Note

Low Risk
Documentation-only change that clarifies authentication behavior for self-hosted GKE deployments; no runtime code changes.

Overview
Updates the Vertex AI integration docs to add a GKE Workload Identity Federation note: when GCP_AUTH_MODE=workload is enabled, the self-hosted Gateway auto-fetches Vertex AI access tokens from metadata so callers don’t need to pass an Authorization header.

Also documents the required IAM permission (roles/aiplatform.user) for the Gateway’s bound GSA.

^{Written by Cursor Bugbot for commit ba8fcff. This will update automatically on new commits. Configure here.}