Demos, deployment patterns and guides for Istio Ambient and the service mesh.

Agentic Architecture Part 1 of 3 Enterprise

Secure Sovereign AI on EKS, Part 1: Zero Trust Infrastructure

An open-weight European model on UK infrastructure, with a control at every layer. An interactive topology of the real eu-west-2 deployment: the hardened AWS edge, Istio ambient with ztunnel and a waypoint, a Vault that is both the mesh CA and the secrets store, agentgateway as the one door for LLM, MCP and inference, kagent, agentregistry and Kyverno, in front of Mistral on vLLM. Sovereignty stated in tiers (data residency, key custody, traffic control), secrets leased from Vault, etcd and backups encrypted in-region, and backup/restore with Velero and a Vault raft snapshot.

Istio ambient + Vault CAagentgateway one doorkagent + gVisorPSA + KyvernoMistral on vLLM

Open the lab → Agentic Reference Part 2 of 3 Enterprise

Secure Sovereign AI on EKS, Part 2: Testing the exploits

The proof to part 1's architecture: twelve controls, each made to refuse a real request, live on the cluster with its real output. Mistral over TLS, a 401 with no token, five admission refusals, a pod that cannot steal the node's role, Vault surviving a pod kill, one-hour SPIFFE certs, an agent that only runs if it came from the registry, an agent denied a tool it isn't entitled to, a per-identity rate limit capping the tempo, a pod provably in a gVisor sandbox, and a real alert email, with a live Grafana dashboard of the stack.

JWT 401 / 2005 admission refusalsagent from registry onlyper-tool MCP authzper-identity rate limitgVisor proof

Open the lab → Agentic Architecture Part 3 of 3 Enterprise

Secure Sovereign AI on GKE, Part 3: The Same Architecture on Google Cloud

The Part 1 architecture on Google Cloud: the same interactive topology with every AWS service swapped for its GCP equivalent, EKS to GKE, S3 to Cloud Storage, KMS to Cloud KMS, IRSA to Workload Identity, the NLB to a passthrough Network Load Balancer, in europe-west2 (London). The security lives in the mesh and the gateway, so the move is a substrate swap, not a redesign. A service-by-service mapping table and a short why-it-ports note; the layer explanations stay in Part 1. This lab deploys to AWS today.

EKS → GKES3 → Cloud StorageKMS → Cloud KMSIRSA → Workload Identityeurope-west2

Open the lab → Agentic Application Lab Part 1 of 2 Enterprise

Claude Code plugins in AgentRegistry, part 1: publish and install

Register a Claude Code plugin as a commit-pinned Plugin pointer, read the inventory the controller scans out of the bundle, serve the catalogue as a marketplace.json through agentgateway, then install it into your own Claude Code and run it. Nine steps on one kind cluster. Pre-GA, so step 1 builds the image.

Plugin · ar.dev/v1alpha1status.inventorymarketplace.jsonagentgateway ingressclaude plugin install

Open the lab → Agentic Reference Part 2 of 2 OSS

Claude Code plugins in AgentRegistry, part 2: inside the policy-review plugin

Part two. The plugin from part one, taken apart: one rule engine behind policy-lint (a file or a whole tree) and cluster-review (a live cluster over kubectl), where each rule is grounded, why the same {{ }} is right in kgateway and an error in agentgateway, and what the PreToolUse hook does to a kubectl apply.

policy-lint · file or treecluster-review · kubectlstatus.ancestors AttachedCEL vs InjaPreToolUse hook

Read the reference → Agentic POC Getting Started Enterprise

kagent quickstart: your first POC

The kagent companion to the agentgateway POC: empty cluster to a working, governed, observable Solo Enterprise for kagent. Install (CRDs + controller + UI by Helm), Keycloak, an MCP tool server, agents deployed declaratively and BYO (Google ADK), AccessPolicies, tracing, and a gVisor SandboxAgent. Helm only, YAML + copy-paste per step, apply and validate in separate cells.

Helm installKeycloak (OIDC)MCPDeclarative + BYO/ADKAccessPoliciesTracingSandboxAgentkind / any k8s

Open the lab → Agentic POC Getting Started Enterprise

agentgateway quickstart: your first POC

The lab to hand a customer on day one: empty cluster to a working, secured, observable Solo Enterprise for agentgateway. Install (CRDs + control plane + UI by Helm), Keycloak, a Gateway + HTTPRoute, an MCP tool server, observability, and LLM cost by dimension. A checklist up top and an official-docs link on every step. Runs on kind or any cluster.

Helm installKeycloak (OIDC)Gateway + HTTPRouteMCPObservabilityCost Managementkind / any k8s

Open the lab → Agentic Application Lab OSS

Per-team Bedrock cost profiling with application inference profiles, through agentgateway

See Amazon Bedrock LLM usage and cost broken out per team even though every team shares one gateway to Bedrock: one application inference profile per team, one AgentgatewayBackend, per-team tokens from the gateway's gen_ai_request_model metric and per-team dollars from AWS Cost Explorer. A JWT team claim picks each team's profile so no client carries an ARN.

Solo Enterprise for agentgatewayAmazon Bedrock · ConverseApplication inference profilesgen_ai_request_model metrickind

Open the demo → Agentic Application Lab OSS

Claude Code on a non-Anthropic model, through agentgateway

Run Claude Code against a model you run instead of Anthropic's, with the model key held in the cluster and every call gated by identity. Solo Enterprise for agentgateway serves the Anthropic Messages API, translates it to an OpenAI model behind the gateway and translates the reply back, with JWT authentication and a CEL rule in front.

Solo Enterprise for agentgatewayAnthropic ↔ OpenAIEnterpriseAgentgatewayPolicy · JWT + CELAgentgatewayBackend · ai.routeskind

Open the demo → Cloud Connect Application Lab OSS

Shipping request events from kgateway over OpenTelemetry

Meter API usage per customer at the kgateway edge with no backend instrumentation: one ListenerPolicy ships each request as an OpenTelemetry access-log record over OTLP to a collector and into self-hosted OpenMeter, off the request path so metering never slows or breaks live traffic.

OSS kgateway 2.2ListenerPolicy · OTLP access logOpenMeter collectorself-hosted OpenMeterkind

Open the demo → Cloud Connect Application Lab Enterprise

Versioned cluster routing with Solo Enterprise for kgateway

Route every request to the right versioned app cluster and keep those clusters independent, using an out-of-cluster kgateway that picks the target from a client header or a JWT version claim and defaults to latest.

