From 9e7a1d0223fcd5d9f23ba9ed12fa3cfcc5b31d83 Mon Sep 17 00:00:00 2001
From: artberger <20074219+artberger@users.noreply.github.com>
Date: Sat, 17 Oct 2026 06:30:11 +0000
Subject: [PATCH] docs: update API (incl. shared types), kubespec widgets,
 Helm, metrics, and agctl CLI docs from agentgateway v1.6.0

Signed-off-by: GitHub Action <action@github.com>
---
 ...gateway.dev_agentgatewaybackends.yaml.html | 190 +++++++++---------
 1 file changed, 96 insertions(+), 94 deletions(-)

diff --git a/assets/agw-docs/pages/reference/api/latest/agentgateway.dev_agentgatewaybackends.yaml.html b/assets/agw-docs/pages/reference/api/latest/agentgateway.dev_agentgatewaybackends.yaml.html
index 8b0fb43d7..db0dc2e74 100644
--- a/assets/agw-docs/pages/reference/api/latest/agentgateway.dev_agentgatewaybackends.yaml.html
+++ b/assets/agw-docs/pages/reference/api/latest/agentgateway.dev_agentgatewaybackends.yaml.html
@@ -2736,22 +2736,22 @@
 </ul></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1731" data-ks-path="spec.policies.health.unhealthyCondition" data-ks-panel="p251"><span class="ks-name-toggle"><span class="ks-name">unhealthyCondition</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1732" data-ks-path="spec.policies.http" data-ks-panel="p105" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">http</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1732" aria-controls="c1732" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1732" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1732" data-ks-path="spec.policies.http" data-ks-panel="p391" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">http</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1732" aria-controls="c1732" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1732" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1733" data-ks-path="spec.policies.http.requestTimeout" data-ks-panel="p106"><span class="ks-name-toggle"><span class="ks-name">requestTimeout</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1734" data-ks-path="spec.policies.http.version" data-ks-panel="p107"><span class="ks-name-toggle"><span class="ks-name">version</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1734" data-ks-path="spec.policies.http.version" data-ks-panel="p392"><span class="ks-name-toggle"><span class="ks-name">version</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1735" data-ks-path="spec.policies.mcp" data-ks-panel="p391" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">mcp</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1735" aria-controls="c1735" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1735" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1736" data-ks-path="spec.policies.mcp.authentication" data-ks-panel="p392" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">authentication</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1736" aria-controls="c1736" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1736" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1737" data-ks-path="spec.policies.mcp.authentication.audiences" data-ks-panel="p393"><span class="ks-name-toggle"><span class="ks-name">audiences</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1738" data-ks-path="spec.policies.mcp.authentication.clientId" data-ks-panel="p394"><span class="ks-name-toggle"><span class="ks-name">clientId</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1739" data-ks-path="spec.policies.mcp.authentication.clientSecretRef" data-ks-panel="p395" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">clientSecretRef</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1739" aria-controls="c1739" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1739" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1735" data-ks-path="spec.policies.mcp" data-ks-panel="p393" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">mcp</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1735" aria-controls="c1735" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1735" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1736" data-ks-path="spec.policies.mcp.authentication" data-ks-panel="p394" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">authentication</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1736" aria-controls="c1736" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1736" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1737" data-ks-path="spec.policies.mcp.authentication.audiences" data-ks-panel="p395"><span class="ks-name-toggle"><span class="ks-name">audiences</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1738" data-ks-path="spec.policies.mcp.authentication.clientId" data-ks-panel="p396"><span class="ks-name-toggle"><span class="ks-name">clientId</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1739" data-ks-path="spec.policies.mcp.authentication.clientSecretRef" data-ks-panel="p397" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">clientSecretRef</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1739" aria-controls="c1739" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1739" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1740" data-ks-path="spec.policies.mcp.authentication.clientSecretRef.group" data-ks-panel="p93"><span class="ks-name-toggle"><span class="ks-name">group</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1741" data-ks-path="spec.policies.mcp.authentication.clientSecretRef.key" data-ks-panel="p104"><span class="ks-name-toggle"><span class="ks-name">key</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1742" data-ks-path="spec.policies.mcp.authentication.clientSecretRef.kind" data-ks-panel="p94"><span class="ks-name-toggle"><span class="ks-name">kind</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1743" data-ks-path="spec.policies.mcp.authentication.clientSecretRef.name" data-ks-panel="p95"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">name</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1744" data-ks-path="spec.policies.mcp.authentication.issuer" data-ks-panel="p396"><span class="ks-name-toggle"><span class="ks-name">issuer</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1745" data-ks-path="spec.policies.mcp.authentication.jwks" data-ks-panel="p397" data-ks-expandable><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">jwks</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1745" aria-controls="c1745" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1745" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1744" data-ks-path="spec.policies.mcp.authentication.issuer" data-ks-panel="p398"><span class="ks-name-toggle"><span class="ks-name">issuer</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1745" data-ks-path="spec.policies.mcp.authentication.jwks" data-ks-panel="p399" data-ks-expandable><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">jwks</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1745" aria-controls="c1745" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1745" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1746" data-ks-path="spec.policies.mcp.authentication.jwks.backendRef" data-ks-panel="p127" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">backendRef</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1746" aria-controls="c1746" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1746" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1747" data-ks-path="spec.policies.mcp.authentication.jwks.backendRef.group" data-ks-panel="p128"><span class="ks-name-toggle"><span class="ks-name">group</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1748" data-ks-path="spec.policies.mcp.authentication.jwks.backendRef.kind" data-ks-panel="p129"><span class="ks-name-toggle"><span class="ks-name">kind</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
@@ -2759,28 +2759,28 @@
 <li class="ks-row"><div class="ks-row-line" id="n1750" data-ks-path="spec.policies.mcp.authentication.jwks.backendRef.namespace" data-ks-panel="p131"><span class="ks-name-toggle"><span class="ks-name">namespace</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1751" data-ks-path="spec.policies.mcp.authentication.jwks.backendRef.port" data-ks-panel="p132"><span class="ks-name-toggle"><span class="ks-name">port</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-integer">integer</span></span></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1752" data-ks-path="spec.policies.mcp.authentication.jwks.cacheDuration" data-ks-panel="p398"><span class="ks-name-toggle"><span class="ks-name">cacheDuration</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1753" data-ks-path="spec.policies.mcp.authentication.jwks.jwksPath" data-ks-panel="p399"><span class="ks-name-toggle"><span class="ks-name">jwksPath</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1752" data-ks-path="spec.policies.mcp.authentication.jwks.cacheDuration" data-ks-panel="p400"><span class="ks-name-toggle"><span class="ks-name">cacheDuration</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1753" data-ks-path="spec.policies.mcp.authentication.jwks.jwksPath" data-ks-panel="p401"><span class="ks-name-toggle"><span class="ks-name">jwksPath</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1754" data-ks-path="spec.policies.mcp.authentication.jwks.url" data-ks-panel="p134"><span class="ks-name-toggle"><span class="ks-name">url</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1755" data-ks-path="spec.policies.mcp.authentication.mode" data-ks-panel="p400"><span class="ks-name-toggle"><span class="ks-name">mode</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1756" data-ks-path="spec.policies.mcp.authentication.provider" data-ks-panel="p401"><span class="ks-name-toggle"><span class="ks-name">provider</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1757" data-ks-path="spec.policies.mcp.authentication.resourceMetadata" data-ks-panel="p402"><span class="ks-name-toggle"><span class="ks-name">resourceMetadata</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-object">object</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1758" data-ks-path="spec.policies.mcp.authentication.validation" data-ks-panel="p403" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">validation</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1758" aria-controls="c1758" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1758" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1759" data-ks-path="spec.policies.mcp.authentication.validation.requiredClaims" data-ks-panel="p404"><span class="ks-name-toggle"><span class="ks-name">requiredClaims</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1755" data-ks-path="spec.policies.mcp.authentication.mode" data-ks-panel="p402"><span class="ks-name-toggle"><span class="ks-name">mode</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1756" data-ks-path="spec.policies.mcp.authentication.provider" data-ks-panel="p403"><span class="ks-name-toggle"><span class="ks-name">provider</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1757" data-ks-path="spec.policies.mcp.authentication.resourceMetadata" data-ks-panel="p404"><span class="ks-name-toggle"><span class="ks-name">resourceMetadata</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-object">object</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1758" data-ks-path="spec.policies.mcp.authentication.validation" data-ks-panel="p405" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">validation</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1758" aria-controls="c1758" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1758" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1759" data-ks-path="spec.policies.mcp.authentication.validation.requiredClaims" data-ks-panel="p406"><span class="ks-name-toggle"><span class="ks-name">requiredClaims</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
