Google opens Agent Gateway preview beyond its cloud

Google opened a limited preview of Agent Gateway for Kubernetes clusters outside Google Cloud on 11 November. Platform and security teams running AI agents on Amazon EKS, Azure AKS, Red Hat OpenShift or bare metal can apply Google's governance without moving those workloads. They must request preview access through a form, and the deployment still depends on a Google Cloud connection. Google Cloud release notes

The preview covers any Kubernetes cluster outside GKE that conforms to Cloud Native Computing Foundation standards. Dedicated Envoy proxies run in namespaces the customer manages. According to the release notes, each agent gets an identity, agents and MCP servers are registered in Agent Registry, and traffic is routed through the local proxies. The proxies enforce access and Model Armor policies and send logs and traces to Cloud Logging and Cloud Trace. Cross cloud deployment overview

Who runs what

The overview splits the work. Google manages the SaaS management plane and the routing configuration of the cross cloud control plane. The customer handles cluster and network configuration, forwards traffic to the proxies, injects Kubernetes Service Account tokens and provides outbound connectivity to Google APIs. That leaves two separate questions: can agents stay on existing infrastructure, and is the organisation comfortable administering the service and collecting logs through Google Cloud. The cluster's location answers neither.

Google Cloud vice presidents Nirav Mehta and Muninder Sambi said in an April 22 announcement that Agent Gateway understands agent protocols such as MCP and A2A to inspect and govern agent interactions. The preview pages do not list which protocols the cross cloud version inspects, so teams should confirm MCP and A2A coverage with Google before assuming it.

Two limits and the cost

Google documents two constraints. A gateway can report ready up to two minutes before it accepts connections on port 8443, so rollouts should confirm readiness with a test request. In cluster service URLs must also be unique across all clusters registered to the same project, so teams that reuse service names across environments should check for collisions first.

The gateway is free during the preview, while Model Armor, Cloud Logging and Cloud Trace are billed at standard rates. A fair comparison with an existing gateway includes those services and the work of operating proxies in the cluster. That comparison is IC's reading of the documentation; we have not tested the preview.

Separately, on 12 November Google released Agent Gateway for GKE in preview, for GKE version 1.37.2-gke.1042000 or higher in europe-west1 and us-central1. It is a different release, so European teams on GKE should not read it as part of this one.