changes from ai-gw-v2-forward-proxy branch

jbaross · jbaross · commit da0c72b51636 · 2026-07-07T10:47:41.000+01:00
diff --git a/app/_ai_gateway_entities/ai-mcp-server.md b/app/_ai_gateway_entities/ai-mcp-server.md
@@ -218,6 +218,10 @@ sequenceDiagram
 > Pings from MCP clients are included in the total request count for an {{site.ai_gateway}}
 > instance, in addition to requests made to the MCP server itself.
 
+### Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
+
 ## Tools
 
 A [tool](#schema-aigateway-mcpserver-tools) maps an MCP tool name to an upstream HTTP endpoint. Each tool needs at minimum a description and an HTTP method. The runtime extracts the host, path, headers, and query from the route configuration, so most tool entries don't need to specify them. Override these on the tool entry only when the route doesn't match the upstream endpoint exactly.
diff --git a/app/_ai_gateway_entities/ai-model.md b/app/_ai_gateway_entities/ai-model.md
@@ -272,6 +272,10 @@ To add redundancy and failover, the load balancer supports configurable retries,
 > [`failover_criteria`](#schema-aigateway-model-config-balancer-failover-criteria) to include HTTP codes
 > like `http_429` or `http_502`, and `non_idempotent` for POST requests.
 
+### Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
+
 ### Health check and circuit breaker
 
 To improve reliability under sustained failures, the load balancer includes a circuit breaker. When a target reaches the failure threshold set by [`max_fails`](#schema-aigateway-model-config-balancer-max-fails), the load balancer stops routing requests to it until the [`fail_timeout`](#schema-aigateway-model-config-balancer-fail-timeout) period elapses. For behavior examples and tuning, see [Circuit breaker](/ai-gateway/load-balancing/#health-check-and-circuit-breaker).
diff --git a/app/_ai_gateway_policies/ai-aws-guardrails/index.md b/app/_ai_gateway_policies/ai-aws-guardrails/index.md
@@ -50,3 +50,6 @@ The AI AWS Guardrails Policy emits structured log data for every inspected reque
 
 To log the raw content of blocked requests and responses, enable [`config.log_blocked_content`](/ai-gateway/policies/ai-aws-guardrails/reference/#schema--config-log-blocked-content). When enabled, the blocked prompt or response body appears under `ai.proxy.aws-guardrails.input_faulty_prompt` and `ai.proxy.aws-guardrails.output_faulty_response` in each log entry.
 
+## Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
diff --git a/app/_ai_gateway_policies/ai-azure-content-safety/index.md b/app/_ai_gateway_policies/ai-azure-content-safety/index.md
@@ -7,3 +7,7 @@ products:
   - ai-gateway
 content_type: plugin
 ---
+
+## Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
diff --git a/app/_ai_gateway_policies/ai-custom-guardrail/index.md b/app/_ai_gateway_policies/ai-custom-guardrail/index.md
@@ -7,3 +7,7 @@ products:
   - ai-gateway
 content_type: plugin
 ---
+
+## Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
diff --git a/app/_ai_gateway_policies/ai-gcp-model-armor/index.md b/app/_ai_gateway_policies/ai-gcp-model-armor/index.md
@@ -124,6 +124,10 @@ The AI GCP Model Armor Policy emits structured log data for every inspected requ
 
 To log the raw content of blocked requests and responses, enable [`config.log_blocked_content`](/ai-gateway/policies/ai-gcp-model-armor/reference/#schema--config-log-blocked-content). When enabled, the blocked prompt or response body appears under `ai.proxy.gcp-model-armor.input_faulty_prompt` and `ai.proxy.gcp-model-armor.output_faulty_response` in the log entry.
 
+## Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
+
 ## Limitations
 
 * Only chat prompts and chat responses are inspected; embeddings and other modalities are not checked.
diff --git a/app/_ai_gateway_policies/ai-lakera-guard/index.md b/app/_ai_gateway_policies/ai-lakera-guard/index.md
@@ -120,3 +120,7 @@ When the guardrails block a request, the log captures the violation reason, dete
   }
 }
 ```
+
+## Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
diff --git a/app/_ai_gateway_policies/ai-prompt-compressor/index.md b/app/_ai_gateway_policies/ai-prompt-compressor/index.md
@@ -165,3 +165,7 @@ sequenceDiagram
 <!-- vale on -->
 
 The AI Prompt Compressor Policy applies structured compression to preserve essential context of prompts sent by users, rather than trimming prompts arbitrarily or risking token overflows. This ensures the LLM receives a well-formed, focused prompt keeping token usage under control.
+
+## Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
diff --git a/app/_ai_gateway_policies/ai-sanitizer/index.md b/app/_ai_gateway_policies/ai-sanitizer/index.md
@@ -192,3 +192,7 @@ This service takes the following optional environment variables at startup:
 * `GUNICORN_WORKERS`: Specifies the number of Gunicorn processes to run
 * `PII_SERVICE_ENGINE_CONF`: Specifies the natural language processing (NLP) engine configuration file
 * `GUNICORN_LOG_LEVEL`: Specifies log level
+
+## Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
diff --git a/app/_ai_gateway_policies/ai-semantic-cache/index.md b/app/_ai_gateway_policies/ai-semantic-cache/index.md
@@ -129,3 +129,7 @@ If your Policy uses a Redis datastore, you can authenticate to it with a cloud R
 This allows you to seamlessly rotate credentials without relying on static passwords. 
 
 {% include_cached /md/ai-gateway/v2/redis-cloud-providers.md name=page.name heading_level=3 %}
+
+## Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
diff --git a/app/_ai_gateway_policies/ai-semantic-prompt-guard/index.md b/app/_ai_gateway_policies/ai-semantic-prompt-guard/index.md
@@ -55,3 +55,7 @@ The matching behavior is as follows:
 {% include_cached md/ai-gateway/v2/redis-cloud-auth.md tier=page.tier %}
 
 {% include_cached md/ai-gateway/v2/redis-cloud-providers.md name=page.name heading_level=3 %}
+
+## Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
diff --git a/app/_ai_gateway_policies/ai-semantic-response-guard/index.md b/app/_ai_gateway_policies/ai-semantic-response-guard/index.md
@@ -82,3 +82,7 @@ To enforce these rules, the AI Semantic Response Guard Policy:
 {% include_cached md/ai-gateway/v2/redis-cloud-auth.md tier=page.tier %}
 
 {% include_cached md/ai-gateway/v2/redis-cloud-providers.md name=page.name heading_level=3 %}
+
+## Forward proxy support
+
+{% include md/ai-gateway/v2/forward-proxy.md %}
diff --git a/app/_includes/md/ai-gateway/v2/forward-proxy.md b/app/_includes/md/ai-gateway/v2/forward-proxy.md
@@ -0,0 +1,5 @@
+Set `config.proxy` on this entity to route its outbound requests through an HTTP forward proxy. Use this in network-isolated deployments where {{site.ai_gateway}} cannot open direct connections to LLM providers or auxiliary services.
+
+The `proxy` record is identical for AI Model, AI MCP Server, and supported AI Policy entities. Existing capabilities such as load balancing, health checking, streaming, WebSocket, and HTTP/2 continue to work when the proxy is active.
+
+For the full field reference, traffic flow, and limitations, see [Forward proxy support](/ai-gateway/forward-proxy/).
diff --git a/app/_includes/md/ai-gateway/v2/konnect-aigw-setup.md b/app/_includes/md/ai-gateway/v2/konnect-aigw-setup.md
@@ -0,0 +1,25 @@
