From 26ef5c993e6c7e377d7bfea7250a4b0e3f7fdf4c Mon Sep 17 00:00:00 2001 From: Dineth Date: Thu, 16 Jul 2026 15:08:23 +0530 Subject: [PATCH 1/6] Add configuration for admin server, event hub, and API key management in gateway values --- .../templates/gateway/gateway-config.yaml | 80 ++++++++++ .../helm/gateway-helm-chart/values.yaml | 141 +++++++++++++++++- 2 files changed, 214 insertions(+), 7 deletions(-) diff --git a/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml b/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml index 52e0f0f89..f04b69980 100644 --- a/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml +++ b/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml @@ -23,6 +23,16 @@ data: shutdown_timeout = {{ $gc.server.shutdown_timeout | quote }} gateway_id = {{ $gc.server.gateway_id | quote }} + [controller.admin_server] + enabled = {{ $gc.admin_server.enabled }} + port = {{ $gc.admin_server.port }} + allowed_ips = [{{- range $i, $ip := $gc.admin_server.allowed_ips }}{{- if gt $i 0 }}, {{ end }}{{ $ip | quote }}{{- end }}] + + [controller.admin_server.pprof] + enabled = {{ $gc.admin_server.pprof.enabled }} + block_profile_rate = {{ $gc.admin_server.pprof.block_profile_rate }} + mutex_profile_fraction = {{ $gc.admin_server.pprof.mutex_profile_fraction }} + [controller.policy_server] port = {{ $gc.policy_server.port }} @@ -81,6 +91,10 @@ data: [controller.policies] definitions_path = {{ $gc.policies.definitions_path | quote }} + build_manifest_path = {{ $gc.policies.build_manifest_path | quote }} + + [controller.llm] + template_definitions_path = {{ $gc.llm.template_definitions_path | quote }} [controller.controlplane] insecure_skip_verify = {{ $gc.controlplane.insecure_skip_verify }} @@ -112,6 +126,18 @@ data: https_port = {{ $router.https_port }} tracing_service_name = {{ $router.tracing_service_name | default "" | quote }} + [router.vhosts.main] + {{- if $router.vhosts.main.domains }} + domains = [{{- range $i, $d := $router.vhosts.main.domains }}{{- if gt $i 0 }}, {{ end }}{{ $d | quote }}{{- end }}] + {{- end }} + default = {{ $router.vhosts.main.default | quote }} + + [router.vhosts.sandbox] + {{- if $router.vhosts.sandbox.domains }} + domains = [{{- range $i, $d := $router.vhosts.sandbox.domains }}{{- if gt $i 0 }}, {{ end }}{{ $d | quote }}{{- end }}] + {{- end }} + default = {{ $router.vhosts.sandbox.default | quote }} + [router.access_logs] enabled = {{ $router.access_logs.enabled }} format = {{ $router.access_logs.format | quote }} @@ -153,6 +179,9 @@ data: stream_idle_timeout = {{ $router.http_listener.timeouts.stream_idle_timeout | quote }} idle_timeout = {{ $router.http_listener.timeouts.idle_timeout | quote }} + [router.lua.request_transformation] + script_path = {{ $router.lua.request_transformation.script_path | quote }} + [router.policy_engine] mode = {{ $router.policy_engine.mode | quote }} host = {{ $router.policy_engine.host | default "" | quote }} @@ -210,6 +239,21 @@ data: level = {{ $gc.logging.level | quote }} format = {{ $gc.logging.format | quote }} + [controller.metrics] + enabled = {{ .Values.gateway.controller.metrics.enabled }} + port = {{ .Values.gateway.controller.metrics.port }} + + [controller.event_hub] + poll_interval = {{ $gc.event_hub.poll_interval | quote }} + cleanup_interval = {{ $gc.event_hub.cleanup_interval | quote }} + retention_period = {{ $gc.event_hub.retention_period | quote }} + + [controller.event_hub.database] + max_open_conns = {{ $gc.event_hub.database.max_open_conns }} + max_idle_conns = {{ $gc.event_hub.database.max_idle_conns }} + conn_max_lifetime = {{ $gc.event_hub.database.conn_max_lifetime | quote }} + conn_max_idle_time = {{ $gc.event_hub.database.conn_max_idle_time | quote }} + [policy_engine.server] extproc_port = {{ $pe.server.extproc_port }} @@ -218,6 +262,11 @@ data: port = {{ $pe.admin.port }} allowed_ips = [{{- range $i, $ip := $pe.admin.allowed_ips }}{{- if gt $i 0 }}, {{ end }}{{ $ip | quote }}{{- end }}] + [policy_engine.admin.pprof] + enabled = {{ $pe.admin.pprof.enabled }} + block_profile_rate = {{ $pe.admin.pprof.block_profile_rate }} + mutex_profile_fraction = {{ $pe.admin.pprof.mutex_profile_fraction }} + [policy_engine.config_mode] mode = {{ $pe.config_mode.mode | quote }} @@ -238,6 +287,18 @@ data: level = {{ $pe.logging.level | quote }} format = {{ $pe.logging.format | quote }} + [policy_engine.metrics] + enabled = {{ $pe.metrics.enabled }} + port = {{ $pe.metrics.port }} + + [policy_engine.python_executor] + timeout = {{ $pe.python_executor.timeout | quote }} + + [policy_engine.python_executor.server] + mode = {{ $pe.python_executor.server.mode | quote }} + port = {{ $pe.python_executor.server.port }} + host = {{ $pe.python_executor.server.host | quote }} + {{- if .Values.gateway.config.analytics }} {{- $analyticsEnabled := and (kindIs "bool" .Values.gateway.config.analytics.enabled) .Values.gateway.config.analytics.enabled }} [analytics] @@ -357,6 +418,11 @@ data: sampling_rate = {{ .Values.gateway.config.tracing.sampling_rate }} {{- end }} + {{- if .Values.gateway.config.subscriptions }} + [subscriptions] + enable_validation = {{ .Values.gateway.config.subscriptions.enable_validation }} + {{- end }} + {{- if .Values.gateway.gatewayRuntime.policies.llmPricing.enabled }} [policy_configurations.llm_cost_v1] pricing_file = "/etc/policy-engine/llm-pricing/model_prices.json" @@ -366,12 +432,26 @@ data: {{ dict "policy_configurations" .Values.gateway.config.policy_configurations | toToml | indent 4 }} {{- end }} + {{- if .Values.gateway.config.api_key }} + [api_key] + api_keys_per_user_per_api = {{ .Values.gateway.config.api_key.api_keys_per_user_per_api }} + algorithm = {{ .Values.gateway.config.api_key.algorithm | quote }} + min_key_length = {{ .Values.gateway.config.api_key.min_key_length }} + max_key_length = {{ .Values.gateway.config.api_key.max_key_length }} + issuer = {{ .Values.gateway.config.api_key.issuer | quote }} + {{- end }} + {{- if .Values.gateway.config.immutable_gateway }} [immutable_gateway] enabled = {{ .Values.gateway.config.immutable_gateway.enabled }} artifacts_dir = {{ .Values.gateway.config.immutable_gateway.artifacts_dir | quote }} {{- end }} + {{- if .Values.gateway.config.mcp }} + [mcp] + append_resource_path_to_backend = {{ .Values.gateway.config.mcp.append_resource_path_to_backend }} + {{- end }} + {{- if .Values.gateway.config_toml }} {{ .Values.gateway.config_toml | indent 4 }} {{- end }} diff --git a/kubernetes/helm/gateway-helm-chart/values.yaml b/kubernetes/helm/gateway-helm-chart/values.yaml index b8d50eed3..02655189a 100644 --- a/kubernetes/helm/gateway-helm-chart/values.yaml +++ b/kubernetes/helm/gateway-helm-chart/values.yaml @@ -77,6 +77,22 @@ gateway: # Unique identifier for the gateway instance gateway_id: "platform-gateway-id" + # Dedicated admin/debug HTTP server (config dump, xDS sync status). Already + # effectively active today even though this block was previously absent from + # config.toml — see defaultConfig() in pkg/config/config.go. Adding it here + # only makes the existing implicit default explicit and overridable. + admin_server: + enabled: true + port: 9092 + allowed_ips: ["*"] + pprof: + # Go runtime profiling (net/http/pprof) served on the admin server, off by + # default. When enabling, also restrict allowed_ips above or reach it via + # `kubectl port-forward` (see gateway.controller.service.expose.admin). + enabled: false + block_profile_rate: 0 + mutex_profile_fraction: 0 + # Policy xDS Server configuration policy_server: # Policy xDS gRPC port for policy distribution @@ -95,11 +111,12 @@ gateway: # Storage configuration storage: - # Storage type: "sqlite", "postgres", "sqlserver", or "memory" + # Storage type: "sqlite", "postgres", or "sqlserver" — the only values accepted + # by the controller's Validate() at startup ("memory" is NOT a valid value, + # despite being mentioned in older docs/comments). # - sqlite: Single-instance embedded database backed by a PersistentVolumeClaim # - postgres: External PostgreSQL database; enables multi-replica controller deployments # - sqlserver: External SQL Server database; enables multi-replica controller deployments - # - memory: No persistence; all state is lost on restart (useful for testing only) type: sqlite # SQLite configuration (used when type=sqlite) @@ -176,6 +193,13 @@ gateway: policies: # Directory containing policy definitions definitions_path: ./default-policies + # Path to build-manifest.yaml, used to detect custom (non-bundled) policies + build_manifest_path: ./build-manifest.yaml + + # LLM provider template configuration + llm: + # Directory containing default LLM provider prompt templates + template_definitions_path: ./default-llm-provider-templates # Control plane connection configuration # Note: host and token are set via gateway.controller.controlPlane and rendered as env vars in the deployment. @@ -229,11 +253,39 @@ gateway: # - text: Human-readable text format (recommended for development) format: json + # EventHub: poll-based eventual-consistency layer used to sync state across + # multiple controller replicas (only relevant when storage.type is postgres or + # sqlserver and replicaCount > 1, but always configured/valid). + event_hub: + # Interval at which events are polled from the database + poll_interval: 3s + # Interval at which old events are cleaned up + cleanup_interval: 10m + # How long events are retained before being deleted + retention_period: 1h + # Connection pool settings for the EventHub database connection + database: + max_open_conns: 5 + max_idle_conns: 2 + conn_max_lifetime: 30m + conn_max_idle_time: 5m + # Router (Envoy) configuration router: # Gateway host for incoming requests gateway_host: "*" + # Virtual-host domain configuration + vhosts: + main: + # Explicit domain list for the main vhost (e.g. ["api.example.com"]). + # Empty (default) relies on the `default` pattern below. + domains: [] + default: "*" + sandbox: + domains: [] + default: "sandbox-*" + # Access logs configuration access_logs: # Enable or disable access logs @@ -256,21 +308,25 @@ gateway: bytesRx: "%BYTES_RECEIVED%" bytesTx: "%BYTES_SENT%" dur: "%DURATION%" - uSvcT: "%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%" + upSvcT: "%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%" xff: "%REQ(X-FORWARDED-FOR)%" ua: "%REQ(USER-AGENT)%" reqId: "%REQ(X-REQUEST-ID)%" host: "%REQ(:AUTHORITY)%" - uHost: "%UPSTREAM_HOST%" - uProto: "%UPSTREAM_PROTOCOL%" - uPath: "%REQ(:PATH)%" + upHost: "%UPSTREAM_HOST%" + upProto: "%UPSTREAM_PROTOCOL%" + upPath: "%REQ(:PATH)%" respCdDtl: "%RESPONSE_CODE_DETAILS%" connTrmDtl: "%CONNECTION_TERMINATION_DETAILS%" + reqTxDur: "%REQUEST_TX_DURATION%" + respTxDur: "%RESPONSE_TX_DURATION%" + reqDur: "%REQUEST_DURATION%" + respDur: "%RESPONSE_DURATION%" # Text format template - used when format is "text" # Uses Envoy command operators: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage text_format: | - [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %REQ(:PATH)% %UPSTREAM_PROTOCOL% %RESPONSE_CODE% %RESPONSE_FLAGS% %RESPONSE_CODE_DETAILS% %CONNECTION_TERMINATION_DETAILS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%" + [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %REQ(:PATH)% %UPSTREAM_PROTOCOL% %RESPONSE_CODE% %RESPONSE_FLAGS% %RESPONSE_CODE_DETAILS% %CONNECTION_TERMINATION_DETAILS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %REQUEST_TX_DURATION% %RESPONSE_TX_DURATION% %REQUEST_DURATION% %RESPONSE_DURATION% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%" # Listener port for incoming HTTP traffic (Envoy proxy port) listener_port: 8080 @@ -334,6 +390,13 @@ gateway: tracing_service_name: router + # Lua script configuration + lua: + request_transformation: + # Do NOT set the deprecated top-level lua_script_path alias — use this + # nested path only (config.go documents lua_script_path as deprecated). + script_path: ./lua/request_transformation.lua + # Policy Engine ext_proc filter configuration policy_engine: # Connection mode: "uds" (Unix domain socket, default) or "tcp" @@ -388,6 +451,13 @@ gateway: - "*" - "127.0.0.1" + pprof: + # Go runtime profiling (net/http/pprof), off by default. When enabling, + # also restrict allowed_ips above or reach it via port-forward. + enabled: false + block_profile_rate: 0 + mutex_profile_fraction: 0 + config_mode: # Configuration mode: "file" or "xds" # - file: Load policy chains from static YAML file @@ -429,11 +499,61 @@ gateway: # Log format: json, text format: json + # Prometheus metrics server (policy-engine side) + metrics: + # Defaults to false to match the policy-engine binary's own code default + # (MetricsConfig.Enabled in its defaultConfig()) — NOT config-template.toml's + # shipped default of true — so behavior for existing deployments is unchanged. + enabled: false + # NOTE: keep in sync with gateway.gatewayRuntime.service.ports.policyEngineMetrics + port: 9003 + + # Python policy executor bridge + python_executor: + # Timeout for a single Python policy execution + timeout: 30s + server: + # Connection mode: "uds" (default) or "tcp" + mode: uds + # Port (only used when mode=tcp) + port: 9010 + # Host (only used when mode=tcp) + host: localhost + # Static API artifacts bundled with the gateway (see docs/gateway/immutable-gateway.md) immutable_gateway: enabled: false artifacts_dir: "/etc/api-platform-gateway/immutable_gateway/artifacts" + # Application-level API-key subscription validation. Absent by default — the + # subscriptionValidation system policy stays uninjected. Uncomment to enable: + # subscriptions: + # enable_validation: true + + # API key configuration (used by the api-key-auth policy) + api_key: + # Number of active API keys allowed per user per API + api_keys_per_user_per_api: 10 + # Hashing algorithm used to store API keys (currently only "sha256") + algorithm: sha256 + # Minimum / maximum accepted length for an external API key value + min_key_length: 36 + max_key_length: 128 + # When non-empty, only API keys whose issuer claim matches (or is unset) are + # accepted by the api-key-auth policy. Defaults to "" (accept any issuer) to + # match the gateway-controller's own code default. config-template.toml ships + # "api-platform-devportal" instead; set this explicitly to that value if this + # gateway should only accept keys minted by the bundled WSO2 Developer Portal — + # do not adopt it as the chart default, or existing deployments minting/accepting + # keys with a different or absent issuer would start being rejected. + issuer: "" + + # MCP (Model Context Protocol) proxy configuration + mcp: + # Restore legacy behaviour of appending "/mcp" to the backend upstream path. + # Default (false) forwards to exactly the configured upstream path. + append_resource_path_to_backend: false + # Raw TOML string to append to the generated