Akka / Deployment / How AAO works / Model routing, serving and training / How a request reaches a model

flowchart TD subgraph internet["internet"] client["OpenAI-compatible client"] end subgraph edge["contour edge"] route["KalixRoute
host + TLS + edge auth"] end subgraph project["project namespace"] agent["in-cluster agent or service"] endpoint["KalixModelEndpoint
models + apiKeySecret"] svc["Service (ExternalName)
CNAME to gateway envoy"] docs["docs-engine"] tiny["tiny-engine"] end subgraph gwsys["agentgateway-system"] gw["gateway envoy
listener per endpoint FQDN
Bearer key + request surface + model table"] end client -->|"https://host/v1"| route route -->|"Host rewritten to internal FQDN
l5d-dst-override to gateway svc"| svc agent -->|"http://endpoint.project.svc.cluster.local/v1
Authorization: Bearer"| svc endpoint -.->|"renders"| svc svc -.->|"DNS only (CNAME)"| gw endpoint -.->|"listener, table rows, key policy"| gw gw -->|"model: docs
mesh: only gateway identity admitted"| docs gw -->|"model: tiny
mesh: only gateway identity admitted"| tiny