Skip to content

api: add GCP OIDC auth support in BackendSecurityPolicies #635

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mathetake merged 26 commits into from
Jun 17, 2025
Merged

api: add GCP OIDC auth support in BackendSecurityPolicies #635

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
bd5edf3
api: add GCP support for backend security policies and API schemas
sukumargaonkar May 22, 2025
90121fb
Merge remote-tracking branch 'upstream/main' into gcp-auth-api
sukumargaonkar May 22, 2025
6c7df97
api: add GCP auth support in filter configuration
sukumargaonkar May 22, 2025
355ad5a
add validations for fields in BackendSecurityPolicyGCPCredentials
sukumargaonkar May 22, 2025
ebc5147
remove unused dependencies from go.mod
sukumargaonkar May 23, 2025
f541e98
Merge remote-tracking branch 'upstream/main' into gcp-auth-api
sukumargaonkar May 23, 2025
40b1477
Reorganize fields under BackendSecurityPolicyGCPCredentials
sukumargaonkar May 24, 2025
f7e2634
Merge remote-tracking branch 'upstream/main' into gcp-auth-api
sukumargaonkar May 27, 2025
2414542
make precommit
sukumargaonkar May 27, 2025
f7d5192
Add Region and ProjectName to GCPAuth
sukumargaonkar Jun 9, 2025
c538a45
Merge remote-tracking branch 'upstream/main' into gcp-auth-api
sukumargaonkar Jun 9, 2025
e101a82
Rename GCPWorkloadIdentityProvider.OIDCConfig to OIDCProvider
sukumargaonkar Jun 10, 2025
e851bcc
Merge remote-tracking branch 'upstream/main' into gcp-auth-api
sukumargaonkar Jun 10, 2025
7263be3
Fix go.mod
sukumargaonkar Jun 10, 2025
622f5f5
Switch from GCP CredentialFile to AccessToken
sukumargaonkar Jun 11, 2025
3001321
Merge remote-tracking branch 'upstream/main' into gcp-auth-api
sukumargaonkar Jun 11, 2025
c4208b4
Merge remote-tracking branch 'upstream/main' into gcp-auth-api
sukumargaonkar Jun 11, 2025
831b6d2
Fix gitignore
sukumargaonkar Jun 11, 2025
04b7c08
Add crdcel test for gcp backendsecurity policy
sukumargaonkar Jun 11, 2025
2ae31ec
Remove unnecessary comments
sukumargaonkar Jun 12, 2025
fa5d02d
Merge remote-tracking branch 'upstream/main' into gcp-auth-api
sukumargaonkar Jun 13, 2025
2756c32
refactor: update GCP schema names to include Vertex AI platform
sukumargaonkar Jun 13, 2025
a4e725c
refactor: GeminiVertexAI schema to GCPVertexAI
sukumargaonkar Jun 16, 2025
700dc73
Merge remote-tracking branch 'upstream/main' into gcp-auth-api
sukumargaonkar Jun 16, 2025
687d29c
Fix CI
sukumargaonkar Jun 16, 2025
a48254b
Update docs and comments
sukumargaonkar Jun 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 42 additions & 2 deletions api/v1alpha1/api.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -404,7 +404,7 @@ type AIServiceBackendSpec struct {
type VersionedAPISchema struct {
// Name is the name of the API schema of the AIGatewayRoute or AIServiceBackend.
//
// +kubebuilder:validation:Enum=OpenAI;AWSBedrock;AzureOpenAI
// +kubebuilder:validation:Enum=OpenAI;AWSBedrock;AzureOpenAI;GCPGemini;GCPAnthropic
Comment thread
sukumargaonkar marked this conversation as resolved.
Outdated
Name APISchema `json:"name"`

// Version is the version of the API schema.
Expand All @@ -427,6 +427,15 @@ const (
//
// https://learn.microsoft.com/en-us/azure/ai-services/openai/reference#api-specs
APISchemaAzureOpenAI APISchema = "AzureOpenAI"
// APISchemaGCPGemini is the schema followed by Gemini models hosted on GCP.
Comment thread
yuzisun marked this conversation as resolved.
Outdated
//
// https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.endpoints/generateContent?hl=en
Comment thread
yuzisun marked this conversation as resolved.
APISchemaGCPGemini APISchema = "GCPGemini"
// APISchemaGCPAnthropic is the schema followed by Anthropic models hosted on GCP.
// This is majorly the Anthropic API with some GCP specific parameters as described in below URL.
//
// https://docs.anthropic.com/en/api/claude-on-vertex-ai
APISchemaGCPAnthropic APISchema = "GCPAnthropic"
)

const (
Expand All @@ -442,6 +451,7 @@ const (
BackendSecurityPolicyTypeAPIKey BackendSecurityPolicyType = "APIKey"
BackendSecurityPolicyTypeAWSCredentials BackendSecurityPolicyType = "AWSCredentials"
BackendSecurityPolicyTypeAzureCredentials BackendSecurityPolicyType = "AzureCredentials"
BackendSecurityPolicyTypeGCPCredentials BackendSecurityPolicyType = "GCPCredentials"
)