 </ul></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1760" data-ks-path="spec.policies.mcp.authorization" data-ks-panel="p405" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">authorization</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1760" aria-controls="c1760" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1760" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1760" data-ks-path="spec.policies.mcp.authorization" data-ks-panel="p407" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">authorization</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1760" aria-controls="c1760" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1760" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1761" data-ks-path="spec.policies.mcp.authorization.action" data-ks-panel="p242"><span class="ks-name-toggle"><span class="ks-name">action</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1762" data-ks-path="spec.policies.mcp.authorization.policy" data-ks-panel="p243" data-ks-expandable><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">policy</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1762" aria-controls="c1762" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1762" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1763" data-ks-path="spec.policies.mcp.authorization.policy.matchExpressions" data-ks-panel="p244"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">matchExpressions</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
 </ul></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1764" data-ks-path="spec.policies.mcp.guardrails" data-ks-panel="p406" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">guardrails</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1764" aria-controls="c1764" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1764" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1765" data-ks-path="spec.policies.mcp.guardrails.processors" data-ks-panel="p407" data-ks-expandable><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">processors</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1765" aria-controls="c1765" aria-expanded="false"><span class="ks-type ks-type-complex">object[]</span></button></div><div class="ks-children-container" id="c1765" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1766" data-ks-path="spec.policies.mcp.guardrails.processors.methods" data-ks-panel="p408"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">methods</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-object">object</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1767" data-ks-path="spec.policies.mcp.guardrails.processors.remote" data-ks-panel="p409" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">remote</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1767" aria-controls="c1767" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1767" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1768" data-ks-path="spec.policies.mcp.guardrails.processors.remote.allowedRequestHeaders" data-ks-panel="p410"><span class="ks-name-toggle"><span class="ks-name">allowedRequestHeaders</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1764" data-ks-path="spec.policies.mcp.guardrails" data-ks-panel="p408" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">guardrails</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1764" aria-controls="c1764" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1764" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1765" data-ks-path="spec.policies.mcp.guardrails.processors" data-ks-panel="p409" data-ks-expandable><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">processors</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1765" aria-controls="c1765" aria-expanded="false"><span class="ks-type ks-type-complex">object[]</span></button></div><div class="ks-children-container" id="c1765" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1766" data-ks-path="spec.policies.mcp.guardrails.processors.methods" data-ks-panel="p410"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">methods</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-object">object</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1767" data-ks-path="spec.policies.mcp.guardrails.processors.remote" data-ks-panel="p411" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">remote</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1767" aria-controls="c1767" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1767" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1768" data-ks-path="spec.policies.mcp.guardrails.processors.remote.allowedRequestHeaders" data-ks-panel="p412"><span class="ks-name-toggle"><span class="ks-name">allowedRequestHeaders</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1769" data-ks-path="spec.policies.mcp.guardrails.processors.remote.backendRef" data-ks-panel="p127" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">backendRef</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1769" aria-controls="c1769" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1769" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1770" data-ks-path="spec.policies.mcp.guardrails.processors.remote.backendRef.group" data-ks-panel="p128"><span class="ks-name-toggle"><span class="ks-name">group</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1771" data-ks-path="spec.policies.mcp.guardrails.processors.remote.backendRef.kind" data-ks-panel="p129"><span class="ks-name-toggle"><span class="ks-name">kind</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
@@ -2788,16 +2788,16 @@
 <li class="ks-row"><div class="ks-row-line" id="n1773" data-ks-path="spec.policies.mcp.guardrails.processors.remote.backendRef.namespace" data-ks-panel="p131"><span class="ks-name-toggle"><span class="ks-name">namespace</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1774" data-ks-path="spec.policies.mcp.guardrails.processors.remote.backendRef.port" data-ks-panel="p132"><span class="ks-name-toggle"><span class="ks-name">port</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-integer">integer</span></span></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1775" data-ks-path="spec.policies.mcp.guardrails.processors.remote.disallowedRequestHeaders" data-ks-panel="p411"><span class="ks-name-toggle"><span class="ks-name">disallowedRequestHeaders</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1776" data-ks-path="spec.policies.mcp.guardrails.processors.remote.failureMode" data-ks-panel="p412"><span class="ks-name-toggle"><span class="ks-name">failureMode</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1777" data-ks-path="spec.policies.mcp.guardrails.processors.remote.metadata" data-ks-panel="p413"><span class="ks-name-toggle"><span class="ks-name">metadata</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-object">object</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1775" data-ks-path="spec.policies.mcp.guardrails.processors.remote.disallowedRequestHeaders" data-ks-panel="p413"><span class="ks-name-toggle"><span class="ks-name">disallowedRequestHeaders</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1776" data-ks-path="spec.policies.mcp.guardrails.processors.remote.failureMode" data-ks-panel="p414"><span class="ks-name-toggle"><span class="ks-name">failureMode</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1777" data-ks-path="spec.policies.mcp.guardrails.processors.remote.metadata" data-ks-panel="p415"><span class="ks-name-toggle"><span class="ks-name">metadata</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-object">object</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1778" data-ks-path="spec.policies.mcp.guardrails.processors.remote.url" data-ks-panel="p134"><span class="ks-name-toggle"><span class="ks-name">url</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
 </ul></div></li>
 </ul></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1779" data-ks-path="spec.policies.sessionAffinity" data-ks-panel="p414" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">sessionAffinity</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1779" aria-controls="c1779" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1779" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1780" data-ks-path="spec.policies.sessionAffinity.source" data-ks-panel="p415"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">source</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1779" data-ks-path="spec.policies.sessionAffinity" data-ks-panel="p416" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">sessionAffinity</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1779" aria-controls="c1779" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1779" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1780" data-ks-path="spec.policies.sessionAffinity.source" data-ks-panel="p417"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">source</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1781" data-ks-path="spec.policies.tcp" data-ks-panel="p108" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">tcp</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1781" aria-controls="c1781" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1781" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1782" data-ks-path="spec.policies.tcp.connectTimeout" data-ks-panel="p109"><span class="ks-name-toggle"><span class="ks-name">connectTimeout</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
@@ -2807,7 +2807,7 @@
 <li class="ks-row"><div class="ks-row-line" id="n1786" data-ks-path="spec.policies.tcp.keepalive.time" data-ks-panel="p113"><span class="ks-name-toggle"><span class="ks-name">time</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1787" data-ks-path="spec.policies.tls" data-ks-panel="p416" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">tls</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1787" aria-controls="c1787" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1787" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1787" data-ks-path="spec.policies.tls" data-ks-panel="p418" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">tls</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1787" aria-controls="c1787" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1787" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1788" data-ks-path="spec.policies.tls.alpnProtocols" data-ks-panel="p115"><span class="ks-name-toggle"><span class="ks-name">alpnProtocols</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1789" data-ks-path="spec.policies.tls.caCertificateRefs" data-ks-panel="p116" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">caCertificateRefs</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1789" aria-controls="c1789" aria-expanded="false"><span class="ks-type ks-type-complex">object[]</span></button></div><div class="ks-children-container" id="c1789" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1790" data-ks-path="spec.policies.tls.caCertificateRefs.key" data-ks-panel="p117"><span class="ks-name-toggle"><span class="ks-name">key</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
@@ -2815,14 +2815,14 @@
 <li class="ks-row"><div class="ks-row-line" id="n1792" data-ks-path="spec.policies.tls.caCertificateRefs.name" data-ks-panel="p119"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">name</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1793" data-ks-path="spec.policies.tls.certificateSource" data-ks-panel="p120"><span class="ks-name-toggle"><span class="ks-name">certificateSource</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1794" data-ks-path="spec.policies.tls.insecureSkipVerify" data-ks-panel="p417"><span class="ks-name-toggle"><span class="ks-name">insecureSkipVerify</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1794" data-ks-path="spec.policies.tls.insecureSkipVerify" data-ks-panel="p419"><span class="ks-name-toggle"><span class="ks-name">insecureSkipVerify</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1795" data-ks-path="spec.policies.tls.keyExchangeGroups" data-ks-panel="p122"><span class="ks-name-toggle"><span class="ks-name">keyExchangeGroups</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1796" data-ks-path="spec.policies.tls.mtlsCertificateRef" data-ks-panel="p123" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">mtlsCertificateRef</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1796" aria-controls="c1796" aria-expanded="false"><span class="ks-type ks-type-complex">object[]</span></button></div><div class="ks-children-container" id="c1796" data-ks-children-container hidden><ul class="ks-tree ks-nested">
