docs: add AIGatewayRoute security policy proposal - #2702
Open
fernandoescolar wants to merge 12 commits into
Open
fernandoescolar wants to merge 12 commits into
fernandoescolar wants to merge 12 commits into
Conversation
Signed-off-by: Fernando Escolar <fernando.escolar@digits.schwarz>
✅ Deploy Preview for theagentrouter canceled.
|
missBerg
added
design
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This commit adds a technical proposal for centralizing client-facing security configuration in AIGatewayRoute.
The proposal describes how the controller could generate and manage an Envoy Gateway SecurityPolicy targeting the HTTPRoute generated for each AIGatewayRoute. It covers JWT authentication, API key authentication, external authorization through Envoy ext_authz, JWT claim propagation, policy merging, resource ownership, reconciliation, cleanup, and conflict handling.
The proposal also defines the initial API and compatibility decisions for v1alpha1 and v1beta1. Model-aware authorization based on the model extracted from the request body is explicitly kept out of scope because it would require a broader data-plane and identity-propagation design.
Related Issues/PRs (if applicable)
N/A
Special notes for reviewers (if applicable)
This PR only adds documentation and does not implement the proposed API or controller changes.
The main goal is to gather feedback on the route-level SecurityPolicy design before implementation.