From da479d6a167f7a6bf503ba41c410cfc5a4bc0c22 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Wed, 14 Oct 2026 10:31:24 +0000 Subject: [PATCH 1/2] [Automated] Draft docs (agentgateway): Allow sending callout requests through CONNECT tunnel Signed-off-by: GitHub Action --- .../configuration/callout-proxy.md | 45 +++++++++++++++++++ .../main/release-notes/release-notes.md | 2 + 2 files changed, 47 insertions(+) create mode 100644 content/docs/standalone/main/documentation/configuration/callout-proxy.md diff --git a/content/docs/standalone/main/documentation/configuration/callout-proxy.md b/content/docs/standalone/main/documentation/configuration/callout-proxy.md new file mode 100644 index 000000000..2c397b25b --- /dev/null +++ b/content/docs/standalone/main/documentation/configuration/callout-proxy.md @@ -0,0 +1,45 @@ +--- +title: Callout proxy +weight: 38 +description: Send gateway-originated callouts through an HTTP proxy. +--- + +Use a callout proxy when the agentgateway process must reach identity providers, authorization services, or cloud APIs through an outbound proxy. Configure the proxy with `config.callouts.tunnel`, or leave that field unset and use the standard proxy environment variables. + +The callout proxy is different from the [egress proxy]({{< link-hextra path="/documentation/configuration/egress-proxy/" >}}). The egress proxy handles client traffic that uses agentgateway as its proxy. The callout proxy handles outbound calls from the agentgateway process. + +## Callouts that use the proxy + +`config.callouts.tunnel` applies to callout APIs. Examples include JWKS fetches, OIDC discovery, external authorization, and cloud provider credential fetches. The setting does not apply to primary backend requests, mirrored backend requests, XDS or CA calls, backends with their own tunnel policy, or Kubernetes services. The setting also does not apply to loopback and link-local addresses, such as cloud metadata servers. + +GCP authentication calls do not read `config.callouts.tunnel`. To proxy those calls, use the standard proxy environment variables instead. + +## Configure the callout proxy + +Add `config.callouts.tunnel` to your configuration file. Because this setting is under the top-level `config` section, restart the agentgateway process after you change the setting. + +```yaml +# yaml-language-server: $schema=https://agentgateway.dev/schema/config +config: + callouts: + tunnel: + url: http://user:pass@proxy.example.com:3128 + noProxy: + - internal.example.com + - 10.0.0.0/8 +``` + +| Field | Description | +| --- | --- | +| `config.callouts.tunnel.url` | The HTTP proxy URL. The URL must use the `http` or `https` scheme. If the proxy requires basic authentication, include the credentials in the URL. | +| `config.callouts.tunnel.noProxy` | Destinations that bypass the proxy. Use `NO_PROXY` syntax, such as hostnames that also match subdomains, IP addresses, CIDR ranges, or `*`. | + +When `config.callouts.tunnel` is set, the setting controls callout proxying. When `config.callouts.tunnel` is omitted, configure callout proxying with the environment variables that the process reads at startup. + +```shell +export ALL_PROXY=http://proxy.example.com:3128 +export NO_PROXY=internal.example.com,10.0.0.0/8 +agentgateway -f config.yaml +``` + +The agentgateway process reads `ALL_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`, including the lowercase forms. diff --git a/content/docs/standalone/main/release-notes/release-notes.md b/content/docs/standalone/main/release-notes/release-notes.md index 8a5dca869..b03be3679 100644 --- a/content/docs/standalone/main/release-notes/release-notes.md +++ b/content/docs/standalone/main/release-notes/release-notes.md @@ -181,12 +181,14 @@ The `AGENTGATEWAY_LEGACY_LLM_USAGE_TOKEN_SEMANTICS` environment variable is remo + - **Per-key local rate limits**: A `localRateLimit` entry takes a CEL `key` that gives each value, such as a user or API key, its own bucket. For more information, see [Per-key limits]({{< link-hextra path="/documentation/configuration/resiliency/rate-limits/#per-key" >}}). - **External processing**: Set `extProc.failureMode: failOpen` in a route's `policies` section to forward requests when the processing server fails. Agentgateway now also forwards the request body if the processing server fails before agentgateway sends any body bytes to it. For more information, see [Failure modes]({{< link-hextra path="/documentation/configuration/traffic-management/extproc/#failure-modes" >}}). - **Graceful drain**: During shutdown, agentgateway stops accepting new connections after `config.connectionMinTerminationDeadline`. It continues to serve open connections until `config.connectionTerminationDeadline`. For more information, see [Shutdown and drain]({{< link-hextra