 <li class="ks-row"><div class="ks-row-line" id="n1797" data-ks-path="spec.policies.tls.mtlsCertificateRef.group" data-ks-panel="p93"><span class="ks-name-toggle"><span class="ks-name">group</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1798" data-ks-path="spec.policies.tls.mtlsCertificateRef.kind" data-ks-panel="p94"><span class="ks-name-toggle"><span class="ks-name">kind</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1799" data-ks-path="spec.policies.tls.mtlsCertificateRef.name" data-ks-panel="p95"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">name</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1800" data-ks-path="spec.policies.tls.sni" data-ks-panel="p418"><span class="ks-name-toggle"><span class="ks-name">sni</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1800" data-ks-path="spec.policies.tls.sni" data-ks-panel="p420"><span class="ks-name-toggle"><span class="ks-name">sni</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1801" data-ks-path="spec.policies.tls.verifySubjectAltNames" data-ks-panel="p125"><span class="ks-name-toggle"><span class="ks-name">verifySubjectAltNames</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string[]</span></span></div></li>
 </ul></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1802" data-ks-path="spec.policies.transformation" data-ks-panel="p252" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">transformation</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1802" aria-controls="c1802" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1802" data-ks-children-container hidden><ul class="ks-tree ks-nested">
@@ -2853,32 +2853,32 @@
 </ul></div></li>
 </ul></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1823" data-ks-path="spec.policies.tunnel" data-ks-panel="p419" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">tunnel</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1823" aria-controls="c1823" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1823" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1824" data-ks-path="spec.policies.tunnel.backendRef" data-ks-panel="p420" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">backendRef</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1824" aria-controls="c1824" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1824" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1825" data-ks-path="spec.policies.tunnel.backendRef.group" data-ks-panel="p421"><span class="ks-name-toggle"><span class="ks-name">group</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1826" data-ks-path="spec.policies.tunnel.backendRef.kind" data-ks-panel="p422"><span class="ks-name-toggle"><span class="ks-name">kind</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1827" data-ks-path="spec.policies.tunnel.backendRef.name" data-ks-panel="p423"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">name</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1823" data-ks-path="spec.policies.tunnel" data-ks-panel="p421" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">tunnel</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1823" aria-controls="c1823" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1823" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1824" data-ks-path="spec.policies.tunnel.backendRef" data-ks-panel="p422" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">backendRef</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1824" aria-controls="c1824" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1824" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1825" data-ks-path="spec.policies.tunnel.backendRef.group" data-ks-panel="p423"><span class="ks-name-toggle"><span class="ks-name">group</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1826" data-ks-path="spec.policies.tunnel.backendRef.kind" data-ks-panel="p424"><span class="ks-name-toggle"><span class="ks-name">kind</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1827" data-ks-path="spec.policies.tunnel.backendRef.name" data-ks-panel="p425"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">name</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1828" data-ks-path="spec.policies.tunnel.backendRef.namespace" data-ks-panel="p131"><span class="ks-name-toggle"><span class="ks-name">namespace</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1829" data-ks-path="spec.policies.tunnel.backendRef.port" data-ks-panel="p424"><span class="ks-name-toggle"><span class="ks-name">port</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-integer">integer</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1829" data-ks-path="spec.policies.tunnel.backendRef.port" data-ks-panel="p426"><span class="ks-name-toggle"><span class="ks-name">port</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-integer">integer</span></span></div></li>
 </ul></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1830" data-ks-path="spec.policies.tunnel.mode" data-ks-panel="p133"><span class="ks-name-toggle"><span class="ks-name">mode</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 <li class="ks-row"><div class="ks-row-line" id="n1831" data-ks-path="spec.policies.tunnel.url" data-ks-panel="p134"><span class="ks-name-toggle"><span class="ks-name">url</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1832" data-ks-path="spec.static" data-ks-panel="p425" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">static</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1832" aria-controls="c1832" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1832" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1833" data-ks-path="spec.static.host" data-ks-panel="p426"><span class="ks-name-toggle"><span class="ks-name">host</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1834" data-ks-path="spec.static.port" data-ks-panel="p427"><span class="ks-name-toggle"><span class="ks-name">port</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-integer">integer</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1835" data-ks-path="spec.static.unixPath" data-ks-panel="p428"><span class="ks-name-toggle"><span class="ks-name">unixPath</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1832" data-ks-path="spec.static" data-ks-panel="p427" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">static</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1832" aria-controls="c1832" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1832" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1833" data-ks-path="spec.static.host" data-ks-panel="p428"><span class="ks-name-toggle"><span class="ks-name">host</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1834" data-ks-path="spec.static.port" data-ks-panel="p429"><span class="ks-name-toggle"><span class="ks-name">port</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-integer">integer</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1835" data-ks-path="spec.static.unixPath" data-ks-panel="p430"><span class="ks-name-toggle"><span class="ks-name">unixPath</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
 </ul></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1836" data-ks-path="status" data-ks-panel="p429" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">status</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1836" aria-controls="c1836" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1836" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1837" data-ks-path="status.conditions" data-ks-panel="p430" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">conditions</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1837" aria-controls="c1837" aria-expanded="false"><span class="ks-type ks-type-complex">object[]</span></button></div><div class="ks-children-container" id="c1837" data-ks-children-container hidden><ul class="ks-tree ks-nested">
-<li class="ks-row"><div class="ks-row-line" id="n1838" data-ks-path="status.conditions.lastTransitionTime" data-ks-panel="p431"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">lastTransitionTime</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1839" data-ks-path="status.conditions.message" data-ks-panel="p432"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">message</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1840" data-ks-path="status.conditions.observedGeneration" data-ks-panel="p433"><span class="ks-name-toggle"><span class="ks-name">observedGeneration</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-integer">integer</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1841" data-ks-path="status.conditions.reason" data-ks-panel="p434"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">reason</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1842" data-ks-path="status.conditions.status" data-ks-panel="p435"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">status</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
-<li class="ks-row"><div class="ks-row-line" id="n1843" data-ks-path="status.conditions.type" data-ks-panel="p436"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">type</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1836" data-ks-path="status" data-ks-panel="p431" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">status</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1836" aria-controls="c1836" aria-expanded="false"><span class="ks-type ks-type-complex">object</span></button></div><div class="ks-children-container" id="c1836" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1837" data-ks-path="status.conditions" data-ks-panel="p432" data-ks-expandable><span class="ks-name-toggle"><span class="ks-name">conditions</span></span><button type="button" class="ks-type-toggle is-clickable" data-ks-children-target="c1837" aria-controls="c1837" aria-expanded="false"><span class="ks-type ks-type-complex">object[]</span></button></div><div class="ks-children-container" id="c1837" data-ks-children-container hidden><ul class="ks-tree ks-nested">
+<li class="ks-row"><div class="ks-row-line" id="n1838" data-ks-path="status.conditions.lastTransitionTime" data-ks-panel="p433"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">lastTransitionTime</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1839" data-ks-path="status.conditions.message" data-ks-panel="p434"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">message</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1840" data-ks-path="status.conditions.observedGeneration" data-ks-panel="p435"><span class="ks-name-toggle"><span class="ks-name">observedGeneration</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-integer">integer</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1841" data-ks-path="status.conditions.reason" data-ks-panel="p436"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">reason</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1842" data-ks-path="status.conditions.status" data-ks-panel="p437"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">status</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
+<li class="ks-row"><div class="ks-row-line" id="n1843" data-ks-path="status.conditions.type" data-ks-panel="p438"><span class="ks-name-toggle"><span class="ks-required" title="Required">*</span><span class="ks-name">type</span></span><span class="ks-type-toggle"><span class="ks-type ks-type-string">string</span></span></div></li>
 </ul></div></li>
 </ul></div></li>
 </ul></div>
@@ -3289,52 +3289,54 @@
 <template data-ks-field-panel="p388"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Settings for passive and active health checking.</div></div><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/llm/models/virtual/">documentation/llm/models/virtual</a></div></div></details></div></template>
 <template data-ks-field-panel="p389"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Settings for evicting unhealthy backends.</div></div><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/llm/models/virtual/">documentation/llm/models/virtual</a></div></div></details></div></template>
