fix: use agentgateway in helm chart

Author: EItanya

charts/substrate/README.md

@@ -69,4 +69,3 @@ See `values.yaml` for the full set; the important keys:
 | `redis.useIAMAuth` | `false` | Google IAM auth |
 | `atelet.gcpAuthForImagePulls` | `false` | Enable only when using GCP registry auth |
 | `otel.endpoint` | `""` | Set to an OTLP endpoint to export traces/metrics |
-| `monitoring.gkePodMonitoring.enabled` | `false` | Enable only on clusters with the GKE/GMP `PodMonitoring` CRD |

charts/substrate/templates/atenet-router-monitoring.yaml

@@ -52,54 +52,68 @@ roleRef:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "substrate.fullname" (list "atenet-router-envoy-config" .) }}
+  name: {{ include "substrate.fullname" (list "atenet-router-agentgateway-config" .) }}
   namespace: {{ .Release.Namespace }}
 data:
-  envoy.yaml: |
-    admin:
-      address:
-        socket_address:
-          address: 0.0.0.0
-          port_value: 9901
-
-    node:
-      id: substrate-envoy-node
-      cluster: substrate-router-cluster
-
-    dynamic_resources:
-      lds_config:
-        resource_api_version: V3
-        ads: {}
-      cds_config:
-        resource_api_version: V3
-        ads: {}
-      ads_config:
-        api_type: GRPC
-        transport_api_version: V3
-        grpc_services:
-        - envoy_grpc:
-            cluster_name: xds_cluster
-
-    static_resources:
-      clusters:
-      - name: xds_cluster
-        connect_timeout: 0.25s
-        type: STRICT_DNS
-        lb_policy: ROUND_ROBIN
-        typed_extension_protocol_options:
-          envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
-            "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
-            explicit_http_config:
-              http2_protocol_options: {}
-        load_assignment:
-          cluster_name: xds_cluster
-          endpoints:
-          - lb_endpoints:
-            - endpoint:
-                address:
-                  socket_address:
-                    address: 127.0.0.1
-                    port_value: 18000
+  config.yaml: |
+    # yaml-language-server: $schema=https://agentgateway.dev/schema/config
+    config:
+      adminAddr: "127.0.0.1:15000"
+      readinessAddr: "0.0.0.0:15021"
+      statsAddr: "0.0.0.0:15020"
+    binds:
+    - port: 8080
+      listeners:
+      - name: http
+        protocol: HTTP
+        routes:
+        - name: substrate-http
+          matches:
+          - path:
+              pathPrefix: /
+          policies:
+            extProc:
+              host: "127.0.0.1:50051"
+              failureMode: failClosed
+              processingOptions:
+                requestBodyMode: none
+                responseBodyMode: none
+                requestHeaderMode: send
+                responseHeaderMode: skip
+                requestTrailerMode: skip
+                responseTrailerMode: skip
+          backends:
+          - dynamic: {}
+    - port: 8443
+      listeners:
+      - name: https
+        protocol: HTTPS
+        tls:
+{{ if eq .Values.auth.mode "mtls" }}
+          cert: "/run/servicedns.podcert.ate.dev/credential-bundle.pem"
+          key: "/run/servicedns.podcert.ate.dev/credential-bundle.pem"
+{{ else }}
+          cert: "/run/agentgateway-tls/tls.crt"
+          key: "/run/agentgateway-tls/tls.key"
+{{ end }}
+        routes:
+        - name: substrate-https
+          matches:
+          - path:
+              pathPrefix: /
+          policies:
+            extProc:
+              host: "127.0.0.1:50051"
+              failureMode: failClosed
+              processingOptions:
+                requestBodyMode: none
+                responseBodyMode: none
+                requestHeaderMode: send
+                responseHeaderMode: skip
+                requestTrailerMode: skip
+                responseTrailerMode: skip
+          backends:
+          - dynamic: {}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -122,30 +136,15 @@ spec:
         prometheus.io/port: "9090"
     spec:
       serviceAccountName: {{ include "substrate.fullname" (list "atenet-router" .) }}
-{{- if eq .Values.auth.mode "jwt" }}
-      initContainers:
-      - name: assemble-envoy-cred-bundle
