Skip to main content

Moving from the open source project to Agent Router Enterprise

Same gateway, new control plane

Tetrate Agent Router Enterprise runs the same Envoy-based gateway as the open source project. What changes is how you configure it. The Admin Console and Admin API replace your YAML, and a Tetrate-hosted management plane replaces the controller you run today. This guide shows what carries over, what you set up again, and how to move traffic with a way back. If you're still deciding, start with why teams move to Enterprise.

You run Agent Router (formerly Envoy AI Gateway) in your own cluster. Your routes, providers, and credentials live in AIGatewayRoute, AIServiceBackend, and BackendSecurityPolicy resources that you apply yourself. Agent Router Enterprise installs its own data plane and Controller, and the Controller takes its configuration from the management plane. You don't upgrade the open source install in place. You stand the Enterprise data plane up beside it and move traffic. When nothing calls the old gateway, you retire it.

What carries over and what you set up again​

AreaOpen source todayWith Agent Router Enterprise
The proxyEnvoy, through Envoy GatewaySame. The Enterprise data plane is Envoy with the Agent Router gateway modules.
Client APIOpenAI-compatibleSame, plus the Anthropic API. Client code changes a base URL and a key.
Providers and credentialsAIServiceBackend and BackendSecurityPolicy YAMLSet up again in the Admin Console or Catalog API. Your provider accounts don't change: bring your own keys, or use Bedrock workload identity.
Routing, fallback, splitsAIGatewayRoute YAMLSet up again as routing policies in the console. The Controller writes the gateway configuration for you.
Quotas and rate limitsPolicy YAML, per gatewayBudgets, rate limits, and spend ceilings by project, key, team, and user. Shared across every data plane.
API keys for app teamsKeys you issuedIssued from the console, per project. App teams get new keys.
Gateway endpointYour Service or IngressA new hostname behind an ingress you create. Tetrate has no inbound path to it.
The aigw CLILocal runs and developmentNot used with Enterprise. The tetrate CLI installs, checks, and upgrades the data plane.
Helm and GitOpsYour charts and manifestsStill Helm. The serve-helm chart renders manifests you can commit for Argo CD or Flux.
What you know about Envoy GatewayYears of running itMost of that knowledge still applies. The GatewayClass, namespaces, and deployment names are new.

Two things don't move: your hand-written routing YAML and the API keys you issued. Everything you know about running Envoy still counts.

Where the Enterprise data plane can run​

The Enterprise data plane needs a cluster of its own. It installs a GatewayClass named tars-egress under the controller name gateway.envoyproxy.io/gatewayclass-controller. An Envoy Gateway that watches the whole cluster claims that class too, and the two controllers fight over it. Your open source install runs Envoy Gateway cluster-wide, so the two can't share a cluster. There is no override.

Plan for a new cluster before you start. A small cluster is enough to start. The prerequisites page lists the sizing and the pre-install check. The check is two commands:

kubectl get gatewayclass
kubectl get deployments -A -l app.kubernetes.io/name=envoy-gateway

Both should come back empty on the target cluster.

What leaves your cluster​

Prompt and response content never reaches the management plane. The management plane stores configuration, user records, and telemetry such as latency and token counts. The Controller polls api.<tenant>.tetrate.ai on TCP 443 for configuration. That is the only connection that stays open. If the link drops, the data plane keeps routing on the last configuration it received. Details are in Network and security and Prerequisites.

Steps​

  1. Create the cluster and check compatibility. A dedicated cluster with no Envoy Gateway on it. The Kubernetes and Gateway API ranges are listed per release on Release compatibility. The installer enforces them.

  2. Get a tenant and onboard. Start from the Fast Track Eval or contact Tetrate. Complete self-hosted onboarding: organization, SSO, and the data plane credential. Download data-plane-credentials.json.

  3. Recreate providers and models. In the Admin Console, add each provider you have as an AIServiceBackend today, with the same account and credential. Add the models your apps call. See Provision models and providers.

  4. Install the data plane. Follow the Helm install guide or the guide for your cloud. The Controller lands in tars-system and the gateway in tars-dataplane.

    tetrate agentrouter dataplane install "${DP_CREDENTIAL}"

  5. Expose the gateway. Create an ingress to the egress service on port 10080, with a hostname you choose, and declare it in global.gateway.hostnames. See Gateway installation.

  6. Create a project and issue keys. One project per team or app. See Issue a project-scoped API key.

  7. Recreate routing. Fallback chains and traffic splits become routing policies. Start with one policy that mirrors one AIGatewayRoute. See the Routing policy reference.

  8. Verify.

    tetrate agentrouter doctor "${DP_CREDENTIAL}" --verbose

    Then send one request to the new hostname with a project key and find it in the request log in the Admin Console.

  9. Move one team. Change that team's base URL and key. Watch Analytics for a day. Then move the next team.

  10. Retire the open source gateway when nothing calls it.

What app teams change​

Two values: the base URL and the API key. The request body doesn't change. Teams on the Anthropic SDK can use the Anthropic endpoint directly.

How to roll back​

The open source gateway keeps running until step 10, so rollback is a base URL change.

  1. Point the team's base URL and key back at the open source gateway.
  2. To remove the Enterprise data plane, run helm uninstall tars -n tars-system. Leave the CRDs. The install guide is clear that CRDs move forward only.
  3. Revoke the data plane credential in the Admin Console. See Data plane credentials.

Two limits. The Enterprise install never reads or changes your open source resources, so there's nothing to restore on that side. And budgets, request logs, and analytics live in the management plane, so when you roll back you lose that view. Your traffic keeps flowing.

Try the console first​

The Fast Track Eval is fully managed, so there's nothing to install. You get a first routed request about 15 minutes after onboarding, and a small team with a cost readout by the end of the day. Use it to see the Admin Console, budgets, and Analytics before you build the self-hosted cluster. Your open source gateway keeps running the whole time.

Get help​