// BackendSecurityPolicy specifies configuration for authentication and authorization rules on the traffic
Expand All @@ -466,7 +476,7 @@ type BackendSecurityPolicy struct {
type BackendSecurityPolicySpec struct {
// Type specifies the auth mechanism used to access the provider. Currently, only "APIKey", "AWSCredentials", and "AzureCredentials" are supported.
Comment thread
yuzisun marked this conversation as resolved.
Outdated
//
// +kubebuilder:validation:Enum=APIKey;AWSCredentials;AzureCredentials
// +kubebuilder:validation:Enum=APIKey;AWSCredentials;AzureCredentials;GCPCredentials
Type BackendSecurityPolicyType `json:"type"`

// APIKey is a mechanism to access a backend(s). The API key will be injected into the Authorization header.
Expand All @@ -483,6 +493,10 @@ type BackendSecurityPolicySpec struct {
//
// +optional
AzureCredentials *BackendSecurityPolicyAzureCredentials `json:"azureCredentials,omitempty"`
// GCPCredentials is a mechanism to access a backend(s). GCP specific logic will be applied.
//
// +optional
GCPCredentials *BackendSecurityPolicyGCPCredentials `json:"gcpCredentials,omitempty"`
}

// BackendSecurityPolicyList contains a list of BackendSecurityPolicy
Expand Down Expand Up @@ -520,6 +534,32 @@ type BackendSecurityPolicyOIDC struct {
Aud string `json:"aud,omitempty"`
}

// BackendSecurityPolicyGCPCredentials contains the supported authentication mechanisms to access GCP.
type BackendSecurityPolicyGCPCredentials struct {
// ProjectID is the GCP project ID that the backend is hosted in.
//
// +kubebuilder:validation:Required
// +kubebuilder:validation:MinLength=1
ProjectID string `json:"projectID"`

@aabchoo aabchoo Jun 12, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is ProjectID specific to Federation Config? Would it make sense to bubble this field up if it's needed for all GCP auth

@sukumargaonkar sukumargaonkar Jun 12, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure if other authentication methods would need project-id, so keeping it within federation config for now

// ServiceAccountEmail is the email address of the service account to be used to access GCP.
//
// +kubebuilder:validation:Required
// +kubebuilder:validation:MinLength=1
ServiceAccountEmail string `json:"serviceAccountEmail"`
Comment thread
yuzisun marked this conversation as resolved.
Outdated
// WorkloadIdentityPoolName is the name of the workload identity pool defined in GCP.
//
// +kubebuilder:validation:Required
// +kubebuilder:validation:MinLength=1
WorkloadIdentityPoolName string `json:"workloadIdentityPoolName"`
Comment thread
yuzisun marked this conversation as resolved.
Outdated
// GCPIdentityProviderName refers to the external identity provider whose credentials your workload is using to authenticate to Google Cloud.
//
// +kubebuilder:validation:Required
// +kubebuilder:validation:MinLength=1
GCPIdentityProviderName string `json:"GCPIdentityProviderName"`
Comment thread
yuzisun marked this conversation as resolved.
Outdated
// BackendSecurityPolicyOIDC is the generic OIDC fields.
Comment thread
yuzisun marked this conversation as resolved.
Outdated
BackendSecurityPolicyOIDC `json:",inline"`
}

// BackendSecurityPolicyAzureCredentials contains the supported authentication mechanisms to access Azure.
type BackendSecurityPolicyAzureCredentials struct {
// ClientID is a unique identifier for an application in Azure.
Expand Down
21 changes: 21 additions & 0 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 11 additions & 0 deletions filterapi/filterconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,8 @@ type BackendAuth struct {
AWSAuth *AWSAuth `json:"aws,omitempty"`
// AzureAuth specifies the location of Azure access token file.
AzureAuth *AzureAuth `json:"azure,omitempty"`
// GCPAuth specifies the location of GCP credential file.
GCPAuth *GCPAuth `json:"gcp,omitempty"`
}

// AWSAuth defines the credentials needed to access AWS.
Expand All @@ -229,6 +231,15 @@ type AzureAuth struct {
Filename string `json:"filename"`
}

// GCPAuth defines the file containing GCP credential that will be mounted to the external proc.
type GCPAuth struct {
// CredentialFileName is the name of the file containing the GCP credential.
//
// +kubebuilder:validation:Required
// +kubebuilder:validation:MinLength=1
CredentialFileName string `json:"credentialFileName,omitempty"`
}

