Skip to content

Egress gateway answers a credential provider fault with 502, not 403 - #2706

Open
Eric Curtin (ericcurtin) wants to merge 3 commits into
agent-substrate:mainfrom
ericcurtin:egress-credential-error-class
Open

Egress gateway answers a credential provider fault with 502, not 403#2706
Eric Curtin (ericcurtin) wants to merge 3 commits into
agent-substrate:mainfrom
ericcurtin:egress-credential-error-class

Conversation

@ericcurtin

@ericcurtin Eric Curtin (ericcurtin) commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

A provider Internal, Unknown or Unimplemented or an unusable credential is now 502, and ResourceExhausted is a retryable 503. InvalidArgument stays 403 since the provider rejected the URI. The config-error row is unchanged.

Fixes #2555

  • Tests pass
  • Appropriate changes to documentation are included in the PR

@ericcurtin

Eric Curtin (ericcurtin) commented Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Quentin Bisson (@QuentinBisson) PTAL, the agentgateway side can match this table. Thank you!

Open
1 task done
@QuentinBisson

Quentin Bisson (QuentinBisson) commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

LGTM from the issue side, the table matches what I proposed. agentgateway/agentgateway#3875 now mirrors this exactly. I'm not a maintainer here though, so this still needs a maintainer's review.

@ericcurtin

Eric Curtin (ericcurtin) commented Oct 17, 2026

Copy link
Copy Markdown
Contributor Author

Keith Mattix II (@keithmattix) Eitan Yarmush (@EItanya) PTAL when you get a chance. QuentinBisson confirmed the table matches what agentgateway will do. Thank you!

@bowei Bowei Du (bowei) added area/network area/security Security related issue/pr kind/bug Something isn't working / bugfixes labels Oct 19, 2026
This was referenced Oct 20, 2026
Merged
Merged
@dims

Davanum Srinivas (dims) commented Oct 21, 2026

Copy link
Copy Markdown
Collaborator

#2555 is closed, do we still need this?

@QuentinBisson

Quentin Bisson (QuentinBisson) commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Yes i closed the issue by mistake. This is still needed

@ericcurtin
egress: answer a credential provider fault with 502, not 403
78f62cd 
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
@ericcurtin
Eric Curtin (ericcurtin) force-pushed the egress-credential-error-class branch from 04f1054 to bdb9ed3 Compare October 23, 2026 01:30
@ericcurtin

Eric Curtin (ericcurtin) commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

Rebased onto main, bdb9ed3. Davanum Srinivas (@dims) thank you, QuentinBisson confirmed it is still needed. Lior Lieberman (@LiorLieberman) Julian Gutierrez Oschmann (@juli4n) PTAL when you get a chance. Thank you!

@BenTheElder Benjamin Elder (BenTheElder) mentioned this pull request Nov 6, 2026
Open
2 tasks done
@ericcurtin

Eric Curtin (ericcurtin) commented Nov 10, 2026

Copy link
Copy Markdown
Contributor Author

Quentin Bisson (@QuentinBisson) DCO sign-off fixed, no code changes.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/network area/security Security related issue/pr kind/bug Something isn't working / bugfixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

egress: answer a credential provider failure by its class instead of 403

4 participants

@ericcurtin @QuentinBisson @dims @bowei