ModelGateway

apiVersion

agents.nanohype.dev/v1alpha1

kind

ModelGateway

scope

Namespaced

reconciled by

eks-agent-platform

short names

mgw

ModelGateway is a per-Platform gateway CR that fronts Bedrock for one or more named routes.

ModelGatewaySpec configures a per-Platform gateway: the routes exposed, which Bedrock models back them, and which Guardrail attaches.

What kubectl get shows

Column	Type	Meaning
Platform	string	—
Endpoint	string	—
Phase	string	—

Spec

• platformRefobjectrequired

  PlatformRef is the owning Platform.

  • namestringrequired

• routes[]objectrequired

  Routes is the list of named routes the gateway exposes.

  • modelIdstringrequired

    ModelID is the route's model. For a foundation route it is the canonical Bedrock model ID or inference-profile ID; for an imported route it is the imported-model ARN (arn:<partition>:bedrock:<region>:<account>:imported-model/<id>).

  • namestringrequired

  • apistring

    Anthropic · OpenAI

    API is the wire format callers speak to this route, and therefore which base URL they must use — the gateway serves each format under its own endpoint prefix. The reconciler publishes the resolved value and its base URL on status.routes, so a caller reads the contract rather than assuming it. Left unset it is derived from the model: an anthropic-family foundation route serves Anthropic, everything else serves OpenAI. There is no static default, because one would be wrong for whichever kind of route it did not describe — an embeddings route is not reachable as Anthropic, and defaulting a Claude route to OpenAI would silently drop thinking blocks and cache points. Set it explicitly to pin the format across a model change: a route declared OpenAI stays OpenAI when repointed from Claude to an open-weight model, so the swap is a CR edit and the app is untouched.

  • crossRegionProfilestring

    CrossRegionProfile enables a Bedrock cross-region inference profile. Foundation routes only; rejected on an imported route.

  • guardrailRefobject

    GuardrailRef overrides the gateway's default guardrail. On a foundation route the guardrail attaches as request headers the caller cannot override. On an imported route an inline guardrail is not applicable (Bedrock inline guardrails are foundation-model-only), so the route is served without one and the gateway surfaces an ImportedRouteGuardrailUnenforced condition — enforcement via ApplyGuardrail is a tracked follow-up.

    1 field under guardrailRef

    • namestringrequired

  • modelFamilystring

    anthropic · meta · mistral · cohere · amazon-titan · amazon-nova · stability

    ModelFamily is the Bedrock model family for a foundation route: anthropic | meta | mistral | cohere | amazon-titan | amazon-nova | stability. Required for a foundation route, rejected for an imported one (enforced by the route-level CEL rules above).

  • modelSourcestringdefault "foundation"

    foundation · imported

    ModelSource discriminates a foundation-model route from an imported (Custom Model Import) route. Defaults to foundation, so an existing route that omits it stays a foundation route.

  • rateLimitinteger (int32)

    RateLimit caps requests per minute (not tokens) on this route. The operator renders it into a local rate-limit rule on the gateway's BackendTrafficPolicy; 0 or unset disables rate limiting for the route.

• defaultGuardrailRefobject

  DefaultGuardrailRef applies when a Route does not specify its own.

  • namestringrequired