google/skills

Apigee as an Agent Gateway Service Extension

Wires an Apigee proxy in as an ext-proc callout on a GCP Agent Gateway. The proxy is a processor, not an API proxy: it has no backend, inspects the LLM request and response the gateway hands it, and returns a verdict.

Usage Attribution

MUST READ: Before executing any gcloud, REST API, or MCP command, you MUST read and follow the instructions in Usage Attribution.

You build the proxy; the user does not.

Two modes, one schema. Decide which before anything else, and say which. Input file present → prod mode: it is the contract, every value comes from it, and a missing or malformed field is a refusal, not a default. No input file and the user is describing an outcome → dev mode: apply the documented defaults, show a plan with durations and get approval, start with identity and metering only, write apigee-agent-gateway-governance.yaml at the end as the handoff. assets/apigee-agent-gateway-governance.example.yaml documents the schema both modes use.

Modes, defaults, durations, cost disclosure and the interlocks that bind both: references/modes.md. Read it before you start.

Colour the plan's ACTION column — green REUSE, cyan CREATE/RESERVE, yellow APPEND/MODIFY; full palette in references/modes.md. Yellow is the one that earns its place: it is the only signal that a resource the user already owns is being changed. Rendered plain, the one row that modifies something is indistinguishable from the dozen that do not — which is exactly the row the approval exists for.

Prerequisite: where the agent runs

Check this before building anything. It decides whether traffic can reach the gateway at all, and it is silent when wrong — every step below still succeeds while nothing arrives.

Use Agent Runtime, created with agent_gateway_config / agent_to_anywhere_config. It is the supported path and the orchestrator builds the client-side PSC, routing, DNS and cert trust for you. There is no gcloud surface for this and no console path — it is SDK-only, at agent creation time. See Route traffic through Agent Gateway for the binding, and references/networking-psc.md for a worked example.

Set GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES: "False" in the agent's env_vars, or every invocation 401s on the agent's own sessions.create, before user code runs. Deploy-time invisible. Full symptom and isolation: references/gotchas.md, Agent Gateway.

Where the agent runs is otherwise settled — the premise is a working gateway and a working agent. Do not explain how to build one or list unsupported compute unprompted; references/networking-psc.md has the constraints if it turns out to matter.

Tool versions

Do not assume these are installed or current.

Tool	Minimum	Why
gcloud	588.0.0	apigee apis import --from-template is on the GA track at this version; older SDKs need gcloud beta
google-cloud-aiplatform[agent_engines,adk]	>=2.1,<3	Agent Runtime client used to bind the agent to the gateway
google-adk	>=2.9,<3	only if you build the test agent with ADK

On gcloud >= 588.0.0: every feature must keep its uid, and the template must never declare endpoints or targets. All six features set uid today and the template declares neither, so the shipped bundle is correct — but both are load-bearing now, and breaking either one still compiles, still deploys, and reports nothing. Mechanism and symptoms: references/gotchas.md, under Authoring (AFT).

gcloud version | head -1          # confirm >= 588.0.0
gcloud components update          # if older
pip install "google-cloud-aiplatform[agent_engines,adk]>=2.1,<3" "google-adk>=2.9,<3"

scripts/compile_check.py needs PyYAML and names the interpreter if it is missing. pip install pyyaml, or run it with a Python 3 that has it; gcloud's bundled interpreter does not, and the SDK's vendored yaml is Python 2.

python3 scripts/compile_check.py assets/apigee-proxy-template.yaml

Execution model

Three layers, and the choice between them is not stylistic:

Layer	Used for	Why
AFT YAML template	the proxy itself	version-controlled, reviewable, diffable
gcloud	PSC, DNS, AuthzExtension, AuthzPolicy	native commands exist
REST (curl)	env properties, envgroups, deployments, debug sessions	no gcloud equivalent today

The customer owns one input file (assets/apigee-agent-gateway-governance.example.yaml). It is the version-controlled artifact. Never hand-edit the generated proxy: regenerate it.

Run the Apigee-side sequence with the script, not by hand. Steps 1, 3 and 4 below are order-dependent and each fails in a way that reads as a different problem. scripts/deploy_proxy.sh does all three, preserves the properties map, polls the async operation, and exits non-zero if the deployment does not come up EXTENSIBLE:

scripts/deploy_proxy.sh --org "$ORG" --env "$ENV" --proxy "$PROXY" \
  --template assets/apigee-proxy-template.yaml [--service-account "$SA"] --yes \
  [--index-endpoint-id ID --index-id ID --sc-project P --sc-region R --embeddings-model M]

Run it without --yes first: it prints the plan and changes nothing. Show that plan, then re-run with --yes once the user agrees.

