### Setup YAML Example

Source: https://github.com/kgateway-dev/kgateway/blob/main/pkg/kgateway/setup/README_test.md

This YAML file is used to add GatewayClass and GatewayParameters for testing.

```yaml
testdata/setup_yaml/setup.yaml: Adds the GatewayClass and GatewayParameters
```

--------------------------------

### Setup KGateway Load Testing Environment

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/e2e/features/loadtesting/README.md

Commands to set up the KGateway load testing environment, including creating a kind cluster, building images, and starting Tilt.

```bash
cd <project-root>

ctlptl create cluster kind --name kind-kind --registry=ctlptl-registry

VERSION=1.0.0-ci1 CLUSTER_NAME=kind-kind make kind-build-and-load

tilt up
```

--------------------------------

### Setup kind cluster for manual testing

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/e2e/README-e2e-framework.md

Configure and start a kind cluster, optionally using cloud-provider-kind for environments like macOS.

```shell
CLOUD_PROVIDER_KIND=true ./hack/kind/setup-kind.sh
```

--------------------------------

### Istio CRDs Setup Example

Source: https://github.com/kgateway-dev/kgateway/blob/main/pkg/kgateway/setup/README_test.md

This YAML file is used to add Istio CRDs for testing.

```yaml
testdata/istio_crds_setup/crds.yaml: Adds istio CRDs
```

--------------------------------

### Install Go Tools

Source: https://github.com/kgateway-dev/kgateway/blob/main/pkg/kgateway/setup/README_test.md

Run this command from the `kgateway/pkg/kgateway` directory to install necessary Go tools for testing.

```shell
make install-go-tools
```

--------------------------------

### Apply example gateway configuration

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/debugging/local-controller.md

Apply an example gateway configuration to the cluster using kubectl.

```sh
kubectl -n kgateway-system apply -f examples/example-gw.yaml
```

--------------------------------

### Copy Example Filter Skeleton

Source: https://github.com/kgateway-dev/kgateway/blob/main/internal/envoy_modules/adding-a-filter.md

Copy the example filter skeleton to start creating a new filter. Remember to replace placeholders with your filter's name.

```bash
cp -r filters/kgateway-example-filter filters/<your-filter-name>
```

--------------------------------

### Run Setup Tests

Source: https://github.com/kgateway-dev/kgateway/blob/main/pkg/kgateway/setup/README_test.md

Execute this command from the `kgateway/pkg/kgateway` directory to run the environment tests in the setup directory.

```shell
go test -v ./setup/
```

--------------------------------

### Define Installation Context

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/testing/e2e-framework.md

Defines the configuration parameters required for installing kgateway via Helm charts.

```go
type Context struct {
    InstallNamespace          string   // e.g. "kgateway-test"
    ProfileValuesManifestFile string   // "production-like" Helm values (required)
    ValuesManifestFile        string   // test-specific Helm values (required)
    ExtraHelmArgs             []string // additional --set flags, etc.
}
```

--------------------------------

### Start Tilt

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/debugging/tilt.md

Launches the Tilt development environment.

```bash
tilt up
```

--------------------------------

### Create TestInstallation

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/testing/e2e-framework.md

Initializes a TestInstallation instance for a test file using the specified installation context.

```go
testInstallation := e2e.CreateTestInstallation(t, &install.Context{
    InstallNamespace:          installNs,
    ProfileValuesManifestFile: e2e.CommonRecommendationManifest,
    ValuesManifestFile:        e2e.EmptyValuesManifestPath,
})
```

--------------------------------

### Specify Experimental Minimum Gateway API Version Constraint

Source: https://github.com/kgateway-dev/kgateway/blob/main/design/12721-e2e-testing-with-gateway-api-versions.md

This example demonstrates how to set a minimum version constraint specifically for the experimental channel. If the standard channel is installed, tests with only an experimental minimum version defined will be skipped.

```go
    MinGwApiVersion: map[base.GwApiChannel]*semver.Version{
        base.GwApiChannelExperimental: base.GwApiV1_3_0,
    },
```

--------------------------------

### Apply example HTTP route configuration

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/debugging/local-controller.md

Apply an example HTTP route configuration to the cluster using kubectl.

```sh
kubectl -n kgateway-system apply -f examples/example-http-route.yaml
```