 <template data-ks-field-panel="p390"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-integer">integer</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Number of consecutive unhealthy responses required before the backend is evicted.<br />For example, a value of 5 means the backend must receive 5 unhealthy responses in a row before being evicted.<br />When both consecutiveFailures and healthThreshold are set, the backend is evicted when either condition is met.<br />When neither is set, a single unhealthy response can trigger eviction.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Format</span><span class="ks-validation-value">int32</span></div><div class="ks-validation-item"><span class="ks-validation-label">Minimum</span><span class="ks-validation-value">0</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/llm/models/virtual/">documentation/llm/models/virtual</a></div></div></details></div></template>
-<template data-ks-field-panel="p391"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Settings for MCP workloads. This is only applicable when<br />connecting to a <code class="ks-inline-code">Backend</code> of type <code class="ks-inline-code">mcp</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">at least one of the fields in [authentication authorization guardrails] must be set</div></div></div></details></div></template>
-<template data-ks-field-panel="p392"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">MCP backend-specific authentication rules.</div><div class="ks-rich-block">This field is deprecated; prefer to use traffic policy <code class="ks-inline-code">jwtAuthentication.mcp</code>, which ensures authentication runs before<br />other policies such as transformation and rate limiting.</div></div></div></template>
-<template data-ks-field-panel="p393"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string[]</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Allowed audiences that are allowed<br />access. This corresponds to the <code class="ks-inline-code">aud</code> claim<br />([RFC 7519 §4.1.3](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3)).<br />If unset, any audience is allowed.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min items</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">64</span></div></div></details></div></template>
-<template data-ks-field-panel="p394"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Client ID to use for short-circuiting Dynamic Client Registration.<br />If set, the gateway will not proxy registration requests to the IDP and instead return this client ID.</div></div></div></template>
-<template data-ks-field-panel="p395"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Reference to a Kubernetes Secret holding the OAuth client secret of the app<br />registration identified by <code class="ks-inline-code">clientId</code> (for example Entra ID confidential clients,<br />which require the secret at the token endpoint). The gateway injects it into the<br />token requests it proxies to the provider. Defaults to the <code class="ks-inline-code">clientSecret</code> key;<br />override via <code class="ks-inline-code">clientSecretRef.key</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Map type</span><span class="ks-validation-value">atomic</span></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">custom credential refs must set both group and kind</div></div></div></details></div></template>
-<template data-ks-field-panel="p396"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">IdP that issued the JWT. This corresponds to the<br /><code class="ks-inline-code">iss</code> claim ([RFC 7519 §4.1.1](https://tools.ietf.org/html/rfc7519#section-4.1.1)).</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">256</span></div></div></details></div></template>
-<template data-ks-field-panel="p397"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Remote JSON Web Key used to validate the signature of<br />the JWT.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">jwksPath is required when backendRef is set</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">jwksPath may not be set when url is set</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">exactly one of the fields in [backendRef url] must be set</div></div></div></details></div></template>
-<template data-ks-field-panel="p398"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">How long a fetched <code class="ks-inline-code">jwks</code> document is used before it is re-fetched from the IdP.<br />Defaults to <code class="ks-inline-code">5m</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^([0-9]{1,5}(h|m|s|ms)){1,4}$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">32</span></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">cacheDuration must be at least 5m.</div></div></div></details></div></template>
-<template data-ks-field-panel="p399"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Path to the IdP <code class="ks-inline-code">jwks</code> endpoint, relative to the root, commonly<br /><code class="ks-inline-code">&quot;.well-known/jwks.json&quot;</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">1024</span></div></div></details></div></template>
-<template data-ks-field-panel="p400"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Validation mode for JWT authentication. Defaults to <code class="ks-inline-code">Strict</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">Optional, Permissive, Strict</span></div></div></details></div></template>
-<template data-ks-field-panel="p401"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Identity provider to use for authentication.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">Auth0, Authentik, Descope, Entra, Keycloak, Okta</span></div></div></details></div></template>
-<template data-ks-field-panel="p402"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-object">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Metadata to use for MCP resources.</div></div></div></template>
-<template data-ks-field-panel="p403"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Additional JWT claim presence requirements. Defaults to requiring <code class="ks-inline-code">exp</code>.<br />Issuer validation always requires <code class="ks-inline-code">iss</code>; a non-empty audiences list also<br />requires <code class="ks-inline-code">aud</code>, regardless of these options. An empty <code class="ks-inline-code">requiredClaims</code><br />list removes only the additional presence requirements. Expiration is<br />still checked whenever <code class="ks-inline-code">exp</code> is present.</div></div></div></template>
-<template data-ks-field-panel="p404"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string[]</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Additional claims that must be present in the token payload.<br />Recognized values: <code class="ks-inline-code">exp</code>, <code class="ks-inline-code">nbf</code>, <code class="ks-inline-code">aud</code>, <code class="ks-inline-code">sub</code>.<br />Defaults to <code class="ks-inline-code">[&quot;exp&quot;]</code> when omitted. An empty list adds no requirements<br />beyond <code class="ks-inline-code">iss</code>, which is always required, and <code class="ks-inline-code">aud</code>, which is required<br />when a non-empty audiences list is configured. Expiration is still<br />checked whenever <code class="ks-inline-code">exp</code> is present.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">4</span></div><div class="ks-validation-item"><span class="ks-validation-label">List type</span><span class="ks-validation-value">atomic</span></div></div></details></div></template>
-<template data-ks-field-panel="p405"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">MCP backend authorization. Unlike authorization at the HTTP level, which rejects<br />unauthorized requests with a <code class="ks-inline-code">403</code> error, this policy works at the<br /><code class="ks-inline-code">MCPBackend</code> level.</div><div class="ks-rich-block">List operations, such as <code class="ks-inline-code">list_tools</code>, will have each item evaluated.<br />Items that do not meet the rule will be filtered.</div><div class="ks-rich-block">Get or call operations, such as <code class="ks-inline-code">call_tool</code>, will evaluate the specific<br />item and reject requests that do not meet the rule.</div></div></div></template>
-<template data-ks-field-panel="p406"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">guardrails</code> routes selected JSON-RPC methods through a remote policy server.</div></div></div></template>
-<template data-ks-field-panel="p407"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object[]</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">processors</code> is the ordered list of policy processors applied to matched<br />methods. Processors run in the order listed; the first to reject a request<br />short-circuits the chain.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min items</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">16</span></div></div></details></div></template>
-<template data-ks-field-panel="p408"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-object">object</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">methods</code> is the allowlist of JSON-RPC methods (e.g. <code class="ks-inline-code">tools/call</code>,<br /><code class="ks-inline-code">tools/list</code>) routed through this processor, keyed by method name with the<br />phase it runs in. Keys may be exact, a prefix wildcard (<code class="ks-inline-code">tools/*</code>), a suffix<br />wildcard (<code class="ks-inline-code">*/list</code>), or <code class="ks-inline-code">*</code> for all methods; the most specific match wins.<br />Methods matching no key, including unknown ones, bypass this processor.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min properties</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max properties</span><span class="ks-validation-value">64</span></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">method wildcards must be '*', a prefix like 'tools/*', or a suffix like '*/list'</div></div></div></details></div></template>
-<template data-ks-field-panel="p409"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">remote</code> configures a gRPC policy server.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">url must not include a path</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">exactly one of the fields in [backendRef url] must be set</div></div></div></details></div></template>
-<template data-ks-field-panel="p410"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string[]</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">allowedRequestHeaders</code> lists the incoming request headers forwarded to<br />the policy server in <code class="ks-inline-code">McpRequest.headers</code>. If empty, all headers and<br />pseudo-headers (<code class="ks-inline-code">:authority</code>, <code class="ks-inline-code">:method</code>, ...) are forwarded. Matching is<br />case-insensitive.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">64</span></div><div class="ks-validation-item"><span class="ks-validation-label">List type</span><span class="ks-validation-value">set</span></div></div></details></div></template>
-<template data-ks-field-panel="p411"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string[]</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">disallowedRequestHeaders</code> lists header names never forwarded to the<br />policy server, even if listed in <code class="ks-inline-code">allowedRequestHeaders</code>. Matching is<br />case-insensitive.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">64</span></div><div class="ks-validation-item"><span class="ks-validation-label">List type</span><span class="ks-validation-value">set</span></div></div></details></div></template>
