GW API oauth2-proxy support

[stelucz]

Hi,
I run nginx ingress that authenticates requests against oauth2-proxy currently. Used annotations are:

    nginx.ingress.kubernetes.io/auth-url: "https://#.example.org/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://#.example.org/oauth2/start?rd=$pass_access_scheme://$http_host$escaped_request_uri"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      auth_request_set $user   $upstream_http_x_auth_request_user;
      auth_request_set $email  $upstream_http_x_auth_request_email;
      proxy_set_header X-User  $user;
      proxy_set_header X-Email $email;

I searched through docs of nginx-gateway-fabric, but I did not find anything about setting such annotations or oauth2-proxy support. Can I achieve the same with nginx-gateway-fabric as with ingress controller? Thank you

[salonichf5]

Currently, the Gateway API is working on defining an API for authentication and authorization (see GEP-1494).

We plan to wait until the Gateway API releases an experimental object related to this functionality. Once we have more implementation details, we’ll prioritize this work. If you’re interested, feel free to follow the discussion and contribute your thoughts here!

[mpstefan]

Hey @stelucz, if you are familiar with the NGINX directives that are behind these annotations, we do offer a mechanism to include them in your NGF configuration via SnippetFilters.

Otherwise, for a more first-class feature around authentication, we are planning to wait for the Gateway API to define authentication and authorization since it will be a while until we can get to it.

Let us know if you do take a look! I'd be curious to see if you can get everything you are looking for working, or if we'd need a few extra things to get the experience you're looking for.