[github-actions]

The target's own content scan fails where the base build passed (docs-theme-extras markdown-leaks / built-html-integrity):

• markdown-leaks.spec.ts > markdown-leaks: rendered HTML scan > no leaked markdown across built HTML pages

agentgateway/agentgateway#4198 — Fail closed when a backend TLS policy can't be built

Docs versions: standalone/main, kubernetes/main

No code-path rule covers 1 touched file(s). The planner could route these only by identifier search, so the candidate pages may miss what they changed, including in the other mode:

• crates/agentgateway/src/proxy/httpproxy.rs

What changes for users: Invalid backend TLS policies now make requests fail with HTTP 503 instead of allowing plaintext backend traffic. An invalid update to a previously accepted policy also fails closed, and the proxy records a warning that the backend TLS policy is invalid.

What the docs now say: The standalone Backend TLS page and the Kubernetes BackendTLS guide now describe the fail-closed behavior, the warning text, and the cases that can trigger it, such as invalid certificates, hostname or SAN problems, and disallowed key exchange groups.

Not verified: No cluster; the configuration and commands are unrun.

How agentgateway-4198 was drafted, and what was not verified

• Code PR: Fail closed when a backend TLS policy can't be built agentgateway#4198
• Code issue: none linked
• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main and kubernetes/main; documented in the development tree, which is where unreleased changes go
• Category: scoped-edit / pr

Plan, and what changed it

• Planned: Document the backend TLS fail-closed behavior on the backend TLS pages named by the code-path targets.
• Learned: assets/agw-docs/pages/security/backendtls.md is shared by older Kubernetes version trees, so references/version-gates.md required a main-only gate; the section index and schema validation page did not own backend TLS runtime behavior.
• Did: Added a standalone fail-closed section, added a gated Kubernetes paragraph, and wrote a breaking-change release note.

Why a documentation change is necessary

The pull request changes what a reader sees when a backend TLS policy cannot be built. Requests to the affected backend now fail with HTTP 503, and the proxy does not connect to the backend in plaintext. The Kubernetes backend TLS guide already told readers that invalid backend TLS configuration affects requests, and the standalone Backend TLS page shows where readers configure backendTLS, but neither page said that invalid backend TLS settings fail closed or that a bad update to a previously working policy also fails closed.

What changed on disk

• assets/agw-docs/pages/security/backendtls.md — Added a main-only Kubernetes note that invalid backend TLS settings fail closed with HTTP 503.
• content/docs/standalone/main/documentation/configuration/security/backend-tls.md — Added a section that documents invalid backend TLS policy behavior for standalone configuration.

How to verify this change

1. In Kubernetes mode, follow the BackendTLS guide until the NGINX backend returns HTTP 200, then replace the CA bundle in the ca ConfigMap with invalid PEM data and reapply the backend TLS policy.
2. Send the same request through the gateway. The response should be HTTP 503, and the backend should not receive the request.
3. In standalone mode, configure a backend with policies.backendTLS.root pointing to an invalid certificate file, then send a request to that backend. The response should be HTTP 503, and the proxy should record a warning that starts with invalid backend TLS policy, requests to the backend will fail:.

What was not verified

• The configuration was not applied to a cluster, so every command in this diff is unrun.
• Internal links are unchecked because Hugo was not run.

How the pages were chosen (triage report)

Draft a documentation change

agentgateway/agentgateway#4198 — Fail closed when a backend TLS policy can't be built

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: standalone/main, kubernetes/main
• Summary (read from the body): When a backend TLS policy fails to build (bad PEM, an invalid hostname or SAN, a key exchange group the crypto provider won't allow, etc.), the proxy rejects the whole policy. If no earlier version of that policy was accepted, the backend ends up with no TLS policy at all and requests go out in plaintext.
• Not tested: no cluster was available, so every command in this diff is unrun
• No rule covers 1 touched file(s). The candidate pages below come from the files that DID match a rule, so they may scope this narrower than the change is. Read these before deciding the change is only about the pages listed:
  • crates/agentgateway/src/proxy/httpproxy.rs

Release notes

This pull request also adds its release-note entries:

• content/docs/kubernetes/main/release-notes/release-notes.md: Invalid backend TLS policies fail closed (breaking_change, in a new 1.8 section)
• content/docs/standalone/main/release-notes/release-notes.md: Invalid backend TLS policies fail closed (breaking_change, in a new 1.8 section)

Check these release-note links and names. Each note is on its page, but a link may not reach the drafted content there, or a name may belong to the other mode:

• content/docs/kubernetes/main/release-notes/release-notes.md: Fail closed when a backend TLS policy can't be built agentgateway#4198's note links to /documentation/configuration/security/backend-tls/, which has no page in content/docs/kubernetes/main
• content/docs/standalone/main/release-notes/release-notes.md: Fail closed when a backend TLS policy can't be built agentgateway#4198's note links to /documentation/security/backendtls/, which has no page in content/docs/standalone/main

Draft branch: pr-tracker-draft-agentgateway-4198

[cloudflare-workers-and-pages]

Deploying agentproxy with    Cloudflare Pages

Latest commit:	4730feb
Status:	✅  Deploy successful!
Preview URL:	https://7ba42639.agentproxy.pages.dev
Branch Preview URL:	https://pr-tracker-draft-agentgatewa-crzi.agentproxy.pages.dev

View logs

[kristin-kronstain-brown]

Moved this PR's release-notes entry to the combined release-notes PR, #1482, so the draft PRs stop conflicting on the release-notes pages. Review or change the entry there.