--------------------------------

### Install the devcontainers CLI

Source: https://github.com/kgateway-dev/kgateway/blob/main/tools/build-tools/README.md

Install the Node Package Manager (npm) global package for the devcontainers CLI. This is a one-time setup step.

```bash
npm install -g @devcontainers/cli
```

--------------------------------

### Setup Kind Cluster with Script

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/e2e/debugging.md

Executes the setup-kind.sh script to prepare the local test environment.

```bash
./hack/kind/setup-kind.sh
```

--------------------------------

### Install container-structure-test on Linux

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/container-structure/README.md

Download, verify checksum, and install the container-structure-test binary on Linux systems.

```bash
# Linux
curl -LO https://github.com/GoogleContainerTools/container-structure-test/releases/download/v1.19.3/container-structure-test-linux-amd64
echo "fa0fa333bb6ba5c14065e7468d2904f5c82d021d7e1c763c9a45c5f2fbe9ff5f  container-structure-test-linux-amd64" | sha256sum --check
chmod +x container-structure-test-linux-amd64
sudo mv container-structure-test-linux-amd64 /usr/local/bin/container-structure-test
```

--------------------------------

### Install container-structure-test on macOS

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/container-structure/README.md

Use Homebrew to install the container-structure-test CLI on macOS.

```bash
# macOS
brew install container-structure-test
```

--------------------------------

### Gateway Installation Assertions

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/testing/e2e-framework.md

Methods to verify the Gateway controller's installation status and retrieve its address.

```APIDOC
## EventuallyGatewayAddress / EventuallyGatewayInstallSucceeded

### Description
`EventuallyGatewayAddress` retrieves the IP address or hostname of a Gateway after it has been created. `EventuallyGatewayInstallSucceeded` confirms that the Gateway controller has been successfully installed and is ready.

### Method
`EventuallyGatewayAddress(ctx, name, ns)
EventuallyGatewayInstallSucceeded(ctx)`

### Endpoint
N/A (These are client-side assertion methods)

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
```go
gatewayAddr, err := s.TestInstallation.AssertionsT(s.T()).EventuallyGatewayAddress(
    s.Ctx,
    "my-gateway",
    "gateway-namespace",
)

s.TestInstallation.AssertionsT(s.T()).EventuallyGatewayInstallSucceeded(s.Ctx)
```

### Response
#### Success Response (200)
`EventuallyGatewayAddress` returns the Gateway's address. `EventuallyGatewayInstallSucceeded` returns void upon success.

#### Response Example
```json
{
  "gatewayAddress": "192.168.1.100"
}
```
```

--------------------------------

### Install Kgateway using Helm

Source: https://github.com/kgateway-dev/kgateway/blob/main/RELEASE.md

Use this command to install Kgateway from GHCR using a specific rolling main build version. Ensure the namespace is correctly specified.

```bash
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.4.0-main --namespace kgateway-system --create-namespace
```

--------------------------------

### Suite-Level Shared Setup with Per-Test Variations

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/testing/e2e-framework.md

This pattern is useful when multiple tests share common resources like the Gateway and backend service. Suite-level setup defines these shared resources, while per-test configurations specify variations, such as different HTTPRoute manifests.

```go
import "github.com/project-example/project/test/base"

// ...

setup = base.TestCase{
    Manifests: []string{gatewayManifest, backendManifest},
}
testCases = map[string]*base.TestCase{
    "TestHeaderMatch": {Manifests: []string{headerMatchRoute}},
    "TestPathMatch":   {Manifests: []string{pathMatchRoute}},
}
```

--------------------------------

### Start Ollama Service Locally

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/debugging/quick-start-ai-gateway-locally.md

Start the Ollama service, specifying the host IP address to make it accessible. This command configures Ollama to listen on the specified IP and port.

```bash
OLLAMA_HOST=192.168.181.210 ollama serve
```

--------------------------------

### Verify KGateway Setup

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/e2e/features/loadtesting/README.md

Kubectl commands to verify the KGateway setup, checking for Gateway API CRDs, KGateway controller pods, and the current cluster context.

```bash
kubectl get crd gateways.gateway.networking.k8s.io

kubectl get pods -n kgateway-system

kubectl config current-context
```

--------------------------------

### Setup local Kind cluster

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/debugging/local-controller.md

Run this script to set up a local Kind cluster for testing. Ensure you have the correct version tag specified.

```sh
VERSION=2.0.0-dev ./hack/kind/setup-kind.sh
```

--------------------------------

### Auth Succeeded Metadata Configuration Example

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/architecture/auth-succeeded-metadata.md

This example illustrates how the auth succeeded metadata is configured for different scenarios within a filter chain. It shows the effect of enabling or disabling authentication mechanisms on specific routes.

```text
filter chain
  [disabled] ext_auth_enabled  <-
  [disabled] ext_auth/<name>   <-

route with extAuth enabled
  ext_auth/<name>: ExtAuthzPerRoute  <-
  ext_auth_enabled: <rustformation>  <-

route with extAuth disabled
  ext_auth/<name>: {disabled: true}  <-
  ext_auth_enabled: {blank}          <-

```

--------------------------------

### Pods YAML Example

Source: https://github.com/kgateway-dev/kgateway/blob/main/pkg/kgateway/setup/README_test.md

This YAML file is used to add shared pods and nodes for testing.

```yaml
testdata/setup_yaml/pods.yaml: Adds the shared pods and nodes
```

--------------------------------

### Run Specific Test Suite with TEST_PKG

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/testing/run-tests.md

Specify which test suite to run using the TEST_PKG environment variable. This example runs the 'test' suite.

```bash
TEST_PKG=test make test
```

--------------------------------

### Clean up example gateway

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/debugging/local-controller.md

Delete the example gateway configuration from the cluster.

```sh
kubectl -n kgateway-system delete -f examples/example-gw.yaml
```

--------------------------------

### Go: Setup Conformance Suite

Source: https://github.com/kgateway-dev/kgateway/blob/main/design/13891-e2e-framework-selection.md

Initializes the conformance suite for Gateway API tests. It sets up the necessary components and retrieves the suite instance for use in tests. Ensure common.SetupConformanceSuite is called before accessing the suite.

```go
var suite *confsuite.ConformanceTestSuite

func TestMain(m *testing.M) {
    if err := common.SetupConformanceSuite(gatewayClassName, []fs.FS{manifestFS}); err != nil {
        fmt.Fprintf(os.Stderr, "failed to set up conformance suite: %v\n", err)
        os.Exit(1)
    }
    suite = common.GetSuite()
    os.Exit(m.Run())
}
```

--------------------------------

### Define SetupByVersion configuration

Source: https://github.com/kgateway-dev/kgateway/blob/main/design/12721-e2e-testing-with-gateway-api-versions.md

Use this structure within BaseTestingSuite to map Gateway API channels and versions to specific test cases. The system selects the highest matching version for the current channel, falling back to the default Setup if no match is found.

```go
	// SetupByVersion allows defining different setup configurations for different GW API versions and channels.
	// The outer map key is the channel (standard or experimental).
	// The inner map key is the minimum version, and the value is the TestCase to use.
	// The system will select the setup with the highest matching version for the current channel.
	// If no setups match, falls back to the Setup field for backward compatibility.
	// Example:
	//   SetupByVersion: map[GwApiChannel]map[*semver.Version]*TestCase{
	//     GwApiChannelExperimental: {
	//       GwApiV1_3_0: &setupExperimentalV1_3,
	//     },
	//     GwApiChannelStandard: {
	//       GwApiV1_3_0: &setupStandardV1_4,
	//     },
	//   }
	SetupByVersion map[GwApiChannel]map[*semver.Version]*TestCase
```

--------------------------------

### Test blocked GET request

Source: https://github.com/kgateway-dev/kgateway/blob/main/examples/waypoint/README.md

Verify that GET requests are blocked by the authorization policy.

```bash
kubectl -n httpbin exec $CLIENT -- curl -si httpbin:8000/get
```

--------------------------------

### Manual Local Development Setup

Source: https://github.com/kgateway-dev/kgateway/blob/main/AGENTS.md

Manually set up the complete development environment, including running Kind, CRDs, MetalLB, and images. Provides a command to reload KGateway after code changes.

```bash
# Set up complete development environment
make run  # kind + CRDs + MetalLB + images + charts

# Update after code change
make kind-reload-kgateway
```

--------------------------------

### Install required CRDs

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/debugging/local-controller.md

Install the necessary Custom Resource Definitions (CRDs) for Kgateway using Helm.

```sh
helm install kgateway-crds install/helm/kgateway-crds
```

--------------------------------

### Create a kind cluster

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/debugging/tilt.md

Initializes a local Kubernetes cluster with a registry using ctlptl.

```bash
ctlptl create cluster kind --name kind-kgateway --registry=ctlptl-registry
```

--------------------------------

### Build and Deploy Dummy IDP

Source: https://github.com/kgateway-dev/kgateway/blob/main/hack/dummy-idp/README.md

Commands to build the container image and apply the Kubernetes manifest.

```shell
VERSION=<version> make kind-build-and-load-dummy-idp
```

```shell
kubectl apply -f <path-to-dummy-idp-manifest.yaml>
```

--------------------------------

### Local Development with Tilt

Source: https://github.com/kgateway-dev/kgateway/blob/main/AGENTS.md

Set up a local Kubernetes cluster using Tilt for live code reloading. This includes creating a cluster, building images, and deploying with Tilt.

```bash
# Initial setup
ctlptl create cluster kind --name kind-kind --registry=ctlptl-registry

# Build images and load into kind
VERSION=v1.0.0-ci1 CLUSTER_NAME=kind make kind-build-and-load  # Builds all 3 images

# Deploy with Tilt (live reload enabled)
tilt up  # Configure via tilt-settings.yaml

# as long as tilt is running, it will auto-reload on code changes
```

--------------------------------

### Define Testing Suite Structure in Go

Source: https://github.com/kgateway-dev/kgateway/blob/main/design/13891-e2e-framework-selection.md

Defines the structure for a testing suite, embedding a base suite and including a local gateway instance. SetupSuite initializes the gateway address and local gateway.

```go
type testingSuite struct {
    *base.BaseTestingSuite
    localGateway common.Gateway
}

func NewTestingSuite(ctx context.Context, testInst *e2e.TestInstallation) suite.TestingSuite {
    return &testingSuite{
        base.NewBaseTestingSuite(ctx, testInst, setup, testCases),
        common.Gateway{},
    }
}

func (s *testingSuite) SetupSuite() {
    s.BaseTestingSuite.SetupSuite()
    address := s.TestInstallation.Assertions.EventuallyGatewayAddress(s.Ctx, "gateway", "default")
    s.localGateway = common.Gateway{...}
}

func (s *testingSuite) TestGatewayWithRoute() {
    s.assertSuccessfulResponse()
}
```

--------------------------------

### Policy Status Examples

Source: https://github.com/kgateway-dev/kgateway/blob/main/design/11741-policy-status-and-merge-reporting.md

Examples of the PolicyStatus structure for different attachment scenarios, including successful attachment, merged policies, and overridden policies.

```yaml
status:
  ancestors:
  - ancestorRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: test
      namespace: default
    conditions:
    - lastTransitionTime: "2025-07-24T18:06:29Z"
      message: Policy accepted
      observedGeneration: 1
      reason: Valid
      status: "True"
      type: Accepted
    - lastTransitionTime: "2025-07-24T18:06:29Z"
      message: Attached to all targets
      observedGeneration: 1
      reason: Attached
      status: "True"
      type: Attached
    controllerName: kgateway.dev/kgateway
```

```yaml
status:
  ancestors:
  - ancestorRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: test
      namespace: default
    conditions:
    - lastTransitionTime: "2025-07-24T18:06:29Z"
      message: Policy accepted
      observedGeneration: 1
      reason: Valid
      status: "True"
      type: Accepted
    - lastTransitionTime: "2025-07-24T18:06:29Z"
      message: Merged with other policies in target(s) and attached
      observedGeneration: 1
      reason: Merged
      status: "True"
      type: Attached
    controllerName: kgateway.dev/kgateway
```

```yaml
status:
  ancestors:
  - ancestorRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: test
      namespace: default
    conditions:
    - lastTransitionTime: "2025-07-24T18:06:29Z"
      message: Policy accepted
      observedGeneration: 1
      reason: Valid
      status: "True"
      type: Accepted
    - lastTransitionTime: "2025-07-24T18:06:29Z"
      message: Overridden due to conflict with higher priority policy in target(s)
      observedGeneration: 1
      reason: Overridden
      status: "False"
      type: Attached
    controllerName: kgateway.dev/kgateway
```

--------------------------------

### Start and execute commands in the devcontainer

Source: https://github.com/kgateway-dev/kgateway/blob/main/tools/build-tools/README.md

Use the devcontainers CLI to start a devcontainer environment and then execute commands within it. This is useful for interactive testing and development.

```bash
devcontainer up --workspace-folder .
devcontainer exec --workspace-folder . bash
```

--------------------------------

### Build and Load Images

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/e2e/debugging.md

Builds and loads initial images into the kind cluster.

```bash
VERSION=1.0.0-ci1 CLUSTER_NAME=kind make kind-build-and-load
```

--------------------------------

### Running Tests with PERSIST_INSTALL

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/e2e/README-e2e-framework.md

Set PERSIST_INSTALL to 'true' to install kgateway without overwriting, skip teardown, and leave the installation intact after tests for manual inspection.

```shell
PERSIST_INSTALL=true ./hack/run-test.sh SessionPersistence
```

--------------------------------

### Run KGateway Load Tests from Command Line

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/e2e/features/loadtesting/README.md

Execute load tests using make commands. Options include running baseline tests (1000 routes), production tests (5000 routes), all load tests, or tests with strict validation enabled.

```bash
# Run baseline test (1000 routes)
make run-load-tests-baseline
```

```bash
# Run production test (5000 routes)
make run-load-tests-production
```

```bash
# Run all load tests (baseline + production)
make run-load-tests
```

```bash
# Run against an already-installed strict-validation controller
VALIDATION_MODE=strict make run-load-tests
```

--------------------------------

### Adding Feature Suites to Test Installations

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/e2e/README-e2e-framework.md

To include a feature suite in a specific test installation, register it within the exported function of the corresponding *_tests.go file.

```go
func IstioTests() []*test.Installation {
	return []*test.Installation{
		test.NewInstallation(
			&istio.Suite{},
			&session.Suite{},
		),
	}
}
```

--------------------------------

### Run tests using the quick start script

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/e2e/README-e2e-framework.md

Use the hack/run-test.sh script to execute e2e or unit tests, run all tests in a package, or list available tests.

```shell
# Run an e2e test suite
./hack/run-test.sh SessionPersistence

# Run a unit test
./hack/run-test.sh TestShouldUseDefaultGatewayParameters

# Run all tests in a package
./hack/run-test.sh --package ./pkg/utils/helmutils

# Skip setup if cluster exists (faster iteration for local development with e2e tests)
PERSIST_INSTALL=true ./hack/run-test.sh SessionPersistence

# List all available tests
./hack/run-test.sh --list
```

--------------------------------

### Build and Test Commands

Source: https://github.com/kgateway-dev/kgateway/blob/main/test/e2e/defaults/extproc/README.md

Commands for building the extproc server and running e2e tests.

```bash
make e2e-test
```

```bash
make extproc-server-docker kind-load-extproc-server
```

--------------------------------

### Example Pod Template with Index Variable

Source: https://github.com/kgateway-dev/kgateway/blob/main/hack/utils/applier/README.md

This is an example of a Kubernetes Pod manifest that uses the `.Index` template variable for its metadata and labels. The YAML must be valid before template evaluation.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: app-{{.Index}}
  namespace: kgateway-system
  labels:
    app: app-{{.Index}}
    test: test1
spec:
  containers:
  - name: app
    image: registry.k8s.io/pause:3.6
    resources:
      limits:
        memory: "1Mi"
        cpu: "1m"
    ports:
      - containerPort: 8080

```

--------------------------------

### ACL Policy Example

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/policy_merging/acl-policy-merging.md

Two example ACL policies for the same route, one with higher weight (policy-a) and one with lower weight (policy-b). These are used to demonstrate deep merge behavior.

```yaml
# policy-a (higher weight, p1)
spec:
  acl:
    defaultAction: deny
    rules:
      - action: allow
        cidrs: ["10.0.0.0/8"]

# policy-b (lower weight, p2)
spec:
  acl:
    defaultAction: deny
    rules:
      - action: allow
        cidrs: ["192.168.1.0/24"]
```

--------------------------------

### Install Kgateway CRDs using Helm

Source: https://github.com/kgateway-dev/kgateway/blob/main/RELEASE.md

Use this command to install the Kgateway CRDs from GHCR using a specific rolling main build version. Ensure the namespace is correctly specified.

```bash
helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.4.0-main --namespace kgateway-system --create-namespace
```

--------------------------------

### Run Dummy IDP Locally with Docker

Source: https://github.com/kgateway-dev/kgateway/blob/main/hack/dummy-idp/README.md

Commands to build and run the service locally using Docker.

```shell
# Build the Go binary and Docker image (will rebuild if source changed)
make dummy-idp-docker

# Run the container
docker run -p 8443:8443 ghcr.io/kgateway-dev/dummy-idp:0.0.1
```

```shell
# Build the binary first (or force rebuild by deleting _output/hack/dummy-idp/dummy-idp-linux-amd64)
make dummy-idp

# Build Docker image with custom tag (from the output directory)
docker build -f _output/hack/dummy-idp/Dockerfile.dummy-idp \
  --build-arg BASE_IMAGE=alpine:3.17.6 \
  --build-arg GOARCH=amd64 \
  -t dummy-idp:local \
  _output/hack/dummy-idp

# Run the container
docker run -p 8443:8443 dummy-idp:local
```

```shell
# Remove the binary to force rebuild
rm -f _output/hack/dummy-idp/dummy-idp-linux-<arch>
make dummy-idp-docker
```

```shell
docker run -p 8443:8443 ghcr.io/kgateway-dev/dummy-idp:0.0.1
```

--------------------------------

### Deploy test namespace

Source: https://github.com/kgateway-dev/kgateway/blob/main/examples/waypoint/README.md

Apply the configuration to set up the test namespace for the waypoint demo.

```bash
kubectl apply -f examples/waypoint/httpbin-mesh.yaml
```

--------------------------------

### GatewayExtension YAML Configurations

Source: https://github.com/kgateway-dev/kgateway/blob/main/design/10851-extension-ordering.md

Provides example YAML configurations for deploying GatewayExtension resources. Use these to set up ExtAuth and ExtProc extensions, including optional placement details.

```yaml
apiVersion: gateway.kgateway.dev/v1alpha1
kind: GatewayExtension
metadata:
  name: basic-extauth
spec:
  type: ExtAuth
  extauth:
  - backendRef:
    - name: custom-auth.svc
      port: 50051
```

```yaml
apiVersion: gateway.kgateway.dev/v1alpha1
kind: GatewayExtension
metadata:
  name: basic-extauth-2
spec:
  type: ExtAuth
  extauth:
  - backendRef:
    - name: custom-auth.svc
      port: 50051
  placement:
    stage: RateLimit # note we need to think more on the stages we expose
    priority: 1
```

```yaml
apiVersion: gateway.kgateway.dev/v1alpha1
kind: GatewayExtension
metadata:
  name: basic-ext-proc
spec:
  type: ExtProc
  extproc:
  - backendRef:
    - name: custom-extproc.svc
      port: 50051
  placement:
    stage: Router
    priority: -1
```

--------------------------------

### Create Backend Service

Source: https://github.com/kgateway-dev/kgateway/blob/main/docs/guides/frontend-tls.md

Deploys and exposes a simple httpbin service in the 'test-mtls' namespace for testing purposes.

```bash
kubectl create deployment httpbin --image=kennethreitz/httpbin -n test-mtls
```

```bash
kubectl expose deployment httpbin --port=8000 --target-port=80 -n test-mtls
```

--------------------------------

### GET /.well-known/oauth-authorization-server

Source: https://github.com/kgateway-dev/kgateway/blob/main/hack/dummy-idp/README.md

Retrieves the OAuth2 discovery document for the identity provider.

```APIDOC
## GET /.well-known/oauth-authorization-server

### Description
Retrieves the OAuth2 discovery document.

### Method
GET

### Endpoint
/.well-known/oauth-authorization-server
```

--------------------------------

### Ollama Server Configuration Output

Source: https://github.com/kgateway-dev/kgateway/blob/main/devel/debugging/quick-start-ai-gateway-locally.md

Example output showing the Ollama server configuration, including environment variables and listening address. This confirms the server is running and configured correctly.

```text
time=2025-05-21T12:33:42.433+08:00 level=INFO source=routes.go:1205 msg="server config"
env="map[HTTPS_PROXY: HTTP_PROXY: NO_PROXY: OLLAMA_CONTEXT_LENGTH:4096
OLLAMA_DEBUG:INFO OLLAMA_FLASH_ATTENTION:false OLLAMA_GPU_OVERHEAD:0
OLLAMA_HOST:http://192.168.181.210:11434 OLLAMA_KEEP_ALIVE:5m0s OLLAMA_KV_CACHE_TYPE:
OLLAMA_LLM_LIBRARY: OLLAMA_LOAD_TIMEOUT:5m0s OLLAMA_MAX_LOADED_MODELS:0
OLLAMA_MAX_QUEUE:512 OLLAMA_MODELS:/Users/zhengkezhou/.ollama/models
OLLAMA_MULTIUSER_CACHE:false OLLAMA_NEW_ENGINE:false OLLAMA_NOHISTORY:false
OLLAMA_NOPRUNE:false OLLAMA_NUM_PARALLEL:0 OLLAMA_ORIGINS:[http://localhost https://localhost
http://localhost:* https://localhost:* http://127.0.0.1 https://127.0.0.1 http://127.0.0.1:* https://127.0.0.1:* 
http://0.0.0.0 https://0.0.0.0 http://0.0.0.0:* https://0.0.0.0:* app://* file://* tauri://* vscode-webview://* 
vscode-file://*] OLLAMA_SCHED_SPREAD:false http_proxy: https_proxy: no_proxy:]"
time=2025-05-21T12:33:42.436+08:00 level=INFO source=images.go:463 msg="total blobs: 12"
time=2025-05-21T12:33:42.437+08:00 level=INFO source=images.go:470 msg="total unused blobs removed: 0"
time=2025-05-21T12:33:42.437+08:00 level=INFO source=routes.go:1258 msg="Listening on 192.168.181.210:11434 (version 0.7.0)"
time=2025-05-21T12:33:42.478+08:00 level=INFO source=types.go:130 msg="inference compute" id=0 library=metal variant="" compute="" driver=0.0 name="" total="16.0 GiB" available="16.0 GiB"
```

--------------------------------

### GET /authorize

Source: https://github.com/kgateway-dev/kgateway/blob/main/hack/dummy-idp/README.md

Initiates the authorization flow and returns a redirect URL with an authorization code.

```APIDOC
## GET /authorize

### Description
Request authorization (returns redirect URL with code).

### Method
GET

### Endpoint
/authorize

### Parameters
#### Query Parameters
- **client_id** (string) - Required - The client identifier
- **redirect_uri** (string) - Required - The callback URI
```

--------------------------------

### E2E Framework POC with sigs.e2e-framework in Go

Source: https://github.com/kgateway-dev/kgateway/blob/main/design/13891-e2e-framework-selection.md

Demonstrates using the sigs.e2e-framework for testing Gateway API resources. It includes setup for manifest application, obtaining gateway addresses, and assessing responses.

```go
func TestGatewayWithRoute(t *testing.T) {
    var gatewayAddress string

    feat := features.New("Gateway with Route").
        Setup(func(ctx context.Context, t *testing.T, cfg *envconf.Config) context.Context {
            // Manifest application: repo-specific code required
            applier := kgateway.NewApplier(cfg.Client())  // Custom helper
            applier.ApplyManifests(ctx, "testdata/gateway-with-route.yaml")
            // Cleanup registered via t.Cleanup (framework-standard)
            
            addr, err := gateway.GetAddress(ctx, cfg, "test-gateway", "kgateway-test")
            if err != nil {
                t.Fatalf("failed to get gateway address: %v", err)
            }
            gatewayAddress = addr
            return ctx
        }).
        Assess("successful response on all listeners", func(ctx context.Context, t *testing.T, _ *envconf.Config) context.Context {
            for _, port := range []int{8080, 80} {
                assertions.AssertSuccessfulResponse(t, gatewayAddress, port)
            }
            return ctx
        }).
        Feature()

    testenv.Test(t, feat)
}
```

--------------------------------

### Apply authorization policy

Source: https://github.com/kgateway-dev/kgateway/blob/main/examples/waypoint/README.md

Apply a policy to deny GET requests to the httpbin service.

```bash
kubectl apply -f examples/waypoint/httpbin-authz.yaml
```