path="/documentation/configuration/static-configuration/#shutdown-drain" >}}). - **Helm chart scaling**: The standalone chart can create a PodDisruptionBudget and a HorizontalPodAutoscaler. For more information, see [Create a PodDisruptionBudget]({{< link-hextra path="/documentation/setup/install/helm/#helm-pdb" >}}). - **Telemetry**: OTLP access logs use the `agentgateway.access` instrumentation scope. The request duration metric records failed requests with an `error_type` label. For the metrics, see the [metrics reference]({{< link-hextra path="/documentation/observability/metrics/reference/#llm" >}}). +- **Callout requests can use an HTTP proxy**: Set `config.callouts.tunnel` to send gateway-originated callouts, such as JWKS fetches, OIDC discovery, external authorization, and cloud credential requests, through an HTTP proxy. If the field is omitted, callouts use the standard proxy environment variables. For more information, see [Callout proxy]({{< link-hextra path="/documentation/configuration/callout-proxy/" >}}). ### OpenTelemetry field names {#v16-otel-attributes} From 06e9ecdbb841bba74c13ac07e7ee9e9295a955e4 Mon Sep 17 00:00:00 2001 From: Kristin Brown Date: Wed, 14 Oct 2026 09:12:38 -0400 Subject: [PATCH 2/2] Move release note to v1.7 Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: Kristin Brown --- .../standalone/main/release-notes/release-notes.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/content/docs/standalone/main/release-notes/release-notes.md b/content/docs/standalone/main/release-notes/release-notes.md index b03be3679..faf88f77d 100644 --- a/content/docs/standalone/main/release-notes/release-notes.md +++ b/content/docs/standalone/main/release-notes/release-notes.md @@ -10,6 +10,14 @@ Review the release notes for agentgateway standalone. > [!NOTE] > For more details, review the [GitHub release notes in the agentgateway repository](https://github.com/agentgateway/agentgateway/releases). +## 🌟 New features {#v17-new-features} + +### Traffic management and operations {#v17-operations} + + + +- **Callout requests can use an HTTP proxy**: Set `config.callouts.tunnel` to send gateway-originated callouts, such as JWKS fetches, OIDC discovery, external authorization, and cloud credential requests, through an HTTP proxy. If the field is omitted, callouts use the standard proxy environment variables. For more information, see [Callout proxy]({{< link-hextra path="/documentation/configuration/callout-proxy/" >}}). + ## ✨ Highlights {#v16-highlights} Version 1.6 provides many updates to existing features, including the following quick highlights. Before you upgrade, review the [breaking changes](#v16-breaking-changes), because several defaults change. @@ -181,14 +189,12 @@ The `AGENTGATEWAY_LEGACY_LLM_USAGE_TOKEN_SEMANTICS` environment variable is remo - - **Per-key local rate limits**: A `localRateLimit` entry takes a CEL `key` that gives each value, such as a user or API key, its own bucket. For more information, see [Per-key limits]({{< link-hextra path="/documentation/configuration/resiliency/rate-limits/#per-key" >}}). - **External processing**: Set `extProc.failureMode: failOpen` in a route's `policies` section to forward requests when the processing server fails. Agentgateway now also forwards the request body if the processing server fails before agentgateway sends any body bytes to it. For more information, see [Failure modes]({{< link-hextra path="/documentation/configuration/traffic-management/extproc/#failure-modes" >}}). - **Graceful drain**: During shutdown, agentgateway stops accepting new connections after `config.connectionMinTerminationDeadline`. It continues to serve open connections until `config.connectionTerminationDeadline`. For more information, see [Shutdown and drain]({{< link-hextra path="/documentation/configuration/static-configuration/#shutdown-drain" >}}). - **Helm chart scaling**: The standalone chart can create a PodDisruptionBudget and a HorizontalPodAutoscaler. For more information, see [Create a PodDisruptionBudget]({{< link-hextra path="/documentation/setup/install/helm/#helm-pdb" >}}). - **Telemetry**: OTLP access logs use the `agentgateway.access` instrumentation scope. The request duration metric records failed requests with an `error_type` label. For the metrics, see the [metrics reference]({{< link-hextra path="/documentation/observability/metrics/reference/#llm" >}}). -- **Callout requests can use an HTTP proxy**: Set `config.callouts.tunnel` to send gateway-originated callouts, such as JWKS fetches, OIDC discovery, external authorization, and cloud credential requests, through an HTTP proxy. If the field is omitted, callouts use the standard proxy environment variables. For more information, see [Callout proxy]({{< link-hextra path="/documentation/configuration/callout-proxy/" >}}). ### OpenTelemetry field names {#v16-otel-attributes}