api: add GCP OIDC auth support in BackendSecurityPolicies by sukumargaonkar · Pull Request #635 · envoyproxy/ai-gateway

sukumargaonkar · 2025-05-22T20:07:28Z

Commit Message
This Commit adds required fields on BackendSecurityPolicy for GCP authentication

Related Issues/PRs (if applicable)
Related Issue: #609

Special notes for reviewers (if applicable)
This PR only make API changes. Implementation for token rotator and backendauth will follow in future PRs

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

api/v1alpha1/api.go

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

api/v1alpha1/api.go

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

# Conflicts: # go.mod

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

api/v1alpha1/api.go

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net> # Conflicts: # go.mod # manifests/charts/ai-gateway-crds-helm/templates/aigateway.envoyproxy.io_backendsecuritypolicies.yaml # site/docs/api/api.mdx

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

aabchoo

nit: please add cel validation

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

aabchoo

Overall looks good to me -- made a few comments

aabchoo · 2025-06-12T19:44:45Z

api/v1alpha1/api.go

+	//
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	ProjectID string `json:"projectID"`


Is ProjectID specific to Federation Config? Would it make sense to bubble this field up if it's needed for all GCP auth

not sure if other authentication methods would need project-id, so keeping it within federation config for now

aabchoo · 2025-06-12T19:46:42Z

filterapi/filterconfig.go

+	// Region is the GCP region to use for the request.
+	Region string `json:"region"`
+	// ProjectName is the GCP project name to use for the request.
+	ProjectName string `json:"projectName"`


How will region and project be used in the extproc?

The region and project-id are required while transforming request path
https://<region>-aiplatform.googleapis.com/v1/projects/<project-id>/locations/<region>/publishers/google/models/<model-name>:generateContent

then maybe ProjectID instead of ProjectName

Tried using project ID in the request url, but kept getting IAM_PERMISSION_DENIED error
not sure if that is an account specific configuration issue or GCP just doesn't like project ID instead of project-name

if future project name is found to be acceptable, we can add that as another field and accept either of them as valid config

looks like it is using the name from the examples

https://aiplatform.googleapis.com/v1/projects/test-project/locations/global/publishers/google/models/gemini-2.0-flash-001:generateContent

if project name is currently required on the url path, then it needs to be added to the BackendSecurityPolicy as well?

tests/crdcel/testdata/backendsecuritypolicies/gcp_oidc.yaml

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

api/v1alpha1/api.go

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

api/v1alpha1/api.go

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

api/v1alpha1/api.go

examples/basic/basic.yaml

manifests/charts/ai-gateway-crds-helm/templates/aigateway.envoyproxy.io_aigatewayroutes.yaml

manifests/charts/ai-gateway-crds-helm/templates/aigateway.envoyproxy.io_aiservicebackends.yaml

filterapi/filterconfig.go

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

**Description** - Implement GCP integration via OIDC token rotator. This PR add support for authenticating against GCP via external OIDC tokens. It uses google's Workload Identity Federation [1] to exchange an OIDC token for GCP's access token. It also support optional service account impersonation. - Add `ProjectName` and `Region` field in BackendSecurityPolicyGCPCredentials 1: https://cloud.google.com/iam/docs/workload-identity-federation **Related Issues/PRs (if applicable)** Previous PR: #635 Related Issue: #609 --------- Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

api: add GCP support for backend security policies and API schemas

bd5edf3

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

sukumargaonkar requested a review from a team as a code owner May 22, 2025 20:07

sukumargaonkar mentioned this pull request May 22, 2025

Support GCP models #609

Closed

sukumargaonkar changed the title ~~api: add GCP support for backend security policies and API schemas~~ api: Add GCP support for BackendSecurityPolicies and API schemas May 22, 2025

sukumargaonkar changed the title ~~api: Add GCP support for BackendSecurityPolicies and API schemas~~ api: add GCP support for BackendSecurityPolicies and API schemas May 22, 2025

sukumargaonkar changed the title ~~api: add GCP support for BackendSecurityPolicies and API schemas~~ api: add GCP OIDC auth support in BackendSecurityPolicies May 22, 2025

