Enable the OAuth2 credential injector HTTPFilter

[samuelfischer]

Description:
Currently the Envoy Gateway only allows to use the Credential Injector for Basic Auth with Proxied Requests to upstream. But what if we need JWT Tokens? Sure, there is the generic_secret and you can use a Kubernetes Secret to insert a JWT for Bearer auth - BUT: what if the tokens need to be refreshed regularly? There actually is an oauth2 credential injector according to the envoy proxy docs, but one cannot use it yet on the gateway, as the Envoy API Extensions only allows for a secret ref, not the configuration we'd need.

[optional Relevant Links:]

• Oauth2 Credential Injector
• Envoy Gateway API Extentions

[arkodg]

can you share a bit more about your use case ?
cc @zhaohuabing

[samuelfischer]

We are getting requests that we proxy to a backend, but the backend is using JWT for authenticating our service with them.
So we need to inject a JWT into the proxied request.

Where the generic kubernetes Secret approach falls short: The Tokens are Shortlived and only are valid for 5 minutes.
So it would be nice to not have to use a small cron job updating the secret every few minutes, but rely on the envoy implementation for that.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[samuelfischer]

are there any news here?

[zhaohuabing]

Sounds reasonable to me.

[sboulkour]

FTR, Envoy API doc marks the feature as work in progress : https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/http/injected_credentials/oauth2/v3/oauth2.proto