Add Agentgateway Azure Backend Auth

[therealmitchconnors]

Description

Azure Auth is implemented in agentgateway protos, but not available via k8s crds with kgateway. This PR adds the fields to use Azure backend auth from k8s. Fixes #13259

Change Type

/kind feature

Changelog

Added support for configuring Agentgateway to use Azure backend auth

Additional Notes

[Copilot]

Pull request overview

This PR adds support for Azure backend authentication to Agentgateway, enabling users to configure Azure authentication methods via Kubernetes CRDs. This complements the existing AWS authentication support and addresses issue #13259.

• Adds AzureAuth and AzureManagedIdentity types to support both managed identity and client secret authentication methods
• Implements buildAzureAuthPolicy and buildAzureClientSecret functions to translate K8s CRD definitions to protobuf API structures
• Updates CRD schemas for both AgentgatewayPolicy and AgentgatewayBackend resources to include Azure authentication fields

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
pkg/kgateway/wellknown/constants.go	Adds constants for Azure authentication secret keys (ClientID, TenantId, ClientSecret)
pkg/agentgateway/plugins/backend_policies.go	Implements Azure authentication translation logic with support for managed identity and client secret
api/v1alpha1/agentgateway/agentgateway_policy_types.go	Defines AzureAuth and AzureManagedIdentity types, adds Azure field to BackendAuth
api/v1alpha1/agentgateway/zz_generated.deepcopy.go	Auto-generated DeepCopy methods for new Azure types
install/helm/agentgateway-crds/templates/agentgateway.dev_agentgatewaypolicies.yaml	Updates CRD schema to include Azure authentication fields and validation rules
install/helm/agentgateway-crds/templates/agentgateway.dev_agentgatewaybackends.yaml	Updates CRD schema to include Azure authentication fields and validation rules
pkg/agentgateway/plugins/testdata/backendpolicy/azureauth.yaml	Adds test case for Azure managed identity authentication

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The test case only covers Azure Managed Identity authentication but does not test the Client Secret authentication path. The buildAzureClientSecret function (lines 706-754 in backend_policies.go) lacks test coverage. Consider adding a test case similar to the AWS auth test that includes a Secret with clientID, tenantID, and clientSecret to ensure this code path is properly validated.

[therealmitchconnors]

@copilot open a new pull request to apply changes based on this feedback

[howardjohn]

overall looks good, had a few questions on slack that will answer some choices though

[howardjohn]

just fyi I am adding GCP auth in #13262 so we will probably merge conflict one way or another

[howardjohn]

This just is basically a flag. there is no config (currently?) for it, you just say you want workload identity

[therealmitchconnors]

So should it be an optional field, with type any? or a bool?

[howardjohn]

depending on some other questions we probably want // +kubebuilder:validation:ExactlyOneOf=secretRef;managedIdentity