-<template data-ks-field-panel="p412"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">failureMode</code> controls behavior when the policy server is unreachable<br />or returns an error. <code class="ks-inline-code">FailOpen</code> allows the request; <code class="ks-inline-code">FailClosed</code><br />(default) denies it.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">FailClosed, FailOpen</span></div></div></details></div></template>
-<template data-ks-field-panel="p413"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-object">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">metadata</code> is static or CEL-evaluated context surfaced to the policy<br />server as fields of the <code class="ks-inline-code">metadata_context</code> google.protobuf.Struct,<br />keyed by config key. Values are CEL expressions.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max properties</span><span class="ks-validation-value">64</span></div></div></details></div></template>
-<template data-ks-field-panel="p414"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Configures best-effort session affinity using an existing request attribute.<br />For AI backends, this applies across the backend's provider groups and must not<br />be configured on an individual provider.</div></div><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/load-balancing/">documentation/traffic-management/load-balancing</a></div></div></details></div></template>
-<template data-ks-field-panel="p415"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">CEL expression evaluated against request state. It must return a string or bytes value.<br />For example, <code class="ks-inline-code">request.headers[&quot;x-session-id&quot;]</code> or <code class="ks-inline-code">string(source.address)</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">16384</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/load-balancing/">documentation/traffic-management/load-balancing</a></div></div></details></div></template>
-<template data-ks-field-panel="p416"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Settings for managing TLS connections to the backend</div><div class="ks-rich-block">When set, TLS is originated to the backend using the system trusted CA<br />certificates, and SNI is inferred from the destination.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">insecureSkipVerify All and caCertificateRefs may not be set together</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">insecureSkipVerify and verifySubjectAltNames may not be set together</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">certificateSource SPIFFE may not be combined with mtlsCertificateRef, caCertificateRefs, or insecureSkipVerify</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">at most one of the fields in [verifySubjectAltNames insecureSkipVerify] may be set</div></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (7)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/idps/google/">documentation/security/backend-authn/token-exchange/idps/google</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/jwt/setup/">documentation/security/jwt/setup</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/clients/claude-desktop/">integrations/llm/clients/claude-desktop</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/arize/">integrations/llm/observability/arize</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/axiom/">integrations/llm/observability/axiom</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/openai-compatible/">integrations/llm/providers/openai-compatible</a></div></div></details></div></template>
-<template data-ks-field-panel="p417"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Originates TLS but skips verification of the backend's certificate<br />WARNING: insecure; only use if the risks are understood</div><div class="ks-rich-block">Modes:<br />* <code class="ks-inline-code">All</code> disables all TLS verification<br />* <code class="ks-inline-code">Hostname</code> trusts the CA certificate but ignores hostname/SAN mismatches.<br />  Still insecure; prefer <code class="ks-inline-code">verifySubjectAltNames</code> where possible.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">All, Hostname</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
-<template data-ks-field-panel="p418"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Server Name Indicator (<code class="ks-inline-code">SNI</code>) to use in the TLS<br />handshake. If unset, the <code class="ks-inline-code">SNI</code> is automatically set based on the<br />destination hostname.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">253</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (3)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/idps/google/">documentation/security/backend-authn/token-exchange/idps/google</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/jwt/setup/">documentation/security/jwt/setup</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/openai-compatible/">integrations/llm/providers/openai-compatible</a></div></div></details></div></template>
-<template data-ks-field-panel="p419"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Settings for managing tunnel connections to the backend, like <code class="ks-inline-code">HTTPS_PROXY</code></div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">exactly one of the fields in [backendRef url] must be set</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">url must not include a path for backend tunnel</div></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
-<template data-ks-field-panel="p420"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">backendRef</code> selects a backend for this policy.<br />Mutually exclusive with <code class="ks-inline-code">url</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">Must have port for Service reference</div></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
-<template data-ks-field-panel="p421"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Group of the referent, for example <code class="ks-inline-code">gateway.networking.k8s.io</code>. Empty selects the core API group</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">253</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
-<template data-ks-field-panel="p422"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Kubernetes resource kind of the referent, for example <code class="ks-inline-code">Service</code>. Defaults to <code class="ks-inline-code">Service</code></div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Default</span><span class="ks-validation-value">Service</span></div><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">63</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
-<template data-ks-field-panel="p423"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Name is the name of the referent.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">253</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
-<template data-ks-field-panel="p424"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-integer">integer</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Destination port number. Required when the referent is a Kubernetes <code class="ks-inline-code">Service</code></div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Format</span><span class="ks-validation-value">int32</span></div><div class="ks-validation-item"><span class="ks-validation-label">Minimum</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Maximum</span><span class="ks-validation-value">65535</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
-<template data-ks-field-panel="p425"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Static hostname, IP address, or Unix Domain Socket backend.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">must specify either unixPath or both host and port</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">unixPath and host/port are mutually exclusive</div></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (17)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/auth0/">documentation/mcp/auth/auth0</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/descope/">documentation/mcp/auth/descope</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/entra/">documentation/mcp/auth/entra</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/okta/">documentation/mcp/auth/okta</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/cross-app-access/">documentation/security/backend-authn/token-exchange/cross-app-access</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/idps/google/">documentation/security/backend-authn/token-exchange/idps/google</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/jwt-bearer/">documentation/security/backend-authn/token-exchange/jwt-bearer</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/mcp/">documentation/security/backend-authn/token-exchange/mcp</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/standard/">documentation/security/backend-authn/token-exchange/standard</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backendtls/">documentation/security/backendtls</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/jwt/setup/">documentation/security/jwt/setup</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/host/">documentation/traffic-management/rewrite/host</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/path/">documentation/traffic-management/rewrite/path</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/clients/claude-desktop/">integrations/llm/clients/claude-desktop</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/arize/">integrations/llm/observability/arize</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/axiom/">integrations/llm/observability/axiom</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
-<template data-ks-field-panel="p426"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Host to connect to for TCP backends.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">256</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (17)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/auth0/">documentation/mcp/auth/auth0</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/descope/">documentation/mcp/auth/descope</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/entra/">documentation/mcp/auth/entra</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/okta/">documentation/mcp/auth/okta</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/cross-app-access/">documentation/security/backend-authn/token-exchange/cross-app-access</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/idps/google/">documentation/security/backend-authn/token-exchange/idps/google</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/jwt-bearer/">documentation/security/backend-authn/token-exchange/jwt-bearer</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/mcp/">documentation/security/backend-authn/token-exchange/mcp</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/standard/">documentation/security/backend-authn/token-exchange/standard</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backendtls/">documentation/security/backendtls</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/jwt/setup/">documentation/security/jwt/setup</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/host/">documentation/traffic-management/rewrite/host</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/path/">documentation/traffic-management/rewrite/path</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/clients/claude-desktop/">integrations/llm/clients/claude-desktop</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/arize/">integrations/llm/observability/arize</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/axiom/">integrations/llm/observability/axiom</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
