agentgateway: Azure OpenAI support

api/v1alpha1/ai_backend.go

@@ -21,23 +21,23 @@ type AIBackend struct {
 	// ```yaml
 	// priorityGroups:
 	//	- providers:
-	//	  - azureOpenai:
+	//	  - azureopenai:
 	//	      deploymentName: gpt-4o-mini
 	//	      apiVersion: 2024-02-15-preview
 	//	      endpoint: ai-gateway.openai.azure.com
 	//	      authToken:
+	//          kind: "SecretRef"
 	//	        secretRef:
 	//	          name: azure-secret
-	//	          namespace: kgateway-system
 	//	- providers:
-	//	  - azureOpenai:
+	//	  - azureopenai:
 	//	      deploymentName: gpt-4o-mini-2
 	//	      apiVersion: 2024-02-15-preview
 	//	      endpoint: ai-gateway-2.openai.azure.com
 	//	      authToken:
+	//          kind: "SecretRef"
 	//	        secretRef:
 	//	          name: azure-secret-2
-	//	          namespace: kgateway-system
 	// ```
 	// +optional
 	// +kubebuilder:validation:MinItems=1

go.mod

@@ -658,3 +658,5 @@ tool (
 	sigs.k8s.io/controller-tools/cmd/controller-gen
 	sigs.k8s.io/kind
 )
+
+replace github.com/agentgateway/agentgateway => github.com/jenshu/agentgateway v0.9.1-0.20251106001326-e9523b28ae9d

go.sum

@@ -194,8 +194,6 @@ github.com/ProtonMail/gopenpgp/v2 v2.7.1 h1:Awsg7MPc2gD3I7IFac2qE3Gdls0lZW8SzrFZ
 github.com/ProtonMail/gopenpgp/v2 v2.7.1/go.mod h1:/BU5gfAVwqyd8EfC3Eu7zmuhwYQpKs+cGD8M//iiaxs=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
-github.com/agentgateway/agentgateway v0.10.6-0.20251103234311-2f71d0e845d0 h1:lpvgT5mTE4yYESVIfJYw/3PcqnfqBgYgl+gwgiUd4Dk=
-github.com/agentgateway/agentgateway v0.10.6-0.20251103234311-2f71d0e845d0/go.mod h1:/Lzpteag/nnE4bwW/3Dh5GaxuICmCQs40VhQpkTatlk=
 github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
 github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
 github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7/go.mod h1:6zEj6s6u/ghQa61ZWa/C2Aw3RkjiTBOix7dkqa1VLIs=
@@ -1037,6 +1035,8 @@ github.com/jedisct1/go-minisign v0.0.0-20241212093149-d2f9f49435c7 h1:FWpSWRD8Fb
 github.com/jedisct1/go-minisign v0.0.0-20241212093149-d2f9f49435c7/go.mod h1:BMxO138bOokdgt4UaxZiEfypcSHX0t6SIFimVP1oRfk=
 github.com/jellydator/ttlcache/v3 v3.3.0 h1:BdoC9cE81qXfrxeb9eoJi9dWrdhSuwXMAnHTbnBm4Wc=
 github.com/jellydator/ttlcache/v3 v3.3.0/go.mod h1:bj2/e0l4jRnQdrnSTaGTsh4GSXvMjQcy41i7th0GVGw=
+github.com/jenshu/agentgateway v0.9.1-0.20251106001326-e9523b28ae9d h1:pp7CFr9yFiBM4tCxZFO2aPJIUbMhO5o34nQtdPFdUoo=
+github.com/jenshu/agentgateway v0.9.1-0.20251106001326-e9523b28ae9d/go.mod h1:/Lzpteag/nnE4bwW/3Dh5GaxuICmCQs40VhQpkTatlk=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jgautheron/goconst v1.8.2 h1:y0XF7X8CikZ93fSNT6WBTb/NElBu9IjaY7CCYQrCMX4=
 github.com/jgautheron/goconst v1.8.2/go.mod h1:A0oxgBCHy55NQn6sYpO7UdnA9p+h7cPtoOZUmvNIako=

hack/utils/oss_compliance/osa_provided.md

@@ -1,7 +1,7 @@
 Name|Version|License
 ---|---|---
 [cel.dev/expr](https://cel.dev/expr)|v0.24.0|Apache License 2.0
-[agentgateway/agentgateway](https://github.com/agentgateway/agentgateway)|v0.10.6-0.20251103234311-2f71d0e845d0|Apache License 2.0
+[agentgateway/agentgateway](https://github.com/agentgateway/agentgateway)|v0.9.1-0.20251106001326-e9523b28ae9d|Apache License 2.0
 [anthropics/anthropic-sdk-go](https://github.com/anthropics/anthropic-sdk-go)|v1.13.0|MIT License
 [retry-go/v4](https://github.com/avast/retry-go)|v4.3.3|MIT License
 [xds/go](https://github.com/cncf/xds)|v0.0.0-20250501225837-2ac532fd4443|Apache License 2.0

install/helm/kgateway-crds/templates/gateway.kgateway.dev_backends.yaml

@@ -572,14 +572,14 @@ spec:
                       groups. Backend policies\nmay target a specific provider by
                       name using targetRefs[].sectionName.\n\nExample configuration
                       with two priority groups:\n```yaml\npriorityGroups:\n\t- providers:\n\t
-                      \ - azureOpenai:\n\t      deploymentName: gpt-4o-mini\n\t      apiVersion:
+                      \ - azureopenai:\n\t      deploymentName: gpt-4o-mini\n\t      apiVersion:
                       2024-02-15-preview\n\t      endpoint: ai-gateway.openai.azure.com\n\t
-                      \     authToken:\n\t        secretRef:\n\t          name: azure-secret\n\t
-                      \         namespace: kgateway-system\n\t- providers:\n\t  -
-                      azureOpenai:\n\t      deploymentName: gpt-4o-mini-2\n\t      apiVersion:
-                      2024-02-15-preview\n\t      endpoint: ai-gateway-2.openai.azure.com\n\t
-                      \     authToken:\n\t        secretRef:\n\t          name: azure-secret-2\n\t
-                      \         namespace: kgateway-system\n```"
+                      \     authToken:\n         kind: \"SecretRef\"\n\t        secretRef:\n\t
+                      \         name: azure-secret\n\t- providers:\n\t  - azureopenai:\n\t
+                      \     deploymentName: gpt-4o-mini-2\n\t      apiVersion: 2024-02-15-preview\n\t
+                      \     endpoint: ai-gateway-2.openai.azure.com\n\t      authToken:\n
+                      \        kind: \"SecretRef\"\n\t        secretRef:\n\t          name:
+                      azure-secret-2\n```"
                     items:
                       description: |-
                         MultiPoolConfig configures the backends for multiple hosts or models from the same provider in one Backend resource.

internal/kgateway/agentgatewaysyncer/backend/translate.go

@@ -151,8 +151,12 @@ func translateLLMProviderToProvider(krtctx krt.HandlerContext, llm *v1alpha1.LLM
 		}
 		auth = buildTranslatedAuthPolicy(krtctx, &llm.OpenAI.AuthToken, secrets, namespace)
 	} else if llm.AzureOpenAI != nil {
-		provider.Provider = &api.AIBackend_Provider_Openai{
-			Openai: &api.AIBackend_OpenAI{},
+		provider.Provider = &api.AIBackend_Provider_Azureopenai{
+			Azureopenai: &api.AIBackend_AzureOpenAI{
+				Host:       llm.AzureOpenAI.Endpoint,
+				Model:      &wrappers.StringValue{Value: llm.AzureOpenAI.DeploymentName},
+				ApiVersion: llm.AzureOpenAI.ApiVersion,
+			},
 		}
 		auth = buildTranslatedAuthPolicy(krtctx, &llm.AzureOpenAI.AuthToken, secrets, namespace)
 	} else if llm.Anthropic != nil {

