feat: add GCP Authentication Support by sukumargaonkar · Pull Request #752 · envoyproxy/ai-gateway

sukumargaonkar · 2025-06-23T16:00:46Z

Description

Implement GCP integration via OIDC token rotator.
This PR add support for authenticating against GCP via external OIDC tokens. It uses google's Workload Identity Federation [1] to exchange an OIDC token for GCP's access token. It also support optional service account impersonation.
Add ProjectName and Region field in BackendSecurityPolicyGCPCredentials

1: https://cloud.google.com/iam/docs/workload-identity-federation

Related Issues/PRs (if applicable)
Previous PR: #635
Related Issue: #609

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

filterapi/filterconfig.go

internal/extproc/chatcompletion_processor.go

internal/extproc/translator/openai_gcpgemini.go

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

sukumargaonkar · 2025-06-27T18:00:21Z

The current CI failure is related to test-coverage in internal/testing package, which can be ignored for now

Package coverage threshold (81%) satisfied:	FAIL
  below threshold:				coverage:	threshold:
  internal/testing				74.5% (41/55)	81%

internal/controller/backend_security_policy.go

internal/controller/gateway.go

internal/extproc/translator/gemini_helper.go

internal/extproc/translator/openai_gcpanthropic_test.go

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

internal/apischema/gcp/gcp.go

internal/controller/backend_security_policy.go

internal/controller/rotators/gcp_oidc_token_rotator.go

internal/extproc/backendauth/gcp.go

internal/extproc/translator/gemini_helper.go

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net> # Conflicts: # api/v1alpha1/api.go # go.sum

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

mathetake · 2025-07-02T16:04:43Z

internal/extproc/translator/gemini_helper.go

+	GCPModelPublisherGoogle    = "google"
+	GCPModelPublisherAnthropic = "anthropic"
+	GCPMethodGenerateContent   = "generateContent"
+	HTTPHeaderKeyContentLength = "Content-Length"


can you unexport them

mathetake · 2025-07-02T16:05:49Z

internal/controller/backend_security_policy.go

 	}
 }
+
+func validateGCPCredentialsParams(gcpCreds *aigv1a1.BackendSecurityPolicyGCPCredentials) error {


shouldn't all of this condition be part of k8s CEL validation? (If so, it's redundant)

mathetake · 2025-07-02T16:07:47Z

internal/controller/rotators/gcp_oidc_token_rotator.go

+
+// serviceAccountTokenGenerator defines a function type for generating a GCP service account access token
+// using an STS token and impersonation configuration.
+type serviceAccountTokenGenerator func(


this needs a gcp prefix in the struct name

mathetake · 2025-07-02T16:08:30Z

internal/controller/rotators/gcp_oidc_token_rotator.go

+	// tokenTypeJWT indicates the subject token type is a JWT.
+	tokenTypeJWT = "urn:ietf:params:oauth:token-type:jwt" //nolint:gosec
+	// stsTokenScope is the OAuth scope for GCP cloud platform operations.
+	stsTokenScope = "https://www.googleapis.com/auth/cloud-platform" //nolint:gosec


gcp prefix is needed here as well

mathetake · 2025-07-02T16:08:41Z

internal/controller/rotators/gcp_oidc_token_rotator.go

+
+// stsTokenGenerator defines a function type for exchanging a JWT token for a GCP STS token
+// using Workload Identity Federation configuration.
+type stsTokenGenerator func(


can you also add gcp prefix here

mathetake · 2025-07-02T16:12:05Z

internal/extproc/backendauth/gcp.go

+			if len(hdr.Header.Value) > 0 {
+				suffixPath := hdr.Header.Value
+				hdr.Header.Value = fmt.Sprintf("%s/%s", prefixPath, suffixPath)
+			}


i don't think you need this in practice. (Envoy's API naming is really bad here, but) we should stick to .RawValue for setting headers. (.Value is for formatter) https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/base.proto#config-core-v3-headervalue

yuzisun · 2025-07-02T16:37:40Z

@sukumargaonkar can you take a look at @mathetake’s comments and address in the follow up PR?

mathetake · 2025-07-04T04:11:03Z

@sukumargaonkar also could you add more unit test around here?

**Description** GCP global region endpoint is different from regional endpoint. Current PR is to handle GCP global region to avoid segfault. Related PR: #752 --------- Signed-off-by: Xiaolin Lin <xlin158@bloomberg.net> Signed-off-by: Dan Sun <dsun20@bloomberg.net> Co-authored-by: Dan Sun <dsun20@bloomberg.net>

**Description** GCP global region endpoint is different from regional endpoint. Current PR is to handle GCP global region to avoid segfault. Related PR: envoyproxy#752 --------- Signed-off-by: Xiaolin Lin <xlin158@bloomberg.net> Signed-off-by: Dan Sun <dsun20@bloomberg.net> Co-authored-by: Dan Sun <dsun20@bloomberg.net> Signed-off-by: yxia216 <yxia216@bloomberg.net>

