From 43ebdb9d3e85cb05fa8317e039bdecf103fa272b Mon Sep 17 00:00:00 2001 From: Jeremy Drouillard Date: Mon, 21 Sep 2026 13:50:28 -0700 Subject: [PATCH 1/2] Remove AIPolicy documentation --- docs/ai-gateway/budgets-and-pricing.mdx | 3 +-- docs/ai-gateway/index.mdx | 6 +++--- .../configure-ai-gateway.mdx | 19 ++++++++----------- 3 files changed, 12 insertions(+), 16 deletions(-) diff --git a/docs/ai-gateway/budgets-and-pricing.mdx b/docs/ai-gateway/budgets-and-pricing.mdx index 7308cafd..30faeda2 100644 --- a/docs/ai-gateway/budgets-and-pricing.mdx +++ b/docs/ai-gateway/budgets-and-pricing.mdx @@ -22,8 +22,7 @@ caller before enabling enforcement. ## Prerequisites -Budget enforcement requires an `AIPolicy` that targets the gateway. The policy -can omit screening controls when you only need budgets. +Budget enforcement runs through gateway-level webhooks. Confirm that both budget entries report `probeSucceeded: true`: diff --git a/docs/ai-gateway/index.mdx b/docs/ai-gateway/index.mdx index f9c98411..77294e22 100644 --- a/docs/ai-gateway/index.mdx +++ b/docs/ai-gateway/index.mdx @@ -36,9 +36,9 @@ The AI Gateway governs model access. The ## How configuration works -Apply `AIGateway` and `AIPolicy` custom resources to configure providers, -routing, resilience, and screening. The AI Gateway operator reconciles those -resources into running infrastructure. +Apply an `AIGateway` custom resource to configure providers, routing, +resilience, and screening. The AI Gateway operator reconciles the resource into +running infrastructure. Manage budgets in the console or use the management API for automation and bulk import. See [Manage budgets](manage-budgets.mdx) and diff --git a/docs/platform/enterprise-platform/configure-ai-gateway.mdx b/docs/platform/enterprise-platform/configure-ai-gateway.mdx index e159e132..db933408 100644 --- a/docs/platform/enterprise-platform/configure-ai-gateway.mdx +++ b/docs/platform/enterprise-platform/configure-ai-gateway.mdx @@ -39,19 +39,16 @@ This installs the AI Gateway operator and custom resource definitions. Apply an Complete the following sequence before sending production traffic: -1. **Apply an `AIGateway` resource** with at least one provider and one route. - See [Connect model providers](../../ai-gateway/providers-and-models.mdx). +1. **Create budgets for every user or group that will send traffic**, before you + enable the budget webhook target. A caller with no applicable budget is + refused. See [Budgets and pricing](../../ai-gateway/budgets-and-pricing.mdx). -2. **Create an `AIPolicy` that targets it.** The operator adds budget - enforcement only to gateways with a matching policy. The policy can omit - screening controls when you only need budget enforcement. +2. **Apply an `AIGateway` resource** with at least one provider and one route. + When the operator's budget webhook target is configured, budget enforcement + applies across the gateway. See + [Connect model providers](../../ai-gateway/providers-and-models.mdx). -3. **Create budgets for every user or group that will send traffic**, before you - point the gateway at the budget service. A caller with no applicable budget - is refused. See - [Budgets and pricing](../../ai-gateway/budgets-and-pricing.mdx). - -4. **Verify.** Confirm the gateway reports its providers ready and that budget +3. **Verify.** Confirm the gateway reports its providers ready and that budget enforcement probed successfully: ```bash From 9f79a2d59c943aec0173c2430acaf2aea96169d3 Mon Sep 17 00:00:00 2001 From: Jeremy Drouillard Date: Mon, 21 Sep 2026 14:01:15 -0700 Subject: [PATCH 2/2] Document budget webhook setup --- .../configure-ai-gateway.mdx | 46 +++++++++++++++---- 1 file changed, 38 insertions(+), 8 deletions(-) diff --git a/docs/platform/enterprise-platform/configure-ai-gateway.mdx b/docs/platform/enterprise-platform/configure-ai-gateway.mdx index db933408..44a91fc1 100644 --- a/docs/platform/enterprise-platform/configure-ai-gateway.mdx +++ b/docs/platform/enterprise-platform/configure-ai-gateway.mdx @@ -39,16 +39,46 @@ This installs the AI Gateway operator and custom resource definitions. Apply an Complete the following sequence before sending production traffic: -1. **Create budgets for every user or group that will send traffic**, before you - enable the budget webhook target. A caller with no applicable budget is - refused. See [Budgets and pricing](../../ai-gateway/budgets-and-pricing.mdx). +1. **Create budgets that cover every caller**, before you enable the budget + webhook target. Set an organization default for resolved directory users, or + create budgets for individual users and groups. A caller with no applicable + budget is refused. See + [Budgets and pricing](../../ai-gateway/budgets-and-pricing.mdx). + +2. **Enable gateway-level budget webhooks.** Add the webhook target and its + receiver configuration to your platform values, then upgrade the release: + + ```yaml title="values.yaml" + global: + webhooks: + issuerRef: + name: + kind: ClusterIssuer + caBundleSecret: + + enterprise-manager: + webhookTLS: + enabled: true + port: 443 + webhookAuth: + audience: + + enterprise-ai-gateway-operator: + upstream: + budgetsWebhook: + serviceName: + port: 443 + audience: + ``` + + Set `serviceName` to the Enterprise Manager Service in the same namespace as + the gateway. The two `audience` values must match exactly. The operator adds + admission and usage webhooks to every OIDC-enabled gateway it manages. -2. **Apply an `AIGateway` resource** with at least one provider and one route. - When the operator's budget webhook target is configured, budget enforcement - applies across the gateway. See - [Connect model providers](../../ai-gateway/providers-and-models.mdx). +3. **Apply an `AIGateway` resource** with at least one provider and one route. + See [Connect model providers](../../ai-gateway/providers-and-models.mdx). -3. **Verify.** Confirm the gateway reports its providers ready and that budget +4. **Verify.** Confirm the gateway reports its providers ready and that budget enforcement probed successfully: ```bash