Agentgateway as an ingress gateway

Install agentgateway and deploy it as an ingress gateway to route external traffic into your ambient mesh.

Deploy Solo Enterprise for agentgateway as an ingress gateway for your ambient mesh. Solo Enterprise for agentgateway uses the enterprise-agentgateway GatewayClass and is fully conformant with the Kubernetes Gateway API. It is the recommended ingress gateway for ambient meshes, whether you route general API traffic, AI agents, MCP servers, or LLM backends.

Unlike Solo Enterprise for kgateway, which runs inside the ambient mesh, agentgateway ingress runs outside the ambient data plane. This is the same model as an Istio ingress gateway: the ingress pod is not captured by ztunnel and instead obtains its own Istio certificate directly from Istiod. The ingress pod then opens HBONE connections to mesh services, so traffic is still mutually authenticated end-to-end and appears in mesh telemetry. This approach is compatible with PeerAuthentication in STRICT mode without additional annotations.

Before you begin

1. Install an ambient mesh that runs the Solo distribution of Istio 1.30 or later with an Enterprise-level Solo Enterprise for Istio license. To set up an ambient mesh, see the install guides for a single cluster or multicluster mesh.

2. Install the following CLI tools.

   • kubectl, the Kubernetes command line tool. Download the kubectl version that is within one minor version of the cluster you plan to use.
   • helm, the Kubernetes package manager.

3. Save the following Solo Enterprise for agentgateway details.

   • Version: Save the Solo Enterprise for agentgateway version for your Solo Enterprise for Istio release. To find available versions, see the supported versions matrix.
   • License: Save your Solo Enterprise for agentgateway license key. Contact your account representative to obtain a valid license.

   export AGENTGATEWAY_VERSION=v2026.6.0
   export AGENTGATEWAY_LICENSE_KEY=<license_key>

Install Solo Enterprise for agentgateway

1. Install the Solo Enterprise for agentgateway CRDs.

   helm install enterprise-agentgateway-crds \
     oci://us-docker.pkg.dev/solo-public/enterprise-agentgateway/charts/enterprise-agentgateway-crds \
     --version ${AGENTGATEWAY_VERSION} \
     -n agentgateway-system \
     --create-namespace

2. Install the Solo Enterprise for agentgateway Helm chart, with the Istio integration enabled. When Istio integration is enabled, the controller sets the ingress pod’s ambient dataplane mode to none so that ztunnel does not capture its traffic. The gateway then authenticates with Istiod directly and originates HBONE connections to mesh services. For all available values, see the Helm reference.

   helm install enterprise-agentgateway \
     oci://us-docker.pkg.dev/solo-public/enterprise-agentgateway/charts/enterprise-agentgateway \
     --version ${AGENTGATEWAY_VERSION} \
     --set licensing.licenseKey=${AGENTGATEWAY_LICENSE_KEY} \
     --set istio.autoEnabled=true \
     -n agentgateway-system

3. Verify that the enterprise-agentgateway control plane pod is running.

   kubectl get pods -n agentgateway-system

   Example output:

   NAME                                        READY   STATUS    RESTARTS   AGE
   enterprise-agentgateway-1a2b3c4d5e-6f7g8    1/1     Running   0          19s

Deploy the ingress gateway

1. Save the namespace where you want to deploy the ingress gateway.

   export INGRESS_NAMESPACE=<namespace>

2. Create a Gateway resource using the enterprise-agentgateway GatewayClass. Because istio.autoEnabled=true was set during install, Istio integration is already enabled for all built-in-class gateways and no per-gateway EnterpriseAgentgatewayParameters resource is needed. The controller provisions a proxy pod and a LoadBalancer service in the same namespace.

   kubectl apply -f - <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: agentgateway-ingress
     namespace: ${INGRESS_NAMESPACE}
   spec:
     gatewayClassName: enterprise-agentgateway
     listeners:
     - name: http
       port: 8080
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: All
   EOF

3. Verify that the ingress gateway pod is running and the Gateway is programmed.

   kubectl get pods -n ${INGRESS_NAMESPACE} -l gateway.networking.k8s.io/gateway-name=agentgateway-ingress
   kubectl get gateway agentgateway-ingress -n ${INGRESS_NAMESPACE}

   Example output:

   NAME                                      READY   STATUS    RESTARTS   AGE
   agentgateway-ingress-6d9f7b8c4-xr2vk      1/1     Running   0          30s
   
   NAME                    CLASS                     ADDRESS          PROGRAMMED   AGE
   agentgateway-ingress    enterprise-agentgateway   198.51.100.10    True         35s

4. Save the external IP address of the ingress gateway.

   export INGRESS_GW_ADDRESS=$(kubectl get gateway agentgateway-ingress -n ${INGRESS_NAMESPACE} \
     -o jsonpath='{.status.addresses[0].value}')
   echo $INGRESS_GW_ADDRESS

Route traffic with HTTPRoute

Create an HTTPRoute to forward incoming requests to a service in your ambient mesh. The following example routes requests for www.example.com to the productpage service in the bookinfo namespace.

1. Create an HTTPRoute that references the ingress gateway.

   kubectl apply -f - <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: productpage
     namespace: bookinfo
   spec:
     parentRefs:
     - name: agentgateway-ingress
       namespace: ${INGRESS_NAMESPACE}
     hostnames:
     - "www.example.com"
     rules:
     - matches:
       - path:
           type: PathPrefix
           value: /productpage
       backendRefs:
       - name: productpage
         port: 9080
   EOF

2. Send a request to the ingress gateway to verify that traffic reaches the app.

   curl -H "Host: www.example.com" http://${INGRESS_GW_ADDRESS}:8080/productpage

   A 200 OK response with the Bookinfo product page HTML confirms the route is working.

3. Verify that mTLS is used between the ingress gateway and the app pod. For more information about this command, see the CLI reference.

   istioctl ztunnel-config connections --namespace bookinfo

   The PROTOCOL column shows HBONE for inbound connections to the app pod, confirming that agentgateway opens an HBONE connection to the ztunnel node proxy and that traffic is mutually authenticated end-to-end.

   Example output:

   WORKLOAD                                    DIRECTION   LOCAL           REMOTE                                   REMOTE TARGET   PROTOCOL   CONN ID
   productpage-6d6bdc6fd6-xr2vk.bookinfo       Inbound     10.0.0.5:9080   agentgateway-ingress.ingress-ns:52314    10.0.0.5:9080   HBONE      1a2b3c4d

Next

• Control in-mesh traffic by creating an agengateway waypoint proxy.
• Install the Solo UI to review your resources and traffic between services in the mesh.
• For advanced agentgateway configuration, such as AI policies, rate limiting, and LLM backends, see the Solo Enterprise for agentgateway documentation.

Uninstall

1. Delete the HTTPRoute.

   kubectl delete httproute productpage -n ${APP_NAMESPACE}

2. Delete the Gateway resource.

   kubectl delete gateway agentgateway-ingress -n ${INGRESS_NAMESPACE}

3. Uninstall the Solo Enterprise for agentgateway Helm chart and CRDs.

   helm uninstall enterprise-agentgateway -n agentgateway-system
   helm uninstall enterprise-agentgateway-crds -n agentgateway-system