Fix agentgateway release pin

[danehans]

Summary

Pin agentgateway and agentgateway-crds to the published agentgateway v1.3.1 release and refresh the generated BOM docs.

Motivation / Context

v2.2.1 is not an agentgateway release, so inference recipes were pointing at an invalid upstream chart version.

Fixes: #1467
Related: #1646

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Build/CI/tooling

Component(s) Affected

• CLI (cmd/aicr, pkg/cli)
• API server (cmd/aicrd, pkg/server)
• Recipe engine / data (pkg/recipe)
• Bundlers (pkg/bundler, pkg/component/*)
• Collectors / snapshotter (pkg/collector, pkg/snapshotter)
• Validator (pkg/validator)
• Core libraries (pkg/errors, pkg/k8s)
• Docs/examples (docs/, examples/)
• Other: ____________

Implementation Notes

The agentgateway CRD health check now also asserts the chart-installed agentgateway.dev CRDs are established.

Testing

make bom-docs
make qualify

Also deployed a focused agentgateway bundle to a fresh Kind cluster and verified the controller, inference gateway, Gateway status, service source ranges, and live Chainsaw health checks.

Risk Assessment

• Low — Isolated chart pin correction, validated with template checks and live Kind deployment
• Medium — Touches multiple components or has broader impact
• High — Breaking change, affects critical paths, or complex rollout

Rollout notes: N/A

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S) — GPG signing info

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Welcome to AICR, @danehans! Thanks for your first pull request.

Before review, please ensure:

• All commits are signed off per the DCO
• CI checks pass (tests, lint, security scan)
• The PR description explains the why behind your changes

A maintainer will review this soon.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: d9f747fc-c463-4c0c-bdb4-d0ff532be9bd

📥 Commits

Reviewing files that changed from the base of the PR and between 1192ddb and 7b879fb.

📒 Files selected for processing (1)

• docs/user/container-images.md

---

📝 Walkthrough

Walkthrough

The PR updates agentgateway and agentgateway-crds references from v2.2.1 to v1.3.1 across recipes, documentation, and a conformance assertion. It also clarifies the CRD health-check scope and adds validation that three agentgateway.dev CRDs reach Established=True.

Estimated code review effort: 2 (Simple) | ~15 minutes

Suggested labels: theme/recipes, dependencies

Suggested reviewers: mchmarny

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: correcting the agentgateway release pin.
Description check	✅ Passed	The description matches the changeset and explains the pin fix and docs refresh.
Linked Issues check	✅ Passed	The PR updates the requested agentgateway and agentgateway-crds pins in the targeted recipes, satisfying issue #1467.
Out of Scope Changes check	✅ Passed	The docs update and CRD health-check enhancement are consistent with the PR goals and do not appear unrelated.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-fix-agentgateway-release-pin.docs.buildwithfern.com/aicr

[github-actions]

Recipe evidence check

Registry change: scoped to recipes that reference a changed component
entry in recipes/registry.yaml (not every leaf).

Protected recipes

Recipes with committed evidence (recipes/evidence/<slug>/<source>/<digest>.yaml) that this PR affects: 1

Recipe	Source	Pointer	Verify	Digest match
h100-aks-ubuntu-inference-dynamo	5bf9e82f0e90a11528ac85f4bcb866c8	sha256-f8d2a0188274d179f37dfe39a257aeaa3fbb97273162586853e0986bfa5d3c05	✅ passed	⚠️ stale (8e88ca57dea5… vs current 27f583e56d70…)

Other affected recipes without evidence yet: 26

These recipes are affected by this PR but carry no committed evidence pointer, so there is
nothing to verify. This is expected — evidence is hardware-gated and added over time.

• b200-gke-cos-inference-dynamo
• b200-gke-cos-inference
• gb200-eks-inference
• gb200-eks-ubuntu-inference-dynamo
• gb200-eks-ubuntu-inference
• gb200-oke-inference
• gb200-oke-ubuntu-inference-dynamo
• gb200-oke-ubuntu-inference
• h100-aks-inference
• h100-aks-ubuntu-inference
• h100-eks-inference
• h100-eks-ubuntu-inference-dynamo
• h100-eks-ubuntu-inference-nim
• h100-eks-ubuntu-inference
• h100-gke-cos-inference-dynamo
• h100-gke-cos-inference
• h100-kind-inference-dynamo
• h100-kind-inference
• h200-eks-inference
• l40s-oke-inference
• rtx-pro-6000-eks-inference
• rtx-pro-6000-eks-ubuntu-inference-dynamo
• rtx-pro-6000-eks-ubuntu-inference-nim
• rtx-pro-6000-eks-ubuntu-inference
• rtx-pro-6000-lke-inference
• rtx-pro-6000-lke-ubuntu-inference

How to refresh evidence

Run on a cluster matching the recipe's criteria:

aicr snapshot -o snapshot.yaml
aicr validate \
  -r recipes/overlays/<slug>.yaml \
  -s snapshot.yaml \
  --emit-attestation ./out \
  --push ghcr.io/<your-fork>/aicr-evidence
# Copy to the per-source path printed in the emit 'copyTo' hint:
#   recipes/evidence/<slug>/<source>/<bundle-digest>.yaml

This gate is warning-only and never blocks merge. See ADR-007 for the trust model.

[yuanchen8911]

thanks for the PR, left a few comments. PTAL.

[yuanchen8911]

cc @danehans

Approving. The re-pin is correct and complete (registry, mixin, BOM, chainsaw assert), and the agentgateway.dev CRD Established asserts close the gap noted in #1221. The CRD-schema mismatch is non-blocking per the thread; follow-up issue to come.

Before merge: please rebase onto current main (the branch is ~90 commits behind and the merge gate will require it), re-run make bom-docs since the BOM has drifted on main, and mark the PR ready for review.

[yuanchen8911]

Follow-up issue filed: #1646 — chore(recipes): vendor GAIE v1.5.0 CRDs for agentgateway (appProtocol support)

[lockwobr]

@yuanchen8911 this is still in draft, do you know why?