Solo Enterprise for kgatewayGateway API · HTTPRouteout-of-cluster BackendentJWT · claimsToHeaderskind

Open the demo → Cloud Connect Application Lab OSS

Versioned cluster routing with agentgateway (part 2)

Route each request to the right versioned app cluster from a gateway outside them, choosing v2 or latest from an override header or a JWT claim and defaulting to latest, so no client can fake its version. Same lab as part 1, now on the agentgateway Rust data plane.

Solo Enterprise for agentgatewayEnterpriseAgentgatewayPolicyCEL · PreRoutingAgentgatewayBackendkind

Open the demo → Agentic Application Lab Enterprise

AgentRegistry end to end, part 3: one agent, three runtimes, governed MCP tools

Run one published agent unchanged on three runtimes (Solo Enterprise for kagent, AWS Bedrock AgentCore, Google Cloud Vertex), pulling approved MCP tools from the AgentRegistry catalog, then lock down which tools it may call with a kagent AccessPolicy enforced at an agentgateway waypoint and watch its tool list shrink live.

arctl · init / build / applyAgentRegistry · in-clusterRuntime · kagent / AgentCore / GeminiAgentRuntimeAccessPolicy · agentgateway waypointKeycloak · OIDC

Open the demo → Agentic Application Lab Enterprise

AgentRegistry end to end, part 2: one realm, two teams, a policy-partitioned catalog

Give three people three different views of one shared AgentRegistry catalog. Registry OIDC maps each Keycloak group to a role, the catalog goes default-deny, and two AccessPolicy resources partition it per team, with every read and publish denial captured live.

AccessPolicy · ar.dev/v1alpha1registry:read / publishRBAC_ROLE_CLAIM=groupssuperuser · field-adminKeycloak · one realm

Open the demo → Agentic Application Lab Enterprise

AgentRegistry end to end, part 1: arctl from init to an agent hosted on kagent

Take three catalog artifacts (an MCP server, a skill, and an agent) from an arctl init scaffold to a summarizer agent hosted on Solo Enterprise for kagent, reachable only with a valid Keycloak token. One kind cluster runs the whole AgentRegistry lifecycle: scaffold, build, publish, deploy, then invoke live over the OIDC-protected A2A endpoint.

arctl · init / run / build / applyAgentRegistry · ar.dev/v1alpha1Runtime · Kuberneteskagent · BYO Agent + kmcpKeycloak · OIDC · A2A

Open the demo → Agentic Platform Lab Enterprise

Full Solo Enterprise Install deployment

Stand up the whole Solo Enterprise agentic platform on one kind cluster: Keycloak as the single OIDC issuer, Solo for kagent, the Enterprise UI, in-cluster AgentRegistry, and Istio ambient with enterprise agentgateway, all reachable at http://*.localtest.me. Installed product by product in dependency order, with every Helm flag and config note explained.

Istio ambient · Gloo OperatorKeycloak · one OIDC realmkagent + AgentRegistryagentgateway · ingress + waypointOTel · ClickHouse · Tracing

Open the lab → Agentic Application Lab OSS

agentgateway standalone on AWS — three nodes, one config file, no Kubernetes

Run agentgateway as a systemd binary on three EC2 instances across three AZs, configured by a single YAML file. S3 for config with the gateway's own file watcher doing the reload, Aurora for the request log and the config overlay, ElastiCache for fleet-wide rate limits, Cognito for identity. Every feature shown config-first then proved, plus four HA exercises.

standalone binarysystemd on EC23 AZs + ASGAurora overlayportable MCP sessions

Open the lab → Agentic Application Lab Enterprise

Code mode in agentgateway — one run_code tool instead of a wall of MCP tools

Expose the whole nineteen-operation Swagger petstore through agentgateway as a single run_code tool (toolMode: Code) on kind, then watch a model answer a plain-English question by writing one JavaScript program the gateway runs in a sandbox instead of one MCP call per operation.

agentgateway code modetoolMode: Coderun_codeOpenAPI → TS APIMCP

Open the demo → Agentic Application Lab Enterprise

Running agent frameworks on kagent: ADK, LangGraph, CrewAI and AutoGen

Run one Kubernetes incident-response workflow five ways on a single kind cluster (kagent-native, Google ADK, LangGraph, CrewAI, AutoGen), each on Solo Enterprise for kagent and reaching its model and tools through enterprise agentgateway. All five diagnose a broken checkout Deployment, one prompt guard on the LLM route protects every one, and no agent gets rewritten.

ADK · LangGraph · CrewAI · AutoGenBYO agentskagent adapters + A2A shimLLM + MCP via agentgatewayprompt guard

Open the demo → Agentic Application Lab Enterprise

Agent identity and scoped tools — one agent can act, the other can't (Part 2)

The enterprise follow-on to the agentic contract. Two agents reach one MCP server that stands in for a locked database; enterprise agentgateway validates each agent's identity token and scopes its tools, so the read-only dba-diagnoser can only diagnose while the privileged sre-remediator can call db_reset_credentials and fix it. Same server, one policy, two identities. The Postgres is simulated — no real DB deployed.

agentgateway MCP authzagent identity (JWT)per-tool RBACKeycloakEnt kagent

Open the demo → Agentic Application Lab OSS

The agentic contract — one JSON shape shared across an A2A call (Part 1)

An SRE orchestrator delegates a database incident to a DBA specialist over A2A, and the specialist answers in one strict Diagnosis shape. Build the specialist twice: a declarative agent forced through a record_diagnosis MCP tool whose schema is the contract, and a BYO Google ADK agent whose pydantic output_schema is the contract. Same shape either way, so the orchestrator swaps between them without noticing.

kagent A2Adeclarative vs BYOGoogle ADK output_schemarecord_diagnosis MCPSRE → DBA

Open the demo → Agentic Application Lab OSS

MCP 2026-07-28 on the wire, live: MRTR and Tasks through agentgateway

Declare agentgateway v1.4.1 (OSS) through Kubernetes CRDs on kind, put it in front of a single-file MCP server, and drive the final spec with full curl commands: server/discover with no handshake, an MRTR elicitation that resumes after the whole server deployment is replaced, a tampered requestState dying at HMAC verification, and a release pipeline running as an MCP Task with a human approval gate. The gateway rejects header/body mismatches before they reach any backend.

agentgateway v1.4.1AgentgatewayBackendMRTRio.modelcontextprotocol/tasksMcp-Method / Mcp-Namekind

Open the demo → Agentic Application Lab Enterprise

Agent-to-Agent in kagent — an SRE that delegates DB incidents to a DBA

Stand up two kagent agents on kind and watch an SRE orchestrator delegate a database incident to a DBA specialist over A2A (agent-to-agent message/send), captured live from the cluster. Runs on Solo Enterprise for kagent, so the caller's identity rides into the agent as an exchanged On-Behalf-Of token.

