Agent gateway integration

[npolshakova]

Description

This feature adds integration between kgateway and AgentGateway, enabling users to configure AgentGateway as a data plane for agent-to-agent (A2A) and Model Context Protocol (MCP) traffic. The new syncer translates Gateway API resources into AgentGateway xDS-compatible Listener and Target configurations.

API changes

NONE

Code changes

• Added new syncer to translate Gateway resources into AgentGateway Listener and Target configuration.
• Added Helm chart values to enable AgentGateway integration.
• Added deployment template for agentgateway
• Added GatewayParameters value to enable AgentGateway deployer integration

CI changes

• New unit setup test
• New e2e test with sample MCP server and A2A agent running in k8s

Docs changes

• Separate Docs tracking issue: AgentGateway Integration Docs #11172

Context

Enhancement Proposal: #11152

Interesting decisions

The self managed gateway status can't be updated by the proxy syncer (since the deployment is self managed). The old behavior would block the syncer from sending updates because the status was in an invalid state. Open to suggestions what the behavior should be (skip statuses for self-managed gateways, use an "unknown" status, partially report, etc.)

Testing steps

You can manually verify the integration with the following steps:

1. Setup:

Setup cluster and package helm chart:

AGENTGATEWAY=true ./hack/kind/setup-kind.sh

Install:

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml

helm upgrade -i -n kgateway-system kgateway-crds ./_test/kgateway-crds-1.0.0-ci1.tgz --create-namespace

helm upgrade -i -n kgateway-system kgateway ./_test/kgateway-1.0.0-ci1.tgz --create-namespace --set agentGateway.enabled=true  --set image.registry=ghcr.io/kgateway-dev

2. Apply config

k apply -f /Users/ninapolshakova/solo/kgateway/test/kubernetes/e2e/features/agentgateway/testdata/mcp.yaml
k apply -f /Users/ninapolshakova/solo/kgateway/test/kubernetes/e2e/features/agentgateway/testdata/a2a.yaml
k apply -f /Users/ninapolshakova/solo/kgateway/test/kubernetes/e2e/features/agentgateway/testdata/agentgateway.yaml
k apply -f /Users/ninapolshakova/solo/kgateway/test/kubernetes/e2e/features/agentgateway/testdata/gateway-mcp-a2a.yaml

For the mcp tool discovery, you can also use this mcp setup with AgentGateway:

kubectl apply -f- <<EOF
# Deployment Manifest for the MCP Proxy
apiVersion: apps/v1
kind: Deployment
metadata:
  name: github
  labels:
    app: github
spec:
  replicas: 1
  selector:
    matchLabels:
      app: github
  template:
    metadata:
      labels:
        app: github
    spec:
      containers:
        - name: github
          image: ghcr.io/agentgateway/agentgateway:latest-ext
          args:
            - -f
            - /etc/agentgateway/config.json
          ports:
            - containerPort: 3000
          volumeMounts:
            - name: github-config
              mountPath: /etc/agentgateway/config.json
              subPath: config.json
      volumes:
        - name: github-config
          configMap:
            name: github-config
---
apiVersion: v1
kind: Service
metadata:
  name: github
spec:
  selector:
    app: github
  ports:
    - protocol: TCP
      port: 3000
      targetPort: 3000
      appProtocol: kgateway.dev/mcp
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: github-config
data:
  config.json: |
    {
      "type": "static",
      "listeners": [
        {
          "name": "sse",
          "protocol": "MCP",
          "sse": {
            "address": "[::]",
            "port": 3000
          }
        }
      ],
      "targets": {
        "mcp": [
          {
            "name": "github",
            "stdio": {
              "cmd": "npx",
              "args": [
                "-y",
                "@modelcontextprotocol/server-github"
              ],
              "env": {
                "GITHUB_PERSONAL_ACCESS_TOKEN": "fake"
              }
            }
          }
        ]
      }
    }
EOF

4. Test the UI:
   Port-forward the UI dashboard:

kubectl port-forward services/agent-gateway 19000:19000

Port-forward the Gateway listener (9090 for a2a, 8080 for mcp):

kubectl port-forward services/agent-gateway 9090:9090

Then navigate to the playground in the UI:

If you port-forward 8080, you should also be able to use the MCP server in the playground:

You can also test the deployer behavior for agentgateway (where kgateway creates the proxy deployment based on the k8s gateway api resource):

 helm upgrade -i -n kgateway-system kgateway ./_test/kgateway-1.0.0-ci1.tgz --create-namespace --values /Users/ninapolshakova/solo/kgateway/test/kubernetes/e2e/tests/manifests/agent-gateway-integration.yaml

Then apply:

kind: GatewayParameters
apiVersion: gateway.kgateway.dev/v1alpha1
metadata:
  name: kgateway
spec:
  kube:
    agentGateway:
      enabled: true
---
kind: GatewayClass
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: agentgateway
spec:
  controllerName: kgateway.dev/kgateway
  parametersRef:
    group: gateway.kgateway.dev
    kind: GatewayParameters
    name: kgateway
    namespace: default
---
kind: Gateway
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: agent-gateway
spec:
  gatewayClassName: agentgateway
  listeners:
    - protocol: kgateway.dev/mcp
      port: 8080
      name: mcp
      allowedRoutes:
        namespaces:
          from: All
    - protocol: kgateway.dev/a2a
      port: 9090
      name: a2a
      allowedRoutes:
        namespaces:
          from: All

You can also scope the gateway to either allow from any namespace or only the namespace the Gateway is defined via allowedRoutes.

Notes for reviewers

• JWT / Unified auth model mentioned in the EP is out of scope for the initial PR (See: [EP] JWT and RBAC support for Envoy and agentgateway. #11194)

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works

Change Type

/kind new_feature

Changelog

Enables kgateway to act as the control plane for [agentgateway](https://agentgateway.dev/). 

[Copilot]

Pull Request Overview

This PR adds integration between kgateway and AgentGateway by introducing a new syncer to translate Gateway API resources into AgentGateway xDS configurations for both A2A and MCP traffic. The changes include new e2e tests, updates to Helm chart values, and modifications in internal controller and proxy syncer components to support the integration.

Reviewed Changes

Copilot reviewed 24 out of 27 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/kubernetes/e2e/features/agentgateway/*	Added new end-to-end tests for AgentGateway integration
internal/kgateway/extensions2/settings/settings.go	Added a new settings field to enable AgentGateway integration
internal/kgateway/proxy_syncer/proxy_syncer.go	Minor comment fix in the proxy syncer logic
internal/kgateway/agentgatewaysyncer/*	New syncer and supporting proto files for AgentGateway functionality
internal/kgateway/krtcollections/setup.go	Updated type registration to include rest config for new collections

Files not reviewed (3)

• Makefile: Language not supported
• hack/kind/setup-kind.sh: Language not supported
• test/kubernetes/e2e/features/agentgateway/a2a-example/Dockerfile: Language not supported

[EItanya]

Gonna leave the syncer changes to other who are more familiar with the code

[jenshu]

approved with non-blocking comments