[merterbak]

Part of #734 (kgateway).

Adds development/examples/kgateway/: kgateway stays the gateway, and an agentmesh-node decides each request over gRPC ext_authz. There are two routes. One goes to a local MCP server, and the other goes through the mesh to a server in another namespace.

run.sh sets up a kind cluster and checks:

• allowed and denied calls for two users
• no token, the wrong audience, and the node's own token are all refused
• with the node down, kgateway returns 503 (failOpen: false, statusOnError: 503), and it recovers once the node is back

The guide is site/content/docs/guides/kgateway.md.

Tested with kind v0.33.0 (k8s v1.37.0) on macOS arm64.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive example and documentation guide for integrating kgateway with mesh authorization using an agentmesh-node over Envoy ext_authz. It includes Kubernetes manifests for local and remote applications, gateway configurations, mesh infrastructure (Keycloak, control plane, router, node), Keycloak realm settings, and a test script (run.sh) to automate the setup and verification in a local kind cluster. The review feedback suggests improving the troubleshooting experience in run.sh by redirecting the output of kind create cluster and helm upgrade commands to log files instead of silencing them entirely.