kagent A2Atools[].type: Agenta2aConfig.skillsSRE → DBAOBO identity

Open the demo → Agentic Application Lab OSS

AgentHarness SRE Sandbox — OpenClaw triages and fixes the cluster

Stand up an on-call SRE agent in a sandbox inside your own kind cluster: it triages broken workloads and patches the autofix=true namespace, but hits a real 403 in the namespace without the label and escalates that one to Slack. What it may change is enforced by Kubernetes RBAC, not the prompt (kagent's AgentHarness standing up an OpenClaw sandbox via an OpenShell gateway).

kagent AgentHarnessOpenShell + OpenClawModelConfiglabel-gated RBACSlack escalation

Open the demo → Agentic Application Lab OSS

Inference routing on agentgateway — KV-cache-aware routing to a self-hosted model pool

Route LLM traffic to a self-hosted model pool and let agentgateway pick the replica from the model servers' live load. The HTTPRoute backend is an InferencePool, not a Service, so the Gateway API Inference Extension Endpoint Picker routes on KV-cache usage and queue depth. Two llm-d simulators with pinned gauges flip the routing decision on cue, no GPU. One kind cluster, driven by a notebook.

agentgateway v2.3.4InferencePool v1Endpoint PickerInferenceObjectivellm-d inference sim

Open the demo → Agentic Application Lab OSS

vLLM Semantic Router on agentgateway — model-aware routing as ExtProc

Route every chat request to the right model or LoRA adapter by prompt content, while clients only ever send "model": "auto" to one endpoint. The vLLM Semantic Router runs inline as a gRPC ExtProc on OSS upstream agentgateway, classifies each prompt and rewrites the request body, on a single kind cluster.

OSS agentgatewayAgentgatewayPolicyextProc processingOptionsAgentgatewayBackend ai.providervLLM + LoRA

Open the demo → Agentic Application Lab OSS

AI Data Loss Prevention — built-in regex + custom webhook

Keep PII out of your LLM calls and block prompt injection at the gateway, using Solo Enterprise agentgateway in front of Anthropic Claude with two stacked promptGuard layers (built-in regex plus a custom webhook) on both request and response.

Solo Enterprise AGWEnterpriseAgentgatewayPolicypromptGuard.request + responseGuardrail Webhook APIAnthropic Claude

Open the demo → Agentic Application Lab OSS

Bring your own guardrail — an external AI firewall on the agentgateway webhook

Plug a third-party AI firewall (NeuralTrust GAF) into agentgateway's promptGuard webhook and enforce Pass/Mask/Reject in front of any LLM. The guard is decoupled from the backend, so one adapter protects an Anthropic, OpenAI or Gemini route unchanged.

Solo Enterprise AGWpromptGuard.webhookexternal guardrailNeuralTrust GAFAnthropic Claude

Open the demo → Agentic Application Lab Enterprise

Cost management on agentgateway — budgets, virtual keys and per-team spend

See which team, user or model is spending on LLM calls and cap that spend before it runs away, all priced by agentgateway and enforced by EnterpriseAgentgatewayBudget on one kind cluster.

Solo Enterprise AGWCost ManagementEnterpriseAgentgatewayBudgetvirtual API keysClickHouse

Open the demo → Agentic Application Lab Enterprise

Per-team static key injection — swap a user JWT for a team API key

Give every team its own upstream LLM API key without any user ever holding a credential: agentgateway validates the user's JWT, routes on the verified team claim, and injects that team's static key. Signed-claim selection means a client can't spoof its way onto another team's key.

Solo Enterprise AGWjwtAuthenticationclaim → headerpolicies.auth.secretRefPreRouting

Open the demo → Agentic Application Lab Enterprise

Impose Human Approval on an Agent the Developer Built

Two identical ADK agents, one deemed risky by an external review. A Kyverno policy reads a ConfigMap and turns on kagent's own approval flow — no code change, no rebuild, and nothing the developer can switch off.

kagent EnterpriserequireApprovalAgentRegistry · arctlKyverno admissionrisk register

Open the demo → Agentic Application Lab OSS

End-User and Platform Approval Gates for MCP Agents

Put two independent human approval gates on one MCP agent: the end user approves changes to their own data inside the kagent chat, while a platform reviewer approves shared-infrastructure changes from a separate queue the agent never sees.

kagentagentgateway · extAuthMCP · Streamable HTTPLangGraph interrupt()HTMX UI

Open the demo → Agentic Application Lab OSS

Per-User MCP Tool RBAC — same agent, different visible tools

One MCP server hands each caller a different set of tools and hides the rest, filtered at the gateway from the caller's JWT so forbidden tools never reach the LLM.

kagentSolo Enterprise AGWEnterpriseAgentgatewayPolicymcp.authorization · CELJWT · jwt.team

Open the demo → Agentic Application Lab

Per-user MCP RBAC, one Agent on kagent and AgentCore

Ship one ADK-Python agent from a single AgentRegistry record and run it on both in-cluster kagent and AWS Bedrock AgentCore, changing only the runtimeRef. An agentgateway in front of the shared Solo KB MCP gates each request to individual tools by Keycloak group.

AgentRegistry · ar.dev/v1alpha1Runtime · Kagent + BedrockAgentCoreAccessPolicy · targetRef.toolsKeycloak · UserGroup claimADK-Python · Solo KB MCP

Open the demo → Agentic Application Lab OSS

Loop and Runaway Containment at the Gateway — max turns + max tool calls + max chain depth + repetition

Stop a runaway agent at the gateway by enforcing four per-session budgets (max tool calls, max turns, max chain depth, repetition) on MCP tools/call traffic, with every cut-off returning a structured JSON deny the agent can parse.

Solo Enterprise AGWEnterpriseAgentgatewayPolicyext-auth · forwardBodyRedis counterscontrolled cut-offper-session budgets

Open the demo → Agentic Application Lab OSS

Locking Down MCP Tools at the Gateway — approved manifest + risk tiers + chain rules

Only curator-approved tools reach the agent, and every tools/call is checked before it hits the upstream. One curated manifest drives the gateway allow-list, the sanitized tools/list, and a gRPC ext-auth that validates args, gates high-risk tools by JWT intent, and blocks forbidden call chains.

agentregistrySolo Enterprise AGWEnterpriseAgentgatewayPolicyext-auth · forwardBodyJSON SchemaRedis

Open the demo → Agentic Application Lab Enterprise

Per-Team LLM Token Budgets — the gateway caps the spend

Give each team a hard LLM token budget that agentgateway enforces: it reads usage.total_tokens off each response and debits that team's bucket, so an over-budget team gets 429 on its next call while every other team keeps working.

kagentSolo Enterprise AGWRateLimitConfig · type:TOKENEnterpriseAgentgatewayPolicyPrometheus + Grafana

Open the demo → Agentic Application Lab

Rug Pull MCP Hack Demo

A fake retail bank with an AI-powered chatbot driving three kagent agents over A2A, each backed by MCP tool servers fronted by agentgateway. A third-party currency-converter vendor gets rug-pulled mid-prompt and tries to exfiltrate the customer's PII — the mesh catches it at the wire, not the model.

kagentagentgatewayMCP rug-pullDORA Article 17kind

Open the demo → Agentic Application Lab

Agentic / MCP Lab — federation, JWT RBAC, OAuth2 token exchange

Put several MCP servers behind one Ambient enterprise-agentgateway-waypoint, federate them into a single MCP session, and gate every call by SPIFFE identity, MCP tool name, per-user JWT and OAuth2 token exchange. Six labs build it up on the multicluster standup, ending with a cross-cluster twist over HBONE.