-<template data-ks-field-panel="p427"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-integer">integer</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Port to connect to for TCP backends.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Format</span><span class="ks-validation-value">int32</span></div><div class="ks-validation-item"><span class="ks-validation-label">Minimum</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Maximum</span><span class="ks-validation-value">65535</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (17)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/auth0/">documentation/mcp/auth/auth0</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/descope/">documentation/mcp/auth/descope</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/entra/">documentation/mcp/auth/entra</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/okta/">documentation/mcp/auth/okta</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/cross-app-access/">documentation/security/backend-authn/token-exchange/cross-app-access</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/idps/google/">documentation/security/backend-authn/token-exchange/idps/google</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/jwt-bearer/">documentation/security/backend-authn/token-exchange/jwt-bearer</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/mcp/">documentation/security/backend-authn/token-exchange/mcp</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/standard/">documentation/security/backend-authn/token-exchange/standard</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backendtls/">documentation/security/backendtls</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/jwt/setup/">documentation/security/jwt/setup</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/host/">documentation/traffic-management/rewrite/host</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/path/">documentation/traffic-management/rewrite/path</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/clients/claude-desktop/">integrations/llm/clients/claude-desktop</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/arize/">integrations/llm/observability/arize</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/axiom/">integrations/llm/observability/axiom</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
-<template data-ks-field-panel="p428"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Filesystem path to a Unix Domain Socket. The gateway pod<br />must share a volume with the target (e.g., via emptyDir sidecar pattern).<br />Mutually exclusive with host/port.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div></div></details></div></template>
-<template data-ks-field-panel="p429"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Current backend status.</div></div></div></template>
-<template data-ks-field-panel="p430"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object[]</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Current condition state for the backend.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">8</span></div><div class="ks-validation-item"><span class="ks-validation-label">List type</span><span class="ks-validation-value">map</span></div><div class="ks-validation-item"><span class="ks-validation-label">List map keys</span><span class="ks-validation-value">type</span></div></div></details></div></template>
-<template data-ks-field-panel="p431"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">lastTransitionTime is the last time the condition transitioned from one status to another.<br />This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Format</span><span class="ks-validation-value">date-time</span></div></div></details></div></template>
-<template data-ks-field-panel="p432"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">message is a human readable message indicating details about the transition.<br />This may be an empty string.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">32768</span></div></div></details></div></template>
-<template data-ks-field-panel="p433"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-integer">integer</span></div><div class="ks-detail-desc"><div class="ks-rich-block">observedGeneration represents the .metadata.generation that the condition was set based upon.<br />For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date<br />with respect to the current state of the instance.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Format</span><span class="ks-validation-value">int64</span></div><div class="ks-validation-item"><span class="ks-validation-label">Minimum</span><span class="ks-validation-value">0</span></div></div></details></div></template>
-<template data-ks-field-panel="p434"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">reason contains a programmatic identifier indicating the reason for the condition's last transition.<br />Producers of specific condition types may define expected values and meanings for this field,<br />and whether the values are considered a guaranteed API.<br />The value should be a CamelCase string.<br />This field may not be empty.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">1024</span></div></div></details></div></template>
-<template data-ks-field-panel="p435"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">status of the condition, one of True, False, Unknown.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">True, False, Unknown</span></div></div></details></div></template>
-<template data-ks-field-panel="p436"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">type of condition in CamelCase or in foo.example.com/CamelCase.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">316</span></div></div></details></div></template>
+<template data-ks-field-panel="p391"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Settings for managing HTTP requests to the backend</div></div><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/llm/realtime/">documentation/llm/realtime</a></div></div></details></div></template>
+<template data-ks-field-panel="p392"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">HTTP protocol version for backend connections. If unset, it is inferred:<br /><code class="ks-inline-code">Service</code> appProtocol, <code class="ks-inline-code">HTTP2</code> for gRPC, the original protocol for<br />plaintext HTTP, or <code class="ks-inline-code">HTTP1</code> for HTTPS because clients often upgrade HTTPS<br />to HTTP/2 even when the backend does not support it.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">HTTP1, HTTP2</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/llm/realtime/">documentation/llm/realtime</a></div></div></details></div></template>
+<template data-ks-field-panel="p393"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Settings for MCP workloads. This is only applicable when<br />connecting to a <code class="ks-inline-code">Backend</code> of type <code class="ks-inline-code">mcp</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">at least one of the fields in [authentication authorization guardrails] must be set</div></div></div></details></div></template>
+<template data-ks-field-panel="p394"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">MCP backend-specific authentication rules.</div><div class="ks-rich-block">This field is deprecated; prefer to use traffic policy <code class="ks-inline-code">jwtAuthentication.mcp</code>, which ensures authentication runs before<br />other policies such as transformation and rate limiting.</div></div></div></template>
+<template data-ks-field-panel="p395"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string[]</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Allowed audiences that are allowed<br />access. This corresponds to the <code class="ks-inline-code">aud</code> claim<br />([RFC 7519 §4.1.3](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3)).<br />If unset, any audience is allowed.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min items</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">64</span></div></div></details></div></template>
+<template data-ks-field-panel="p396"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Client ID to use for short-circuiting Dynamic Client Registration.<br />If set, the gateway will not proxy registration requests to the IDP and instead return this client ID.</div></div></div></template>
+<template data-ks-field-panel="p397"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Reference to a Kubernetes Secret holding the OAuth client secret of the app<br />registration identified by <code class="ks-inline-code">clientId</code> (for example Entra ID confidential clients,<br />which require the secret at the token endpoint). The gateway injects it into the<br />token requests it proxies to the provider. Defaults to the <code class="ks-inline-code">clientSecret</code> key;<br />override via <code class="ks-inline-code">clientSecretRef.key</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Map type</span><span class="ks-validation-value">atomic</span></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">custom credential refs must set both group and kind</div></div></div></details></div></template>
+<template data-ks-field-panel="p398"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">IdP that issued the JWT. This corresponds to the<br /><code class="ks-inline-code">iss</code> claim ([RFC 7519 §4.1.1](https://tools.ietf.org/html/rfc7519#section-4.1.1)).</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">256</span></div></div></details></div></template>
+<template data-ks-field-panel="p399"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Remote JSON Web Key used to validate the signature of<br />the JWT.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">jwksPath is required when backendRef is set</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">jwksPath may not be set when url is set</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">exactly one of the fields in [backendRef url] must be set</div></div></div></details></div></template>
+<template data-ks-field-panel="p400"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">How long a fetched <code class="ks-inline-code">jwks</code> document is used before it is re-fetched from the IdP.<br />Defaults to <code class="ks-inline-code">5m</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^([0-9]{1,5}(h|m|s|ms)){1,4}$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">32</span></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">cacheDuration must be at least 5m.</div></div></div></details></div></template>
+<template data-ks-field-panel="p401"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Path to the IdP <code class="ks-inline-code">jwks</code> endpoint, relative to the root, commonly<br /><code class="ks-inline-code">&quot;.well-known/jwks.json&quot;</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">1024</span></div></div></details></div></template>
+<template data-ks-field-panel="p402"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Validation mode for JWT authentication. Defaults to <code class="ks-inline-code">Strict</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">Optional, Permissive, Strict</span></div></div></details></div></template>
+<template data-ks-field-panel="p403"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Identity provider to use for authentication.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">Auth0, Authentik, Descope, Entra, Keycloak, Okta</span></div></div></details></div></template>
+<template data-ks-field-panel="p404"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-object">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Metadata to use for MCP resources.</div></div></div></template>
+<template data-ks-field-panel="p405"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Additional JWT claim presence requirements. Defaults to requiring <code class="ks-inline-code">exp</code>.<br />Issuer validation always requires <code class="ks-inline-code">iss</code>; a non-empty audiences list also<br />requires <code class="ks-inline-code">aud</code>, regardless of these options. An empty <code class="ks-inline-code">requiredClaims</code><br />list removes only the additional presence requirements. Expiration is<br />still checked whenever <code class="ks-inline-code">exp</code> is present.</div></div></div></template>
+<template data-ks-field-panel="p406"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string[]</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Additional claims that must be present in the token payload.<br />Recognized values: <code class="ks-inline-code">exp</code>, <code class="ks-inline-code">nbf</code>, <code class="ks-inline-code">aud</code>, <code class="ks-inline-code">sub</code>.<br />Defaults to <code class="ks-inline-code">[&quot;exp&quot;]</code> when omitted. An empty list adds no requirements<br />beyond <code class="ks-inline-code">iss</code>, which is always required, and <code class="ks-inline-code">aud</code>, which is required<br />when a non-empty audiences list is configured. Expiration is still<br />checked whenever <code class="ks-inline-code">exp</code> is present.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">4</span></div><div class="ks-validation-item"><span class="ks-validation-label">List type</span><span class="ks-validation-value">atomic</span></div></div></details></div></template>
+<template data-ks-field-panel="p407"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">MCP backend authorization. Unlike authorization at the HTTP level, which rejects<br />unauthorized requests with a <code class="ks-inline-code">403</code> error, this policy works at the<br /><code class="ks-inline-code">MCPBackend</code> level.</div><div class="ks-rich-block">List operations, such as <code class="ks-inline-code">list_tools</code>, will have each item evaluated.<br />Items that do not meet the rule will be filtered.</div><div class="ks-rich-block">Get or call operations, such as <code class="ks-inline-code">call_tool</code>, will evaluate the specific<br />item and reject requests that do not meet the rule.</div></div></div></template>
+<template data-ks-field-panel="p408"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">guardrails</code> routes selected JSON-RPC methods through a remote policy server.</div></div></div></template>
+<template data-ks-field-panel="p409"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object[]</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">processors</code> is the ordered list of policy processors applied to matched<br />methods. Processors run in the order listed; the first to reject a request<br />short-circuits the chain.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min items</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">16</span></div></div></details></div></template>
+<template data-ks-field-panel="p410"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-object">object</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">methods</code> is the allowlist of JSON-RPC methods (e.g. <code class="ks-inline-code">tools/call</code>,<br /><code class="ks-inline-code">tools/list</code>) routed through this processor, keyed by method name with the<br />phase it runs in. Keys may be exact, a prefix wildcard (<code class="ks-inline-code">tools/*</code>), a suffix<br />wildcard (<code class="ks-inline-code">*/list</code>), or <code class="ks-inline-code">*</code> for all methods; the most specific match wins.<br />Methods matching no key, including unknown ones, bypass this processor.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min properties</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max properties</span><span class="ks-validation-value">64</span></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">method wildcards must be '*', a prefix like 'tools/*', or a suffix like '*/list'</div></div></div></details></div></template>
+<template data-ks-field-panel="p411"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">remote</code> configures a gRPC policy server.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">url must not include a path</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">exactly one of the fields in [backendRef url] must be set</div></div></div></details></div></template>
+<template data-ks-field-panel="p412"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string[]</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">allowedRequestHeaders</code> lists the incoming request headers forwarded to<br />the policy server in <code class="ks-inline-code">McpRequest.headers</code>. If empty, all headers and<br />pseudo-headers (<code class="ks-inline-code">:authority</code>, <code class="ks-inline-code">:method</code>, ...) are forwarded. Matching is<br />case-insensitive.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">64</span></div><div class="ks-validation-item"><span class="ks-validation-label">List type</span><span class="ks-validation-value">set</span></div></div></details></div></template>
+<template data-ks-field-panel="p413"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string[]</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">disallowedRequestHeaders</code> lists header names never forwarded to the<br />policy server, even if listed in <code class="ks-inline-code">allowedRequestHeaders</code>. Matching is<br />case-insensitive.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">64</span></div><div class="ks-validation-item"><span class="ks-validation-label">List type</span><span class="ks-validation-value">set</span></div></div></details></div></template>
+<template data-ks-field-panel="p414"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">failureMode</code> controls behavior when the policy server is unreachable<br />or returns an error. <code class="ks-inline-code">FailOpen</code> allows the request; <code class="ks-inline-code">FailClosed</code><br />(default) denies it.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">FailClosed, FailOpen</span></div></div></details></div></template>
+<template data-ks-field-panel="p415"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-object">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">metadata</code> is static or CEL-evaluated context surfaced to the policy<br />server as fields of the <code class="ks-inline-code">metadata_context</code> google.protobuf.Struct,<br />keyed by config key. Values are CEL expressions.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max properties</span><span class="ks-validation-value">64</span></div></div></details></div></template>
+<template data-ks-field-panel="p416"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Configures best-effort session affinity using an existing request attribute.<br />For AI backends, this applies across the backend's provider groups and must not<br />be configured on an individual provider.</div></div><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/load-balancing/">documentation/traffic-management/load-balancing</a></div></div></details></div></template>
+<template data-ks-field-panel="p417"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">CEL expression evaluated against request state. It must return a string or bytes value.<br />For example, <code class="ks-inline-code">request.headers[&quot;x-session-id&quot;]</code> or <code class="ks-inline-code">string(source.address)</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">16384</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/load-balancing/">documentation/traffic-management/load-balancing</a></div></div></details></div></template>
+<template data-ks-field-panel="p418"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Settings for managing TLS connections to the backend</div><div class="ks-rich-block">When set, TLS is originated to the backend using the system trusted CA<br />certificates, and SNI is inferred from the destination.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">insecureSkipVerify All and caCertificateRefs may not be set together</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">insecureSkipVerify and verifySubjectAltNames may not be set together</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">certificateSource SPIFFE may not be combined with mtlsCertificateRef, caCertificateRefs, or insecureSkipVerify</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">at most one of the fields in [verifySubjectAltNames insecureSkipVerify] may be set</div></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (7)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/idps/google/">documentation/security/backend-authn/token-exchange/idps/google</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/jwt/setup/">documentation/security/jwt/setup</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/clients/claude-desktop/">integrations/llm/clients/claude-desktop</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/arize/">integrations/llm/observability/arize</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/axiom/">integrations/llm/observability/axiom</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/openai-compatible/">integrations/llm/providers/openai-compatible</a></div></div></details></div></template>
+<template data-ks-field-panel="p419"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Originates TLS but skips verification of the backend's certificate<br />WARNING: insecure; only use if the risks are understood</div><div class="ks-rich-block">Modes:<br />* <code class="ks-inline-code">All</code> disables all TLS verification<br />* <code class="ks-inline-code">Hostname</code> trusts the CA certificate but ignores hostname/SAN mismatches.<br />  Still insecure; prefer <code class="ks-inline-code">verifySubjectAltNames</code> where possible.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">All, Hostname</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
+<template data-ks-field-panel="p420"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Server Name Indicator (<code class="ks-inline-code">SNI</code>) to use in the TLS<br />handshake. If unset, the <code class="ks-inline-code">SNI</code> is automatically set based on the<br />destination hostname.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">253</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (3)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/idps/google/">documentation/security/backend-authn/token-exchange/idps/google</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/jwt/setup/">documentation/security/jwt/setup</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/openai-compatible/">integrations/llm/providers/openai-compatible</a></div></div></details></div></template>
+<template data-ks-field-panel="p421"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Settings for managing tunnel connections to the backend, like <code class="ks-inline-code">HTTPS_PROXY</code></div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">exactly one of the fields in [backendRef url] must be set</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">url must not include a path for backend tunnel</div></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
+<template data-ks-field-panel="p422"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block"><code class="ks-inline-code">backendRef</code> selects a backend for this policy.<br />Mutually exclusive with <code class="ks-inline-code">url</code>.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">Must have port for Service reference</div></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
+<template data-ks-field-panel="p423"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Group of the referent, for example <code class="ks-inline-code">gateway.networking.k8s.io</code>. Empty selects the core API group</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">253</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
+<template data-ks-field-panel="p424"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Kubernetes resource kind of the referent, for example <code class="ks-inline-code">Service</code>. Defaults to <code class="ks-inline-code">Service</code></div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Default</span><span class="ks-validation-value">Service</span></div><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">63</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
+<template data-ks-field-panel="p425"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Name is the name of the referent.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">253</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
