LLMGateway

The infrastructure CRD behind an LLM gateway: the operator reconciles it into a StatefulSet plus a Service that agents in the namespace point at.

Where Agent and Tool describe work, LLMGateway describes shared infrastructure. This page is the resource reference; for what a gateway does and how to wire agents through one, see LLM gateways.

LLMGateway

The CR itself is small on purpose. Upstream providers, model pricing, and budget rules are delivered as ConfigMaps the platform keeps in sync, so the spec covers only how the workload runs: replica count, compute footprint, and the Service it is reached on.

Create these from the dashboard

A gateway hand-applied with kubectl has no provider credentials synced into it and cannot mint virtual keys. Create gateways under Capabilities → Gateways and let the operator own the rest.

A gateway

llmgateway.yaml· yaml

1apiVersion: autonomic.sh/v1alpha1
2kind: LLMGateway
3metadata:
4  name: shared-gateway
5  namespace: adaptive
6spec:
7  # Each replica owns a usage shard; budget enforcement sums the shards,
8  # so more replicas widen the (bounded) enforcement staleness window.
9  replicas: 2
10  service:
11    type: ClusterIP
12    port: 4000
13  resources:
14    requests:
15      cpu: 500m
16      memory: 1Gi
17    limits:
18      cpu: "2"
19      memory: 4Gi
20  # ConfigMap keys the platform writes. Leave unset and the operator
21  # manages the conventional <name>-budgets / <name>-pricing maps itself.
22  budgets:
23    name: shared-gateway-budgets
24    key: budgets.yaml
25  pricing:
26    name: shared-gateway-pricing
27    key: pricing.yaml

Status

The controller writes .status.phase, .status.readyReplicas, the reachable .status.endpoint, and .status.lastError when reconciliation fails, alongside the usual conditions. The dashboard surfaces the same fields on the gateway's detail page.

Where credentials live

Provider keys are synced into the gateway by the platform, and agents receive short-lived virtual keys rather than the upstream credential. Control-plane secret material is encrypted at rest — see EXO_ENCRYPTION_KEY.