config.toml # Use this for additional configuration not covered by the structured values above # Example: @@ -581,6 +701,13 @@ gateway: name: "" key: password metrics: + # Whether the controller's own Prometheus metrics HTTP server actually starts. + # Defaults to false to match the gateway-controller binary's own code default + # (Controller.Metrics.Enabled in defaultConfig()) — NOT config-template.toml's + # shipped default of true — so this chart's behavior does not silently change + # for existing deployments upgrading past this release. Set to true to expose + # Prometheus metrics on `port` below. + enabled: false port: 9091 persistence: enabled: true From 3a3e5bf48ad709bf27cf16cb084b62b82fbd4de0 Mon Sep 17 00:00:00 2001 From: Dineth Date: Fri, 17 Jul 2026 11:25:17 +0530 Subject: [PATCH 2/6] . --- kubernetes/helm/gateway-helm-chart/README.md | 1 + .../templates/gateway/gateway-config.yaml | 18 ----------- .../helm/gateway-helm-chart/values.yaml | 31 ------------------- 3 files changed, 1 insertion(+), 49 deletions(-) diff --git a/kubernetes/helm/gateway-helm-chart/README.md b/kubernetes/helm/gateway-helm-chart/README.md index c24039b60..8281d6f53 100644 --- a/kubernetes/helm/gateway-helm-chart/README.md +++ b/kubernetes/helm/gateway-helm-chart/README.md @@ -132,6 +132,7 @@ All configurable values are documented in `values.yaml`. Component blocks are fu - `gateway.controller.tls.*` – TLS certificate configuration for HTTPS listener using cert-manager or existing secrets. - `gateway.controller.upstreamCerts.*` – Custom CA certificates for upstream backend TLS verification. - `gateway.config.policy_engine.*` – policy engine configuration including xDS client settings and admin API. +- `gateway.config.api_key` / `gateway.config.subscriptions` – API-key policy tuning (length/algorithm/issuer) and opt-in application-subscription validation. Refer to the inline comments inside `values.yaml` for a complete matrix of options and the expected data types for each block. diff --git a/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml b/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml index f04b69980..b16e87206 100644 --- a/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml +++ b/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml @@ -91,10 +91,6 @@ data: [controller.policies] definitions_path = {{ $gc.policies.definitions_path | quote }} - build_manifest_path = {{ $gc.policies.build_manifest_path | quote }} - - [controller.llm] - template_definitions_path = {{ $gc.llm.template_definitions_path | quote }} [controller.controlplane] insecure_skip_verify = {{ $gc.controlplane.insecure_skip_verify }} @@ -179,9 +175,6 @@ data: stream_idle_timeout = {{ $router.http_listener.timeouts.stream_idle_timeout | quote }} idle_timeout = {{ $router.http_listener.timeouts.idle_timeout | quote }} - [router.lua.request_transformation] - script_path = {{ $router.lua.request_transformation.script_path | quote }} - [router.policy_engine] mode = {{ $router.policy_engine.mode | quote }} host = {{ $router.policy_engine.host | default "" | quote }} @@ -243,17 +236,6 @@ data: enabled = {{ .Values.gateway.controller.metrics.enabled }} port = {{ .Values.gateway.controller.metrics.port }} - [controller.event_hub] - poll_interval = {{ $gc.event_hub.poll_interval | quote }} - cleanup_interval = {{ $gc.event_hub.cleanup_interval | quote }} - retention_period = {{ $gc.event_hub.retention_period | quote }} - - [controller.event_hub.database] - max_open_conns = {{ $gc.event_hub.database.max_open_conns }} - max_idle_conns = {{ $gc.event_hub.database.max_idle_conns }} - conn_max_lifetime = {{ $gc.event_hub.database.conn_max_lifetime | quote }} - conn_max_idle_time = {{ $gc.event_hub.database.conn_max_idle_time | quote }} - [policy_engine.server] extproc_port = {{ $pe.server.extproc_port }} diff --git a/kubernetes/helm/gateway-helm-chart/values.yaml b/kubernetes/helm/gateway-helm-chart/values.yaml index 02655189a..151e5bd34 100644 --- a/kubernetes/helm/gateway-helm-chart/values.yaml +++ b/kubernetes/helm/gateway-helm-chart/values.yaml @@ -193,13 +193,6 @@ gateway: policies: # Directory containing policy definitions definitions_path: ./default-policies - # Path to build-manifest.yaml, used to detect custom (non-bundled) policies - build_manifest_path: ./build-manifest.yaml - - # LLM provider template configuration - llm: - # Directory containing default LLM provider prompt templates - template_definitions_path: ./default-llm-provider-templates # Control plane connection configuration # Note: host and token are set via gateway.controller.controlPlane and rendered as env vars in the deployment. @@ -253,23 +246,6 @@ gateway: # - text: Human-readable text format (recommended for development) format: json - # EventHub: poll-based eventual-consistency layer used to sync state across - # multiple controller replicas (only relevant when storage.type is postgres or - # sqlserver and replicaCount > 1, but always configured/valid). - event_hub: - # Interval at which events are polled from the database - poll_interval: 3s - # Interval at which old events are cleaned up - cleanup_interval: 10m - # How long events are retained before being deleted - retention_period: 1h - # Connection pool settings for the EventHub database connection - database: - max_open_conns: 5 - max_idle_conns: 2 - conn_max_lifetime: 30m - conn_max_idle_time: 5m - # Router (Envoy) configuration router: # Gateway host for incoming requests @@ -390,13 +366,6 @@ gateway: tracing_service_name: router - # Lua script configuration - lua: - request_transformation: - # Do NOT set the deprecated top-level lua_script_path alias — use this - # nested path only (config.go documents lua_script_path as deprecated). - script_path: ./lua/request_transformation.lua - # Policy Engine ext_proc filter configuration policy_engine: # Connection mode: "uds" (Unix domain socket, default) or "tcp" From 6a994f59926c244e0e21239a8900d170ec47beec Mon Sep 17 00:00:00 2001 From: Dineth Date: Fri, 17 Jul 2026 12:31:26 +0530 Subject: [PATCH 3/6] .. --- kubernetes/helm/gateway-helm-chart/Chart.yaml | 4 +-- .../templates/gateway/gateway-config.yaml | 30 ++++++++++++++++++ .../helm/gateway-helm-chart/values.yaml | 31 +++++++++++++++++++ 3 files changed, 63 insertions(+), 2 deletions(-) diff --git a/kubernetes/helm/gateway-helm-chart/Chart.yaml b/kubernetes/helm/gateway-helm-chart/Chart.yaml index 0249e2d6e..c9a3b1b13 100644 --- a/kubernetes/helm/gateway-helm-chart/Chart.yaml +++ b/kubernetes/helm/gateway-helm-chart/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 name: gateway kubeVersion: ">=1.24.0-0" description: Helm chart for deploying the Gateway Operator components -version: 1.1.4 -appVersion: "1.2.0-beta-SNAPSHOT" +version: 1.2.0-alpha +appVersion: "1.2.0-alpha" type: application home: https://github.com/wso2/api-platform sources: diff --git a/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml b/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml index b16e87206..a370b9f74 100644 --- a/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml +++ b/kubernetes/helm/gateway-helm-chart/templates/gateway/gateway-config.yaml @@ -91,6 +91,16 @@ data: [controller.policies] definitions_path = {{ $gc.policies.definitions_path | quote }} + {{- if $gc.policies.build_manifest_path }} + build_manifest_path = {{ $gc.policies.build_manifest_path | quote }} + {{- end }} + + {{- if $gc.llm }} + [controller.llm] + {{- if $gc.llm.template_definitions_path }} + template_definitions_path = {{ $gc.llm.template_definitions_path | quote }} + {{- end }} + {{- end }} [controller.controlplane] insecure_skip_verify = {{ $gc.controlplane.insecure_skip_verify }} @@ -105,6 +115,19 @@ data: apim_oauth2_username = {{ $gc.controlplane.apim_oauth2_username | quote }} apim_oauth2_password = {{ $gc.controlplane.apim_oauth2_password | quote }} + {{- if $gc.event_hub }} + [controller.event_hub] + poll_interval = {{ $gc.event_hub.poll_interval | quote }} + cleanup_interval = {{ $gc.event_hub.cleanup_interval | quote }} + retention_period = {{ $gc.event_hub.retention_period | quote }} + + [controller.event_hub.database] + max_open_conns = {{ $gc.event_hub.database.max_open_conns }} + max_idle_conns = {{ $gc.event_hub.database.max_idle_conns }} + conn_max_lifetime = {{ $gc.event_hub.database.conn_max_lifetime | quote }} + conn_max_idle_time = {{ $gc.event_hub.database.conn_max_idle_time | quote }} + {{- end }} + {{- range $gc.encryption.providers }} [[controller.encryption.providers]] type = {{ .type | quote }} @@ -165,6 +188,13 @@ data: route_idle_timeout_ms = {{ $router.upstream.timeouts.route_idle_timeout_ms }} connect_timeout_ms = {{ $router.upstream.timeouts.connect_timeout_ms }} + {{- if $router.lua }} + [router.lua.request_transformation] + {{- if $router.lua.request_transformation.script_path }} + script_path = {{ $router.lua.request_transformation.script_path | quote }} + {{- end }} + {{- end }} + [router.http_listener] server_header_transformation = {{ $router.http_listener.server_header_transformation | quote }} server_header_value = {{ $router.http_listener.server_header_value | quote }} diff --git a/kubernetes/helm/gateway-helm-chart/values.yaml b/kubernetes/helm/gateway-helm-chart/values.yaml index 151e5bd34..8db82becc 100644 --- a/kubernetes/helm/gateway-helm-chart/values.yaml +++ b/kubernetes/helm/gateway-helm-chart/values.yaml @@ -193,6 +193,13 @@ gateway: policies: # Directory containing policy definitions definitions_path: ./default-policies + # Path to build-manifest.yaml for custom policy detection + build_manifest_path: ./build-manifest.yaml + + # LLM provider template configuration + llm: + # Directory containing default LLM provider prompt templates + template_definitions_path: ./default-llm-provider-templates # Control plane connection configuration # Note: host and token are set via gateway.controller.controlPlane and rendered as env vars in the deployment. @@ -226,6 +233,23 @@ gateway: apim_oauth2_username: "" apim_oauth2_password: "" + # EventHub: poll-based eventual-consistency layer used to sync state across + # multiple controller replicas (only relevant when storage.type is postgres or + # sqlserver and replicaCount > 1, but always configured/valid). + event_hub: + # Interval at which events are polled from the database + poll_interval: 3s + # Interval at which old events are cleaned up + cleanup_interval: 10m + # How long events are retained before being deleted + retention_period: 1h + # Connection pool settings for the EventHub database connection + database: + max_open_conns: 5 + max_idle_conns: 2 + conn_max_lifetime: 30m + conn_max_idle_time: 5m + # Encryption provider configuration for secret management. # File paths must match the mount path set in gateway.controller.encryptionKeys.mountPath. encryption: @@ -366,6 +390,13 @@ gateway: tracing_service_name: router + # Lua script configuration + lua: + request_transformation: + # Do NOT set the deprecated top-level lua_script_path alias — use this + # nested path only (config.go documents lua_script_path as deprecated). + script_path: ./lua/request_transformation.lua + # Policy Engine ext_proc filter configuration policy_engine: # Connection mode: "uds" (Unix domain socket, default) or "tcp" From d1dddb11e7f4841c0b73236eff7a04939dee8449 Mon Sep 17 00:00:00 2001 From: Dineth Date: Fri, 17 Jul 2026 12:47:44 +0530 Subject: [PATCH 4/6] .. --- kubernetes/helm/gateway-helm-chart/values.