Gateway Reverse Proxy Routing
Purpose
This functional area routes inbound traffic to the correct backend host.
Main Capabilities
- accept inbound HTTP requests
- forward traffic to portal and runtime backends
- support a unified ingress model with explicitly ordered routes
- probe backend cluster health and adapt routing accordingly
Named Routes
The Gateway exposes a set of named routes that map URL path patterns to backend clusters. Routes are evaluated in priority order — more specific paths win over broader catch-all patterns.
Portal Routes
| Route | Path Pattern | Notes |
|---|---|---|
portal-health-route |
/portal/health |
Anonymous health probe for the Portal host |
portal-health-live-route |
/portal/health/live |
Anonymous liveness probe |
portal-health-ready-route |
/portal/health/ready |
Anonymous readiness probe |
portal-admin-route |
/portal/api/v1/admin/{**} |
Administrative API — requires authentication |
portal-api-route |
/portal/{**} |
General Portal API and web traffic |
Runtime Routes
| Route | Path Pattern | Notes |
|---|---|---|
runtime-health-route |
/runtime/health |
Anonymous health probe for the Runtime host |
runtime-health-live-route |
/runtime/health/live |
Anonymous liveness probe |
runtime-health-ready-route |
/runtime/health/ready |
Anonymous readiness probe |
runtime-version-route |
/runtime/version |
Anonymous version endpoint |
runtime-tools-route |
/runtime/{tenantId}/{clientId}/tools |
Tool discovery — requires authentication |
runtime-mcp-route |
/runtime/{tenantId}/{clientId}/mcp |
MCP endpoint — requires authentication |
runtime-invoke-route |
/runtime/{tenantId}/{clientId}/tools/{toolId}/invoke |
Tool invocation — requires authentication |
runtime-host-route |
/runtime/{**} |
General Runtime catch-all |
Route Resolution
When a request arrives, the Gateway resolves the first route whose path pattern matches. Routes with more literal path segments take precedence over those with wildcards. This ensures, for example, that /portal/api/v1/admin/... matches the admin route before the general portal catch-all.
Backend Health Checking
Both the Portal and Runtime clusters have active health checking configured. The Gateway probes each cluster's liveness endpoint at regular intervals and removes unhealthy destinations from the load balancing pool until they recover. This ensures the Gateway only forwards traffic to responsive backend instances.
Functional Value
This area hides internal host topology from clients and simplifies platform exposure. Clients interact with a single address and path namespace, while the Gateway handles the distribution of requests to the appropriate backend based on path structure and route priority.