[Proposal] Approach for attaching backend security for AI Gateway

[Thenujan-Nagaratnam]

Why we need this

Currently, the AI Gateway only supports api-key for backend authentication. This works by attaching the set-headers policy with a configured header and value.

apiVersion: gateway.api-platform.wso2.com/v1
kind: LlmProvider
metadata:
  name: openai-provider
spec:
  displayName: OpenAI Provider
  version: v1.0
  template: openai
  upstream:
    url: https://api.openai.com/v1
    auth:
      type: api-key
      header: Authorization
      value: "Bearer {{ secret \"openai-api-key\" }}"

The problem with this approach is that it doesn't scale: introducing a new auth scheme requires a gateway-level change to support it, and patching an existing auth scheme means changing both the policy and the gateway.

The proposed solution is a generalized way to attach any auth scheme, so that policy-level changes never require a gateway-level change. upstream.auth will be updated to support this via one of the following patterns:

Option 01 - Use a first-class auth scheme built into the gateway

apiVersion: gateway.api-platform.wso2.com/v1
kind: LlmProvider
metadata:
  name: primary-openai-provider
spec:
  displayName: Primary OpenAI Provider
  version: v1.0
  template: openai
  upstream:
    url: https://api.openai.com/v1
    auth:
      type: oauth2
      policyParams:                 
        grantType: client_credentials
        tokenEndpoint: https://api.openai.com/oauth2/token
        clientId: {{ secret "openai-client-id" }}
        clientSecret: {{ secret "openai-client-secret" }}
        params:
          scope: {{ secret "openai-scope" }}

Option 02 - Use a first-class auth scheme, but pin a specific policy name/version (e.g. a newer major version, or a fork of the built-in policy)

apiVersion: gateway.api-platform.wso2.com/v1
kind: LlmProvider
metadata:
  name: primary-openai-provider
spec:
  displayName: Primary OpenAI Provider
  version: v1.0
  template: openai
  upstream:
    url: https://api.openai.com/v1
    auth:
      type: oauth2
      policyName: oauth2-generator
      policyVersion: v2
      policyParams:                       
        grantType: client_credentials
        tokenEndpoint: https://api.openai.com/oauth2/token
        clientId: {{ secret "openai-client-id" }}
        clientSecret: {{ secret "openai-client-secret" }}
        params:
          scope: {{ secret "openai-scope" }}

Option 03 - Attach a fully custom auth policy (not one of the first-class supported types)

apiVersion: gateway.api-platform.wso2.com/v1
kind: LlmProvider
metadata:
  name: primary-openai-provider
spec:
  displayName: Primary OpenAI Provider
  version: v1.0
  template: openai
  upstream:
    url: https://api.openai.com/v1
    auth:
      type: other
      policyName: oauth2-generator
      policyVersion: v2
      policyParams:                       
        grantType: client_credentials
        tokenEndpoint: https://api.openai.com/oauth2/token
        clientId: {{ secret "openai-client-id" }}
        clientSecret: {{ secret "openai-client-secret" }}
        params:
          scope: {{ secret "openai-scope" }}