christian-posta

Clip source: Solving the Identity Crisis for AI Agents

Introduction

Uber is at the forefront of leveraging AI, empowering engineers to build AI solutions to improve productivity. In early 2025, the company built an internal Agent platform that allows teams to compose, deploy, and operate production-grade agents at scale. Additionally, Uber’s microservices tech stack comprising thousands of services was made AI-ready by enabling MCP® (Model Context Protocol) support over existing service APIs.

Increasing agentic autonomy necessitates strict oversight of the agents and the actions they execute. Accountability, the ability to answer “who did what, when and why” is critical for auditing, compliance, and executive trust. Without clear attribution, security controls can be harder to enforce, incident response may slow, and trust may be impacted.

This blog outlines the major updates to Uber’s identity and access technology stack in 2025 to accommodate AI agents. To maintain a proactive stance as AI adoption acc

christian-posta

Agentgateway Objects context

CEL name	Rust field	When / where it’s set
request	request	HTTP request (method, uri, host, scheme, path, version, headers, body, startTime, endTime). Set from live request or from RequestSnapshot.
response	response	HTTP response (code, headers, body). Only set when the executor is built with a response (e.g. new_request_and_response, new_response, or logger with response).
jwt	jwt	JWT claims. Present when JWT auth is enabled and a token was verified.
apiKey	api_key	API key claims. Present when API key auth is enabled.

christian-posta

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: public-oauth-mcp
  namespace: enterprise-agentgateway
spec:
  parentRefs:
  - name: agentgateway
  rules:
    - matches:

christian-posta

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: agentgateway
  namespace: gloo-system
spec:
  gatewayClassName: enterprise-agentgateway
  listeners:
    - name: http
      port: 8080

christian-posta

source .env.sh

Create cluster

Based on this documentation: https://docs.nvidia.com/datacenter/cloud-native/gpu-operator/latest/google-gke.html

Create a cluster with CPU nodes and we'll add GPU nodes later

christian-posta

Here's a step-by-step guide to create a cost-conscious Kubernetes cluster in Google Kubernetes Engine (GKE), configure nodes with GPUs, and set up NVIDIA NGC Infrastructure Manager (NIM) along with deploying an LLM that uses the OpenAI API.

---

Step 1: Prerequisites

1. Google Cloud Account: Ensure you have an active Google Cloud account.
2. gcloud CLI: Install the Google Cloud SDK.
3. kubectl: Install kubectl if it's not already installed.
4. NVIDIA GPU Driver Support: Ensure you have access to NVIDIA resources and APIs.

christian-posta

SOURCE_NAME=$(kubectl get po -A -o wide | grep $1 | head -n 1 | awk '{print $2}')
TARGET_NAME=$(kubectl get po -A -o wide | grep $2 | head -n 1| awk '{print $2}')

SOURCE_IP=$(kubectl get po -A -o wide | grep $1 | head -n 1 | awk '{print $7}')
TARGET_IP=$(kubectl get po -A -o wide | grep $2 | head -n 1 | awk '{print $7}')

echo "Source: $SOURCE_NAME, Target: $TARGET_NAME"
echo "Source: $SOURCE_IP, Target: $TARGET_IP"
echo "Running command: sh -c \"kubectl sniff -i eth0 -o ./local.pcap $SOURCE_NAME -f '((tcp) and (net $TARGET_IP))'\""
sh -c "kubectl sniff -i eth0 -o ./local.pcap $SOURCE_NAME -f '((tcp) and (net $TARGET_IP))'"

christian-posta

GLOO=${1:-gloo}

POD=$(kubectl get po -n gloo-system | grep $GLOO | awk '{ print $1 }' | head -n 1)
echo "gloo pod to debug '$POD'"

PF_CMD=$(squashctl --debugger dlv --namespace gloo-system --machine --pod $POD) 

echo "PF CMD: $PF_CMD"

K_CMD=$(echo "$PF_CMD" | jq .PortForwardCmd | sed s/:/2345:/) 

christian-posta

Review of service mesh 2019:

In 2019 the common themes for service mesh were:

• more service-mesh distributions! everyone in the API/software networking space is coming up with their own distributions of service mesh. I think this is natrually a good thing for the market as it shows there is some value to be provided here and that different approaches should be explored. this will also lead us to a point of convergence soon in the future.

• more organizations are POCing service mesh (up from just having architectural discussions from previous year)

• usability is key! mesh technology like linkerd has shown how a mesh can be simpler to use and operate, with other mesh technologies taking note and improving their usability

christian-posta

apiVersion: gateway.solo.io/v1
kind: VirtualService
metadata:
  name: banking-vs
  namespace: gloo-system  
spec:
  virtualHost:
    domains:
    - 'banking.api.solo.io'
    routes: