Skip to content

Spike: Short-lived upstream credential auto-rotation #555

Description

@shaneutt

What

The purpose of this spike is to assess automatic rotation of short-lived upstream credentials before they expire. Applies to all cloud provider auth mechanisms (SigV4 sessions, Azure AD tokens, GCP access tokens).

Why

Cloud provider tokens are short-lived (typically 1 hour). Without automatic rotation, the gateway must be restarted or manually reconfigured when credentials expire. Envoy AI Gateway automatically retrieves and attaches fresh tokens per-request.

Goals

  • Background credential refresh before expiry (with configurable buffer)
  • Atomic credential swap - no request sees a partially-rotated credential
  • Retry with fresh credentials on 401/403 from upstream
  • Credential health monitoring and alerting on refresh failures

The result of this spike should be a proposal to drive the capability forward.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions