Authorization down to call arguments really does work. It costs about 20ms per response and the default deployment tops out around 100 requests per second, and one iteration-count setting turns out to own that cost. Writing the condition the way the documentation shows leaves tools/list returning nothing, so an agent finds no tools at all: wrap the CEL in has().
What A2A gives you is a contract for progress and cancellation. What it costs is a larger response (seven times plain HTTP for the same job) and 1.2 to 2.1 ms more per call. The authentication the agent card declares is not enforced by the SDK’s default setup, so read declaration and enforcement separately.
The gateway hop costs under 1 ms per tool call and never improves p99, and in return you get control and observation the server cannot do on its own. One argument-conditioned policy was accepted and still did not enforce what it said, so turn a policy on and then check it with real calls.
Porting the transport to the v2 SDK is mostly a version bump. The real migration is deciding where handle state lives, and leaving it in pod memory brings the old failure back behind an HTTP 200 that transport retries never see.
A CNI is picked once and rarely revisited, and there is no organized data on what it consumes day to day. Measuring 5 CNIs in 14 configurations under identical conditions showed an 8x memory spread, eBPF map memory that shows up in different metrics depending on the CNI, and a 70% kube-proxy memory saving from the nftables mode that had not been published as a number.
We rebuilt last year’s Gateway API PoC from the scoring model up and re-measured 7 implementations. All 7 pass official conformance, but the features you can actually use range from 6 to 13.
Putting nine agents through ten Kubernetes incident scenarios under identical conditions surfaced two things: the Efficient tier beat Flagship outright, and each brand has a clearly different operational personality.
~$3,240/month, ~$38,880/year saved (~49%). Consolidated EKS 1.32/1.33 to 1.35, ArgoCD v1 to v3, and Kafka Zookeeper to KRaft in one shot while reducing nodes from 25 to 15. Achieved fully zero-downtime cutover with Route53 Weighted Routing.
~$414/mo, ~$5,000/yr saved combined (~48%): 39% on production, 61% on dev. Six waste patterns and a zero-downtime execution playbook for small K8s clusters.
100-round PoC results and selection guide for 7 Kubernetes Gateway API implementations across 17 test scenarios