// UnmarshalConfigYaml reads the file at the given path and unmarshals it into a Config struct.
func UnmarshalConfigYaml(path string) (*Config, []byte, error) {
raw, err := os.ReadFile(path)
Expand Down
7 changes: 7 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,9 @@ require (
4d63.com/gochecknoglobals v0.2.2 // indirect
al.essio.dev/pkg/shellescape v1.5.1 // indirect
cel.dev/expr v0.23.1 // indirect
cloud.google.com/go/auth v0.15.0 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
cloud.google.com/go/compute/metadata v0.6.0 // indirect
dario.cat/mergo v1.0.1 // indirect
github.com/4meepo/tagalign v1.4.2 // indirect
github.com/Abirdcfly/dupword v0.1.3 // indirect
Expand Down Expand Up @@ -212,9 +215,12 @@ require (
github.com/google/go-github/v56 v56.0.0 // indirect
github.com/google/go-querystring v1.1.0 // indirect
github.com/google/licensecheck v0.3.1 // indirect
github.com/google/s2a-go v0.1.9 // indirect
github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
github.com/gordonklaus/ineffassign v0.1.0 // indirect
github.com/gorilla/mux v1.8.1 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
Expand Down Expand Up @@ -420,6 +426,7 @@ require (
golang.org/x/time v0.10.0 // indirect
golang.org/x/tools v0.31.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/api v0.223.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2 // indirect
google.golang.org/grpc/security/advancedtls v1.0.0 // indirect
Expand Down
15 changes: 15 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,13 @@ cel.dev/expr v0.23.1/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
cloud.google.com/go v0.116.0 h1:B3fRrSDkLRt5qSHWe40ERJvhvnQwdZiHu0bJOpldweE=
cloud.google.com/go/auth v0.15.0 h1:Ly0u4aA5vG/fsSsxu98qCQBemXtAtJf+95z9HK+cxps=
cloud.google.com/go/auth v0.15.0/go.mod h1:WJDGqZ1o9E9wKIL+IwStfyn/+s59zl4Bi+1KQNVXLZ8=
cloud.google.com/go/auth/oauth2adapt v0.2.7 h1:/Lc7xODdqcEw8IrZ9SvwnlLX6j9FHQM74z6cBk9Rw6M=
cloud.google.com/go/auth/oauth2adapt v0.2.7/go.mod h1:NTbTTzfvPl1Y3V1nPpOgl2w6d/FjO7NNUQaWSox6ZMc=
cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
Expand Down Expand Up @@ -612,6 +619,8 @@ github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXi
github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg=
github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2 h1:SJ+NtwL6QaZ21U+IrK7d0gGgpjGGvd2kz+FzTHVzdqI=
github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2/go.mod h1:Tv1PlzqC9t8wNnpPdctvtSUOPUUg4SHeE6vR1Ir2hmg=
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
Expand All @@ -620,7 +629,11 @@ github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
github.com/googleapis/gnostic v0.1.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
github.com/googleapis/gnostic v0.3.1/go.mod h1:on+2t9HRStVgn95RSsFWFz+6Q0Snyqv1awfrALZdbtU=
Expand Down Expand Up @@ -1523,6 +1536,8 @@ gomodules.xyz/jsonpatch/v2 v2.0.1/go.mod h1:IhYNNY4jnS53ZnfE4PAmpKtDpTCj1JFXc+3m
gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
google.golang.org/api v0.223.0 h1:JUTaWEriXmEy5AhvdMgksGGPEFsYfUKaPEYXd4c3Wvc=
google.golang.org/api v0.223.0/go.mod h1:C+RS7Z+dDwds2b+zoAk5hN/eSfsiCn0UDrYof/M4d2M=
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
Expand Down
2 changes: 2 additions & 0 deletions manifests/charts/ai-gateway-crds-helm/templates/aigateway.envoyproxy.io_aigatewayroutes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -477,6 +477,8 @@ spec:
- OpenAI
- AWSBedrock
- AzureOpenAI
- GCPGemini
Comment thread
yuzisun marked this conversation as resolved.
Outdated
- GCPAnthropic
type: string
version:
description: Version is the version of the API schema.
Expand Down
2 changes: 2 additions & 0 deletions ...ests/charts/ai-gateway-crds-helm/templates/aigateway.envoyproxy.io_aiservicebackends.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,8 @@ spec:
- OpenAI
- AWSBedrock
- AzureOpenAI
- GCPGemini
Comment thread
yuzisun marked this conversation as resolved.
Outdated
- GCPAnthropic
type: string
version:
description: Version is the version of the API schema.
Expand Down
Loading