oidc: native oauth2 per-route config#8703
Merged
zhaohuabing merged 1 commit intoenvoyproxy:mainfrom Apr 13, 2026
Merged
Conversation
✅ Deploy Preview for cerulean-figolla-1f9435 canceled.
|
zhaohuabing
force-pushed
the
oauth2-per-route-config
branch
from
ee7b228 to
24269fc
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #8703 +/- ##
==========================================
+ Coverage 74.34% 74.41% +0.06%
==========================================
Files 244 244
Lines 38868 38866 -2
==========================================
+ Hits 28896 28921 +25
+ Misses 7970 7948 -22
+ Partials 2002 1997 -5 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
zhaohuabing
force-pushed
the
oauth2-per-route-config
branch
5 times, most recently
from
98d67b0 to
18b2f4e
Compare
zhaohuabing
force-pushed
the
oauth2-per-route-config
branch
2 times, most recently
from
2961327 to
cd68c4b
Compare
Member
Author
|
/retest |
1 similar comment
Member
Author
|
/retest |
arkodg
reviewed
Apr 12, 2026
| license.override = ["Apache-2.0"] | ||
| reason = "This package is dual-licensed: the code under the Apache 2.0 license and the documentation under the CC-BY-SA-4.0 license" | ||
|
|
||
| # TODO: Remove this override after github.com/envoyproxy/go-control-plane v0.14.1 is released. |
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
zirain
force-pushed
the
oauth2-per-route-config
branch
from
cd68c4b to
d9593f1
Compare
zirain
approved these changes
Apr 13, 2026
skos-ninja
pushed a commit
to skos-ninja/envoy-gateway
that referenced
this pull request
May 1, 2026
native oauth2 per-route config Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Jake Oliver <jake@truelayer.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR leverages Envoy’s newly introduced native per-route configuration to configure the OAuth2 filter for SecurityPolicies.
With native per-route config, only a dumb OAuth2 filter is added to the listener’s HCM filter chain, while the actual configuration is pushed to the route level. As a result, CRUD operations on
SecurityPoliciesno longer trigger listener churn.