MCP federationSPIFFE authzJWT RBACOAuth2 / RFC 8693enterprise-agentgateway-waypoint

Open the lab → Cloud Connect Application Lab Enterprise

Ambient Deployment and L4/L7 Policies Demo

One petshop app, the whole ambient security model. Every workload gets a SPIFFE SVID from its ServiceAccount; ztunnel authorizes on that identity at L4 with no waypoint, proven from the access logs. Hit the shared-ServiceAccount gap, then add an agentgateway waypoint, wire in Keycloak, and do L7 properly — JWT + CEL authz, a canary split, and a rate limit by workload identity. Ends with workload claims: signed claims in each pod's cert close that gap at L4, live.

Solo Istio 1.30.3-soloSPIFFE / SVIDztunnel L4 authzworkload claimswaypoint + JWTKeycloakkind

Open the demo → Cloud Connect Application Lab OSS

Sidecars to Ambient When Your PKI Is RSA

The mesh CA is Vault behind cert-manager istio-csr and the PKI is all RSA, with the signing role locked to key_type=rsa. Sidecars are happy. Then ambient arrives and ztunnel, which only generates ECDSA P-256 keys, gets every CSR rejected. Break it on purpose in a scratch namespace, fix it with key_type=any, roll the sidecars once for HBONE interop, and migrate one namespace under load while the RSA namespace never notices, same cert serials and all.

Istio 1.30.3 (upstream)Vault PKIistio-csrRSA → ECSTRICT mTLSfortiokind

Open the lab → Cloud Connect Application Lab OSS

Sidecar to Ambient on OSS Istio

The same sidecar-to-ambient migration, on upstream community Istio: no licence, no operator. The mesh goes bilingual with a helm upgrade, then every namespace migrates with one label flip and flips back the same way. Every L7 namespace shares one cluster-wide waypoint (allowedRoutes: All + two labels), the L4 namespace needs none, the canary moves to HTTPRoute, and the mixed-fleet gap community images leave open is shown live before the calling estate closes it. Zero downtime at every cut, then rollback.

Istio 1.30.3 (upstream)one cluster-wide waypointlabel-flip + rollbackDR / VS → HTTPRoutekind

Open the demo → Cloud Connect Application Lab Enterprise

Multi-region load balancing and failover on ambient

Two EKS regions, one peered ambient mesh, no management plane in the data path. Automatic regional failover at both layers: the mesh (a locality-preferred global service that serves cross-region when local pods die, over the east-west gateway) and the edge (kgateway per region behind AWS Global Accelerator, anycast IPs, cutover in ~40s, no DNS). Plus the honest answers to locality routing and the 1000-tenant scale question, and six live gotchas fixed in the scripts.

two EKS regionsambient multicluster peeringglobal serviceGlobal Acceleratorkgateway ingressRoute 53no mgmt plane

Open the demo → Cloud Connect Application Lab Enterprise

Open ports vs used ports on ambient

svc-b exposes eleven ports, svc-a uses six, the policy allows ten: build the audit that proves it. ztunnel JSON access logs feed a per-node collector DaemonSet that merge-patches its own key in one central ConfigMap, and a CronJob writes report.json: used, unused, allowed-but-never-used and denied ports per service. Then the policy shrinks to the observed set. Bonus: an OSS kagent agent publishes the report to GitHub via the GitHub MCP server.

Solo Istio 1.29.3-soloztunnel L4 authzJSON access logsDaemonSet → ConfigMap → CronJobkagent + GitHub MCPkind

Open the demo → Cloud Connect Application Lab Enterprise

Sidecar to Ambient Upgrade

Migrate a petstore app from Istio sidecar mode to ambient one namespace at a time on a single kind cluster: L4 with no waypoint, L7 behind a waypoint with DestinationRule and VirtualService still working, sidecar and ingress traffic routed through the waypoint, subsets moved to HTTPRoute, zero downtime the whole way, then a single-label rollback.

Solo Istio 1.29.3-soloGloo Operatorztunnel + waypointDR / VS → HTTPRoutekind

Open the demo → Cloud Connect Application Lab Enterprise

Anthos Service Mesh to Enterprise Istio Ambient, on GKE

ASM will not take you to ambient and Google owns the control plane, so you do not upgrade it: new GKE cluster, Solo Enterprise Istio, drain across. Sidecar-first install, Vault-backed CA with the RSA to EC transition rehearsed, L4 and waypoint-first L7 migrations measured under load, an east-west ServiceEntry bridge for the migration window, and the ordering mistake that costs 2.1% of requests, proven both ways.

ASM 1.20.8 → Solo Istio 1.30.3-soloGKE 1.34agentgatewayVault + istio-csrOSS A/B

Open the demo → Cloud Connect Infra Standup Lab Enterprise

Istio Ingress Gateway & Ambient Multicluster Mesh on Kind

Stand up a working Istio Ambient multicluster mesh on two local kind clusters and see cross-cluster traffic run over mTLS. A mock VM joins the mesh with its own SPIFFE identity, and AuthorizationPolicy controls egress and blocks the VM on identity alone.

kindIstio AmbientztunnelMetalLBmulticlusterVM enrollment

Stand it up → Cloud Connect Infra Standup Lab Enterprise

Solo AgentGateway Ambient Multicluster — Standup

Stand up a two-cluster ambient mesh you can run any cross-cluster or agentic lab on: two kind clusters peered over HBONE, with Solo Enterprise agentgateway v2.3.3 registered as the Gateway API class for both the ingress and the L7 waypoint/egress, Gloo UI optional. No workloads, just the platform the labs that follow build on.

agentgateway v2.3.3Istio Ambient 1.29.2ztunnelGloo UIquick.sh

Stand it up → Cloud Connect Infra Standup Lab

Manual multi-cluster vs Solo Enterprise for Istio management plane

Decide whether to wire a multi-cluster Solo Istio Ambient mesh by hand or run the Solo Enterprise for Istio management plane in front of it, judged on the Day-2 realities that actually cost you: root CA and remote-secret rotation, cluster registration, cross-cluster RBAC, federation, and audit.

decision docSolo Enterprise for IstioDay 2 opscert rotationRBAC

Read the comparison → Cloud Connect Application Lab

Cloud Connectivity Lab — failover, waypoint, egress

Three demos on the multicluster standup. You'll keep an app serving after a whole cluster loses its copy of a service (cross-cluster failover via the global mesh.internal hostname), add L7 routing to traffic that never leaves the mesh (an Ambient waypoint), and allow one workload to reach an external service while denying another on SPIFFE identity (an egress waypoint to httpbin.org).

cross-cluster failoverenterprise-agentgateway-waypointHTTPRouteegressSPIFFE

Open the lab →

Field guide

The OpenAI and Hugging Face incident: zero trust for agents on Kubernetes

OpenAI's evaluation agents escaped through a package registry they were allowed to use, coordinated through shared storage, and reached Hugging Face. All of them were sandboxed, and it made no difference. The dated chain, and the control that breaks each step.

transitive reachabilityper-run identityambient default-denylayer 7 write verb

Read the field guide → Field guide

How to set up an AgentRegistry plugin, MCP intake review

Set up an AgentRegistry Plugin end to end: write the bundle, register it with arctl as a pointer to its git commit, install it from the registry marketplace, then publish the same logic as an agent for CI. The worked example reviews a candidate MCP server, checking what each tool claims about itself against what its name, description and schema show.

MCP tool annotationsclaim vs evidencearctl init / build / applyPlugin · marketplacemcp.authorization CEL

Open the field guide → How-to Part 1 of 2 Enterprise

Deploying an MCP tool through the AgentRegistry UI, part 1: publish, deploy, expose

The full self-service path for an MCP server, clicked through the AgentRegistry UI: connect kagent as a runtime, publish the server to the catalogue, deploy it, then expose it through agentgateway with the Virtual runtime. Every UI sits behind Keycloak, and a CEL policy over the JWT Groups claim decides which tools each user can see.

Add Runtime ConnectionCreate MCP ServerDeploy to kagentVirtual runtimemcp.authorization CEL

Open the how-to → How-to Part 2 of 2 Enterprise

Deploying an MCP tool through the AgentRegistry UI, part 2: fine-grained RBAC

Registry access policies, set up step by step: users and groups stay in the IdP, policies bind groups to scope:verb grants per resource, default deny underneath. Builds the self-service policy that let a developer publish and deploy in part 1 without being able to delete or widen their own access.

Access Policiesprincipals · IdP groupsscope:verb rulesdefault denyarctl apply

Open the how-to → Field guide Enterprise

agentgateway on OpenShift, the Gateway API CRD version question

Run agentgateway on OpenShift without touching the Gateway API CRDs the cluster owns. OpenShift's Ingress Operator pins those CRDs to one version per release, but agentgateway runs against Gateway API 1.3 to 1.5, so on 4.21 (1.3.0) and 4.22 (1.4.1) you skip the CRD apply step and install against the versions the cluster already manages. Validated end to end on a live 4.21.20 cluster with a zero-drop migration.

agentgatewayOpenShiftGateway API CRDszero-downtime migrationSCCkgateway

Open the field guide → Sizing guide OSS

Sizing an agentgateway deployment

Work out how much CPU and memory an agentgateway deployment needs and what to put in the pod's requests and limits, with a proxy that scales on concurrent requests and a control plane that scales on configuration sized apart.

agentgatewaycapacity planningCPU / memoryrequests / limitsLLM

Open the sizing guide → How-to

Deploying kagent on EKS

Keep Solo Enterprise for kagent's agent-to-controller callbacks working on EKS. The projected service-account token is signed by the cluster's external OIDC provider, so flip K8S_TOKEN_REVIEW to true and the controller validates it through the Kubernetes TokenReview API instead of local JWKS.

kagent enterpriseEKSTokenReviewservice-account tokenOIDC

Open the how-to → Reference Enterprise

EnterpriseAgentgatewayPolicy vs AccessPolicy — which layer, when

Two ways to authorize what an agent can do, guarding different boundaries: per-tool CEL at the agentgateway (which MCP tools a token gets, no mesh) versus AccessPolicy on the kagent identity graph (which agent or user may invoke which agent, through the mesh). A decision diagram, a side-by-side, example YAML, and when to layer both.

mcp.authorization · CELAccessPolicyper-tool authzdecision diagramdefence in depth

Open the reference → Field guide OSS

Gateway-enforced human approval for MCP tool calls

Hold a high-impact MCP tools/call until a human signs off, enforced at the gateway with an AgentgatewayPolicy and extAuth so one gate covers every agent that shares the tool.

agentgatewayAgentgatewayPolicy · extAuthMCP · Streamable HTTPext-authz gRPCkind

Open the field guide → How-to

Wire this site into your AI client via MCP

Wire this site's public MCP endpoint into Claude Code, Claude.ai or Cursor so your AI client can search and read every lab and article as tools, with no auth. Includes a Wrangler deploy walkthrough if you want your own copy of the Cloudflare Worker.

MCPClaude CodeCursorCloudflare Workers

Open the how-to → Field guide OSS

Client IP allowlists per namespace, enforced at the waypoint

Ingress skips the waypoint by default, so an edge client IP filter belongs at the ingress gateway, and that is where this starts. The waypoint earns its place only when each namespace must own its allowlist next to the workload: istio.io/ingress-use-waypoint adds the north-south hop, then an AuthorizationPolicy on remote.ip filters. The opt-in is additive, so there is no ingress-only binding, and only one of the two options can be made unbypassable. With the client-IP rules and the trust-domain trap that makes a copied policy fail silently.

ingress-use-waypointremote.iptargetRefs: ServiceexternalTrafficPolicy: LocalIstio 1.30.3 ambient

Open the field guide → Field guide Enterprise

Multi-cluster Segments & customizable global hostnames in ambient Istio

Run a multi-cluster ambient mesh where each tenant owns a domain and every service gets a predictable global hostname, without forcing namespace sameness. New in Solo Enterprise for Istio 1.30: template those hostnames with spec.hostnames and reference them from routing and policy.

SegmentsNamespace samenessGlobal hostnamesAmbientMulticlusterSolo Enterprise for Istio 1.30

Open the field guide → Field guide

Intelligent LLM routing with the vLLM Semantic Router on agentgateway

Route every LLM request to the right model automatically, with no client change. A field guide to running the vLLM Semantic Router as an ExtProc service behind agentgateway on Kubernetes.

vLLM Semantic RouteragentgatewayExtProcLoRA adaptersPII detectionKubernetes

Open the field guide → Reference OSS

RFCs for JWT, OAuth and MCP-auth

Look up any IETF RFC behind the JWT, OAuth, token-exchange, DPoP, resource-indicator and MCP-authorisation work on this site, grouped by category, with a short description of each and a link to the lab that exercises it.

JWT · JOSEOAuth 2.0 / 2.1Token ExchangeDPoP · mTLSPKCE · PAR · JAR · RARPRM · AS MetadataMCP authorisation

Open the reference → Field guide

Eight enterprise controls for MCP traffic in agentgateway policy

The eight enterprise controls an MCP front door needs, each mapped to the exact EnterpriseAgentgatewayPolicy field that closes the gap, using the GitHub MCP server as the example.

agentgateway 2.3EnterpriseAgentgatewayPolicyCEL · jwt.* · mcp.tool.nameext-authz · forwardBodyRateLimitConfigpromptGuard

Open the field guide → Reference

How MCP traffic flows, from one client to agentgateway

Read an MCP exchange off the wire and know exactly what agentgateway does to it: the four-phase JSON-RPC lifecycle, session state, tool-list multiplexing and CEL filtering, progressive disclosure, and where the 2026-07-28 release candidate takes the protocol.

JSON-RPC 2.0Mcp-Session-IdmultiplexingCEL tool-accessambient waypointtoolMode: Search

Open the reference → Field guide OSS

Air-gapped image management with containerd registry mirrors

Install the full Solo stack (kgateway, agentgateway, Solo Enterprise for Istio, kagent) into an air-gapped cluster without rewriting image references on every Helm value or CR. You redirect every image pull at the container runtime layer instead, so charts and CRs install with stock values.

IDMS · ITMSRKE2 registries.yamlCAPI KubeadmConfigTemplatecontainerd hosts.tomlCosign · KyvernoNIST 800-53

Open the field guide → Overview

MCP Elicitation for upstream OAuth

How Enterprise AgentGateway lets a Keycloak-authenticated user reach an MCP server that only trusts a different upstream IdP, collecting per-user consent once and replaying stored tokens. Covers the actors, the three identities, the request flow, and when to use it over token exchange.

MCPEnterprise AgentGatewayElicitationKeycloak → EntraSnowflake External OAuthoffline_access

Open the overview → Field guide Enterprise

Securing MCP and agentic systems — Common customer questions

Secure and govern an MCP-based agentic architecture end to end with agentgateway: authn/authz across the three MCP hops, RBAC/ABAC/TBAC and risk-tiered tools, plus runtime safety (strict schemas, DLP, runaway containment, HITL, kill-switch) mapped to OWASP, NIST AI RMF and MITRE ATLAS.

MCPagentgatewayOAuth2 · OIDCRFC 8693CELRBAC · ABACpromptGuard · DLPHITLkill-switchOWASP · NIST · ATLAS

Open the field guide → Decision

kgateway vs Istio Ingress Gateway — a decision page

Decide where to land for north-south traffic when moving off NGINX Ingress or weighing Istio Ingress Gateway as the edge, and on what basis: config propagation, control-plane footprint, JWT/OIDC and rate-limit surface, non-Kubernetes backends, benchmarks, plus the kgateway-edge and Ambient-east-west two-layer model.

kgatewayIstio AmbientGateway APIFrontegg · OIDCfleet-scale

Open the decision page → Field guide OSS

HTTPRoutes and tenant/team delegation routing

Give every team its own routes on one shared gateway without a central file everyone fights over, using kgateway route delegation: a parent HTTPRoute hands each path prefix by label to a child route the owning team controls in its own namespace.

HTTPRoutekgatewayGateway APIdelegationmulti-tenant

Open the field guide → Reference

istiod → ztunnel + waypoint — xDS on Istio Ambient

Read a waypoint or ztunnel config dump and know exactly which xDS resources it should hold: how one istiod fans WDS + WADS to ztunnel and standard Envoy xDS to waypoints over one ADS stream, and how Solo Enterprise scales multicluster peering to N, not N squared.

xDS · ADSWDS · WADSztunnel stateEnvoy xDSmulticluster

Open the xDS map → Reference Enterprise

Solo ext-auth-service — one binary, plugin chain, AuthConfig

Authenticate and authorize MCP, LLM and API traffic without building a custom ext_authz. A visual reference to the Solo external auth service bundled in agentgateway and kgateway enterprise: the built-in plugins, the request flow, the wiring CRDs, and an OAuth2 introspection plus OPA Rego sample for per-subject MCP tool authorization.

ext-auth-serviceAuthConfigJWT · JWKSOAuth2 introspectionOPA · RegobooleanExpr

Open the reference → Reference

External Processing (ExtProc) — streaming request/response mutation

Read and mutate any part of an HTTP request or response, headers, body and trailers, from your own gRPC server. The ExtProc field guide for kgateway and agentgateway, with runnable Python and Go servers and an ExtProc-vs-ExtAuth picker.

ExtProcGatewayExtensionAgentgatewayPolicyprocessingModeSTREAMED · BUFFEREDPython · Go

Open the reference → Reference Enterprise

JWT claims to HTTP headers — verified-claim routing on kgateway

Route, rate-limit and authorise multi-tenant traffic on a verified x-tenant-id header instead of re-parsing a JWT in every service. Shows the claimsToHeaders shortcut on kgateway and the CEL transformation equivalent on agentgateway, with negative tests that prove bad tokens never reach the backend.

claimsToHeadersAuthConfigJWKSEnterpriseKgatewayTrafficPolicyx-tenant-id

Open the reference → Interactive

JWT token exchange — Keycloak + agentgateway STS, hop by hop

Step through an RFC 8693 token exchange hop by hop to see how an agentgateway STS remints a JWT at each hop and nests the prior subject in the act claim, so one signed token carries the whole call chain.

Keycloakagentgateway STSRFC 8693act claimA2A

Open the walkthrough → Reference OSS

Virtual keys in agentgateway

Understand what a virtual key actually is, as opposed to the raw provider credential, then stand one up in agentgateway by composing API-key auth, token-based rate limiting, and per-key metrics. Drop-in YAML for per-user, tiered, and multi-tenant budgets.

Virtual keysAPI-key authToken budgetsRate limitingObservabilityMulti-tenantLLM

Open the reference → Cookbook

CEL Cookbook for agentgateway

Find the exact CEL expression for any agentgateway policy without guessing at variable names or call syntax, across all six surfaces where CEL runs. Full variable reference, custom-function table, and drop-in YAML per pattern, with two JWT payloads traced through every example.