+<template data-ks-field-panel="p426"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-integer">integer</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Destination port number. Required when the referent is a Kubernetes <code class="ks-inline-code">Service</code></div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Format</span><span class="ks-validation-value">int32</span></div><div class="ks-validation-item"><span class="ks-validation-label">Minimum</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Maximum</span><span class="ks-validation-value">65535</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (1)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
+<template data-ks-field-panel="p427"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Static hostname, IP address, or Unix Domain Socket backend.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">must specify either unixPath or both host and port</div></div><div class="ks-validation-item"><span class="ks-validation-label">Rule</span><div class="ks-validation-value ks-validation-value-block">unixPath and host/port are mutually exclusive</div></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (17)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/auth0/">documentation/mcp/auth/auth0</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/descope/">documentation/mcp/auth/descope</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/entra/">documentation/mcp/auth/entra</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/okta/">documentation/mcp/auth/okta</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/cross-app-access/">documentation/security/backend-authn/token-exchange/cross-app-access</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/idps/google/">documentation/security/backend-authn/token-exchange/idps/google</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/jwt-bearer/">documentation/security/backend-authn/token-exchange/jwt-bearer</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/mcp/">documentation/security/backend-authn/token-exchange/mcp</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/standard/">documentation/security/backend-authn/token-exchange/standard</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backendtls/">documentation/security/backendtls</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/jwt/setup/">documentation/security/jwt/setup</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/host/">documentation/traffic-management/rewrite/host</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/path/">documentation/traffic-management/rewrite/path</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/clients/claude-desktop/">integrations/llm/clients/claude-desktop</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/arize/">integrations/llm/observability/arize</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/axiom/">integrations/llm/observability/axiom</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
+<template data-ks-field-panel="p428"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Host to connect to for TCP backends.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">256</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (17)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/auth0/">documentation/mcp/auth/auth0</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/descope/">documentation/mcp/auth/descope</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/entra/">documentation/mcp/auth/entra</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/okta/">documentation/mcp/auth/okta</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/cross-app-access/">documentation/security/backend-authn/token-exchange/cross-app-access</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/idps/google/">documentation/security/backend-authn/token-exchange/idps/google</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/jwt-bearer/">documentation/security/backend-authn/token-exchange/jwt-bearer</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/mcp/">documentation/security/backend-authn/token-exchange/mcp</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/standard/">documentation/security/backend-authn/token-exchange/standard</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backendtls/">documentation/security/backendtls</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/jwt/setup/">documentation/security/jwt/setup</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/host/">documentation/traffic-management/rewrite/host</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/path/">documentation/traffic-management/rewrite/path</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/clients/claude-desktop/">integrations/llm/clients/claude-desktop</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/arize/">integrations/llm/observability/arize</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/axiom/">integrations/llm/observability/axiom</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
+<template data-ks-field-panel="p429"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-integer">integer</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Port to connect to for TCP backends.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Format</span><span class="ks-validation-value">int32</span></div><div class="ks-validation-item"><span class="ks-validation-label">Minimum</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Maximum</span><span class="ks-validation-value">65535</span></div></div></details><details class="ks-validation ks-documentation"><summary class="ks-validation-summary">Documentation References (17)</summary><div class="ks-validation-body"><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/auth0/">documentation/mcp/auth/auth0</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/descope/">documentation/mcp/auth/descope</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/entra/">documentation/mcp/auth/entra</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/mcp/auth/okta/">documentation/mcp/auth/okta</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/cross-app-access/">documentation/security/backend-authn/token-exchange/cross-app-access</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/idps/google/">documentation/security/backend-authn/token-exchange/idps/google</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/jwt-bearer/">documentation/security/backend-authn/token-exchange/jwt-bearer</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/mcp/">documentation/security/backend-authn/token-exchange/mcp</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backend-authn/token-exchange/standard/">documentation/security/backend-authn/token-exchange/standard</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/backendtls/">documentation/security/backendtls</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/security/jwt/setup/">documentation/security/jwt/setup</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/host/">documentation/traffic-management/rewrite/host</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../documentation/traffic-management/rewrite/path/">documentation/traffic-management/rewrite/path</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/clients/claude-desktop/">integrations/llm/clients/claude-desktop</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/arize/">integrations/llm/observability/arize</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/observability/axiom/">integrations/llm/observability/axiom</a></div><div class="ks-doc-link-row"><a class="ks-doc-link" href="../../../integrations/llm/providers/backend-tunnel-proxy/">integrations/llm/providers/backend-tunnel-proxy</a></div></div></details></div></template>
+<template data-ks-field-panel="p430"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Filesystem path to a Unix Domain Socket. The gateway pod<br />must share a volume with the target (e.g., via emptyDir sidecar pattern).<br />Mutually exclusive with host/port.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div></div></details></div></template>
+<template data-ks-field-panel="p431"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Current backend status.</div></div></div></template>
+<template data-ks-field-panel="p432"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-complex">object[]</span></div><div class="ks-detail-desc"><div class="ks-rich-block">Current condition state for the backend.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max items</span><span class="ks-validation-value">8</span></div><div class="ks-validation-item"><span class="ks-validation-label">List type</span><span class="ks-validation-value">map</span></div><div class="ks-validation-item"><span class="ks-validation-label">List map keys</span><span class="ks-validation-value">type</span></div></div></details></div></template>
+<template data-ks-field-panel="p433"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">lastTransitionTime is the last time the condition transitioned from one status to another.<br />This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Format</span><span class="ks-validation-value">date-time</span></div></div></details></div></template>
+<template data-ks-field-panel="p434"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">message is a human readable message indicating details about the transition.<br />This may be an empty string.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">32768</span></div></div></details></div></template>
+<template data-ks-field-panel="p435"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-integer">integer</span></div><div class="ks-detail-desc"><div class="ks-rich-block">observedGeneration represents the .metadata.generation that the condition was set based upon.<br />For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date<br />with respect to the current state of the instance.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Format</span><span class="ks-validation-value">int64</span></div><div class="ks-validation-item"><span class="ks-validation-label">Minimum</span><span class="ks-validation-value">0</span></div></div></details></div></template>
+<template data-ks-field-panel="p436"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">reason contains a programmatic identifier indicating the reason for the condition's last transition.<br />Producers of specific condition types may define expected values and meanings for this field,<br />and whether the values are considered a guaranteed API.<br />The value should be a CamelCase string.<br />This field may not be empty.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Min length</span><span class="ks-validation-value">1</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">1024</span></div></div></details></div></template>
+<template data-ks-field-panel="p437"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">status of the condition, one of True, False, Unknown.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Enum</span><span class="ks-validation-value">True, False, Unknown</span></div></div></details></div></template>
+<template data-ks-field-panel="p438"><div class="ks-detail-card"><div class="ks-detail-path" data-ks-detail-path></div><div class="ks-detail-meta-line"><span class="ks-detail-type ks-type-string">string</span><span class="ks-detail-required">Required</span></div><div class="ks-detail-desc"><div class="ks-rich-block">type of condition in CamelCase or in foo.example.com/CamelCase.</div></div><details class="ks-validation"><summary class="ks-validation-summary">Validation</summary><div class="ks-validation-body"><div class="ks-validation-item"><span class="ks-validation-label">Pattern</span><span class="ks-validation-value">^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$</span></div><div class="ks-validation-item"><span class="ks-validation-label">Max length</span><span class="ks-validation-value">316</span></div></div></details></div></template>
 
 </div>
 </template>