Upgrade agentgateway v1.1.0 → v1.4.0 to adopt native RFC 8693 token exchange

[shapirov103]

Summary

The cluster's AgentGateway (agentgateway-system) is running v1.1.0. Upstream agentgateway released v1.4.0 on 2026-07-27, which adds native RFC 8693 OAuth token exchange and Cross App Access (ID-JAG) as backend authentication modes. Upgrading unblocks the token-exchange delegation model described in docs/architecture/agent-identity-and-token-exchange.md.

Correction to prior assumption

An earlier investigation concluded RFC 8693 token exchange was exclusive to Solo.io's commercial "Solo Enterprise for agentgateway" product and not available in the open-source project. That conclusion was wrong. Verified directly against the agentgateway/agentgateway GitHub repository:

• PR #2189 — auth: add RFC 8693 token exchange backend auth (merged, by @gilad9366)
• PR #2458 — controller: OAuth Token Exchange support (merged, by @markuskobler)
• Both shipped in the v1.4.0 release (2026-07-27), release notes section "OAuth token exchange backend authentication": "Agentgateway can exchange an incoming token for a backend credential by using RFC 8693 OAuth 2.0 token exchange and the RFC 7523 JWT bearer grant."
• Implementation lives in crates/agentgateway/src/http/auth/oauth/ (transport.rs, client_auth.rs, cross_app_access.rs) and crates/agentgateway/src/http/oidc/, with runnable examples under examples/traffic-token-exchange/oauth-rfc8693/ and examples/traffic-cross-app-access/keycloak/.

Solo.io's separate documentation site (docs.solo.io/agentgateway/...) covers their own commercial STS/OBO layer, which is a distinct product built on top of the OSS project — not the source of this capability. This is genuinely open-source and requires no commercial license.

Current state

• Installed: cr.agentgateway.dev/controller:v1.1.0 and cr.agentgateway.dev/agentgateway:v1.1.0 (verified via kubectl get deploy -n agentgateway-system -o jsonpath='{.spec.template.spec.containers[0].image}')
• v1.1.0 predates token exchange entirely; the only backend.auth keys available are [aws, azure, gcp, key, passthrough, secretRef].
• Three minor releases behind: v1.1.0 → v1.2.x → v1.3.x → v1.4.0.

Breaking changes to account for (from the v1.4.0 release notes)

• Gateway API v1.6 / TCPRoute v1 — the controller now uses v1 instead of v1alpha2; re-apply the Gateway API CRDs before upgrading.
• MCP guardrail request-phase rejections now return HTTP 200 with a JSON-RPC error body (previously non-200) — any client/test expecting a non-200 status needs updating.
• Standalone auth.location no longer double-nests expression — not applicable to our Kubernetes-mode install, but worth confirming.
• musl-based container image variants are no longer published; standard glibc images only (binaries are still musl-built).
• Security advisory GHSA-mvgg-jvj2-4frq (High, 8.1) — stateful MCP sessions could cross routes and overwrite the authorization policy. Review before/after upgrading.

Proposed scope

1. Upgrade agentgateway/agentgateway-proxy from v1.1.0 to v1.4.0 in the relevant Helm values/chart (gitops/addons/...), including the Gateway API v1.6 CRD re-apply.
2. Validate existing JWT auth policy (jwt-auth-policy, dual Keycloak + EKS OIDC issuers) and MCP routes (mcp-time, etc.) still work post-upgrade.
3. Design and adopt backend.auth.oauthTokenExchange (or the Kubernetes-mode equivalent field — see AgentgatewayPolicy/AgentgatewayBackend CRD reference for v1.4) for the delegation use case in the architecture doc: exchanging the workload's agentgateway-audience token for a downstream-scoped credential per RFC 8693.
4. Update docs/architecture/agent-identity-and-token-exchange.md to reflect the corrected OSS-availability finding and the concrete upgrade path.

References

• agentgateway v1.4.0 release notes
• Kubernetes OAuth token exchange docs
• Kubernetes Cross App Access docs
• RFC 8693: https://datatracker.ietf.org/doc/html/rfc8693