[github-actions]

Warning

1 reference(s) this draft adds appear in neither the code change (agentgateway/agentgateway#3864) nor these docs. Readers run what these pages say, so check each one before merging. A host marked no has never appeared in either.

Reference	Kind	Host seen before
http://user:pass@proxy.example.com:3128	URL	no

agentgateway/agentgateway#3864 — Allow sending callout requests through CONNECT tunnel

Docs versions: standalone/main

What changes for users: Operators can set config.callouts.tunnel.url and optional config.callouts.tunnel.noProxy, or use standard proxy environment variables, to send gateway-originated callouts through an HTTP proxy. The setting applies to callout APIs such as JWKS, OIDC discovery, external authorization, and cloud credential fetches, but not primary backends, XDS/CA, or GCP auth through config.

What the docs now say: The new Callout proxy page explains the difference from the egress proxy, shows the config.callouts.tunnel fields, states which callouts use the proxy, and calls out the environment-variable fallback.

Not verified: The standalone configuration and runtime proxy path were not run.

How agentgateway-3864 was drafted, and what was not verified

• Code PR: Allow sending callout requests through CONNECT tunnel agentgateway#3864
• Code issue: none linked
• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main; documented in the development tree, which is where unreleased changes go
• Category: new-page / pr

Plan, and what changed it

• Planned: Create a standalone configuration page for config.callouts.tunnel.
• Learned: create-in.md authorized only content/docs/standalone/main/documentation/configuration, and body.md limited the feature to callout APIs.
• Did: Created callout-proxy.md in that directory and wrote a proposed feature release note.

Why a documentation change is necessary

The pull request adds the new config.callouts block and reference rows for config.callouts.tunnel.url and config.callouts.tunnel.noProxy, but no prose page mentioned the fields. The body says users can configure CONNECT settings for callouts with config.callouts.tunnel or standard environment variables. Without a page, standalone users can find the generated schema row but cannot see which outbound calls use the proxy or which calls are excluded.

What changed on disk

• content/docs/standalone/main/documentation/configuration/callout-proxy.md - Added a new standalone configuration page for callout proxy settings.

How to verify this change

1. Create a standalone config that includes config.callouts.tunnel.url and config.callouts.tunnel.noProxy, then run agentgateway -f config.yaml --validate-only. The command should print Configuration is valid!.
2. Start agentgateway with that config and trigger a feature that makes a callout, such as OIDC discovery, a JWKS fetch, or external authorization. The agentgateway logs should include callouts will use proxy, and the proxy should receive the outbound request.
3. Repeat the call with a destination that matches config.callouts.tunnel.noProxy, or with a loopback or link-local destination. The proxy should not receive that callout.

Proposed release note

Wrote proposed-release-note.md: this is an unlabelled new user-configurable feature, so the note declares kind: feature and places it under Traffic management and operations.

What was not verified

The configuration was not applied or run, and no outbound callout was sent through an HTTP proxy.

How the pages were chosen (triage report)

Draft a new page

agentgateway/agentgateway#3864 — Allow sending callout requests through CONNECT tunnel

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main
• Summary (read from the body): Replaces feat(oidc): support backendTunnel for OIDC policy outbound egress agentgateway#3608 Replaces feat: allow tunnel for remote JWKS and FileInlineOrRemote fetches agentgateway#2724 For Internal policy callouts policies should be configurable agentgateway#1883 (but doesn't do the TLS part)
• Not tested: standalone configuration needs no cluster; whole config files the draft adds are validated with --validate-only after drafting, and commands are unrun
• No rule covers 9 touched file(s). The candidate pages below come from the files that DID match a rule, so they may scope this narrower than the change is. Read these before deciding the change is only about the pages listed:
  • Cargo.toml
  • crates/agentgateway/src/app.rs
  • crates/agentgateway/src/client/aws.rs
  • crates/agentgateway/src/client/azure.rs
  • crates/agentgateway/src/client/mod.rs
  • crates/agentgateway/src/http/auth/aws.rs
  • ...and 3 more
• Pages to create:
  • content/docs/standalone/main/documentation/configuration (13 sibling page(s))

Warnings

• Allow sending callout requests through CONNECT tunnel agentgateway#3864: re-drafting because it was named on this run, though its earlier draft is issue. Nothing removes the earlier entry; the new draft replaces it in the ledger when it opens.

Release notes

This pull request also adds its release-note entries:

• content/docs/standalone/main/release-notes/release-notes.md: Callout requests can use an HTTP proxy (feature)

Draft branch: pr-tracker-draft-agentgateway-3864

---

Important

The test suite has not run on this pull request. It was opened by github-actions[bot], and GitHub does not start workflows for pull requests opened with the repository's own token. Doc tests, link checking and the static checks are held as action_required until somebody presses Approve and run on the Checks tab. Cloudflare Pages and DCO are GitHub Apps rather than Actions, so those two do run on their own.

Please approve the checks before reviewing the content: an absence of failures here means the tests have not run, not that they passed.

Maintainer edits

• Release notes moved from the v1.6 section to v1.7, because the code change merged after v1.6.0.

[cloudflare-workers-and-pages]

Deploying agentproxy with    Cloudflare Pages

Latest commit:	06e9ecd
Status:	⚡️  Build in progress...

View logs

[kristin-kronstain-brown]

Closing as a duplicate of #1286, which documents the same change (agentgateway/agentgateway#3864) and was opened before this draft was turned into a pull request.