CELAuthorizationTransformationRate limitingObservabilityMCPLLMJWT claims

Open the cookbook → Reference Enterprise

JWT, OIDC and on-behalf-of — auth flows in Istio Ambient

Tell apart the four auth layers in Istio Ambient plus Solo Enterprise and know which component runs each: JWT validation, claims-based authorization, OIDC login, and RFC 8693 token exchange for on-behalf-of calls.

JWTOIDCRequestAuthenticationtoken exchangeSolo ext-authz

Open the auth map → Knowledge base

Scoring agents with agentevals: trace-based evaluation on kagent

Score kagent agents from their OpenTelemetry traces with agentevals: stand up an in-cluster collector, turn on tracing, write a golden eval set, and read back a per-framework table of LLM calls, tokens and latency.

agentevalsOpenTelemetrygolden eval settool_trajectorytokens + latencykagent

Open the guide → Setup guide Enterprise

RFC 8693 token exchange across identity providers — Entra, Keycloak, Auth0, Okta

Stop your gateway forwarding a user's raw login token downstream and have it swap in a token scoped for each downstream that still carries the real user. Copy-paste RFC 8693 token exchange on Solo Enterprise Agentgateway for Entra, Keycloak, Auth0, Okta and Frontegg.

RFC 8693Entra IDKeycloakAuth0OktaEnterpriseAgentgatewayPolicytokenExchange

Open the setup guide → Reference

Trust & identity — from RootTrustPolicy to an mTLS handshake

Trace a workload's SPIFFE identity across a multi-cluster ambient mesh, from the offline root through RootTrustPolicy down to the SVID a ztunnel presents in a cross-cluster HBONE handshake.

RootTrustPolicySPIFFEcert-managerVaultcross-cluster mTLS

Open the trust chain → Reference OSS

Gateway API on Istio Ambient — what attaches to what

Place any Kubernetes Gateway API kind on Istio Ambient in the right spot first time. A map of which kind attaches at the edge, on a waypoint, or on the east-west gateway, which gatewayClassName picks which proxy, and how parentRefs and targetRefs resolve, with copy-paste YAML.

Gateway APIHTTPRoutewaypointingresseast-west

Open the map → Reference

L4 ztunnel-native egress in SEFI 1.30

Lock down which external hosts your ambient workloads can reach, enforced on workload identity at L4, by turning the existing ztunnel DaemonSet into the egress gateway. No new proxy, with a NetworkPolicy backstop so nothing slips past.

ztunnelAuthorizationPolicyServiceEntryNetworkPolicyalpha

Open the walkthrough → Reference Enterprise

HBONE + east-west — cross-cluster packet flow

Trace a single request crossing from cluster-east to cluster-west over Istio Ambient, hop by hop, so you can read a cross-cluster HBONE capture and fix it: ztunnel wrapping, the east-west gateway on :15008, SPIFFE-identity SNI routing, and where the mTLS terminates.

HBONEztunneleast-west gatewaySPIFFEmulti-network

Open the walkthrough → Reference

Whose Waypoint? L7 across an Ambient Mesh

Across two peered ambient clusters, the caller's waypoint runs the L7 AuthorizationPolicy, not the destination's. Trace one request through the global-service path to place the policy in the right cluster and keep SPIFFE identity intact for L4 checks at the far end.

global servicewaypointmesh.internalAuthorizationPolicySPIFFE

Open the walkthrough → Reference Enterprise

Gloo Operator — deploy Istio Ambient across N clusters

Run identical Istio Ambient across a whole cluster fleet from one management cluster: the Gloo Operator watches a set of CRs and reconciles shared trust, east-west gateways and tenancy into every workload cluster. A visual reference to the CRDs it watches, with copy-paste YAML and meshctl/helm/kubectl equivalents.

Gloo Operatormulti-clusterIstio AmbientRootTrustPolicylifecycle CRDs

Open the visual map → Reference

kagent CRDs — a visual map

Know which kagent CRD to reach for and write correct YAML for each. A visual map of every kagent resource plus the Solo Enterprise AccessPolicy and KubernetesCluster bolt-ons, with copy-paste YAML checked against the shipped schema.

kagentkagent-enterpriseA2AMCPAccessPolicy

Open the visual map → Reference OSS

agentregistry CRDs — a visual map

Look up any of the six agentregistry kinds (Agent, MCPServer, Skill, Prompt, Runtime, Deployment): what each models, which fields it carries, and copy-paste YAML you can arctl apply -f.

agentregistryarctl · /v0/applyagentgatewaykagentAWS AgentCore

Open the visual map → Field guide

Pushing agents to AgentRegistry, tags, versioning, pipelines, integrity

Publish agents and MCP servers into AgentRegistry from a pipeline so you always know which build is running and can roll back by moving a pointer tag. Covers the metadata.tag field, a two-track versioning convention, and the integrity pattern from build to runtime.

arctlmetadata.tagsemverOIDCimage digestcosign

Read the field guide → Reference OSS

Istio Ambient CRDs — a visual map

Work out where every Istio Ambient CRD is actually enforced, on ztunnel at L4 or a waypoint at L7, so you can tell why an L7 policy silently does nothing. Copy-paste YAML for each CRD family plus a full reference table.

Istio AmbientGateway APIztunnelwaypointCRDs

Open the visual map → How-To

Istio Ambient Metrics & Alerting

The istiod metrics that tell you whether Solo Enterprise for Istio Ambient is healthy, and the PromQL to alert when it is not. Covers cert expiry, multi-cluster XDS links, the wds/wads push path and the waiting-for-sync stall, with drop-in ServiceMonitor and PrometheusRule YAML.

PrometheusAlertManageristiod · :15014WDS · WADSPrometheusRule

Preview reference → Reference Enterprise

Ambient segments: one mesh, hard internal boundaries

Segments let one ambient multicluster mesh carry isolated worlds inside it, so same-named services do not merge across a boundary. Covers the Segment CRD vs the cluster membership label, choosing your own DNS domain, and why service-scope is visibility not security, with AuthorizationPolicy doing the per-cluster access control. Worked through a PCI cardholder-data-environment example.

Segmentservice-scopeAuthorizationPolicymulticlusterPCI

Read the reference →

Deep dive

Adding human approval to an agent you did not write

August 4, 2026

A developer writes an agent. Someone else decides it needs a human to approve its changes. Anything the agent's own code does, the agent's own code can stop doing — so the control goes at admission, the one moment you are guaranteed to be in the path and the author is not. A name in a ConfigMap, one Kyverno policy, and kagent pauses the tool and asks. No service to run and no queue to operate. Plus the discovery that a BYO agent can use the native flow too via ADK's require_confirmation, and why gating reads trains reviewers to click yes.

