feat: forward proxy egress for upstream AI traffic

[kanurag94]

Description

Adds a spec.forwardProxy field to GatewayConfig that routes all upstream AI/LLM traffic from Gateways referencing the config through an HTTP CONNECT forward proxy. This is for data planes in locked-down networks that have no direct egress to providers and must send all outbound traffic through a proxy.

At xDS translation time the extension server resolves the proxy from the owning Gateway's GatewayConfig (route parentRefs → Gateway → aigateway.envoyproxy.io/gateway-config annotation) and wraps each upstream cluster's transport socket in Envoy's http_11_proxy transport, keeping the upstream TLS session nested inside the CONNECT tunnel. InferencePool clusters are excluded, wrapping is idempotent, and it is a no-op when no proxy is configured.

Config

apiVersion: aigateway.envoyproxy.io/v1beta1
kind: GatewayConfig
metadata:
  name: my-gateway-config
spec:
  forwardProxy:
    address: proxy.corp:3128 # host:port of the HTTP CONNECT proxy

The Gateway opts in via the existing aigateway.envoyproxy.io/gateway-config annotation.

Non-goals

Proxy authentication (Proxy-Authorization) and TLS to the proxy itself are not supported yet — the proxy is expected to authorize the gateway by network policy (e.g. an IP allowlist).

Related Issues/PRs (if applicable)

Fixes #1759

[codecov-commenter]

Codecov Report

❌ Patch coverage is 87.73585% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.87%. Comparing base (ea1c886) to head (ce2b183).

Files with missing lines	Patch %	Lines
internal/extensionserver/forward_proxy.go	87.37%	7 Missing and 6 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2367      +/-   ##
==========================================
+ Coverage   84.85%   84.87%   +0.01%     
==========================================
  Files         151      152       +1     
  Lines       22086    22192     +106     
==========================================
+ Hits        18742    18835      +93     
- Misses       2213     2220       +7     
- Partials     1131     1137       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kanurag94]

@gemini review

[kanurag94]

/retest

[gemini-code-assist]

Code Review

This pull request introduces support for routing upstream AI/LLM traffic through an HTTP CONNECT forward proxy by adding a ForwardProxy configuration field to GatewayConfig (v1alpha1 and v1beta1). The implementation wraps upstream transport sockets in Envoy's http_11_proxy transport socket. The feedback suggests improving port validation by parsing the port as a 16-bit unsigned integer to automatically reject out-of-range TCP ports, along with adding a corresponding test case.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.