[Automated] Draft docs (agentgateway): jwks: support x5c key sets in fips140=only mode

[github-actions]

agentgateway/agentgateway#3924 — jwks: support x5c key sets in fips140=only mode

Docs versions: kubernetes/main

What changes for users: Kubernetes JWT policies can use remote JWKS documents that include x5c certificate chains and x5t SHA-1 thumbprints when the controller runs with GODEBUG=fips140=only. This affects providers such as Keycloak, Microsoft Entra ID, and Auth0 that include certificate chains in their JWKS responses.

What the docs now say: The JWT auth guide now states, in the jwks.remote.jwksPath field row, that JWKS documents with x5c certificate chains and x5t SHA-1 thumbprints are accepted in strict FIPS 140-3 mode.

Not verified: No cluster was used; the configuration and verification steps are unrun.

How agentgateway-3924 was drafted, and what was not verified

• Code PR: jwks: support x5c key sets in fips140=only mode agentgateway#3924
• Code issue: none linked
• Product: agentgateway (upstream) -> agentgateway/website
• Docs version: kubernetes/main, documented in the development tree.
• Category: scoped-edit / pr

Plan, and what changed it

• Planned: Document the strict FIPS 140-3 JWKS behavior on the Kubernetes JWT page that owns remote JWKS setup.
• Learned: assets/agw-docs/pages/security/jwt-setup.md is a shared asset, so the new sentence needed an upstream main-only version gate from hugo.yaml and the Kubernetes version tree list.
• Did: Added one gated sentence to the JWT auth field table and wrote a proposed Security fixes release note.

Why a documentation change is necessary

The pull request changes how the Kubernetes controller parses and serializes JWKS documents when strict FIPS 140-3 enforcement is enabled. The diff routes remote JWKS fetches, cached JWKS loads, serialized cached key sets, and inline JWT provider JWKS parsing through ParseKeySet or MarshalKeySet. The JWT auth guide already documents the remote JWKS configuration path, but did not state that JWKS responses with x5c certificate chains work when the controller runs with GODEBUG=fips140=only.

What changed on disk

• assets/agw-docs/pages/security/jwt-setup.md: Added a gated note to the jwks.remote.jwksPath row for kubernetes/main.

How to verify this change

1. In a Kubernetes cluster whose agentgateway controller runs with GODEBUG=fips140=only, follow the JWT auth guide with an identity provider whose JWKS endpoint returns keys that include x5c certificate chains and matching x5t thumbprints.
2. Check the policy status.

   kubectl get agentgatewaypolicy jwt-auth-policy -n agentgateway-system -o json | jq '.status'

   The status shows an accepted policy instead of a controller crash or a JWKS decode failure.
3. Send a request with a valid token from that identity provider. The request succeeds with the expected 200 response from the guide.

What was not verified

The configuration was not applied to a cluster, so every command in this diff is unrun.

How the pages were chosen (triage report)

Draft a documentation change

agentgateway/agentgateway#3924 — jwks: support x5c key sets in fips140=only mode

• Product: agentgateway (upstream) → agentgateway/website
• Docs version: kubernetes/main
• Summary (read from the body): With GODEBUG=fips140=only, the controller panics on any JWKS that includes x5c certs (Keycloak, Entra ID and Auth0 all do by default). go-jose computes a SHA-1 thumbprint of the cert, which strict mode doesn't allow. That SHA-1 is only an identifier, so JWKS parsing/serialization now runs inside fips140.WithoutEnforcement.
• Not tested: no cluster was available, so every command in this diff is unrun

Release notes

This pull request also adds its release-note entries:

• content/docs/kubernetes/main/release-notes/release-notes.md: jwks: support x5c key sets in fips140=only mode (fix, under Security)

Draft branch: pr-tracker-draft-agentgateway-3924

[cloudflare-workers-and-pages]

Deploying agentproxy with    Cloudflare Pages

Latest commit:	b4870ae
Status:	✅  Deploy successful!
Preview URL:	https://6eb4d7e8.agentproxy.pages.dev
Branch Preview URL:	https://pr-tracker-draft-agentgatewa-q3kw.agentproxy.pages.dev

View logs