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/kubernetes/helm/gateway-helm-chart/values.yaml b/kubernetes/helm/gateway-helm-chart/values.yaml index 8db82becc..8786a5c2c 100644 --- a/kubernetes/helm/gateway-helm-chart/values.yaml +++ b/kubernetes/helm/gateway-helm-chart/values.yaml @@ -111,9 +111,7 @@ gateway: # Storage configuration storage: - # Storage type: "sqlite", "postgres", or "sqlserver" — the only values accepted - # by the controller's Validate() at startup ("memory" is NOT a valid value, - # despite being mentioned in older docs/comments). + # Storage type: "sqlite", "postgres", "sqlserver" # - sqlite: Single-instance embedded database backed by a PersistentVolumeClaim # - postgres: External PostgreSQL database; enables multi-replica controller deployments # - sqlserver: External SQL Server database; enables multi-replica controller deployments From 0a788c54820d264822aadc236a6da3909b89b80d Mon Sep 17 00:00:00 2001 From: Dineth Date: Fri, 17 Jul 2026 13:12:35 +0530 Subject: [PATCH 5/6] Update gateway controller and runtime image tags to 1.2.0-alpha --- kubernetes/helm/gateway-helm-chart/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kubernetes/helm/gateway-helm-chart/values.yaml b/kubernetes/helm/gateway-helm-chart/values.yaml index 8786a5c2c..1ef267aae 100644 --- a/kubernetes/helm/gateway-helm-chart/values.yaml +++ b/kubernetes/helm/gateway-helm-chart/values.yaml @@ -568,7 +568,7 @@ gateway: controller: image: repository: ghcr.io/wso2/api-platform/gateway-controller - tag: "1.2.0-beta-SNAPSHOT" + tag: "1.2.0-alpha" pullPolicy: Always imagePullSecrets: [] service: @@ -838,7 +838,7 @@ gateway: gatewayRuntime: image: repository: ghcr.io/wso2/api-platform/gateway-runtime - tag: "1.2.0-beta-SNAPSHOT" + tag: "1.2.0-alpha" pullPolicy: Always imagePullSecrets: [] service: From d2d111120d7c6fcf4a3ba07cf766434806c1f950 Mon Sep 17 00:00:00 2001 From: Dineth Date: Fri, 17 Jul 2026 16:53:25 +0530 Subject: [PATCH 6/6] Update appVersion to 1.2.0-alpha2 in Chart.yaml and update gateway controller and runtime image tags to 1.2.0-alpha2 in values.yaml --- kubernetes/helm/gateway-helm-chart/Chart.yaml | 2 +- kubernetes/helm/gateway-helm-chart/values.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/kubernetes/helm/gateway-helm-chart/Chart.yaml b/kubernetes/helm/gateway-helm-chart/Chart.yaml index c9a3b1b13..6619ec5b4 100644 --- a/kubernetes/helm/gateway-helm-chart/Chart.yaml +++ b/kubernetes/helm/gateway-helm-chart/Chart.yaml @@ -3,7 +3,7 @@ name: gateway kubeVersion: ">=1.24.0-0" description: Helm chart for deploying the Gateway Operator components version: 1.2.0-alpha -appVersion: "1.2.0-alpha" +appVersion: "1.2.0-alpha2" type: application home: https://github.com/wso2/api-platform sources: diff --git a/kubernetes/helm/gateway-helm-chart/values.yaml b/kubernetes/helm/gateway-helm-chart/values.yaml index 1ef267aae..7226c9516 100644 --- a/kubernetes/helm/gateway-helm-chart/values.yaml +++ b/kubernetes/helm/gateway-helm-chart/values.yaml @@ -568,7 +568,7 @@ gateway: controller: image: repository: ghcr.io/wso2/api-platform/gateway-controller - tag: "1.2.0-alpha" + tag: "1.2.0-alpha2" pullPolicy: Always imagePullSecrets: [] service: @@ -838,7 +838,7 @@ gateway: gatewayRuntime: image: repository: ghcr.io/wso2/api-platform/gateway-runtime - tag: "1.2.0-alpha" + tag: "1.2.0-alpha2" pullPolicy: Always imagePullSecrets: [] service: