namannagar89 opened a new pull request, #13733: URL: https://github.com/apache/apisix/pull/13733
### Description `ai-proxy` / `ai-proxy-multi` GCP (Vertex AI) auth currently supports **only** a static service-account JSON key: `apisix/utils/google-cloud-oauth.lua` signs a JWT with the private key and exchanges it for an access token. When APISIX runs on GKE with [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) (or anywhere Application Default Credentials are available), this forces a long-lived SA key purely for APISIX — a downgrade from the keyless posture the platform otherwise provides. This PR adds a **metadata-server (ADC / Workload Identity)** auth path. ### What changed - **`apisix/utils/google-cloud-oauth.lua`**: when no SA key is available (or `use_metadata_server: true`), fetch the token from the GCE/GKE metadata server (`GET /computeMetadata/v1/instance/service-accounts/default/token`, header `Metadata-Flavor: Google`). Host overridable via `GCE_METADATA_HOST`. Existing token caching (`max_ttl` / `expire_early_secs`) is reused unchanged, since the metadata response carries `expires_in`. - **`apisix/plugins/ai-transport/auth.lua`**: pass `use_metadata_server` / `metadata_host` through. - **`apisix/plugins/ai-proxy/schema.lua`**: add `auth.gcp.use_metadata_server` (boolean, default false). - **`t/plugin/ai-proxy-gcp-metadata.t`**: tests — default selection (no key → metadata; key → JWT), token fetch from a mock metadata endpoint, and `GCE_METADATA_HOST` override. - **docs** (en + zh) for `ai-proxy` and `ai-proxy-multi`. ### Behavior - **No behavior change** when a key is configured (`service_account_json` / `GCP_SERVICE_ACCOUNT`) — the JWT flow is unchanged. - With no key configured, the plugin now uses the metadata server automatically instead of failing. ### Related issue Closes #13732 ### Checklist - [x] Tests added (`t/plugin/ai-proxy-gcp-metadata.t`) - [x] Docs updated (en + zh, both plugins) - [x] `luacheck` clean - [x] `[email protected]` clean -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
