
does apply, but is highly discouraged -- to set dependent environment
variables, you can use `$(VAR_NAME)`, but it's highly discouraged.
`$$(VAR_NAME)` avoids expansion and results in a literal
`$(VAR_NAME)`.
If `SESSION_KEY` is specified, it takes precedence over the
controller-managed per-`Gateway` session key `Secret`. | | Optional: \{\}
|
-| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#resourcerequirements-v1-core)_ | The compute resources required by this container. See
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
for details. | | Optional: \{\}
|
+| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envvar-v1-core) array_ | The container environment variables. These override any existing
values. If you want to delete an environment variable entirely, use
`$patch: delete` with `AgentgatewayParametersOverlays` instead. Note that
[variable
expansion](https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/)
does apply, but is highly discouraged -- to set dependent environment
variables, you can use `$(VAR_NAME)`, but it's highly discouraged.
`$$(VAR_NAME)` avoids expansion and results in a literal
`$(VAR_NAME)`.
If `SESSION_KEY` is specified, it takes precedence over the
controller-managed per-`Gateway` session key `Secret`. | | Optional: \{\}
|
+| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#resourcerequirements-v1-core)_ | The compute resources required by this container. See
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
for details. | | Optional: \{\}
|
| `shutdown` _[ShutdownSpec](#shutdownspec)_ | Shutdown delay configuration. How graceful planned or unplanned data
plane changes happen is in tension with how quickly rollouts of the data
plane complete. How long a data plane pod must wait for shutdown to be
perfectly graceful depends on how you have configured your `Gateway`
resources. | | Optional: \{\}
|
| `istio` _[IstioSpec](#istiospec)_ | Configure Istio integration. If enabled, Agentgateway can natively connect to Istio enabled pods with mTLS. | | Optional: \{\}
|
| `deployment` _[KubernetesResourceOverlay](#kubernetesresourceoverlay)_ | `deployment` allows specifying overrides for the generated
`Deployment` resource. | | Optional: \{\}
|
@@ -461,7 +461,7 @@ _Appears in:_
| `kind` _string_ | `AgentgatewayPolicy` | | |
| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | Optional: \{\}
|
| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | Optional: \{\}
|
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
|
+| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
|
| `spec` _[AgentgatewayPolicySpec](#agentgatewaypolicyspec)_ | spec defines the desired state of AgentgatewayPolicy. | | ExactlyOneOf: [targetRefs targetSelectors]
Required: \{\}
|
| `status` _[PolicyStatus](#policystatus)_ | status defines the current state of AgentgatewayPolicy. | | Optional: \{\}
|
@@ -551,7 +551,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
-| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core)_ | `secretRef` references a Kubernetes `Secret` containing the AWS
credentials. The `Secret` must have keys `accessKey`, `secretKey`, and
optionally `sessionToken`. | | Required: \{\}
|
+| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core)_ | `secretRef` references a Kubernetes `Secret` containing the AWS
credentials. The `Secret` must have keys `accessKey`, `secretKey`, and
optionally `sessionToken`. | | Required: \{\}
|
#### AwsBackend
@@ -584,7 +584,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
-| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core)_ | `secretRef` references a Kubernetes `Secret` containing the Azure
credentials. The `Secret` must have keys `clientId`, `tenantId`, and
`clientSecret`. | | Optional: \{\}
|
+| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core)_ | `secretRef` references a Kubernetes `Secret` containing the Azure
credentials. The `Secret` must have keys `clientId`, `tenantId`, and
`clientSecret`. | | Optional: \{\}
|
| `managedIdentity` _[AzureManagedIdentity](#azuremanagedidentity)_ | Details for managed identity authentication | | Optional: \{\}
|
@@ -666,7 +666,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `key` _string_ | `key` provides an inline key to use as the value of the
`Authorization` header. This option is the least secure; usage of a
`Secret` is preferred. | | MaxLength: 2048
Optional: \{\}
|
-| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core)_ | `secretRef` references a Kubernetes `Secret` storing the key to use as
the authorization value. This must be stored in the `Authorization` key. | | Optional: \{\}
|
+| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core)_ | `secretRef` references a Kubernetes `Secret` storing the key to use as
the authorization value. This must be stored in the `Authorization` key. | | Optional: \{\}
|
| `passthrough` _[BackendAuthPassthrough](#backendauthpassthrough)_ | `passthrough` passes through an existing token that has been sent by the
client and validated. Other policies, like JWT and API key
authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect. | | Optional: \{\}
|
| `aws` _[AwsAuth](#awsauth)_ | Auth specifies an explicit AWS authentication method for the backend.
When omitted, we will try to use the default AWS SDK authentication methods. | | Optional: \{\}
|
| `azure` _[AzureAuth](#azureauth)_ | Azure specifies an Azure authentication method for the backend. | | Optional: \{\}
|
@@ -699,7 +699,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
-| `duration` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | Duration specifies the base time a backend should be evicted after being marked unhealthy.
Subsequent evictions use multiplicative backoff (duration * times_evicted).
If all endpoints are evicted, the load balancer falls back to returning evicted endpoints
rather than failing entirely.
If unset, defaults to `3s`. | 3s | Optional: \{\}
|
+| `duration` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | Duration specifies the base time a backend should be evicted after being marked unhealthy.
Subsequent evictions use multiplicative backoff (duration * times_evicted).
If all endpoints are evicted, the load balancer falls back to returning evicted endpoints
rather than failing entirely.
If unset, defaults to `3s`. | 3s | Optional: \{\}
|
| `restoreHealth` _integer_ | RestoreHealth is the health score (0–100) assigned to a backend when it returns from eviction.
For gradual recovery, set below 100; for full recovery immediately, set 100.
If unset, the backend resumes with the health it had when evicted. | | Maximum: 100
Minimum: 0
Optional: \{\}
|
| `consecutiveFailures` _integer_ | ConsecutiveFailures is the number of consecutive unhealthy responses required before the backend is evicted.
For example, a value of 5 means the backend must receive 5 unhealthy responses in a row before being evicted.
When both consecutiveFailures and healthThreshold are set, the backend is evicted when either condition is met.
When neither is set, a single unhealthy response can trigger eviction. | | Minimum: 0
Optional: \{\}
|
| `healthThreshold` _integer_ | HealthThreshold is the EWMA (exponentially-weighted moving average) health score threshold, expressed as 0–100.
When set, a backend is only evicted if its computed health drops below this value after an unhealthy response.
For example, 50 means the backend is evicted when its EWMA health falls below 50% following failures.
Unlike consecutiveFailures (which counts consecutive failures), this uses a sliding-window average
so a single success in a stream of failures can delay eviction.
When both consecutiveFailures and healthThreshold are set, the backend is evicted when either condition is met.
When neither is set, a single unhealthy response triggers eviction. | | Maximum: 100
Minimum: 0
Optional: \{\}
|
@@ -746,7 +746,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `version` _[HTTPVersion](#httpversion)_ | `version` specifies the HTTP protocol version to use when connecting to
the backend.
If not specified, the version is automatically determined:
* `Service` types can specify it with `appProtocol` on the `Service`
port.
* If traffic is identified as gRPC, `HTTP2` is used.
* If the incoming traffic was plaintext HTTP, the original protocol will
be used.
* If the incoming traffic was HTTPS, `HTTP1` will be used. This is
because most clients will transparently upgrade HTTPS traffic to
`HTTP2`, even if the backend doesn't support it. | | Enum: [HTTP1 HTTP2]
Optional: \{\}
|
-| `requestTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | requestTimeout specifies the deadline for receiving a response from the backend. | | Optional: \{\}
|
+| `requestTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | requestTimeout specifies the deadline for receiving a response from the backend. | | Optional: \{\}
|
#### BackendMCP
@@ -809,7 +809,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `keepalive` _[Keepalive](#keepalive)_ | `keepAlive` defines settings for enabling TCP keepalives on the
connection. | | Optional: \{\}
|
-| `connectTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | `connectTimeout` defines the deadline for establishing a connection to
the destination. | | Optional: \{\}
|
+| `connectTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | `connectTimeout` defines the deadline for establishing a connection to
the destination. | | Optional: \{\}
|
#### BackendTLS
@@ -828,8 +828,8 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
-| `mtlsCertificateRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core) array_ | `mtlsCertificateRef` enables mutual TLS to the backend, using the
specified key (`tls.key`) and cert (`tls.crt`) from the referenced
`Secret`.
An optional `ca.cert` field, if present, will be used to verify the
server certificate. If `caCertificateRefs` is also specified, the
`caCertificateRefs` field takes priority.
If unspecified, no client certificate will be used. | | MaxItems: 1
Optional: \{\}
|
-| `caCertificateRefs` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core) array_ | `caCertificateRefs` defines the CA certificate `ConfigMap` to use to
verify the server certificate.
If unset, the system's trusted certificates are used. | | MaxItems: 1
Optional: \{\}
|
+| `mtlsCertificateRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core) array_ | `mtlsCertificateRef` enables mutual TLS to the backend, using the
specified key (`tls.key`) and cert (`tls.crt`) from the referenced
`Secret`.
An optional `ca.cert` field, if present, will be used to verify the
server certificate. If `caCertificateRefs` is also specified, the
`caCertificateRefs` field takes priority.
If unspecified, no client certificate will be used. | | MaxItems: 1
Optional: \{\}
|
+| `caCertificateRefs` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core) array_ | `caCertificateRefs` defines the CA certificate `ConfigMap` to use to
verify the server certificate.
If unset, the system's trusted certificates are used. | | MaxItems: 1
Optional: \{\}
|
| `insecureSkipVerify` _[InsecureTLSMode](#insecuretlsmode)_ | insecureSkipVerify originates TLS but skips verification of the backend's certificate.
WARNING: This is an insecure option that should only be used if the risks are understood.
There are two modes:
* `All` disables all TLS verification.
* `Hostname` verifies the CA certificate is trusted, but ignores any
mismatch of hostname or SANs. Note that this method is still insecure;
prefer setting `verifySubjectAltNames` to customize the valid hostnames
if possible. | | Enum: [All Hostname]
Optional: \{\}
|
| `sni` _[SNI](#sni)_ | `sni` specifies the Server Name Indicator (`SNI`) to be used in the TLS
handshake. If unset, the `SNI` is automatically set based on the
destination hostname. | | MaxLength: 253
MinLength: 1
Pattern: `^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
Optional: \{\}
|
| `verifySubjectAltNames` _[ShortString](#shortstring) array_ | `verifySubjectAltNames` specifies the Subject Alternative Names (`SAN`)
to verify in the server certificate.
If not present, the destination hostname is automatically used. | | MaxItems: 16
MaxLength: 256
MinItems: 1
MinLength: 1
Optional: \{\}
|
@@ -894,7 +894,7 @@ _Appears in:_
| `mode` _[BasicAuthenticationMode](#basicauthenticationmode)_ | `mode` is the validation mode for basic auth authentication. | Strict | Enum: [Strict Optional]
Optional: \{\}
|
| `realm` _string_ | `realm` specifies the `realm` to return in the `WWW-Authenticate`
header for failed authentication requests. If unset, `Restricted` will
be used. | | Optional: \{\}
|
| `users` _string array_ | `users` provides an inline list of username and password pairs that will
be accepted. Each entry represents one line of the `htpasswd` format:
https://httpd.apache.org/docs/2.4/programs/htpasswd.html.
Note: passwords should be the hash of the password, not the raw password. Use the `htpasswd` or similar commands
to generate a hash. MD5, bcrypt, crypt, and SHA-1 are supported.
Example:
users:
- "user1:$apr1$ivPt0D4C$DmRhnewfHRSrb3DQC.WHC."
- "user2:$2y$05$r3J4d3VepzFkedkd/q1vI.pBYIpSqjfN0qOARV3ScUHysatnS0cL2" | | MaxItems: 256
MinItems: 1
Optional: \{\}
|
-| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core)_ | `secretRef` references a Kubernetes `Secret` storing the `.htaccess`
file. The `Secret` must have a key named `.htaccess`, and should contain
the complete `.htaccess` file.
Note: passwords should be the hash of the password, not the raw password. Use the `htpasswd` or similar commands
to generate a hash. MD5, bcrypt, crypt, and SHA-1 are supported.
Example:
apiVersion: v1
kind: Secret
metadata:
name: basic-auth
stringData:
.htaccess: \|
alice:$apr1$3zSE0Abt$IuETi4l5yO87MuOrbSE4V.
bob:$apr1$Ukb5LgRD$EPY2lIfY.A54jzLELNIId/ | | Optional: \{\}
|
+| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core)_ | `secretRef` references a Kubernetes `Secret` storing the `.htaccess`
file. The `Secret` must have a key named `.htaccess`, and should contain
the complete `.htaccess` file.
Note: passwords should be the hash of the password, not the raw password. Use the `htpasswd` or similar commands
to generate a hash. MD5, bcrypt, crypt, and SHA-1 are supported.
Example:
apiVersion: v1
kind: Secret
metadata:
name: basic-auth
stringData:
.htaccess: \|
alice:$apr1$3zSE0Abt$IuETi4l5yO87MuOrbSE4V.
bob:$apr1$Ukb5LgRD$EPY2lIfY.A54jzLELNIId/ | | Optional: \{\}
|
#### BasicAuthenticationMode
@@ -1198,7 +1198,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `field` _[ShortString](#shortstring)_ | The name of the field. | | MaxLength: 256
MinLength: 1
Required: \{\}
|
-| `value` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#json-v1-apiextensions-k8s-io)_ | The field default value, which can be any JSON Data Type. | | Required: \{\}
|
+| `value` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#json-v1-apiextensions-k8s-io)_ | The field default value, which can be any JSON Data Type. | | Required: \{\}
|
#### FieldTransformation
@@ -1256,12 +1256,12 @@ _Appears in:_
| --- | --- | --- | --- |
| `maxBufferSize` _integer_ | `maxBufferSize` defines the maximum HTTP body size that will be buffered
into memory.
Bodies will only be buffered for policies which require buffering.
If unset, this defaults to `2mb`. | | Minimum: 1
Optional: \{\}
|
| `http1MaxHeaders` _integer_ | `http1MaxHeaders` defines the maximum number of headers that are allowed
in `HTTP/1.1` requests.
If unset, this defaults to 100. | | Maximum: 4096
Minimum: 1
Optional: \{\}
|
-| `http1IdleTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | `http1IdleTimeout` defines the timeout before an unused connection is
closed.
If unset, this defaults to 10 minutes. | | Optional: \{\}
|
+| `http1IdleTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | `http1IdleTimeout` defines the timeout before an unused connection is
closed.
If unset, this defaults to 10 minutes. | | Optional: \{\}
|
| `http2WindowSize` _integer_ | `http2WindowSize` indicates the initial window size for stream-level flow
control for received data. | | Minimum: 1
Optional: \{\}
|
| `http2ConnectionWindowSize` _integer_ | `http2ConnectionWindowSize` indicates the initial window size for
connection-level flow control for received data. | | Minimum: 1
Optional: \{\}
|
| `http2FrameSize` _integer_ | `http2FrameSize` sets the maximum frame size to use.
If unset, this defaults to `16kb`. | | Maximum: 1.677215e+06
Minimum: 16384
Optional: \{\}
|
-| `http2KeepaliveInterval` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | | | Optional: \{\}
|
-| `http2KeepaliveTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | | | Optional: \{\}
|
+| `http2KeepaliveInterval` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | | | Optional: \{\}
|
+| `http2KeepaliveTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | | | Optional: \{\}
|
#### FrontendTCP
@@ -1293,7 +1293,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
-| `handshakeTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | `handshakeTimeout` specifies the deadline for a TLS handshake to
complete. If unset, this defaults to `15s`. | | Optional: \{\}
|
+| `handshakeTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | `handshakeTimeout` specifies the deadline for a TLS handshake to
complete. If unset, this defaults to `15s`. | | Optional: \{\}
|
| `alpnProtocols` _[TinyString](#tinystring)_ | `alpnProtocols` sets the Application-Layer Protocol Negotiation (`ALPN`)
value to use in the TLS handshake.
If not present, defaults to `["h2", "http/1.1"]`. | | MaxItems: 16
MaxLength: 64
MinItems: 1
MinLength: 1
Optional: \{\}
|
| `minProtocolVersion` _[TLSVersion](#tlsversion)_ | MinTLSVersion configures the minimum TLS version to support. | | Enum: [1.2 1.3]
Optional: \{\}
|
| `maxProtocolVersion` _[TLSVersion](#tlsversion)_ | MaxTLSVersion configures the maximum TLS version to support. | | Enum: [1.2 1.3]
Optional: \{\}
|
@@ -1513,7 +1513,7 @@ _Appears in:_
| `repository` _string_ | The image repository (name). | | Optional: \{\}
|
| `tag` _string_ | The image tag. | | Optional: \{\}
|
| `digest` _string_ | The hash digest of the image, e.g. `sha256:12345...` | | Optional: \{\}
|
-| `pullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#pullpolicy-v1-core)_ | The image pull policy for the container. See
https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
for details. | | Optional: \{\}
|
+| `pullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#pullpolicy-v1-core)_ | The image pull policy for the container. See
https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
for details. | | Optional: \{\}
|
#### InsecureTLSMode
@@ -1620,7 +1620,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
-| `resourceMetadata` _object (keys:string, values:[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#json-v1-apiextensions-k8s-io))_ | `resourceMetadata` defines the metadata to use for MCP resources,
served at the MCP OAuth metadata endpoints. | | Optional: \{\}
|
+| `resourceMetadata` _object (keys:string, values:[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#json-v1-apiextensions-k8s-io))_ | `resourceMetadata` defines the metadata to use for MCP resources,
served at the MCP OAuth metadata endpoints. | | Optional: \{\}
|
| `provider` _[McpIDP](#mcpidp)_ | `provider` specifies the identity provider to use for MCP authentication flows. | | Enum: [Auth0 Keycloak]
Optional: \{\}
|
@@ -1657,8 +1657,8 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `retries` _integer_ | retries specifies the maximum number of keep-alive probes to send before dropping the connection.
If unset, this defaults to 9. | | Maximum: 64
Minimum: 1
Optional: \{\}
|
-| `time` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | time specifies the number of seconds a connection needs to be idle before keep-alive probes start being sent.
If unset, this defaults to 180s. | | Optional: \{\}
|
-| `interval` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | interval specifies the number of seconds between keep-alive probes.
If unset, this defaults to 180s. | | Optional: \{\}
|
+| `time` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | time specifies the number of seconds a connection needs to be idle before keep-alive probes start being sent.
If unset, this defaults to 180s. | | Optional: \{\}
|
+| `interval` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | interval specifies the number of seconds between keep-alive probes.
If unset, this defaults to 180s. | | Optional: \{\}
|
#### LLMProvider
@@ -1760,7 +1760,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
-| `resourceMetadata` _object (keys:string, values:[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#json-v1-apiextensions-k8s-io))_ | ResourceMetadata defines the metadata to use for MCP resources. | | Optional: \{\}
|
+| `resourceMetadata` _object (keys:string, values:[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#json-v1-apiextensions-k8s-io))_ | ResourceMetadata defines the metadata to use for MCP resources. | | Optional: \{\}
|
| `provider` _[McpIDP](#mcpidp)_ | `provider` specifies the identity provider to use for authentication. | | Enum: [Auth0 Keycloak]
Optional: \{\}
|
| `issuer` _[ShortString](#shortstring)_ | `issuer` identifies the IdP that issued the JWT. This corresponds to the
`iss` claim (https://tools.ietf.org/html/rfc7519#section-4.1.1). | | MaxLength: 256
MinLength: 1
Optional: \{\}
|
| `audiences` _string array_ | `audiences` specifies the list of allowed audiences that are allowed
access. This corresponds to the `aud` claim
(https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3).
