Skip to content

Policy order and targeting docs#339

Open
artberger wants to merge 1 commit intomainfrom
adb-policy-info
Open

Policy order and targeting docs#339
artberger wants to merge 1 commit intomainfrom
adb-policy-info

Conversation

@artberger
Copy link
Collaborator

Closes #336

@artberger artberger self-assigned this Mar 25, 2026
@artberger artberger added documentation Improvements or additions to documentation agentgateway labels Mar 25, 2026
@cloudflare-workers-and-pages
Copy link

Deploying agentproxy with  Cloudflare Pages  Cloudflare Pages

Latest commit: fdfc915
Status: ✅  Deploy successful!
Preview URL: https://7dd8366b.agentproxy.pages.dev
Branch Preview URL: https://adb-policy-info.agentproxy.pages.dev

View logs


Agentgateway processes each request through four phases in the following order. You cannot change the phase order, but you can control which filters run in each phase by configuring the appropriate policy sections.

```mermaid
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like this:

Image

description: Learn about how AgentgatewayPolicy sections target different Kubernetes resource types, and how policies are merged when multiple policies apply to the same resource.
---

{{< reuse "agw-docs/pages/agentgateway/about/policies.md" >}}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure we needed it in 2.2.x as pre/ post routing was not in place

| 11 | Cross-Site Request Forgery (CSRF) | `csrf` |
| 12 | Header modifiers | `headerModifiers` |
| 13 | Host rewrite | `hostRewrite` |
| 14 | Direct response | `directResponse` |
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am assuming this is only supported in the postrouting phase since not all of these are supported in the prerouting phase?

| 13 | Host rewrite | `hostRewrite` |
| 14 | Direct response | `directResponse` |

### PreRouting filters
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
### PreRouting filters
### Supported PreRouting filters

Copy link
Collaborator

@howardjohn howardjohn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice!

| -- | -- | -- | -- |
| `frontend` | Gateway | Not allowed | Applies to all listeners on the targeted Gateway. |
| `traffic` | Gateway, HTTPRoute, GRPCRoute, ListenerSet | Optional | When targeting a Gateway, the `sectionName` selects a specific listener. When targeting an HTTPRoute or GRPCRoute, the `sectionName` selects a specific route rule. |
| `backend` | Gateway, HTTPRoute, GRPCRoute, ListenerSet, Service, {{< reuse "agw-docs/snippets/agentgateway/agentgatewaybackend.md" >}} | Optional | When targeting a Service, the `sectionName` selects a specific port. When targeting an {{< reuse "agw-docs/snippets/agentgateway/agentgatewaybackend.md" >}}, the `sectionName` selects a specific sub-backend. |
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is gateway really supported as a backend?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes! For example, you may want to do "for all calls to all backends enable keepalives" etc.

| -- | -- |
| `frontend` | Field-level merge across policies that target the same Gateway. |
| `traffic` | Gateway < Listener < Route < Route Rule |
| `backend` | Gateway < Listener < Route < Route Rule < Backend/Service |
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a bit off. While AgentgatewayPolicy can currently on targetRef things, there is inline filters in HTTPRoute which translate down to the same policy concept in the data plane. i nthe future we may allow filters pointing to AGWPolicy as well.

Gateway < Listener < Route (targetRef) < Route Rule (targetRef) < Backend (targetRef) < backend (inline on backend object) < route backend ref (inline on route )

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agentgateway documentation Improvements or additions to documentation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Filter order of policies

3 participants