Support for managed identity for Azure OpenAI and AKS clusters

[ehrnst]

Description:

Is there a plan to support managed identity when authenticating against Azure OpenAI. This will be a great addition to clusters already running on AKS to use Entra Workload Identity instead of key.
If the gateway pods can already be assigned an identity, maybe this could be configurable here https://github.com/envoyproxy/ai-gateway/blob/main/examples/basic/azure_openai.yaml

[optional Relevant Links:]

https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview?WT.mc_id=%3Fwt.mc_id%3DAZ-MVP-5003437

[mathetake]

This sounds like a good addition here, though I have zero knowledge on Azure auth

ai-gateway/api/v1alpha1/backendsecurity_policy.go

Line 212 in 1ad38b2

type BackendSecurityPolicyAzureCredentials struct {

cc @xiaolin593 @aabchoo

[ehrnst]

Wow quick reply!
I am no developer but I assume this will need to leverage azure identity package in Go
https://learn.microsoft.com/en-us/azure/developer/go/sdk/authentication/authentication-overview

The way I foresee this work is that when configuring the provider. We could set a flag, but it will require to add annotations etc to the pods as well to assign the spn to envoy. But the latter is “basic” for Aks workloads

technically it is the same as workload federation which is supported on GCP

[MattMencel]

I was actually looking for this feature today, so I've made a PR for it. ☝️

[xiaolin593]

This sounds like a good addition here, though I have zero knowledge on Azure auth

ai-gateway/api/v1alpha1/backendsecurity_policy.go

Line 212 in 1ad38b2

type BackendSecurityPolicyAzureCredentials struct {
cc @xiaolin593 @aabchoo

Sounds a good plan. I don't have AKS environment and knowledge, will defer to someone else.