Skip to content

Commit e4ffdb1

Browse files
Copilotg3force
Copilot
and
g3force
committed
feat: introduce Guard and GuardrailProvider CRDs with AiGateway integration
Co-authored-by: g3force <779094+g3force@users.noreply.github.com>
1 parent 7e75905 commit e4ffdb1

19 files changed

Lines changed: 1011 additions & 4 deletions

‎PROJECT‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,4 +82,20 @@ resources:
8282
kind: ToolGatewayClass
8383
path: github.com/agentic-layer/agent-runtime-operator/api/v1alpha1
8484
version: v1alpha1
85+
- api:
86+
crdVersion: v1
87+
namespaced: true
88+
domain: agentic-layer.ai
89+
group: runtime
90+
kind: Guard
91+
path: github.com/agentic-layer/agent-runtime-operator/api/v1alpha1
92+
version: v1alpha1
93+
- api:
94+
crdVersion: v1
95+
namespaced: true
96+
domain: agentic-layer.ai
97+
group: runtime
98+
kind: GuardrailProvider
99+
path: github.com/agentic-layer/agent-runtime-operator/api/v1alpha1
100+
version: v1alpha1
85101
version: "3"

‎api/v1alpha1/aigateway_types.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ type AiGatewaySpec struct {
4848
// +optional
4949
EnvFrom []corev1.EnvFromSource `json:"envFrom,omitempty"`
5050

51+
// Guardrails lists the Guard resources to be applied to requests through this AI gateway.
52+
// Guards are applied in the order they are listed.
53+
// +optional
54+
Guardrails []GuardRef `json:"guardrails,omitempty"`
55+
5156
// CommonMetadata defines labels and annotations to be applied to the Deployment and Service
5257
// resources created for this gateway, as well as the pod template.
5358
// +optional
@@ -59,6 +64,18 @@ type AiGatewaySpec struct {
5964
PodMetadata *EmbeddedMetadata `json:"podMetadata,omitempty"`
6065
}
6166

67+
// GuardRef is a reference to a Guard resource.
68+
type GuardRef struct {
69+
// Name is the name of the Guard resource.
70+
// +kubebuilder:validation:MinLength=1
71+
Name string `json:"name"`
72+
73+
// Namespace is the namespace of the Guard resource.
74+
// If not specified, defaults to the same namespace as the AiGateway.
75+
// +optional
76+
Namespace string `json:"namespace,omitempty"`
77+
}
78+
6279
type AiModel struct {
6380
// Name is the identifier for the AI model (e.g., "gpt-4", "claude-3-opus")
6481
// +kubebuilder:validation:Required

‎api/v1alpha1/guard_types.go‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/*
2+
Copyright 2025 Agentic Layer.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1
18+
19+
import (
20+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
21+
)
22+
23+
// GuardSpec defines the desired state of Guard.
24+
type GuardSpec struct {
25+
// Name is the identifier of the guard as known by the referenced GuardrailProvider.
26+
// +kubebuilder:validation:MinLength=1
27+
Name string `json:"name"`
28+
29+
// Version is the version of the guard at the provider (if supported).
30+
// +optional
31+
Version string `json:"version,omitempty"`
32+
33+
// Mode defines when the guard is applied relative to the LLM call.
34+
// +kubebuilder:validation:Enum=pre_call;post_call;during_call
35+
Mode string `json:"mode"`
36+
37+
// Description provides a human-readable description of the guard's purpose.
38+
// This field is for documentation purposes only and has no effect on the guard's behavior.
39+
// +optional
40+
Description string `json:"description,omitempty"`
41+
42+
// ProviderRef references the GuardrailProvider that hosts this guard.
43+
// If Namespace is not specified, defaults to the same namespace as the Guard.
44+
ProviderRef GuardrailProviderRef `json:"providerRef"`
45+
}
46+
47+
// GuardrailProviderRef is a reference to a GuardrailProvider resource.
48+
type GuardrailProviderRef struct {
49+
// Name is the name of the GuardrailProvider.
50+
// +kubebuilder:validation:MinLength=1
51+
Name string `json:"name"`
52+
53+
// Namespace is the namespace of the GuardrailProvider.
54+
// If not specified, defaults to the same namespace as the Guard.
55+
// +optional
56+
Namespace string `json:"namespace,omitempty"`
57+
}
58+
59+
// GuardStatus defines the observed state of Guard.
60+
type GuardStatus struct {
61+
// +operator-sdk:csv:customresourcedefinitions:type=status
62+
Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
63+
}
64+
65+
// +kubebuilder:object:root=true
66+
// +kubebuilder:subresource:status
67+
68+
// Guard is the Schema for the guards API.
69+
type Guard struct {
70+
metav1.TypeMeta `json:",inline"`
71+
metav1.ObjectMeta `json:"metadata,omitempty"`
72+
73+
Spec GuardSpec `json:"spec,omitempty"`
74+
Status GuardStatus `json:"status,omitempty"`
75+
}
76+
77+
// +kubebuilder:object:root=true
78+
79+
// GuardList contains a list of Guard.
80+
type GuardList struct {
81+
metav1.TypeMeta `json:",inline"`
82+
metav1.ListMeta `json:"metadata,omitempty"`
83+
Items []Guard `json:"items"`
84+
}
85+
86+
func init() {
87+
SchemeBuilder.Register(&Guard{}, &GuardList{})
88+
}

‎api/v1alpha1/guardrailprovider_types.go‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/*
2+
Copyright 2025 Agentic Layer.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1
18+
19+
import (
20+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
21+
)
22+
23+
// GuardrailProviderSpec defines the desired state of GuardrailProvider.
24+
type GuardrailProviderSpec struct {
25+
// Protocol defines the guardrail protocol used by this provider.
26+
// +kubebuilder:validation:Enum=openai-moderation;bedrock
27+
Protocol string `json:"protocol"`
28+
29+
// TransportType defines the transport used to communicate with the guardrail backend.
30+
// Required when BackendRef is specified.
31+
// +kubebuilder:validation:Enum=http;grpc;envoy-ext-proc
32+
// +optional
33+
TransportType string `json:"transportType,omitempty"`
34+
35+
// BackendRef references the Kubernetes Service acting as the guardrail backend.
36+
// When omitted, the provider uses the protocol's default managed endpoint
37+
// (e.g., the official OpenAI moderation API or AWS Bedrock).
38+
// +optional
39+
BackendRef *GuardrailBackendRef `json:"backendRef,omitempty"`
40+
}
41+
42+
// GuardrailBackendRef references a Kubernetes Service acting as the guardrail backend.
43+
type GuardrailBackendRef struct {
44+
// Name is the name of the Kubernetes Service.
45+
// +kubebuilder:validation:MinLength=1
46+
Name string `json:"name"`
47+
48+
// Namespace is the namespace of the Kubernetes Service.
49+
// If not specified, defaults to the same namespace as the GuardrailProvider.
50+
// +optional
51+
Namespace string `json:"namespace,omitempty"`
52+
53+
// Port is the port number of the Kubernetes Service.
54+
// +kubebuilder:validation:Minimum=1
55+
// +kubebuilder:validation:Maximum=65535
56+
Port int32 `json:"port"`
57+
}
58+
59+
// GuardrailProviderStatus defines the observed state of GuardrailProvider.
60+
type GuardrailProviderStatus struct {
61+
// +operator-sdk:csv:customresourcedefinitions:type=status
62+
Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
63+
}
64+
65+
// +kubebuilder:object:root=true
66+
// +kubebuilder:subresource:status
67+
68+
// GuardrailProvider is the Schema for the guardrailproviders API.
69+
type GuardrailProvider struct {
70+
metav1.TypeMeta `json:",inline"`
71+
metav1.ObjectMeta `json:"metadata,omitempty"`
72+
73+
Spec GuardrailProviderSpec `json:"spec,omitempty"`
74+
Status GuardrailProviderStatus `json:"status,omitempty"`
75+
}
76+
77+
// +kubebuilder:object:root=true
78+
79+
// GuardrailProviderList contains a list of GuardrailProvider.
80+
type GuardrailProviderList struct {
81+
metav1.TypeMeta `json:",inline"`
82+
metav1.ListMeta `json:"metadata,omitempty"`
83+
Items []GuardrailProvider `json:"items"`
84+
}
85+
86+
func init() {
87+
SchemeBuilder.Register(&GuardrailProvider{}, &GuardrailProviderList{})
88+
}

0 commit comments

Comments
 (0)