Policies

Apply Layer 7 authorization policies and traffic routes to services using an agentgateway waypoint.

When Solo Enterprise for agentgateway is deployed as a waypoint, you can enforce L7 policies on traffic to services in your ambient mesh. Two types of policies work with agentgateway as a waypoint:

• EnterpriseAgentgatewayPolicy: The native Solo Enterprise for agentgateway policy CRD. Supports CEL-based authorization, request transformation, rate limiting, and upstream authentication, including WIMSE workload identity propagation.
• Standard Istio policies: HTTPRoute resources for traffic management are unchanged and continue to work. Currently, Istio AuthPolicy resources are unsupported.

EnterpriseAgentgatewayPolicy

EnterpriseAgentgatewayPolicy is the recommended policy type for agentgateway waypoints. It supports CEL-based authorization expressions that can match on source identity (trust domain, namespace, service account) and request attributes (method, path, headers). For the full field reference, see the EnterpriseAgentgatewayPolicy API reference.

apiVersion: enterpriseagentgateway.solo.io/v1alpha1
kind: EnterpriseAgentgatewayPolicy
metadata:
  name: <policy_name>
  namespace: <namespace>
spec:
  targetRefs:
  - kind: Service           # or ServiceEntry
    group: ""               # use "networking.istio.io" for ServiceEntry
    name: <svc_name>
  traffic:
    authorization:
      action: Allow         # or Deny
      policy:
        matchExpressions:
        - '<CEL_expression>'

CEL expression attributes

Use the following attributes in CEL expressions.

Example: Allow GET and HEAD from specific service accounts

The following policy allows only GET and HEAD requests from two service accounts in the httpbin namespace. All other requests are denied by default.

apiVersion: enterpriseagentgateway.solo.io/v1alpha1
kind: EnterpriseAgentgatewayPolicy
metadata:
  name: httpbin-allow-get-only
  namespace: httpbin
spec:
  targetRefs:
  - kind: Service
    group: ""
    name: httpbin
  traffic:
    authorization:
      action: Allow
      policy:
        matchExpressions:
        - 'source.identity.trustDomain == "cluster1" && source.identity.namespace == "httpbin" && source.identity.serviceAccount == "client-in-ambient" && (request.method == "GET" || request.method == "HEAD")'
        - 'source.identity.trustDomain == "cluster1" && source.identity.namespace == "httpbin" && source.identity.serviceAccount == "client-in-mesh" && (request.method == "GET" || request.method == "HEAD")'

Example: Allow cross-cluster traffic

In a multicluster mesh, include the trust domain of the peer cluster to allow cross-cluster requests.

apiVersion: enterpriseagentgateway.solo.io/v1alpha1
kind: EnterpriseAgentgatewayPolicy
metadata:
  name: httpbin-allow-cross-cluster
  namespace: httpbin
spec:
  targetRefs:
  - kind: Service
    group: ""
    name: httpbin
  traffic:
    authorization:
      action: Allow
      policy:
        matchExpressions:
        - 'source.identity.trustDomain == "cluster1" && source.identity.namespace == "httpbin" && source.identity.serviceAccount == "client-in-ambient" && (request.method == "GET" || request.method == "HEAD")'
        - 'source.identity.trustDomain == "cluster2" && source.identity.namespace == "httpbin" && source.identity.serviceAccount == "client-in-ambient" && (request.method == "GET" || request.method == "HEAD")'

Request transformation

Use traffic.transformation.request.set to add or overwrite headers on inbound requests before they reach the upstream service.

apiVersion: enterpriseagentgateway.solo.io/v1alpha1
kind: EnterpriseAgentgatewayPolicy
metadata:
  name: add-workload-header
  namespace: <namespace>
spec:
  targetRefs:
  - kind: Service
    group: ""
    name: <svc_name>
  traffic:
    transformation:
      request:
        set:
        - name: x-istio-workload
          value: "<VALUE>"

Transformation runs before authorization, so downstream services receive the enriched headers regardless of which rule matched.

Targeting ServiceEntries

To apply a policy to a ServiceEntry-backed service, set kind: ServiceEntry and group: networking.istio.io in targetRefs:

spec:
  targetRefs:
  - kind: ServiceEntry
    group: "networking.istio.io"
    name: <SERVICEENTRY_NAME>

Targeting global services

In a multicluster mesh, an EnterpriseAgentgatewayPolicy that targets a Kubernetes Service can automatically extend to the corresponding global service. Add the solo.io/service-inheritance: "true" annotation to the policy. The waypoint controller then expands the policy to cover traffic addressed to the global hostname (for example, <service>.<namespace>.mesh.internal).

apiVersion: enterpriseagentgateway.solo.io/v1alpha1
kind: EnterpriseAgentgatewayPolicy
metadata:
  name: <policy_name>
  namespace: <namespace>
  annotations:
    solo.io/service-inheritance: "true"
spec:
  targetRefs:
  - group: ""
    kind: Service
    name: <svc_name>
  traffic:
    ...

To enable inheritance for all EnterpriseAgentgatewayPolicy resources without annotating each one, set ENABLE_SERVICE_INHERITANCE=true on the istiod deployment. To opt individual resources out when the environment variable is set, annotate them with solo.io/service-inheritance: "false".

For HTTPRoute resources targeting a global service, see Standard Istio policies.

Workload identity propagation (WIT/WIMSE)

EnterpriseAgentgatewayPolicy supports a backend.workloadIdentity field that controls how the waypoint presents workload identity on outbound requests to upstream services. The backend.workloadIdentity field is mutually exclusive with backend.auth and backend.tokenExchange.

For configuration details and examples, see Workload identity tokens (WIT/WIMSE).

Standard Istio policies

AuthorizationPolicy is not yet supported with the agentgateway waypoint. Use EnterpriseAgentgatewayPolicy for authorization.

HTTPRoute resources work with agentgateway waypoints in the same way that they work with community waypoints. Reference the target service in parentRefs.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: reviews
  namespace: default
spec:
  parentRefs:
  - group: ""
    kind: Service
    name: reviews
    port: 9080
  rules:
  - backendRefs:
    - name: reviews-v1
      port: 9080
      weight: 90
    - name: reviews-v2
      port: 9080
      weight: 10

To attach an HTTPRoute to a global service in a multicluster mesh, use the GlobalService synthetic kind in parentRefs instead of targeting the local Service or its autogenerated ServiceEntry:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: <route_name>
  namespace: <namespace>
spec:
  parentRefs:
  - group: networking.istio.io
    kind: GlobalService
    name: <svc_name>
  rules:
  - ...

Rate limiting

Rate limiting at the agentgateway waypoint uses the same two-resource pattern as the native Solo Enterprise for agentgateway:

1. A RateLimitConfig (ratelimit.solo.io/v1alpha1) defines the limit rules (request-based, token-based, or CEL-based).
2. An EnterpriseAgentgatewayPolicy applies those rules to a target by referencing them in traffic.entRateLimit.global.rateLimitConfigRefs.

The following example limits a service to 5 requests per minute.

apiVersion: ratelimit.solo.io/v1alpha1
kind: RateLimitConfig
metadata:
  name: my-service-rate-limit
  namespace: <namespace>
spec:
  raw:
    descriptors:
    - key: generic_key
      value: counter
      rateLimit:
        requestsPerUnit: 5
        unit: MINUTE
    rateLimits:
    - actions:
      - genericKey:
          descriptorValue: counter
      type: REQUEST
---
apiVersion: enterpriseagentgateway.solo.io/v1alpha1
kind: EnterpriseAgentgatewayPolicy
metadata:
  name: my-service-rate-limit
  namespace: <namespace>
spec:
  targetRefs:
  - kind: Service
    group: ""
    name: <svc_name>
  traffic:
    entRateLimit:
      global:
        rateLimitConfigRefs:
        - name: my-service-rate-limit

For token-based rate limiting, CEL-based limiting, and MCP-specific rate limiting, see the Solo Enterprise for agentgateway rate limiting documentation.