+To create a new Gateway using Konnect:
+
+1. Create a new personal access token by opening the [Konnect PAT page](https://cloud.konghq.com/global/account/tokens) and selecting **Generate Token**.
+1. Export your token to an environment variable:
+
+   ```bash
+   export KONNECT_TOKEN='YOUR_KONNECT_PAT'
+   ```
+1. Run the {{site.ai_gateway}} [quickstart script](https://get.konghq.com/quickstart/ai) to automatically provision a Control Plane in {{site.konnect_product_name}} and a local Data Plane:
+
+   ```bash
+   curl -Ls https://get.konghq.com/quickstart/ai | bash -s -- -k $KONNECT_TOKEN
+   ```
+
+This sets up a {{site.ai_gateway}} Control Plane named `ai-quickstart`, provisions a local Data Plane, and prints out the following environment variables export:
+
+```bash
+export AI_GATEWAY_ID=your-gateway-id
+export DECK_KONNECT_TOKEN=$KONNECT_TOKEN
+export DECK_KONNECT_CONTROL_PLANE_NAME=quickstart
+export KONNECT_CONTROL_PLANE_URL=https://us.api.konghq.com
+export KONNECT_PROXY_URL='http://localhost:8000'
+```
+
+Copy and paste these into your terminal to configure your session.
diff --git a/app/_kong_plugins/ai-aws-guardrails/index.md b/app/_kong_plugins/ai-aws-guardrails/index.md
@@ -94,4 +94,3 @@ To use AWS IAM roles with the plugin, set the `config.aws_assume_role_arn`, `con
 The AI AWS Guardrails plugin emits structured log data for every inspected request and response. For the full list of log fields, see the [{{site.ai_gateway}} audit log reference](/ai-gateway/ai-audit-log-reference/#ai-aws-guardrails-logs).
 
 To log the raw content of blocked requests and responses, enable [`config.log_blocked_content`](/plugins/ai-aws-guardrails/reference/#schema--config-log-blocked-content). {% new_in 3.14 %} When enabled, the blocked prompt or response body appears under `ai.proxy.aws-guardrails.input_faulty_prompt` and `ai.proxy.aws-guardrails.output_faulty_response` in each log entry.
-
diff --git a/app/_kong_plugins/ai-gcp-model-armor/index.md b/app/_kong_plugins/ai-gcp-model-armor/index.md
@@ -173,4 +173,4 @@ To log the raw content of blocked requests and responses, enable [`config.log_bl
 * Only chat prompts and chat responses are inspected; embeddings and other modalities are not checked.
 * Inspects one chat message or one response body at a time. Combining multiple messages reduces accuracy.
 * For SSE streaming, unsafe content may appear briefly before termination with `"stop_reason: blocked by content safety"`.
-* Only one `template_id` can be configured per plugin instance.
+* Only one `template_id` can be configured per plugin instance.
diff --git a/app/_kong_plugins/ai-lakera-guard/index.md b/app/_kong_plugins/ai-lakera-guard/index.md
@@ -172,4 +172,4 @@ When a request is blocked, the log captures the violation reason, detector detai
     }
   }
 }
-```
+```
diff --git a/app/_kong_plugins/forward-proxy/index.md b/app/_kong_plugins/forward-proxy/index.md
@@ -38,6 +38,10 @@ search_aliases:
 
 min_version:
   gateway: '1.0'
+
+related_resources:
+  - text: Forward proxy support for {{site.ai_gateway}}
+    url: /ai-gateway/forward-proxy/
 ---
 
 The Forward Proxy Advanced plugin allows {{site.base_gateway}} to connect to intermediary transparent HTTP proxies, instead of directly to the `upstream_url`, when forwarding requests upstream. 
diff --git a/app/ai-gateway/forward-proxy.md b/app/ai-gateway/forward-proxy.md

Original file line number	Diff line number	Diff line change
`@@ -120,3 +120,7 @@ When the guardrails block a request, the log captures the violation reason, dete`
`120`	`120`	`}`
`121`	`121`	`}`
`122`	`122`	```
	`123`	`+`
	`124`	`+## Forward proxy support`
	`125`	`+`
	`126`	`+{% include md/ai-gateway/v2/forward-proxy.md %}`