Skip to content

bring back bed rock auth #13089

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yuval-k merged 14 commits into from
Dec 11, 2025
Merged

bring back bed rock auth #13089

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
3177084
bring back bed rock auth
yuval-k Dec 10, 2025
804d8c2
more yaml tests
yuval-k Dec 10, 2025
8e61c84
PR comments
yuval-k Dec 10, 2025
7af67c2
move auth to the provider
yuval-k Dec 11, 2025
bcab27c
move aws to policy.
yuval-k Dec 11, 2025
91bc916
cleanup
yuval-k Dec 11, 2025
065d8d8
Merge remote-tracking branch 'origin/main' into yuval-k/bedrock-auth
yuval-k Dec 11, 2025
ba9cf57
bump agentgw
yuval-k Dec 11, 2025
d44b375
fix build
yuval-k Dec 11, 2025
3b733f1
make verify
yuval-k Dec 11, 2025
ec09ef7
fix yaml
yuval-k Dec 11, 2025
3835d2a
Merge remote-tracking branch 'origin/main' into yuval-k/bedrock-auth
yuval-k Dec 11, 2025
ee88619
fix yaml after merge
yuval-k Dec 11, 2025
90f4e71
more yamls
yuval-k Dec 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions api/v1alpha1/agentgateway/agentgateway_policy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -707,7 +707,7 @@ const (
HostnameRewriteModeNone HostnameRewriteMode = "None"
)

// +kubebuilder:validation:ExactlyOneOf=key;secretRef;passthrough
// +kubebuilder:validation:ExactlyOneOf=key;secretRef;passthrough;aws
type BackendAuth struct {
// key provides an inline key to use as the value of the Authorization header.
// This option is the least secure; usage of a Secret is preferred.
Expand All @@ -726,7 +726,21 @@ type BackendAuth struct {
// request, the original token would be unchanged, so this would have no effect.
// +optional
Passthrough *BackendAuthPassthrough `json:"passthrough,omitempty"`
// TODO: aws, azure, gcp
// TODO: azure, gcp

// Auth specifies an explicit AWS authentication method for the backend.
// When omitted, we will try to use the default AWS SDK authentication methods.
//
// +optional
AWS *AwsAuth `json:"aws,omitempty"`
}

// AwsAuth specifies the authentication method to use for the backend.
type AwsAuth struct {
// SecretRef references a Kubernetes Secret containing the AWS credentials.
// The Secret must have keys "accessKey", "secretKey", and optionally "sessionToken".
// +required
Copy link
Contributor

@EItanya EItanya Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we going to add workload credentials in the future?

Copy link
Contributor Author

@yuval-k yuval-k Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you mean from the env of the pod? i think that is already supported - it's the default if you don't specify auth. cc @howardjohn

SecretRef corev1.LocalObjectReference `json:"secretRef"`
}

type BackendAuthPassthrough struct {
Expand Down
21 changes: 21 additions & 0 deletions api/v1alpha1/agentgateway/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ go 1.25.3

require (
// Also update AgentgatewayDefaultTag in pkg/deployer/wellknown.go and test/deployer/testdata/*
github.com/agentgateway/agentgateway v0.10.6-0.20251203184148-f45f1a94cdfa
github.com/agentgateway/agentgateway v0.10.6-0.20251211180119-76b0afc55496
github.com/avast/retry-go/v4 v4.3.3
github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e
github.com/envoyproxy/go-control-plane v0.14.0
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,8 +196,8 @@ github.com/PuerkitoBio/goquery v1.10.1 h1:Y8JGYUkXWTGRB6Ars3+j3kN0xg1YqqlwvdTV8W
github.com/PuerkitoBio/goquery v1.10.1/go.mod h1:IYiHrOMps66ag56LEH7QYDDupKXyo5A8qrjIx3ZtujY=
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
github.com/agentgateway/agentgateway v0.10.6-0.20251203184148-f45f1a94cdfa h1:PWDaZIBsPpGIo/3PdYRRIrU5kCKC86nkkEZLqTDi5rI=
github.com/agentgateway/agentgateway v0.10.6-0.20251203184148-f45f1a94cdfa/go.mod h1:/Lzpteag/nnE4bwW/3Dh5GaxuICmCQs40VhQpkTatlk=
github.com/agentgateway/agentgateway v0.10.6-0.20251211180119-76b0afc55496 h1:A7qJ8Ac6vMHDSqcFDpk/IBfZPjxbH44/78dtsodxiEk=
github.com/agentgateway/agentgateway v0.10.6-0.20251211180119-76b0afc55496/go.mod h1:/Lzpteag/nnE4bwW/3Dh5GaxuICmCQs40VhQpkTatlk=
github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7/go.mod h1:6zEj6s6u/ghQa61ZWa/C2Aw3RkjiTBOix7dkqa1VLIs=
Expand Down
2 changes: 1 addition & 1 deletion hack/utils/oss_compliance/osa_provided.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ Name|Version|License
[cel.dev/expr](https://cel.dev/expr)|v0.24.0|Apache License 2.0
[semver/v3](https://github.com/Masterminds/semver)|v3.4.0|MIT License
[PuerkitoBio/goquery](https://github.com/PuerkitoBio/goquery)|v1.10.1|BSD 3-clause "New" or "Revised" License
[agentgateway/agentgateway](https://github.com/agentgateway/agentgateway)|v0.10.6-0.20251203184148-f45f1a94cdfa|Apache License 2.0
[agentgateway/agentgateway](https://github.com/agentgateway/agentgateway)|v0.10.6-0.20251211180119-76b0afc55496|Apache License 2.0
[anthropics/anthropic-sdk-go](https://github.com/anthropics/anthropic-sdk-go)|v1.13.0|MIT License
[retry-go/v4](https://github.com/avast/retry-go)|v4.3.3|MIT License
[xds/go](https://github.com/cncf/xds)|v0.0.0-20251110193048-8bfbf64dc13e|Apache License 2.0
Expand Down
Loading