bring back bed rock auth #13089

yuval-k · 2025-12-10T21:55:17Z

Description

Add auth for bedrock backend

Change Type

/kind cleanup

Changelog

NONE

Additional Notes

While this looks like a feature is added, this actually just brings back something that was removed in #12830. as that PR didn't made it to a release yet, there shouldn't be a change in the release notes.

Signed-off-by: Yuval Kohavi <[email protected]>

Copilot

Pull request overview

This PR restores AWS Bedrock authentication functionality that was previously removed in PR #12830. The implementation adds authentication support for AWS Bedrock backends in the agent gateway, allowing users to configure either implicit AWS SDK authentication or explicit credentials via Kubernetes secrets.

Key changes:

Added AwsAuth API type with support for secret-based AWS credentials
Implemented buildBedrockAuthPolicy to translate auth configuration into backend policies
Updated test coverage with a new test case for Bedrock with secret reference

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`api/v1alpha1/agentgateway/agentgateway_backend_types.go`	Added `AwsAuth` struct and `Auth` field to `BedrockConfig` for configuring AWS authentication
`pkg/kgateway/agentgatewaysyncer/backend/translate.go`	Implemented `buildBedrockAuthPolicy` function and updated `translateLLMProvider` to handle Bedrock auth for both single and multi-provider configurations
`pkg/kgateway/agentgatewaysyncer/backend/translate_test.go`	Added test case "Bedrock backend with new secret ref" to verify secret-based authentication
`pkg/kgateway/agentgatewaysyncer/backend/testdata/Valid_Bedrock_backend_with_custom_region_and_guardrail.yaml`	Updated test snapshot to include implicit AWS auth policy
`pkg/kgateway/agentgatewaysyncer/backend/testdata/Bedrock_backend_with_new_secret_ref.yaml`	New test snapshot showing explicit AWS credentials from secret
`pkg/kgateway/agentgatewaysyncer/backend/testdata/Bedrock_backend_with_new_route_types_(responses_and_anthropic_token_count).yaml`	Updated test snapshot to include implicit AWS auth policy

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-10T22:05:25Z

pkg/kgateway/agentgatewaysyncer/backend/translate.go

+		Kind: &api.BackendAuthPolicy_Aws{
+			Aws: &api.Aws{
+				Kind: &api.Aws_ExplicitConfig{
+					ExplicitConfig: &api.AwsExplicitConfig{
+						AccessKeyId:     accessKeyId,
+						SecretAccessKey: secretAccessKey,
+						SessionToken:    sessionToken,
+						Region:          region,
+					},
+				},
+			},
+		},
+	}, errors.Join(errs...)
+


The function returns a BackendAuthPolicy even when there are validation errors (errs slice is not empty). This could result in an auth policy being returned with empty accessKeyId or secretAccessKey fields when the corresponding secret values are missing. Consider returning nil for the auth policy when errors are present, or ensure that the error check happens before the policy is used.

pkg/kgateway/agentgatewaysyncer/backend/translate_test.go

api/v1alpha1/agentgateway/agentgateway_backend_types.go

Copilot · 2025-12-10T22:05:26Z

pkg/kgateway/agentgatewaysyncer/backend/translate.go

+		errs = append(errs, errors.New("accessKey is missing or not a valid string"))
+	} else {
+		accessKeyId = value
+	}
+
+	// Extract secret key
+	if value, exists := kubeutils.GetSecretValue(secret, wellknown.SecretKey); !exists {
+		errs = append(errs, errors.New("secretKey is missing or not a valid string"))
+	} else {
+		secretAccessKey = value
+	}
+


The error messages for missing secret keys don't include context about which secret is being accessed. Consider including the secret name and namespace in the error messages to help users identify which secret needs to be fixed. For example: "accessKey is missing in secret test-ns/bedrock-secret".

