For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Set connection and response deadlines for a Kubernetes Service or other destination backend.

Set deadlines for connecting to a backend and receiving its response. Backend timeouts apply to a selected destination, so you configure them in the backend section of an AgentgatewayPolicy.

A backend connection timeout starts when agentgateway begins to open a connection to the destination, and ends when the TCP connection is established. A backend response timeout starts when agentgateway sends the request to the destination, and ends when the complete response is received. For the other timeout types and where each one attaches, see About timeouts.

Set the request timeout long enough to include backend calls and any retries. A backend response timeout that is longer than the request timeout cannot extend the overall deadline.

Configure backend timeouts

The following example applies both backend timeout types to the httpbin Service, so that they apply to every route that reaches that Service. Because the policy targets a Service, create it in the same namespace as that Service. To set the same deadlines on a route instead, see HTTP connection settings.

1. Create the backend timeout policy.

   kubectl apply -f- <<EOF
   apiVersion: agentgateway.dev/v1alpha1
   kind: AgentgatewayPolicy
   metadata:
     name: httpbin-backend-timeouts
     namespace: httpbin
   spec:
     targetRefs:
     - group: ""
       kind: Service
       name: httpbin
     backend:
       tcp:
         connectTimeout: 2s
       http:
         requestTimeout: 5s
   EOF

   Setting	Description
   targetRefs	The destination that receives the settings. To select one Service port, set sectionName to its numeric port. You can also target an AgentgatewayBackend, route, route rule, listener, or Gateway.
   backend.tcp.connectTimeout	Maximum time to establish a connection to the destination. The value must be at least 100ms.
   backend.http.requestTimeout	Maximum time to receive the complete HTTP response from the destination. The value must be at least 1ms.

2. Verify that the policy is accepted.

   kubectl get AgentgatewayPolicy \
     httpbin-backend-timeouts -n httpbin

3. Optional: Port-forward the proxy admin port to verify the effective settings.

   kubectl port-forward deployment/agentgateway-proxy \
     -n agentgateway-system 15000 &
   sleep 2
   curl -s http://localhost:15000/config_dump | \
     jq '[.policies[] | select(.name.name == "httpbin-backend-timeouts")] | .[0]'

Set a webhook timeout

A guardrail webhook, external authorization server, or external processor is also a backend, and none of them carry a timeout field of their own. When the integration references a Kubernetes Service, attach a separate AgentgatewayPolicy to that Service and set backend.http.requestTimeout, the same way as the preceding example. For a worked example, see Configure the webhook timeout.

Cleanup

kubectl delete AgentgatewayPolicy \
  httpbin-backend-timeouts -n httpbin

For the other destination settings that use the same attachment model, see Policy sections.