For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

GCP backend authentication

Authenticate to Google Cloud Platform (GCP) backends from the gateway using GCP authentication.

Configure authentication for backends in Google Cloud Platform (GCP) with an AgentgatewayPolicy.

By default, the proxy uses ambient credentials from the cluster provider environment, such as Workload Identity on GKE, or the GOOGLE_APPLICATION_CREDENTIALS environment variable set to a service account key file. To use token-based credentials, apply an AgentgatewayPolicy with GCP auth to your backend.

Before you begin

Before you begin

1. Set up an agentgateway proxy.
2. Install the httpbin sample app.

Configure GCP backend authentication

Create an AgentgatewayPolicy that uses GCP authentication to sign requests to your backend.

For access token authentication (used for most GCP services):

kubectl apply -f- <<EOF
apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayPolicy
metadata:
  name: gcp-backend-auth
  namespace: agentgateway-system
spec:
  targetRefs:
    - group: agentgateway.dev
      kind: AgentgatewayBackend
      name: my-gcp-backend
  backend:
    auth:
      gcp:
        type: AccessToken
EOF

For ID token authentication (used for Cloud Run and other audience-based services):

kubectl apply -f- <<EOF
apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayPolicy
metadata:
  name: gcp-backend-auth
  namespace: agentgateway-system
spec:
  targetRefs:
    - group: agentgateway.dev
      kind: AgentgatewayBackend
      name: my-gcp-backend
  backend:
    auth:
      gcp:
        type: IdToken
        audience: "https://my-cloudrun-service-xyz.run.app"
EOF

Cleanup

kubectl delete AgentgatewayPolicy gcp-backend-auth -n agentgateway-system