nodeport directory · worker 172.16.10.155
Worker 172.16.10.155. All access is NodePort — LoadBalancers stay
pending on this bare-metal lab. Type the URL, see what it does.
Claude Desktop ≠ :30398/anthropic
· Codex ≠ :30160/openai
· Grok Build ≠ :31397/grok.
Dedicated client gateways take Entra JWT. The open paths are for kagent / curl.
Entra JWT on a dedicated Gateway. PathPrefix / so the client’s
/v1/… lands at the NodePort root.
| Name | What it does | URL | Auth |
|---|---|---|---|
| Claude Desktop | Claude Desktop → Anthropic |
http://127.0.0.1:18789/
via scripts/claude-desktop-lab-proxy.py → :31938 · HTTPS :31211 · guide
|
Entra JWT |
| Codex | Codex CLI → OpenAI Responses |
http://172.16.10.155:31928/v1
must end /v1 · loopback :18790 · HTTPS :31540 · guide
|
Entra JWT |
| Grok Build | Grok Build → xAI Responses |
http://172.16.10.155:31918/v1
must end /v1 · loopback :18791 · HTTPS :31987 · guide
|
Entra JWT |
kagent / curl. No Entra. Gateway injects the upstream key.
| Name | What it does | URL | Auth |
|---|---|---|---|
| OpenAI gpt-5.5 | kagent default model | http://172.16.10.155:30160/openai |
open |
| xAI grok-4.5 | kagent grok |
http://172.16.10.155:31397/grok
unpinned: /grok-flex
|
open |
| Anthropic claude-fable-5 | kagent claude |
http://172.16.10.155:30398/anthropic
unpinned: /anthropic-flex
|
open |
| Gemini 2.5 Flash | kagent gemini | http://172.16.10.155:32637/gemini |
open |
| Bedrock Sonnet 4.5 | dedicated Bedrock path |
http://172.16.10.155:30275/bedrock
not :30160
|
open |
| OpenAI gpt-5.6 | dedicated gpt-5.6 | http://172.16.10.155:30536/gpt56 |
open |
| DGX Spark Qwen3.8-27B (NVFP4) | local vLLM |
http://172.16.10.155:31944/spark
upstream 172.16.10.173:8000
|
open |
All on agentgateway-proxy :30160. Workshop deep-dive stays on
llm-gateway.html.
| Name | What it does | URL | Auth |
|---|---|---|---|
| OpenAI flex | unpinned OpenAI | http://172.16.10.155:30160/openai-flex |
open |
| LLM load balance | gpt-5.5 + grok-4.5 | http://172.16.10.155:30160/llm-lb |
open |
| LLM failover | OpenAI → xAI → Anthropic | http://172.16.10.155:30160/llm-failover |
open |
| Bedrock LB | Nova Pro + Lite + Llama | http://172.16.10.155:30160/bedrock-lb |
open |
| Bedrock failover | Sonnet → Nova → Llama | http://172.16.10.155:30160/bedrock-failover |
open |
| Route by model | body.model routing | http://172.16.10.155:30160/route-by-model |
open |
| Embeddings | OpenAI embeddings | http://172.16.10.155:30160/embeddings |
open |
| Guard demo | promptGuard | http://172.16.10.155:30160/guard-demo |
open |
| Enrich demo | prompt enrichment | http://172.16.10.155:30160/enrich-demo |
open |
| Token rate limit | token RL | http://172.16.10.155:30160/token-rl |
open |
| WAF demo | WAF first-pass | http://172.16.10.155:30160/waf-demo |
open |
| Secure OpenAI | Entra JWT on LLM | http://172.16.10.155:30160/secure-openai |
Entra JWT |
| Virtual key | virtual key + team budget | http://172.16.10.155:30160/vk-openai |
virtual key |
| Budget demo | budget 429 path | http://172.16.10.155:30160/budget-demo |
open |
Virtual MCP on :31606. GitHub elicit is a different
Gateway — not :30160.
| Name | What it does | URL | Auth |
|---|---|---|---|
| Virtual MCP | open federation | http://172.16.10.155:31606/mcp |
open |
| MCP secure | Entra JWT + tool RBAC | http://172.16.10.155:31606/mcp-secure |
Entra JWT |
| MCP RBAC | group-filtered catalog | http://172.16.10.155:31606/mcp-rbac |
Entra JWT |
| GitHub MCP | shared PAT | http://172.16.10.155:31606/github |
open |
| Drone MCP | Tello/RMTT tools |
http://172.16.10.155:31606/drone
also /drone-search · /drone-code · /drone-codesearch
|
open |
| Composable | account-brief | http://172.16.10.155:31606/composable |
open |
| OpenAPI MCP | Open-Meteo | http://172.16.10.155:31606/openapi-mcp |
open |
| GitHub elicit | per-user STS elicit |
http://172.16.10.155:31025/github-elicit
not :30160 · guide
|
Entra JWT |
| AgentRegistry | published MCP | http://172.16.10.155:32394/registry |
open |
On :30160. Identity hops and per-agent A2A — all Entra JWT.
identity.html · kagent.html.
| Name | What it does | URL | Auth |
|---|---|---|---|
| Passthrough | Entra JWT as-is | http://172.16.10.155:30160/identity/passthrough |
Entra JWT |
| Impersonate | STS mint, no act | http://172.16.10.155:30160/identity/impersonate |
Entra JWT |
| Graph /me | Entra OBO → Graph | http://172.16.10.155:30160/graph-me |
Entra JWT |
| Hello agent | A2A hello | http://172.16.10.155:30160/agents/hello |
Entra JWT |
| K8s agent | A2A k8s | http://172.16.10.155:30160/agents/k8s |
Entra JWT |
| GitHub agent | A2A github | http://172.16.10.155:30160/agents/github |
Entra JWT |
Source: GitOps under config/ via Argo agentgateway-config.
Deep-dives:
Claude Desktop ·
Codex ·
Grok Build ·
LLM workshop ·
MCP ·
identity ·
kagent ·
markdown.