What
The purpose of this spike is to assess automatic rotation of short-lived upstream credentials before they expire. Applies to all cloud provider auth mechanisms (SigV4 sessions, Azure AD tokens, GCP access tokens).
Why
Cloud provider tokens are short-lived (typically 1 hour). Without automatic rotation, the gateway must be restarted or manually reconfigured when credentials expire. Envoy AI Gateway automatically retrieves and attaches fresh tokens per-request.
Goals
- Background credential refresh before expiry (with configurable buffer)
- Atomic credential swap - no request sees a partially-rotated credential
- Retry with fresh credentials on 401/403 from upstream
- Credential health monitoring and alerting on refresh failures
The result of this spike should be a proposal to drive the capability forward.
What
The purpose of this spike is to assess automatic rotation of short-lived upstream credentials before they expire. Applies to all cloud provider auth mechanisms (SigV4 sessions, Azure AD tokens, GCP access tokens).
Why
Cloud provider tokens are short-lived (typically 1 hour). Without automatic rotation, the gateway must be restarted or manually reconfigured when credentials expire. Envoy AI Gateway automatically retrieves and attaches fresh tokens per-request.
Goals
The result of this spike should be a proposal to drive the capability forward.