-        image: {{ .Values.images.busybox }}
-        command:
-        - sh
-        - -c
-        - cat /run/ateapi-tls-src/tls.crt /run/ateapi-tls-src/tls.key > /run/envoy-tls/credential-bundle.pem
-        volumeMounts:
-        - name: ateapi-tls-src
-          mountPath: /run/ateapi-tls-src
-          readOnly: true
-        - name: envoy-tls
-          mountPath: /run/envoy-tls
-{{- end }}
       containers:
       - name: atenet-router
         image: {{ include "substrate.componentImage" (list "atenet" .) }}
         args:
         - "router"
         - "--standalone"
+        - "--networking-mode=agentgateway"
         - "--namespace={{ .Release.Namespace }}"
         - "--port-http=8080"
-        - "--port-xds=18000"
         - "--port-extproc=50051"
         - "--extproc-address=127.0.0.1"
         - "--ateapi-address={{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc:443"
@@ -157,11 +156,6 @@ spec:
 {{- end }}
         - "--status-port=4040"
         - "--port-https=8443"
-{{- if eq .Values.auth.mode "mtls" }}
-        - "--envoy-cert-path=/run/servicedns.podcert.ate.dev/credential-bundle.pem"
-{{- else }}
-        - "--envoy-cert-path=/run/envoy-tls/credential-bundle.pem"
-{{- end }}
         env:
         - name: POD_NAME
           valueFrom:
@@ -182,8 +176,6 @@ spec:
           value: {{ .Values.otel.endpoint | quote }}
 {{- end }}
         ports:
-        - name: xds
-          containerPort: 18000
         - name: extproc
           containerPort: 50051
         - name: status
@@ -199,36 +191,40 @@ spec:
           mountPath: /var/run/secrets/tokens/ateapi
           readOnly: true
 {{- end }}
-      - name: envoy
-        image: {{ .Values.images.envoy }}
-        command:
-        - "/usr/local/bin/envoy"
-        - "-c"
-        - "/etc/envoy/envoy.yaml"
-        - "--component-log-level"
-        - "upstream:debug,router:debug,ext_proc:debug"
+      - name: agentgateway
+        image: {{ .Values.images.agentgateway }}
+        args:
+        - "-f"
+        - "/etc/agentgateway/config.yaml"
         ports:
         - name: http
           containerPort: 8080
         - name: https
           containerPort: 8443
-        - name: admin
-          containerPort: 9901
+        - name: readiness
+          containerPort: 15021
+        - name: gw-metrics
+          containerPort: 15020
         volumeMounts:
-        - name: envoy-config
-          mountPath: /etc/envoy
+        - name: agentgateway-config
+          mountPath: /etc/agentgateway
 {{- if eq .Values.auth.mode "mtls" }}
         - name: "servicedns"
           mountPath: "/run/servicedns.podcert.ate.dev"
 {{- else }}
-        - name: envoy-tls
-          mountPath: /run/envoy-tls
+        - name: agentgateway-tls
+          mountPath: /run/agentgateway-tls
           readOnly: true
 {{- end }}
+        readinessProbe:
+          httpGet:
+            path: /healthz/ready
+            port: readiness
+          periodSeconds: 10
       volumes:
-      - name: envoy-config
+      - name: agentgateway-config
         configMap:
-          name: {{ include "substrate.fullname" (list "atenet-router-envoy-config" .) }}
+          name: {{ include "substrate.fullname" (list "atenet-router-agentgateway-config" .) }}
 {{- if eq .Values.auth.mode "mtls" }}
       - name: "servicedns"
         projected:
@@ -238,11 +234,9 @@ spec:
               keyType: ECDSAP256
               credentialBundlePath: credential-bundle.pem
 {{- else }}
-      - name: ateapi-tls-src
+      - name: agentgateway-tls
         secret:
           secretName: {{ .Values.auth.jwt.serverCertSecret }}
-      - name: envoy-tls
-        emptyDir: {}
       - name: ateapi-ca
         configMap:
           name: {{ .Values.auth.jwt.caBundleConfigMap }}

charts/substrate/templates/atenet-router.yaml

@@ -103,16 +103,12 @@ ateApiServerEnvVarsConfigMap: ate-api-server-envvars
 otel:
   endpoint: ""
 
-monitoring:
-  gkePodMonitoring:
-    enabled: false
-
 image:
   registry: ghcr.io/kagent-dev/substrate
   tag: ""
 
 images:
   valkey: valkey/valkey:8.0
-  envoy: envoyproxy/envoy:v1.30-latest
+  agentgateway: cr.agentgateway.dev/agentgateway:v1.3.0-alpha.1
   coredns: coredns/coredns:1.11.1
   busybox: busybox:1.36