**Description** GCP global region endpoint is different from regional endpoint. Current PR is to handle GCP global region to avoid segfault. Related PR: envoyproxy#752 --------- Signed-off-by: Xiaolin Lin <xlin158@bloomberg.net> Signed-off-by: Dan Sun <dsun20@bloomberg.net> Co-authored-by: Dan Sun <dsun20@bloomberg.net> Signed-off-by: Erica Hughberg <erica.sundberg.90@gmail.com>

**Description** GCP global region endpoint is different from regional endpoint. Current PR is to handle GCP global region to avoid segfault. Related PR: envoyproxy#752 --------- Signed-off-by: Xiaolin Lin <xlin158@bloomberg.net> Signed-off-by: Dan Sun <dsun20@bloomberg.net> Co-authored-by: Dan Sun <dsun20@bloomberg.net>

api: implement GCP OIDC token rotator for Workload Identity Federation

58a0187

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

sukumargaonkar changed the title ~~feat: implement GCP OIDC token rotator for Workload Identity Federation~~ feat: Add GCP Authentication Support Jun 23, 2025

sukumargaonkar mentioned this pull request Jun 23, 2025

Support GCP models #609

Closed

update gcp-url generation and add tests

a89edc2

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

sukumargaonkar changed the title ~~feat: Add GCP Authentication Support~~ feat: add GCP Authentication Support Jun 25, 2025

sukumargaonkar added 4 commits June 25, 2025 19:49

test: add unit test for NewAzureTokenRotator implementation

ac7a21d

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

test: improve test coverage

289a82f

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Fix lint

12f0ac2

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

test: add error handling tests for GCP OIDC token rotator

7a1f61e

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

yuzisun reviewed Jun 27, 2025

View reviewed changes

filterapi/filterconfig.go Outdated Show resolved Hide resolved

yuzisun reviewed Jun 27, 2025

View reviewed changes

internal/extproc/chatcompletion_processor.go Outdated Show resolved Hide resolved

yuzisun reviewed Jun 27, 2025

View reviewed changes

internal/extproc/translator/openai_gcpgemini.go Show resolved Hide resolved

yuzisun reviewed Jun 27, 2025

View reviewed changes

internal/extproc/translator/openai_gcpgemini.go Outdated Show resolved Hide resolved

test: add error handling tests for GatewayController methods

920fb33

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

sukumargaonkar marked this pull request as ready for review June 27, 2025 17:59

sukumargaonkar requested a review from a team as a code owner June 27, 2025 17:59

mathetake requested a review from aabchoo June 27, 2025 18:01

alexagriffith reviewed Jun 27, 2025

View reviewed changes

internal/controller/backend_security_policy.go Show resolved Hide resolved

alexagriffith reviewed Jun 27, 2025

View reviewed changes

internal/controller/gateway.go Show resolved Hide resolved

alexagriffith reviewed Jun 27, 2025

View reviewed changes

internal/extproc/translator/gemini_helper.go Show resolved Hide resolved

alexagriffith reviewed Jun 27, 2025

View reviewed changes

internal/extproc/translator/gemini_helper.go Outdated Show resolved Hide resolved

alexagriffith reviewed Jun 27, 2025

View reviewed changes

internal/extproc/translator/openai_gcpanthropic_test.go Show resolved Hide resolved

sukumargaonkar added 2 commits June 27, 2025 16:38

rename GCPGemini to GCPVertexAI and address PR comments

a7dcb4d

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Merge remote-tracking branch 'upstream/main' into gcp-auth-implementaion

330cf44

yuzisun reviewed Jun 28, 2025

View reviewed changes

internal/apischema/gcp/gcp.go Show resolved Hide resolved

aabchoo reviewed Jun 30, 2025

View reviewed changes

sukumargaonkar added 3 commits July 1, 2025 18:10

add proxy support for gcp auth

4722692

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

Merge remote-tracking branch 'upstream/main' into gcp-auth-implementaion

65e2230

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net> # Conflicts: # api/v1alpha1/api.go # go.sum

docs: enhance comments for GenerateContentRequest fields in gcp.go

4473a55

Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net>

yuzisun approved these changes Jul 2, 2025

View reviewed changes

yuzisun merged commit 10bf331 into envoyproxy:main Jul 2, 2025
24 checks passed

mathetake reviewed Jul 2, 2025

View reviewed changes

This was referenced Jul 4, 2025

feat: implement GCP Gemini request and response translation #819

Merged

test: increase the GCP credential coverage #858

Merged

xiaolin593 mentioned this pull request Nov 4, 2025

fix: handle GCP global region #1480

Merged

Conversation

sukumargaonkar commented Jun 23, 2025 • edited by mathetake Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sukumargaonkar commented Jun 27, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mathetake Jul 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mathetake Jul 2, 2025

Choose a reason for hiding this comment

Uh oh!

mathetake Jul 2, 2025

Choose a reason for hiding this comment

Uh oh!

mathetake Jul 2, 2025

Choose a reason for hiding this comment

Uh oh!

mathetake Jul 2, 2025

Choose a reason for hiding this comment

Uh oh!

mathetake Jul 2, 2025

Choose a reason for hiding this comment

Uh oh!

yuzisun commented Jul 2, 2025

Uh oh!

mathetake commented Jul 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sukumargaonkar commented Jun 23, 2025 •

edited by mathetake

Loading

mathetake Jul 2, 2025 •

edited

Loading