Kyverno admissionagentgateway extAuthkagentAgentRegistryMCPprompt.prepend

Read the post → Deep dive

MCP went stateless: the 2026-07-28 spec on the wire

August 3, 2026

MCP's biggest revision since launch went final on 28 July: sessions, the initialize handshake and server push are gone. A walk through the actual payloads. Requests are self-describing (Mcp-Method and Mcp-Name headers, _meta capabilities) so any instance serves any request cold; MRTR lets a server ask a question by returning early and having the client retry, with the continuation state riding in the payload; the Tasks extension gives long-running work a durable handle with the same elicitation shape when it pauses. Plus the required resultType breaking change most coverage missed, and what the stateless rewrite hands to agentgateway: header-match policy, mandatory caching contracts and one trace per workflow, with core spec support already shipped in v1.4.0 and Tasks in v1.4.1.

MCP 2026-07-28StatelessMRTRTasks extensionStreamable HTTPagentgateway

Read the post → Deep dive

The lethal trifecta test for AI agents

July 3, 2026

A year on, Simon Willison's lethal trifecta is still the sharpest test an agent deployment has: private data + untrusted content + external communication in one agent means your data eventually walks out. Detection cannot be the foundation when 95% is a failing grade, so switch a leg off instead: per-identity tool RBAC and curated catalogues, pinned tool descriptions against rug pulls, declared backends, sandboxed execution and out-of-band approvals. Per agent, per route, with a runnable lab behind every claim. Plus A2A chains, defence in depth around the legs, trace-based evals gating the deploy, and the TM Forum Catalyst that ran it against live telco networks.

Lethal trifectaMCPagentgatewayagentregistrykagentPrompt guardA2AAgentEvals

Read the post → Deep dive

ID-JAG: enterprise identity finally catches up with AI agents

June 21, 2026

On 18 June, Anthropic, Microsoft and Okta all shipped support for the same OAuth draft: ID-JAG, which lets your identity provider broker an agent's access to a third-party tool, no pasted keys and no per-tool consent. The engineering view: the five-step brokered flow, the act claim that names the agent and the governance gap it leaves open, and how agentgateway's token exchange already does the hard part. Plus where elicitation fits and what it deliberately does not solve. It is an IETF draft, not an RFC.

ID-JAG (IETF draft)Cross-App AccessEnterprise-Managed AuthMCPOAuth token exchangeagentgateway

Read the post → Deep dive

SVIDs, SPIRE and WIMSE: how workload identity flows through the mesh

June 8, 2026

A ground-up primer on SVIDs, the SPIFFE Verifiable Identity Documents every mTLS connection in a mesh rests on. What an SVID carries, the X.509-SVID vs JWT-SVID split, how a workload is issued one through the Workload API with no bootstrap secret, the three issuance models in an Istio mesh (default, sidecar+SPIRE, and ambient+SPIRE where ztunnel fetches it as a delegate), and where the cert stops carrying identity once an L7 hop terminates TLS. Then up a layer to WIMSE, the IETF effort that standardises carrying that identity across HTTP boundaries without a replayable token, and how to consume it today. Plus naming and trust-domain design, the don't-encode-authz rule, and how it lands in Solo Enterprise for Istio.

SPIFFESVIDX.509 vs JWTWorkload APISPIREWIMSESolo Enterprise for Istio

Read the post → Deep dive

MCP's 2026 roadmap: Tasks, stateless servers, and where it converges with A2A

June 7, 2026

A read of MCP's 2026 roadmap and the 2026-07-28 release candidate that separates signal from headline. Tasks (now an extension) gives MCP async call-now / fetch-later delegation; the protocol went stateless at the wire layer so servers run behind a plain load balancer; and MCP Server Cards add connection-free discovery over .well-known. On A2A: MCP converges with it at the edges (delegation, discovery, server-initiated interaction) but stays out of its core of peer-to-peer cross-vendor agent transport, and neither replaces the other. What it all means if you run MCP behind agentgateway.

MCP 2026 roadmapTasksStateless serversMCP Server CardsA2A v1.0agentgateway

Read the post → Deep dive

I read Anthropic's Zero Trust framework for AI agents. Here's where Solo already answers it.

June 6, 2026

A compliance person's read of Anthropic's Zero Trust framework for AI agents, three maturity tiers across seven control domains, then where the Solo stack lines up against it. Solo Enterprise for Istio for SPIFFE identity and mTLS, agentgateway for per-tool CEL authorisation and on-behalf-of token exchange over MCP, agentregistry for a signed catalogue, kagent for declarative lifecycle and human-in-the-loop. For regulated EMEA teams under DORA, NIS2 and PCI DSS, the value is that the evidence comes from fewer places.

Anthropic Zero TrustagentgatewayagentregistrykagentSolo Enterprise for IstioDORA · NIS2 · PCI DSS

Read the post → Quick take

JWKS, and how agentgateway uses it

May 31, 2026

JWKS is the public-key directory an IdP publishes so a gateway can verify JWTs locally, without ever holding the private key. What a JWK Set contains, the verification flow, and exactly how agentgateway's dataplane turns it into a kid-keyed table — pinning the algorithm to the key (not the token) to close alg:none and RS256→HS256 confusion, and handling rotation via the kid overlap window.

JWKSJWTOIDCRS256 · ES256agentgatewayLocal validation

Read the post → Quick take

Extending the gateway: when to use CEL vs OPA vs ext-authz vs ext-proc

May 29, 2026

Four mechanisms for extending the gateway's policy, auth, and traffic handling: CEL (declarative, zero infrastructure), OPA (external data, Rego), ext-authz (full custom auth), ext-proc (body mutation). Links to the deep-dive KBs.

CELOPA Regoext-authzext-procagentgatewaykgateway

Read the post → Deep dive

The SANS AI Security Maturity Model has a Stage 3 problem. Here's the architecture that solves it.

May 23, 2026

How agentgateway, agentregistry and kagent map onto the SANS AI Security Maturity Model — pillar by pillar, stage by stage — and close the Stage 3 gap most enterprises can't bridge with existing tooling. Includes a stage → product mapping table, the Governance Floor Rule, the Shadow AI problem treated as infrastructure not culture, and an 8-week practical starting point.

SANS AISMMagentgatewayagentregistrykagentNIST AI RMFEU AI ActDORA · NIS2MITRE ATLAS

Read the post → Quick take

Hello, MasterTheMesh — why I started this site

May 18, 2026

I joined Solo.io as EMEA Field CTO on 11 May 2026. This is my first week of writing things down in public — a quick career detour through DynamicOps, VMware, Broadcom and WeaveONE, and a note on what this site is and isn't.

metaintroductionfield-cto

Read the post →