For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.
Backend TLS
When your backend requires TLS (re-encryption or mTLS), NGINX’s proxy-ssl-* annotations are translated by the agentgateway emitter into an AgentgatewayPolicy with spec.backend.tls settings. The policy targets the backend Service.
Before: Ingress with backend TLS
cat <<'EOF' > backend-tls-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: backend-tls-demo
annotations:
nginx.ingress.kubernetes.io/proxy-ssl-secret: "default/backend-tls-secret"
nginx.ingress.kubernetes.io/proxy-ssl-verify: "on"
nginx.ingress.kubernetes.io/proxy-ssl-name: "internal-api.example.com"
spec:
ingressClassName: agentgateway
rules:
- host: app.example.com
http:
paths:
- backend:
service:
name: secure-api
port:
number: 443
path: /api
pathType: Prefix
EOFConvert
ingress2gateway print --providers=ingress-nginx --emitter=agentgateway \
--input-file backend-tls-ingress.yaml > backend-tls-agentgateway.yamlAfter: AgentgatewayPolicy with backend TLS
cat backend-tls-agentgateway.yamlThe tool generates a Gateway, HTTPRoute(s), and an AgentgatewayPolicy per backend Service. The policy name is <service-name>-backend-tls. With verification enabled (proxy-ssl-verify: "on"), the emitter configures mTLS via mtlsCertificateRef and does not set insecureSkipVerify:
apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayPolicy
metadata:
name: secure-api-backend-tls
namespace: default
spec:
targetRefs:
- group: ""
kind: Service
name: secure-api
backend:
tls:
mtlsCertificateRef:
- name: backend-tls-secret
sni: internal-api.example.comIf you set proxy-ssl-verify: "off", the emitter would set spec.backend.tls.insecureSkipVerify: All instead of mTLS.
Apply
kubectl apply -f backend-tls-agentgateway.yaml