Global Policy Support for LLM Providers and Proxies

.github/workflows/operator-integration-test.yml

@@ -1114,7 +1114,7 @@ jobs:
           API_READY=""
           for i in $(seq 1 60); do
             API_STATUS=$(curl -s -o /tmp/subscription-precheck-body.txt -w "%{http_code}" -u admin:admin \
-              "http://localhost:9090/api/management/v0.9/rest-apis/hello-sub-api" || true)
+              "http://localhost:9090/api/management/v1alpha2/rest-apis/hello-sub-api" || true)
             if [ "${API_STATUS}" = "200" ]; then
               API_READY="yes"
               echo "hello-sub-api is resolvable via management API"

cli/it/resources/gateway/sample-api.yaml

@@ -17,7 +17,7 @@
 # --------------------------------------------------------------------
 
 # Sample API definition for CLI integration tests
-apiVersion: gateway.api-platform.wso2.com/v1alpha1
+apiVersion: gateway.api-platform.wso2.com/v1alpha2
 kind: RestApi
 metadata:
   name: petstore-api-v1.0

cli/it/resources/gateway/sample-mcp-config.yaml

@@ -17,7 +17,7 @@
 # --------------------------------------------------------------------
 
 # Sample MCP configuration for CLI integration tests
-apiVersion: gateway.api-platform.wso2.com/v1alpha1
+apiVersion: gateway.api-platform.wso2.com/v1alpha2
 kind: Mcp
 metadata:
   name: test-mcp-v1.0

cli/src/cmd/gateway/restapi/apikey/create.go

@@ -47,7 +47,7 @@ ap gateway rest-api api-key create --file api-key.yaml
 ap gateway rest-api api-key create -f api-key.json
 
 # The file is an ApiKey custom resource, e.g.:
-#   apiVersion: gateway.api-platform.wso2.com/v1alpha1
+#   apiVersion: gateway.api-platform.wso2.com/v1alpha2
 #   kind: ApiKey
 #   metadata:
 #     name: petstore-key-acme

cli/src/cmd/gateway/subscription/create.go

@@ -41,7 +41,7 @@ ap gateway subscription create --file subscription.yaml
 ap gateway subscription create -f subscription.json
 
 # The file is a Subscription custom resource, e.g.:
-#   apiVersion: gateway.api-platform.wso2.com/v1alpha1
+#   apiVersion: gateway.api-platform.wso2.com/v1alpha2
 #   kind: Subscription
 #   metadata:
 #     name: petstore-acme-bronze

cli/src/cmd/gateway/subscriptionplan/create.go

@@ -41,7 +41,7 @@ ap gateway subscription-plan create --file subscription-plan.yaml
 ap gateway subscription-plan create -f subscription-plan.json
 
 # The file is a SubscriptionPlan custom resource, e.g.:
-#   apiVersion: gateway.api-platform.wso2.com/v1alpha1
+#   apiVersion: gateway.api-platform.wso2.com/v1alpha2
 #   kind: SubscriptionPlan
 #   metadata:
 #     name: bronze-1k-per-min

cli/src/internal/gateway/cr_test.go

@@ -34,7 +34,7 @@ func writeTempCR(t *testing.T, name, content string) string {
 }
 
 func TestParseResourceCR_ValidYAML(t *testing.T) {
-	path := writeTempCR(t, "plan.yaml", `apiVersion: gateway.api-platform.wso2.com/v1alpha1
+	path := writeTempCR(t, "plan.yaml", `apiVersion: gateway.api-platform.wso2.com/v1alpha2
 kind: SubscriptionPlan
 metadata:
   name: bronze-1k-per-min

cli/src/internal/mcp/generator.go

@@ -421,7 +421,7 @@ func generateMCPConfigFile(url string, toolsResult ToolsResult,
 	}
 
 	mcp := gwmodels.MCPProxyConfiguration{
-		ApiVersion: gwmodels.MCPProxyConfigurationApiVersionGatewayApiPlatformWso2Comv1alpha1,
+		ApiVersion: gwmodels.MCPProxyConfigurationApiVersionGatewayApiPlatformWso2Comv1alpha2,
 		Kind:       gwmodels.MCPProxyConfigurationKindMcp,
 		Metadata: gwmodels.Metadata{
 			Name: "Generated-MCP-v1.0",

docs/rest-apis/gateway/README.md

@@ -4,8 +4,8 @@
 REST API for managing API configurations in the WSO2 API Platform Gateway.
 
 Base URLs:
-* <a href="http://localhost:9090/api/management/v0.9">http://localhost:9090/api/management/v0.9</a>
-* <a href="http://gateway-controller:9090/api/management/v0.9">http://gateway-controller:9090/api/management/v0.9</a>
+* <a href="http://localhost:9090/api/management/v1alpha2">http://localhost:9090/api/management/v1alpha2</a>
+* <a href="http://gateway-controller:9090/api/management/v1alpha2">http://gateway-controller:9090/api/management/v1alpha2</a>
 
 ## Table of Contents
 

docs/rest-apis/gateway/certificate-management.md

@@ -12,7 +12,7 @@ Manage custom TLS certificates for HTTPS upstream verification
 
 ```shell
 
-curl -X GET http://localhost:9090/api/management/v0.9/certificates \
+curl -X GET http://localhost:9090/api/management/v1alpha2/certificates \
   -u {username}:{password} \
   -H 'Accept: application/json'
 
@@ -71,7 +71,7 @@ Required roles: `admin`, `developer`
 
 ```shell
 
-curl -X POST http://localhost:9090/api/management/v0.9/certificates \
+curl -X POST http://localhost:9090/api/management/v1alpha2/certificates \
   -u {username}:{password} \
   -H 'Content-Type: application/json' \
   -H 'Accept: application/json' \
@@ -140,7 +140,7 @@ Required roles: `admin`, `developer`
 
 ```shell
 
-curl -X DELETE http://localhost:9090/api/management/v0.9/certificates/{id} \
+curl -X DELETE http://localhost:9090/api/management/v1alpha2/certificates/{id} \
   -u {username}:{password} \
   -H 'Accept: application/json'
 
@@ -203,7 +203,7 @@ Status Code **200**
 
 ```shell
 
-curl -X POST http://localhost:9090/api/management/v0.9/certificates/reload \
+curl -X POST http://localhost:9090/api/management/v1alpha2/certificates/reload \
   -u {username}:{password} \
   -H 'Accept: application/json'
 

docs/rest-apis/gateway/llm-provider-management.md

@@ -12,7 +12,7 @@ CRUD operations for LLM Provider configurations
 
 ```shell
 
-curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
+curl -X POST http://localhost:9090/api/management/v1alpha2/llm-providers \
   -u {username}:{password} \
   -H 'Content-Type: application/json' \
   -H 'Accept: application/json' \
@@ -26,7 +26,7 @@ Add a new LLM provider to the Gateway. A provider defines how to interact with a
 
 ```json
 {
-  "apiVersion": "gateway.api-platform.wso2.com/v1alpha1",
+  "apiVersion": "gateway.api-platform.wso2.com/v1alpha2",
   "kind": "LlmProvider",
   "metadata": {
     "name": "wso2-openai-provider"
@@ -92,7 +92,7 @@ Required roles: `admin`
 
 ```json
 {
-  "apiVersion": "gateway.api-platform.wso2.com/v1alpha1",
+  "apiVersion": "gateway.api-platform.wso2.com/v1alpha2",
   "kind": "LlmProvider",
   "metadata": {
     "name": "wso2-openai-provider"
@@ -163,7 +163,7 @@ Required roles: `admin`
 
 ```shell
 
-curl -X GET http://localhost:9090/api/management/v0.9/llm-providers \
+curl -X GET http://localhost:9090/api/management/v1alpha2/llm-providers \
   -u {username}:{password} \
   -H 'Accept: application/json'
 
@@ -207,7 +207,7 @@ Required roles: `admin`, `developer`
   "count": 2,
   "providers": [
     {
-      "apiVersion": "gateway.api-platform.wso2.com/v1alpha1",
+      "apiVersion": "gateway.api-platform.wso2.com/v1alpha2",
       "kind": "LlmProvider",
       "metadata": {
         "name": "wso2-openai-provider"
@@ -339,7 +339,20 @@ Status Code **200**
 |»»»»» exceptions|[[RouteException](schemas.md#schemarouteexception)]|false|none|Path exceptions to the access control mode|
 |»»»»»» path|string|true|none|Path pattern|
 |»»»»»» methods|[string]|true|none|HTTP methods|
-|»»»» policies|[[LLMPolicy](schemas.md#schemallmpolicy)]|false|none|List of policies applied only to this operation (overrides or adds to API-level policies)|
+|»»»» globalPolicies|[[Policy](schemas.md#schemapolicy)]|false|none|Global (api-level) policies applied across ALL operations as one shared scope, evaluated before operation-level policies.|
+|»»»»» name|string|true|none|Name of the policy|
+|»»»»» version|string|true|none|Version of the policy. Only major-only version is allowed (e.g., v0, v1). Full semantic version (e.g., v1.0.0) is not accepted and will be rejected. The Gateway Controller resolves the major version to the single matching full version installed in the gateway image.|
+|»»»»» executionCondition|string|false|none|Expression controlling conditional execution of the policy|
+|»»»»» params|object|false|none|Arbitrary parameters for the policy (free-form key/value structure)|
+|»»»» operationPolicies|[[OperationPolicy](schemas.md#schemaoperationpolicy)]|false|none|Operation-level policies scoped to specific paths/methods, evaluated after global policies.|
+|»»»»» name|string|true|none|none|
+|»»»»» version|string|true|none|none|
+|»»»»» executionCondition|string|false|none|Expression controlling conditional execution of the policy|
+|»»»»» paths|[[OperationPolicyPath](schemas.md#schemaoperationpolicypath)]|true|none|none|
+|»»»»»» path|string|true|none|none|
+|»»»»»» methods|[string]|true|none|none|
+|»»»»»» params|object|true|none|JSON Schema describing the parameters accepted by this policy. This itself is a JSON Schema document.|
+|»»»» policies|[[LLMPolicy](schemas.md#schemallmpolicy)]|false|none|DEPRECATED - use operationPolicies. Still honoured (treated identically to operationPolicies).|
 |»»»»» name|string|true|none|none|
 |»»»»» version|string|true|none|none|
 |»»»»» paths|[[LLMPolicyPath](schemas.md#schemallmpolicypath)]|true|none|none|
@@ -364,7 +377,7 @@ Status Code **200**
 
 |Property|Value|
 |---|---|
-|apiVersion|gateway.api-platform.wso2.com/v1alpha1|
+|apiVersion|gateway.api-platform.wso2.com/v1alpha2|
 |kind|LlmProvider|
 |hostRewrite|auto|
 |hostRewrite|manual|
@@ -386,7 +399,7 @@ Status Code **200**
 
 ```shell
 
-curl -X GET http://localhost:9090/api/management/v0.9/llm-providers/{id} \
+curl -X GET http://localhost:9090/api/management/v1alpha2/llm-providers/{id} \
   -u {username}:{password} \
   -H 'Accept: application/json'
 
@@ -415,7 +428,7 @@ Required roles: `admin`, `developer`
 
 ```json
 {
-  "apiVersion": "gateway.api-platform.wso2.com/v1alpha1",
+  "apiVersion": "gateway.api-platform.wso2.com/v1alpha2",
   "kind": "LlmProvider",
   "metadata": {
     "name": "wso2-openai-provider"
@@ -485,7 +498,7 @@ Required roles: `admin`, `developer`
 
 ```shell
 
-curl -X PUT http://localhost:9090/api/management/v0.9/llm-providers/{id} \
+curl -X PUT http://localhost:9090/api/management/v1alpha2/llm-providers/{id} \
   -u {username}:{password} \
   -H 'Content-Type: application/json' \
   -H 'Accept: application/json' \
@@ -499,7 +512,7 @@ Update an existing LLM provider in the Gateway.
 
 ```json
 {
-  "apiVersion": "gateway.api-platform.wso2.com/v1alpha1",
+  "apiVersion": "gateway.api-platform.wso2.com/v1alpha2",
   "kind": "LlmProvider",
   "metadata": {
     "name": "wso2-openai-provider"
@@ -566,7 +579,7 @@ Required roles: `admin`
 
 ```json
 {
-  "apiVersion": "gateway.api-platform.wso2.com/v1alpha1",
+  "apiVersion": "gateway.api-platform.wso2.com/v1alpha2",
   "kind": "LlmProvider",
   "metadata": {
     "name": "wso2-openai-provider"
@@ -637,7 +650,7 @@ Required roles: `admin`
 
 ```shell
 
-curl -X DELETE http://localhost:9090/api/management/v0.9/llm-providers/{id} \
+curl -X DELETE http://localhost:9090/api/management/v1alpha2/llm-providers/{id} \
   -u {username}:{password} \
   -H 'Accept: application/json'
 
@@ -700,7 +713,7 @@ Status Code **200**
 
 ```shell
 
-curl -X POST http://localhost:9090/api/management/v0.9/llm-providers/{id}/api-keys \
+curl -X POST http://localhost:9090/api/management/v1alpha2/llm-providers/{id}/api-keys \
   -u {username}:{password} \
   -H 'Content-Type: application/json' \
   -H 'Accept: application/json' \
@@ -777,7 +790,7 @@ Required roles: `admin`, `consumer`
 
 ```shell
 
-curl -X GET http://localhost:9090/api/management/v0.9/llm-providers/{id}/api-keys \
+curl -X GET http://localhost:9090/api/management/v1alpha2/llm-providers/{id}/api-keys \
   -u {username}:{password} \
   -H 'Accept: application/json'
 
@@ -842,7 +855,7 @@ Required roles: `admin`, `consumer`
 
 ```shell
 
-curl -X POST http://localhost:9090/api/management/v0.9/llm-providers/{id}/api-keys/{apiKeyName}/regenerate \
+curl -X POST http://localhost:9090/api/management/v1alpha2/llm-providers/{id}/api-keys/{apiKeyName}/regenerate \
   -u {username}:{password} \
   -H 'Content-Type: application/json' \
   -H 'Accept: application/json' \
@@ -917,7 +930,7 @@ Required roles: `admin`, `consumer`
 
 ```shell
 
-curl -X PUT http://localhost:9090/api/management/v0.9/llm-providers/{id}/api-keys/{apiKeyName} \
+curl -X PUT http://localhost:9090/api/management/v1alpha2/llm-providers/{id}/api-keys/{apiKeyName} \
   -u {username}:{password} \
   -H 'Content-Type: application/json' \
   -H 'Accept: application/json' \
@@ -995,7 +1008,7 @@ Required roles: `admin`, `consumer`
 
 ```shell
 
-curl -X DELETE http://localhost:9090/api/management/v0.9/llm-providers/{id}/api-keys/{apiKeyName} \
+curl -X DELETE http://localhost:9090/api/management/v1alpha2/llm-providers/{id}/api-keys/{apiKeyName} \
   -u {username}:{password} \
   -H 'Accept: application/json'