From b930e2fc2b6502e0cbc37e5078710a0b1edeff6a Mon Sep 17 00:00:00 2001
From: ryan-crabbe-berri <ryan@berri.ai>
Date: Tue, 28 Jul 2026 10:22:49 -0700
Subject: [PATCH] fix(gateway): route /a2a through the gateway component
 (#34958)

* fix(gateway): route /a2a through the gateway component

A2A message-send runs the completion bridge, an outbound LLM call, but the
ingress only listed /v1/a2a so the serving routes at /a2a/{agent_id} fell to
the backend catch-all. Backend pods hold no provider credentials, so every
invocation died with a missing-provider-key auth error while the same call
succeeds on the gateway fleet. Adds /a2a to the ingress gateway prefixes and
the gateway route allowlist, plus a parity test so an ingress prefix that the
gateway trims can never reappear

* revert(test): drop the allowlist parity tests

---------

Co-authored-by: yuneng-jiang <yuneng@berri.ai>
---
 gateway/routes/allowlist.py         | 1 +
 helm/litellm/templates/ingress.yaml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/gateway/routes/allowlist.py b/gateway/routes/allowlist.py
index 792a56a2cd8..a80bbc9ca19 100644
--- a/gateway/routes/allowlist.py
+++ b/gateway/routes/allowlist.py
@@ -54,6 +54,7 @@ GATEWAY_PATH_PREFIXES: tuple[str, ...] = (
     "/messages",
     "/v1/skills",
     "/v1/a2a/",
+    "/a2a/",
     # LiteLLM-native LLM surface
     "/v1/rerank",
     "/v2/rerank",
diff --git a/helm/litellm/templates/ingress.yaml b/helm/litellm/templates/ingress.yaml
index 30a8e7c974b..b7c78d3fdad 100644
--- a/helm/litellm/templates/ingress.yaml
+++ b/helm/litellm/templates/ingress.yaml
@@ -19,7 +19,7 @@
     "/v1/fine-tuning" "/fine-tuning" "/v1/responses" "/responses" "/v1/threads" "/threads"
     "/v1/assistants" "/assistants" "/v1/vector_stores" "/vector_stores" "/v1/indexes"
     "/v1/models" "/models" "/openai" "/engines"
-    "/v1/messages" "/messages" "/v1/skills" "/v1/a2a"
+    "/v1/messages" "/messages" "/v1/skills" "/v1/a2a" "/a2a"
     "/v1/rerank" "/v2/rerank" "/rerank" "/v1/ocr" "/ocr" "/v1/rag" "/rag"
     "/v1/video" "/v1/videos" "/video" "/videos" "/v1/search" "/search"
     "/v1/containers" "/containers" "/v1/evals" "/v1/memory" "/queue/chat"