Merge remote-tracking branch 'upstream/main' into gcp-auth-api

90121fb

sukumargaonkar marked this pull request as draft May 22, 2025 20:43

api: add GCP auth support in filter configuration

6c7df97

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

sukumargaonkar marked this pull request as ready for review May 22, 2025 20:54

xiaolin593 reviewed May 22, 2025

View reviewed changes

api/v1alpha1/api.go Outdated Show resolved Hide resolved

api/v1alpha1/api.go Outdated Show resolved Hide resolved

sukumargaonkar added 3 commits May 22, 2025 19:04

add validations for fields in BackendSecurityPolicyGCPCredentials

355ad5a

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

remove unused dependencies from go.mod

ebc5147

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Merge remote-tracking branch 'upstream/main' into gcp-auth-api

f541e98

aabchoo reviewed May 23, 2025

View reviewed changes

api/v1alpha1/api.go Outdated Show resolved Hide resolved

xiaolin593 reviewed May 23, 2025

View reviewed changes

api/v1alpha1/api.go Outdated Show resolved Hide resolved

api/v1alpha1/api.go Outdated Show resolved Hide resolved

api/v1alpha1/api.go Outdated Show resolved Hide resolved

sukumargaonkar added 3 commits May 27, 2025 11:16

Reorganize fields under BackendSecurityPolicyGCPCredentials

40b1477

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Merge remote-tracking branch 'upstream/main' into gcp-auth-api

f7e2634

# Conflicts: # go.mod

make precommit

2414542

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

aabchoo reviewed May 27, 2025

View reviewed changes

api/v1alpha1/api.go Outdated Show resolved Hide resolved

api/v1alpha1/api.go Show resolved Hide resolved

aabchoo reviewed May 30, 2025

View reviewed changes

api/v1alpha1/api.go Outdated Show resolved Hide resolved

sukumargaonkar added 8 commits June 9, 2025 14:39

Add Region and ProjectName to GCPAuth

f7d5192

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Merge remote-tracking branch 'upstream/main' into gcp-auth-api

c538a45

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net> # Conflicts: # go.mod # manifests/charts/ai-gateway-crds-helm/templates/aigateway.envoyproxy.io_backendsecuritypolicies.yaml # site/docs/api/api.mdx

Rename GCPWorkloadIdentityProvider.OIDCConfig to OIDCProvider

e101a82

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Merge remote-tracking branch 'upstream/main' into gcp-auth-api

e851bcc

Fix go.mod

7263be3

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Switch from GCP CredentialFile to AccessToken

622f5f5

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Merge remote-tracking branch 'upstream/main' into gcp-auth-api

3001321

Merge remote-tracking branch 'upstream/main' into gcp-auth-api

c4208b4

aabchoo reviewed Jun 11, 2025

View reviewed changes

sukumargaonkar added 2 commits June 11, 2025 17:57

Fix gitignore

831b6d2

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Add crdcel test for gcp backendsecurity policy

04b7c08

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

aabchoo reviewed Jun 12, 2025

View reviewed changes

Remove unnecessary comments

2ae31ec

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

mathetake reviewed Jun 13, 2025

View reviewed changes

api/v1alpha1/api.go Outdated Show resolved Hide resolved

sukumargaonkar added 2 commits June 13, 2025 09:16

Merge remote-tracking branch 'upstream/main' into gcp-auth-api

fa5d02d

refactor: update GCP schema names to include Vertex AI platform

2756c32

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

mathetake reviewed Jun 14, 2025

View reviewed changes

api/v1alpha1/api.go Outdated Show resolved Hide resolved

mathetake reviewed Jun 14, 2025

View reviewed changes

api/v1alpha1/api.go Show resolved Hide resolved

sukumargaonkar added 3 commits June 16, 2025 10:24

refactor: GeminiVertexAI schema to GCPVertexAI

a4e725c

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Merge remote-tracking branch 'upstream/main' into gcp-auth-api

700dc73

Fix CI

687d29c

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

yuzisun reviewed Jun 17, 2025

View reviewed changes

api/v1alpha1/api.go Outdated Show resolved Hide resolved

yuzisun reviewed Jun 17, 2025

View reviewed changes

examples/basic/basic.yaml Outdated Show resolved Hide resolved

yuzisun reviewed Jun 17, 2025

View reviewed changes

manifests/charts/ai-gateway-crds-helm/templates/aigateway.envoyproxy.io_aigatewayroutes.yaml Outdated Show resolved Hide resolved

yuzisun reviewed Jun 17, 2025

View reviewed changes

manifests/charts/ai-gateway-crds-helm/templates/aigateway.envoyproxy.io_aiservicebackends.yaml Outdated Show resolved Hide resolved

yuzisun reviewed Jun 17, 2025

View reviewed changes

filterapi/filterconfig.go Show resolved Hide resolved

Update docs and comments

a48254b

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

mathetake approved these changes Jun 17, 2025

View reviewed changes

mathetake merged commit 7e42af9 into envoyproxy:main Jun 17, 2025
17 checks passed

sukumargaonkar mentioned this pull request Jun 23, 2025

feat: add GCP Authentication Support #752

Merged

Conversation

sukumargaonkar commented May 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aabchoo left a comment

Choose a reason for hiding this comment

Uh oh!

aabchoo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sukumargaonkar commented May 22, 2025 •

edited

Loading