<p>I'm looking for a way to authenticate an Istio-enabled Kubernetes cluster with an external Oauth2 provider.  The Nginx Ingress controller has a way to do this when using vanilla Ingres resources.</p>

<p><a href="https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/</a></p>

<p>However, I'm not sure how to do this with Istio Gateway and VirtualService objects. Basically, I need to be able to provide an auth-url and an auth-sigin url to Istio, so it will authenticate the same way that the oauth Nginx ingress controller does. I've found a few examples of EnvoyFilters suggest ways to do this, but there isn't a lot of documentation on how to make this work.</p>

<p>Any advice to get Istio to integrate with an external Oauth would be much appreciated. </p>

<p>OriginAuthenticationMethod is the authentication policy that you are looking for.</p>

<p>Refer: <a href="https://istio.io/docs/reference/config/security/istio.authentication.v1alpha1/#OriginAuthenticationMethod" rel="nofollow noreferrer">https://istio.io/docs/reference/config/security/istio.authentication.v1alpha1/#OriginAuthenticationMethod</a></p>

<blockquote>
  <p>Currently, only JWT is supported for origin authentication.</p>
</blockquote>

<p>A workaround would be using another type of Ingress.</p>