npolshakova · 2025-12-10T22:21:41Z

api/v1alpha1/agentgateway/agentgateway_backend_types.go

+	// SecretRef references a Kubernetes Secret containing the AWS credentials.
+	// The Secret must have keys "accessKey", "secretKey", and optionally "sessionToken".
+	// +required
+	SecretRef *corev1.LocalObjectReference `json:"secretRef,omitempty"`


If required, let's remove omitempty and change it to corev1.LocalObjectReference

npolshakova · 2025-12-10T22:23:34Z

pkg/kgateway/agentgatewaysyncer/backend/translate_test.go

 			},
 		},
+		{
+			name: "Bedrock backend with new secret ref",


Can we use the new format: https://github.com/kgateway-dev/kgateway/blob/main/pkg/kgateway/agentgatewaysyncer/backend/testdata/Valid_OpenAI_backend_with_inline_auth.yaml

Signed-off-by: Yuval Kohavi <[email protected]>

howardjohn · 2025-12-10T23:56:52Z

api/v1alpha1/agentgateway/agentgateway_backend_types.go

+type AwsAuth struct {
+	// SecretRef references a Kubernetes Secret containing the AWS credentials.
+	// The Secret must have keys "accessKey", "secretKey", and optionally "sessionToken".
+	// +required


Should not be required. If not set, we use the implciit workload identity

nvm, missed the 'if not set, use implicit' at the higher level. But if wer move it, we will need to make it optional

moved it to BackendAuth and made optional. the secret is still required - if in the future we will add more options, we can make it optional then - it is not a breaking change

howardjohn · 2025-12-11T00:02:30Z

api/v1alpha1/agentgateway/agentgateway_backend_types.go

+	// When omitted, we will try to use the default AWS SDK authentication methods.
+	//
+	// +optional
+	Auth *AwsAuth `json:"auth,omitempty"`


hmmm not sure this belongs here vs policies.backend.auth.aws. That would be consistent. On the other hand, this is currently only usable for bedrock. But in the future probably we would support lambda, etc, which would necessitate putting it in a more broad area.

I think for consistency and future proofing we need to move this.

i'll try but it will be slightly annoying to do - as if there is no policy, i'll want to implicitly attach the implicit one inline

nvm - agentgw will default to the implicit one, so doing this is not annoying

there's no region in the policy, so this depends on agentgateway/agentgateway#718 Signed-off-by: Yuval Kohavi <[email protected]>

EItanya · 2025-12-11T13:59:00Z

api/v1alpha1/agentgateway/agentgateway_policy_types.go

+type AwsAuth struct {
+	// SecretRef references a Kubernetes Secret containing the AWS credentials.
+	// The Secret must have keys "accessKey", "secretKey", and optionally "sessionToken".
+	// +required


Are we going to add workload credentials in the future?

you mean from the env of the pod? i think that is already supported - it's the default if you don't specify auth. cc @howardjohn

Signed-off-by: Yuval Kohavi <[email protected]>

yuval-k · 2025-12-11T16:02:21Z

weird flake:


ERROR: failed to build: failed to solve: process "/bin/sh -c apt-get update     && apt-get upgrade -y     && apt-get install --no-install-recommends -y  ca-certificates     && apt-get install wget -y     && rm -rf  /var/log/*log /var/lib/apt/lists/* /var/log/apt/* /var/lib/dpkg/*-old /var/cache/debconf/*-old" did not complete successfully: exit code: 100

note for #12981 maybe we can better cache docker images

Signed-off-by: Yuval Kohavi <[email protected]>

yuval-k · 2025-12-11T20:07:25Z

flakes on docker gateway timeout

Signed-off-by: Yuval Kohavi <[email protected]>

Copilot AI review requested due to automatic review settings December 10, 2025 21:55

gateway-bot added do-not-merge/description-invalid kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. release-note-none labels Dec 10, 2025

Copilot started reviewing on behalf of yuval-k December 10, 2025 21:55 View session

gateway-bot removed the do-not-merge/description-invalid label Dec 10, 2025

bring back bed rock auth

3177084

Signed-off-by: Yuval Kohavi <[email protected]>

yuval-k force-pushed the yuval-k/bedrock-auth branch from ccb0a61 to 3177084 Compare December 10, 2025 22:01

Copilot AI reviewed Dec 10, 2025

View reviewed changes

npolshakova reviewed Dec 10, 2025

View reviewed changes

yuval-k added 2 commits December 10, 2025 17:29

more yaml tests

804d8c2

Signed-off-by: Yuval Kohavi <[email protected]>

PR comments

8e61c84

Signed-off-by: Yuval Kohavi <[email protected]>

yuval-k enabled auto-merge December 10, 2025 23:29

npolshakova approved these changes Dec 10, 2025

View reviewed changes

yuval-k added this pull request to the merge queue Dec 10, 2025

yuval-k removed this pull request from the merge queue due to a manual request Dec 10, 2025

yuval-k added this pull request to the merge queue Dec 10, 2025

yuval-k removed this pull request from the merge queue due to a manual request Dec 10, 2025

move auth to the provider

7af67c2

Signed-off-by: Yuval Kohavi <[email protected]>

yuval-k enabled auto-merge December 11, 2025 00:02

howardjohn reviewed Dec 11, 2025

View reviewed changes

move aws to policy.

bcab27c

there's no region in the policy, so this depends on agentgateway/agentgateway#718 Signed-off-by: Yuval Kohavi <[email protected]>

EItanya reviewed Dec 11, 2025

View reviewed changes

cleanup

91bc916

Signed-off-by: Yuval Kohavi <[email protected]>

yuval-k disabled auto-merge December 11, 2025 15:31

Merge remote-tracking branch 'origin/main' into yuval-k/bedrock-auth

065d8d8

Signed-off-by: Yuval Kohavi <[email protected]>

yuval-k force-pushed the yuval-k/bedrock-auth branch from 50fb348 to 065d8d8 Compare December 11, 2025 15:55

yuval-k enabled auto-merge December 11, 2025 16:03

howardjohn approved these changes Dec 11, 2025

View reviewed changes

yuval-k added this pull request to the merge queue Dec 11, 2025

github-merge-queue bot removed this pull request from the merge queue due to failed status checks Dec 11, 2025

yuval-k added 3 commits December 11, 2025 13:21

bump agentgw

ba9cf57

Signed-off-by: Yuval Kohavi <[email protected]>

fix build

d44b375

Signed-off-by: Yuval Kohavi <[email protected]>

make verify

3b733f1

Signed-off-by: Yuval Kohavi <[email protected]>

yuval-k enabled auto-merge December 11, 2025 19:03

yuval-k added 3 commits December 11, 2025 14:32

fix yaml

ec09ef7

Signed-off-by: Yuval Kohavi <[email protected]>

Merge remote-tracking branch 'origin/main' into yuval-k/bedrock-auth

3835d2a

Signed-off-by: Yuval Kohavi <[email protected]>

fix yaml after merge

ee88619

Signed-off-by: Yuval Kohavi <[email protected]>

more yamls

90f4e71

Signed-off-by: Yuval Kohavi <[email protected]>

npolshakova approved these changes Dec 11, 2025

View reviewed changes

yuval-k added this pull request to the merge queue Dec 11, 2025

npolshakova mentioned this pull request Dec 11, 2025

Enhancing agw backend status support and testing #13073

Open

Merged via the queue into main with commit c90bbb1 Dec 11, 2025
29 checks passed

yuval-k deleted the yuval-k/bedrock-auth branch December 11, 2025 21:02

bring back bed rock auth #13089

bring back bed rock auth #13089

Uh oh!

Conversation

yuval-k commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change Type

Changelog

Additional Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yuval-k Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yuval-k commented Dec 11, 2025

Uh oh!

Uh oh!

yuval-k commented Dec 11, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

yuval-k commented Dec 10, 2025 •

edited

Loading

yuval-k Dec 11, 2025 •

edited

Loading