The vector-search flags are the one exception to "edit the default in every feature that declares it". Those three ids are substituted at deploy time and checked for leftovers; hand-editing them into feature-semantic-cache.yaml deploys fine, skips the check, and makes the file single-use.

scripts/ensure_gateway_connectivity.sh is the same idea for the gateway leg (step 0). It is the only part of this skill that modifies a resource the user already owns, so it applies nothing without --yes.

The steps are written out below so you can diagnose a failure, not so you can retype them.

Inputs you must resolve first

Environment prerequisites: references/setup.md — gcloud SDK (588+), project, billing, gcloud services enable, region, credentials, IAM. Nothing below creates any of it.

Prod: from the input file, then environment, then ask — never invent. Dev: apply the references/modes.md defaults, and ask only for what has none.

• project, region
• apigee.org, apigee.environment, apigee.envgroup, apigee.hostname, apigee.proxy
• network.vpc, network.subnet, network.networkAttachment
• gateway.name, gateway.matchPaths (a list, one entry per wire shape), gateway.manageNetworkConfig

matchPaths drives TWO artifacts; write both from the same list. The AuthzPolicy paths[].suffix gets one suffix per entry, verbatim with leading punctuation kept — it decides what the gateway routes to Apigee. The template's LLM_URI_MATCH gets one (request.uri Like "*<entry>*") clause per entry, OR-ed, leading : or / stripped — it decides what the proxy acts on once it arrives. The shipped two-entry default gives:

((request.uri Like "*generateContent*") or (request.uri Like "*chat/completions*"))

The AuthzPolicy is the outer gate and wins: a suffix list narrower than matchPaths means the missing shape never reaches Apigee at all. Derive both from the input file and never from the default when the file disagrees — the file is the reviewable contract and a mismatch is invisible once deployed.

A one-entry list is legitimate and governs one shape. Dropping an entry governs one fewer silently — deploys clean, zero transactions for the shape dropped — and narrows feature-normalize, Model Armor and the cache together. references/gotchas.md, Runtime.

semanticCache is a KNOWN ISSUE whenever it is on — warn, then build it. The key is the prompt embedding alone: no caller, no model, no shape. A hit therefore crosses callers — similar prompts share an answer — and one model behind one shape does not make it safe. With more shapes the first model to answer answers for the other too: empty HTTP 200 across shapes, wrong-model body within one. Warn whenever the cache is on, not only on multi-shape, then build. Wording: references/modes.md; mechanism: references/gotchas.md.

Each entry is a SUFFIX match. You write these, not the user — derive them from which endpoint their agent actually calls, and do not ask them to reason about suffixes. Vertex's OpenAI-compatible endpoint and api.openai.com need different entries, and getting it wrong governs nothing silently; the forms and the evidence are in references/gotchas.md, Runtime.

There is no apiShape field. Metering does not depend on the wire shape — the count is normalised in JS across both — so the field selected nothing and was removed. Adding a shape is an || branch in extract-model.js plus an entry in matchPaths.

Three places carry the callout hostname and all three must match — the Apigee envgroup, the AuthzExtension authority/service, and the private DNS A record. You set all three from one value: a build invariant to hold, not a question for the user. It becomes a topic only when a callout never lands, and then it is the first check. Build order matters alongside it — the AuthzExtension is inert until the host resolves and the proxy is deployed, so "the extension exists" is not evidence that leg works. references/gotchas.md, Runtime.

Workflow

0. Gateway: give it a route into the VPC

A gateway with no networkConfig has no route into the customer's VPC and cannot resolve the callout hostname. This skill builds it — network attachment, egress and DNS peering — so its absence is a build step, not a blocker, and should be reported that way. Do not open with an alarm about a resource you are about to create.

One thing here does need the user, and it is the reason this is step 0 rather than a silent prerequisite: attaching egress is one-way and affects traffic they already run. Settle it in the plan, before anything executes — see "Confirm everything up front" below. Capturing a known-good agent turn first is worth doing when they are nervous about a production gateway, because it separates "never worked" from "we broke it"; it is a precaution to offer, not a step to impose.

gcloud network-services agent-gateways describe "$GATEWAY" \
  --location="$REGION" --project="$PROJECT" --format='value(networkConfig)'
gcloud network-security authz-policies list \
  --location="$REGION" --project="$PROJECT"

A console-created gateway already has a CUSTOM AuthzPolicy — an IAP REQUEST_AUTHZ one, which coexists with ours and is not needed for the egress JWT. You never create the gateway, so assess it rather than assuming. references/gotchas.md, Agent Gateway.

Empty networkConfig output means missing, and it is easy to miss: the gateway still serves ordinary agent traffic perfectly, because that path goes to public Google endpoints and never enters the VPC. Only the Apigee callout fails.

If it is missing, behaviour depends on gateway.manageNetworkConfig:

• true — run the script below. It creates the network attachment, then read-modify-writes the gateway to add the egress attachment and DNS peering. Agreement for this is taken in the plan, not here; --yes carries it.
• false — the user has said they want to make this change themselves. Print the script invocation and let them run it. Do not modify the gateway.

scripts/ensure_gateway_connectivity.sh \
  --gateway "$GATEWAY" --project "$PROJECT" --region "$REGION" \
  --vpc "$VPC" --subnet "$SUBNET" --attachment "$ATTACHMENT" \
  --domain "$DNS_DOMAIN"            # add --yes only after the user agrees

Either way networkConfig has to exist before the Apigee work starts — not because its absence is an error, but because every later step then succeeds and governs nothing.

Use the script, not the raw commands: import is a whole-resource upsert and a hand-built YAML silently drops the gateway's registries and protocols. Why, and the etag and PROTOCOL_UNSPECIFIED handling: references/gotchas.md.

1. Apigee: enable the environment

The env must carry apigee-service-extension-enabled=true. No gcloud flag exists; PATCH the properties map.

curl -s -H "Authorization: Bearer $TOKEN" \
  "https://apigee.googleapis.com/v1/organizations/$ORG/environments/$ENV"

The PATCH replaces the whole map. Read it first and re-send every property you intend to keep, or you will silently drop them.

curl -X PATCH -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  "https://apigee.googleapis.com/v1/organizations/$ORG/environments/$ENV?updateMask=properties" \
  -d '{"properties":{"property":[{"name":"apigee-service-extension-enabled","value":"true"}]}}'

This does not disable Apigee Analytics — the two coexist; if analytics looks missing it is the separate per-environment add-on. references/gotchas.md.

Use a dedicated environment, attached to exactly one envgroup. An environment in two makes the gateway 404 every request with the extension never invoked. It also leaves the / base path free, which is what the proxy ships with.

scripts/ensure_apigee_environment.sh creates the environment, attaches it to the regional runtime instance, and creates and attaches the envgroup — so step 2 is already done when it succeeds. It creates billable resources and applies nothing without --yes; that agreement is taken in the plan, not here.

scripts/ensure_apigee_environment.sh \
  --org "$ORG" --env "$ENV" --region "$REGION" \
  --envgroup "$ENVGROUP" --hostname "$HOSTNAME"      # add --yes to apply

It is idempotent and resumable, and refuses with exit 2 when the environment is already in another envgroup or the envgroup exists on a different hostname. It also handles three things a runbook tends to get wrong — the omitted type on create, the four-minute instance attachment that locks the environment, and polling the operation rather than a GET that succeeds too early.

2. Apigee: envgroup on the callout hostname

Done already if step 1's script ran. Verify, or do it by hand for an envgroup that already exists. The hostname must be exactly the callout host, and the group must be attached to the env.

curl -s -H "Authorization: Bearer $TOKEN" \
  "https://apigee.googleapis.com/v1/organizations/$ORG/envgroups/$ENVGROUP/attachments"

How many envgroups is the environment in? More than one and the callout never lands. deploy_proxy.sh enforces this before touching anything and exits 2 naming them; assess_integration.sh reports it. Read the failure literally if it fires — the environment is wrong, not the script.

3. Build the proxy from the template

gcloud apigee apis import organizations/$ORG/apis/$PROXY \
  --from-template=assets/apigee-proxy-template.yaml

Each features: entry resolves relative to the template file's own directory, never the working directory, so a bare filename must sit beside the template (a subpath like features/feature-identity.yaml works too). assets/ is flat by convention, not compiler demand — but moving a file without updating features: fails the import with a bare FileNotFoundError.

If you get Permission denied on resource ... (or it may not exist) on an org you demonstrably have access to, it is the credential, not the access. With context-aware access enabled the default gcloud credential is rejected. Pass the ADC token instead:

CLOUDSDK_AUTH_ACCESS_TOKEN=$(gcloud auth application-default print-access-token) \
  gcloud apigee apis import ...

To change a parameter,