If unset, any audience is allowed. | | MaxItems: 64
MinItems: 1
Optional: \{\}
|
@@ -1835,8 +1835,8 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
-| `namespaces` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#labelselector-v1-meta)_ | `namespace` is the label selector for namespaces that `Service`
resources should be selected from. If unset, only the namespace of the
`AgentgatewayBackend` is searched. | | Optional: \{\}
|
-| `services` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#labelselector-v1-meta)_ | `services` is the label selector for which `Service` resources should be
selected. | | Optional: \{\}
|
+| `namespaces` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#labelselector-v1-meta)_ | `namespace` is the label selector for namespaces that `Service`
resources should be selected from. If unset, only the namespace of the
`AgentgatewayBackend` is searched. | | Optional: \{\}
|
+| `services` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#labelselector-v1-meta)_ | `services` is the label selector for which `Service` resources should be
selected. | | Optional: \{\}
|
#### McpTarget
@@ -1854,7 +1854,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `host` _[ShortString](#shortstring)_ | Host is the hostname or IP address of the MCP target. | | MaxLength: 256
MinLength: 1
Optional: \{\}
|
-| `backendRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core)_ | `backendRef` references a namespace-local `Service` resource by name.
When set, this replaces `host` only; `port`, `path`, and `protocol`
remain configured on this target. | | Optional: \{\}
|
+| `backendRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core)_ | `backendRef` references a namespace-local `Service` resource by name.
When set, this replaces `host` only; `port`, `path`, and `protocol`
remain configured on this target. | | Optional: \{\}
|
| `port` _integer_ | Port is the port number of the MCP target. | | Maximum: 65535
Minimum: 1
Required: \{\}
|
| `path` _[LongString](#longstring)_ | Path is the URL path of the MCP target endpoint.
Defaults to `"/sse"` for the `SSE` protocol or `"/mcp"` for the
`StreamableHTTP` protocol if not specified. | | MaxLength: 1024
MinLength: 1
Optional: \{\}
|
| `protocol` _[MCPProtocol](#mcpprotocol)_ | Protocol is the protocol to use for the connection to the MCP
target. | | Enum: [StreamableHTTP SSE]
Optional: \{\}
|
@@ -2209,7 +2209,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `jwksPath` _string_ | Path to the IdP `jwks` endpoint, relative to the root, commonly
`".well-known/jwks.json"`. | | MaxLength: 2000
MinLength: 1
Required: \{\}
|
-| `cacheDuration` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | | 5m | Optional: \{\}
|
+| `cacheDuration` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | | 5m | Optional: \{\}
|
| `backendRef` _[BackendObjectReference](#backendobjectreference)_ | `backendRef` references the remote JWKS server to reach.
Supported types are `Service` and static `Backend`. An
`AgentgatewayPolicy` containing backend TLS config can then be attached
to the `Service` or `Backend` in order to set TLS options for a
connection to the remote `jwks` source. | | Required: \{\}
|
@@ -2373,7 +2373,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
-| `request` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | request specifies a timeout for an individual request from the gateway to a backend. This covers the time from when
the request first starts being sent from the gateway to when the full response has been received from the backend. | | Optional: \{\}
|
+| `request` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#duration-v1-meta)_ | request specifies a timeout for an individual request from the gateway to a backend. This covers the time from when
the request first starts being sent from the gateway to when the full response has been received from the backend. | | Optional: \{\}
|
diff --git a/scripts/crd-ref-docs-config.yaml b/scripts/crd-ref-docs-config.yaml
index 347ac10c6..206331269 100644
--- a/scripts/crd-ref-docs-config.yaml
+++ b/scripts/crd-ref-docs-config.yaml
@@ -11,5 +11,5 @@ processor:
# - they duplicate the main resource with just metadata + items
- "(AgentgatewayBackend|AgentgatewayParameters|AgentgatewayPolicy)List$"
-renderer:
+render:
kubernetesVersion: "1.31"