internal/kgateway/agentgatewaysyncer/backend/translate_test.go

@@ -301,6 +301,45 @@ func TestBuildAIBackendIr(t *testing.T) {
 					aiIr.Backend.GetAi().ProviderGroups[0].Providers[0].GetOpenai().Model.Value == "gpt-4"
 			},
 		},
+		{
+			name: "Valid Azure OpenAI backend",
+			backend: &v1alpha1.Backend{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "azure-openai-backend",
+					Namespace: "test-ns",
+				},
+				Spec: v1alpha1.BackendSpec{
+					Type: v1alpha1.BackendTypeAI,
+					AI: &v1alpha1.AIBackend{
+						LLM: &v1alpha1.LLMProvider{
+							AzureOpenAI: &v1alpha1.AzureOpenAIConfig{
+								AuthToken: v1alpha1.SingleAuthToken{
+									Kind: v1alpha1.Passthrough,
+								},
+								Endpoint:       "endpoint-123.openai.azure.com",
+								DeploymentName: "my-deployment",
+								ApiVersion:     "2024-02-15-preview",
+							},
+						},
+					},
+				},
+			},
+			secrets:     nil,
+			expectError: false,
+			validate: func(aiIr *AIIr) bool {
+				return aiIr != nil &&
+					aiIr.Backend != nil &&
+					aiIr.Backend.Name == "test-ns/azure-openai-backend" &&
+					aiIr.Backend.GetAi() != nil &&
+					len(aiIr.Backend.GetAi().ProviderGroups) == 1 &&
+					len(aiIr.Backend.GetAi().ProviderGroups[0].Providers) == 1 &&
+					aiIr.Backend.GetAi().ProviderGroups[0].Providers[0].GetAzureopenai() != nil &&
+					aiIr.Backend.GetAi().ProviderGroups[0].Providers[0].GetAzureopenai().Model != nil &&
+					aiIr.Backend.GetAi().ProviderGroups[0].Providers[0].GetAzureopenai().Model.Value == "my-deployment" &&
+					aiIr.Backend.GetAi().ProviderGroups[0].Providers[0].GetAzureopenai().Host == "endpoint-123.openai.azure.com" &&
+					aiIr.Backend.GetAi().ProviderGroups[0].Providers[0].GetAzureopenai().ApiVersion == "2024-02-15-preview"
+			},
+		},
 		{
 			name: "Valid Anthropic backend with model",
 			backend: &v1alpha1.Backend{

internal/kgateway/agentgatewaysyncer/testdata/inputs/backend/multipool-priority-levels.yaml

@@ -49,6 +49,15 @@ spec:
           authToken:
             kind: "Inline"
             inline: "sk-anthropic-primary"
+      - name: azureopenai
+        azureopenai:
+          endpoint: ai-gateway.openai.azure.com
+          deploymentName: gpt-4o-mini
+          apiVersion: 2024-02-15-preview
+          authToken:
+            kind: "SecretRef"
+            secretRef:
+              name: azure-secret
     # Priority 1 - Secondary fallback providers
     - providers:
       - name: gemini
@@ -89,6 +98,14 @@ data:
 ---
 apiVersion: v1
 kind: Secret
+metadata:
+  name: azure-secret
+type: Opaque
+data:
+  Authorization: QmVhcmVyIGF6dXJlLWFwaS1rZXkK # Bearer azure-api-key
+---
+apiVersion: v1
+kind: Secret
 metadata:
   name: gemini-fallback-secret
 type: Opaque

internal/kgateway/agentgatewaysyncer/testdata/outputs/backend/multipool-priority-levels.yaml

@@ -8,6 +8,11 @@ Backends:
       - anthropic:
           model: claude-3-opus-20240229
         name: anthropic
+      - azureopenai:
+          apiVersion: 2024-02-15-preview
+          host: ai-gateway.openai.azure.com
+          model: gpt-4o-mini
+        name: azureopenai
     - providers:
       - gemini:
           model: gemini-1.5-flash
@@ -40,6 +45,13 @@ Policies:
   name: auth-default/multipool-priority-anthropic
   target:
     subBackend: default/multipool-priority/anthropic
+- backend:
+    auth:
+      key:
+        secret: azure-api-key
+  name: auth-default/multipool-priority-azureopenai
+  target:
+    subBackend: default/multipool-priority/azureopenai
 - backend:
     auth:
       aws: