|
| 1 | +// Copyright 2026 Google LLC |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +package router |
| 16 | + |
| 17 | +import ( |
| 18 | + "context" |
| 19 | + "fmt" |
| 20 | + "strings" |
| 21 | + |
| 22 | + corev1 "k8s.io/api/core/v1" |
| 23 | + "k8s.io/apimachinery/pkg/util/intstr" |
| 24 | +) |
| 25 | + |
| 26 | +type agentgatewayProvider struct { |
| 27 | + cfg RouterConfig |
| 28 | +} |
| 29 | + |
| 30 | +func (p agentgatewayProvider) Name() string { |
| 31 | + return NetworkingModeAgentgateway |
| 32 | +} |
| 33 | + |
| 34 | +func (p agentgatewayProvider) RequiresXDS() bool { |
| 35 | + return false |
| 36 | +} |
| 37 | + |
| 38 | +func (p agentgatewayProvider) ConfigMapData() map[string]string { |
| 39 | + return map[string]string{"config.yaml": p.localConfig()} |
| 40 | +} |
| 41 | + |
| 42 | +func (p agentgatewayProvider) Container() corev1.Container { |
| 43 | + ports := []corev1.ContainerPort{ |
| 44 | + {Name: "http", ContainerPort: int32(p.cfg.HttpPort)}, |
| 45 | + {Name: "readiness", ContainerPort: 15021}, |
| 46 | + {Name: "metrics", ContainerPort: 15020}, |
| 47 | + } |
| 48 | + if p.cfg.HttpsPort > 0 && tlsCertPath(p.cfg) != "" { |
| 49 | + ports = append(ports, corev1.ContainerPort{Name: "https", ContainerPort: int32(p.cfg.HttpsPort)}) |
| 50 | + } |
| 51 | + |
| 52 | + return corev1.Container{ |
| 53 | + Name: "agentgateway", |
| 54 | + Image: p.cfg.AgentgatewayImage, |
| 55 | + Args: []string{"-f", "/etc/agentgateway/config.yaml"}, |
| 56 | + Ports: ports, |
| 57 | + VolumeMounts: []corev1.VolumeMount{ |
| 58 | + {Name: "proxy-config", MountPath: "/etc/agentgateway"}, |
| 59 | + }, |
| 60 | + ReadinessProbe: &corev1.Probe{ |
| 61 | + ProbeHandler: corev1.ProbeHandler{ |
| 62 | + HTTPGet: &corev1.HTTPGetAction{ |
| 63 | + Path: "/healthz/ready", |
| 64 | + Port: intstr.FromInt32(15021), |
| 65 | + }, |
| 66 | + }, |
| 67 | + PeriodSeconds: 10, |
| 68 | + }, |
| 69 | + } |
| 70 | +} |
| 71 | + |
| 72 | +func (p agentgatewayProvider) ServicePorts() []corev1.ServicePort { |
| 73 | + ports := []corev1.ServicePort{ |
| 74 | + {Name: "http", Port: int32(p.cfg.HttpPort), TargetPort: intstr.FromString("http")}, |
| 75 | + } |
| 76 | + if p.cfg.HttpsPort > 0 && tlsCertPath(p.cfg) != "" { |
| 77 | + ports = append(ports, corev1.ServicePort{Name: "https", Port: int32(p.cfg.HttpsPort), TargetPort: intstr.FromString("https")}) |
| 78 | + } |
| 79 | + return ports |
| 80 | +} |
| 81 | + |
| 82 | +func (p agentgatewayProvider) CheckReady(ctx context.Context) (bool, string) { |
| 83 | + return checkHTTPReady(ctx, "http://127.0.0.1:15021/healthz/ready", "") |
| 84 | +} |
| 85 | + |
| 86 | +func (p agentgatewayProvider) localConfig() string { |
| 87 | + httpRoute := p.routeBlock("substrate-http") |
| 88 | + config := fmt.Sprintf(`# yaml-language-server: $schema=https://agentgateway.dev/schema/config |
| 89 | +config: |
| 90 | + adminAddr: "127.0.0.1:15000" |
| 91 | + readinessAddr: "0.0.0.0:15021" |
| 92 | + statsAddr: "0.0.0.0:15020" |
| 93 | +binds: |
| 94 | +- port: %d |
| 95 | + listeners: |
| 96 | + - name: http |
| 97 | + protocol: HTTP |
| 98 | + routes: |
| 99 | +%s`, p.cfg.HttpPort, indent(httpRoute, 4)) |
| 100 | + |
| 101 | + if p.cfg.HttpsPort > 0 && tlsCertPath(p.cfg) != "" { |
| 102 | + cert := tlsCertPath(p.cfg) |
| 103 | + key := tlsKeyPath(p.cfg) |
| 104 | + config += fmt.Sprintf(`- port: %d |
| 105 | + listeners: |
| 106 | + - name: https |
| 107 | + protocol: HTTPS |
| 108 | + tls: |
| 109 | + cert: %q |
| 110 | + key: %q |
| 111 | + routes: |
| 112 | +%s`, p.cfg.HttpsPort, cert, key, indent(p.routeBlock("substrate-https"), 4)) |
| 113 | + } |
| 114 | + |
| 115 | + return config |
| 116 | +} |
| 117 | + |
| 118 | +func (p agentgatewayProvider) routeBlock(name string) string { |
| 119 | + extprocHost := fmt.Sprintf("%s:%d", p.cfg.ExtprocAddr, p.cfg.ExtprocPort) |
| 120 | + // processingOptions limit ext_proc to request headers only; agentgateway defaults |
| 121 | + // break WebSocket upgrades because this server only handles headers. |
| 122 | + return fmt.Sprintf(`- name: %s |
| 123 | + matches: |
| 124 | + - path: |
| 125 | + pathPrefix: / |
| 126 | + policies: |
| 127 | + extProc: |
| 128 | + host: %q |
| 129 | + failureMode: failClosed |
| 130 | + processingOptions: |
| 131 | + requestBodyMode: none |
| 132 | + responseBodyMode: none |
| 133 | + requestHeaderMode: send |
| 134 | + responseHeaderMode: skip |
| 135 | + requestTrailerMode: skip |
| 136 | + responseTrailerMode: skip |
| 137 | + backends: |
| 138 | + - dynamic: {} |
| 139 | +`, name, extprocHost) |
| 140 | +} |
| 141 | + |
| 142 | +func indent(s string, spaces int) string { |
| 143 | + prefix := strings.Repeat(" ", spaces) |
| 144 | + lines := strings.Split(s, "\n") |
| 145 | + for i, line := range lines { |
| 146 | + if line != "" { |
| 147 | + lines[i] = prefix + line |
| 148 | + } |
| 149 | + } |
| 150 | + return strings.Join(lines, "\n") |
| 151 | +} |
0 commit comments