Grok Build Gateway · Entra JWT → xAI

[model.agw]
model = "grok-4.5"
base_url = "http://172.16.10.155:31918/v1"
name = "Grok via agentgateway"
env_key = "GROK_AGW_TOKEN"
api_backend = "responses"
supports_backend_search = false

[models]
default = "agw"

TENANT=8635e970-2205-4189-bc77-77519ff5064f
CLIENT=36fb017c-5b4b-4c26-9bd7-7af25793178b

curl -sS -X POST "https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/devicecode" \
  -d "client_id=${CLIENT}" \
  -d "scope=openid profile email offline_access"

# complete user_code in a browser, then:
curl -sS -X POST "https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/token" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
  -d "client_id=${CLIENT}" \
  -d "device_code=${DEVICE_CODE}"

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: grok-build-gateway
  namespace: agentgateway-system
spec:
  gatewayClassName: enterprise-agentgateway
  # Load the shared model cost catalog so this gateway's LLM traffic is priced
  # in USD for Cost Management. Without this, spans on this gateway compute
  # CostUsd=0 regardless of catalog contents (only gateways with a parametersRef
  # price requests). Same params object as agentgateway-proxy / codex.
  infrastructure:
    parametersRef:
      group: enterpriseagentgateway.solo.io
      kind: EnterpriseAgentgatewayParameters
      name: agentgateway-proxy-params
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: All
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - name: solo-ui-tls
            kind: Secret
      allowedRoutes:
        namespaces:
          from: All

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: grok-build
  namespace: agentgateway-system
spec:
  parentRefs:
    - name: grok-build-gateway
      namespace: agentgateway-system
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: xai-grok-build
          namespace: agentgateway-system
          group: agentgateway.dev
          kind: AgentgatewayBackend

apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayBackend
metadata:
  name: xai-grok-build
  namespace: agentgateway-system
  labels:
    app.kubernetes.io/component: grok-build
    app.kubernetes.io/part-of: entra-id
spec:
  ai:
    provider:
      openai: {}
      host: api.x.ai
      port: 443
      pathPrefix: /v1
  policies:
    ai:
      routes:
        "/v1/responses": Responses
        "/v1/chat/completions": Completions
        "/v1/models": Models
        "*": Passthrough
    auth:
      secretRef:
        name: xai-secret
    tls:
      sni: api.x.ai

apiVersion: agentgateway.dev/v1alpha1
kind: AgentgatewayPolicy
metadata:
  name: grok-build-jwt-auth
  namespace: agentgateway-system
  labels:
    app.kubernetes.io/component: grok-build
    app.kubernetes.io/part-of: entra-id
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: grok-build
  traffic:
    jwtAuthentication:
      mode: Strict
      providers:
        - issuer: https://login.microsoftonline.com/8635e970-2205-4189-bc77-77519ff5064f/v2.0
          audiences:
            - "36fb017c-5b4b-4c26-9bd7-7af25793178b"
          jwks:
            remote:
              backendRef:
                name: entra-jwks
                kind: AgentgatewayBackend
                group: agentgateway.dev
                port: 443
              jwksPath: /8635e970-2205-4189-bc77-77519ff5064f/discovery/v2.0/keys
              cacheDuration: 5m