For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Authenticate to Google Cloud Platform (GCP) backends from the gateway using GCP authentication.

Configure authentication for backends in Google Cloud Platform (GCP) with an AgentgatewayPolicy.

By default, the proxy uses ambient credentials from the cluster provider environment, such as Workload Identity on GKE, or the GOOGLE_APPLICATION_CREDENTIALS environment variable set to a service account key file. To use token-based credentials, apply an AgentgatewayPolicy with GCP auth to your backend.

Before you begin

1. Set up an agentgateway proxy.
2. Install the httpbin sample app.

Configure GCP backend authentication

Create an AgentgatewayPolicy that uses GCP authentication to sign requests to your backend.

For access token authentication (used for most GCP services):

kubectl apply -f- <<EOF
apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayPolicy
metadata:
  name: gcp-backend-auth
  namespace: agentgateway-system
spec:
  targetRefs:
    - group: agentgateway.dev
      kind: AgentgatewayBackend
      name: my-gcp-backend
  backend:
    auth:
      gcp:
        type: AccessToken
EOF

For ID token authentication (used for Cloud Run and other audience-based services):

kubectl apply -f- <<EOF
apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayPolicy
metadata:
  name: gcp-backend-auth
  namespace: agentgateway-system
spec:
  targetRefs:
    - group: agentgateway.dev
      kind: AgentgatewayBackend
      name: my-gcp-backend
  backend:
    auth:
      gcp:
        type: IdToken
        audience: "https://my-cloudrun-service-xyz.run.app"
EOF

To use a service account key instead of ambient credentials, set backend.auth.gcp.secretRef to a Secret key that contains the Google credential JSON. If the JSON is malformed or incomplete, the controller accepts the policy with a non-fatal warning. The policy status can still report Valid. Requests to the backend that uses the invalid credential fail closed with backend authentication failed: GCP credential configuration is invalid. Routes to other backends keep serving, and warning and response messages do not include values from the credential JSON.

Cleanup

kubectl delete AgentgatewayPolicy gcp-backend-auth -n agentgateway-system