Installing an Agent Gateway on Kubernetes

Introduction

In part 1 we covered what an agent gateway is and why agentic systems need one. This tutorial gets one running. You will install agentgateway — the open-source (Apache-2.0) data plane hosted by the Linux Foundation’s Agentic AI Foundation — onto a Kubernetes cluster, create a Gateway, and send your first request through it.

Everything here runs on open-source components, so you can follow along on a free local cluster.

Versions used in this tutorial: Gateway API v1.5.0, agentgateway v1.2.1.

Step 1 — Create a local cluster (optional)

If you already have a cluster, skip this. For a throwaway local cluster, kind is the quickest option:

kind create cluster --name agw-lab

Confirm the node is ready:

kubectl get nodes

NAME                    STATUS   ROLES           AGE   VERSION
agw-lab-control-plane   Ready    control-plane   60s   v1.36.1

Step 2 — Install the Gateway API CRDs

agentgateway is configured through the Kubernetes Gateway API, so its custom resources go in first:

kubectl apply --server-side --force-conflicts \
  -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/standard-install.yaml

Step 3 — Install the agentgateway CRDs

agentgateway ships as two Helm charts: the CRDs and the control plane. Install the CRDs first:

helm upgrade -i agentgateway-crds oci://cr.agentgateway.dev/charts/agentgateway-crds \
  --create-namespace --namespace agentgateway-system \
  --version v1.2.1 \
  --set controller.image.pullPolicy=Always

Step 4 — Install the agentgateway control plane

helm upgrade -i agentgateway oci://cr.agentgateway.dev/charts/agentgateway \
  --namespace agentgateway-system \
  --version v1.2.1 \
  --set controller.image.pullPolicy=Always \
  --set controller.extraEnv.KGW_ENABLE_GATEWAY_API_EXPERIMENTAL_FEATURES=true \
  --wait

The control plane watches Gateway API and agentgateway resources and turns them into running proxies.

Step 5 — Verify the install

Check the control-plane pod:

kubectl get pods -n agentgateway-system

NAME                           READY   STATUS    RESTARTS   AGE
agentgateway-68c7bd47d-kh528   1/1     Running   0          20s

Confirm the GatewayClass was registered and accepted:

kubectl get gatewayclass agentgateway

NAME           CONTROLLER                      ACCEPTED   AGE
agentgateway   agentgateway.dev/agentgateway   True       30s

ACCEPTED: True means the control plane is ready to manage Gateways of this class.

Step 6 — Create a Gateway

The control plane is running, but no proxy exists yet. Create a Gateway and the control plane will provision one for you:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: agentgateway-proxy
  namespace: agentgateway-system
spec:
  gatewayClassName: agentgateway
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: All

Apply it (save the file as gateway.yaml or pipe it with kubectl apply -f -), then check its status:

kubectl get gateway agentgateway-proxy -n agentgateway-system

NAME                 CLASS          ADDRESS   PROGRAMMED   AGE
agentgateway-proxy   agentgateway             True         10s

PROGRAMMED: True means the proxy is deployed and ready for routes.

Step 7 — Route a request to a backend

Deploy a sample HTTP backend (httpbin):

kubectl apply -f https://raw.githubusercontent.com/kgateway-dev/kgateway/refs/heads/main/examples/httpbin.yaml

Attach an HTTPRoute that sends traffic for www.example.com to it:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httpbin
  namespace: httpbin
spec:
  parentRefs:
    - name: agentgateway-proxy
      namespace: agentgateway-system
  hostnames:
    - "www.example.com"
  rules:
    - backendRefs:
        - name: httpbin
          port: 8000

Step 8 — Send a request through the gateway

Port-forward the proxy in one terminal:

kubectl port-forward deployment/agentgateway-proxy -n agentgateway-system 8080:80

In another terminal, call the route:

curl -i localhost:8080/headers -H "host: www.example.com"

HTTP/1.1 200 OK
content-type: application/json; encoding=utf-8
content-length: 148

{
  "headers": {
    "Host": [ "www.example.com" ],
    "User-Agent": [ "curl/8.7.1" ]
  }
}

A 200 with the headers echoed back confirms the request travelled through agentgateway to the backend. You now have a working agent gateway.

Clean up

Remove the demo route when you are done, so it does not collide with later tutorials:

kubectl delete httproute httpbin -n httpbin

To tear down the whole local cluster:

kind delete cluster --name agw-lab

What’s next

You have a gateway routing plain HTTP. The next tutorial puts it to work on agent traffic: exposing a Model Context Protocol (MCP) tool through the gateway, with discovery and an audit trail.

Next in this series: Your First MCP Gateway.

Summary

• agentgateway installs as two Helm charts (CRDs + control plane) on top of the Kubernetes Gateway API.
• The control plane registers an agentgateway GatewayClass and turns each Gateway you create into a running proxy.
• An HTTPRoute attaches a backend to the Gateway, and a request through the proxy returns 200.
• Every component here is open source, so the setup runs on a free local kind cluster.