'Can I use `envoyExtAuthzHttp` with Anthos for OIDC?

Currently I am handling OIDC using OAuth2-proxy and Istio. We would now like to upgrade to Anthos since we are mainly on GCP. Everything works but I need to configure envoyExtAuthzHttp. Previously I would run kubectl edit configmap istio -n istio-system and add the following...

extensionProviders:
  - name: oauth2-proxy    
    envoyExtAuthzHttp:
      service: http-oauth-proxy.istio-system.svc.cluster.local    
      port: 4180
      includeRequestHeadersInCheck: ['cookie']      
      headersToUpstreamOnAllow: ['authorization']      
      headersToDownstreamOnDeny: ['content-type', 'set-cookie']

However, ASM does not seem to install that config map...

Error from server (NotFound): configmaps "istio" not found

I noticed there is an istio-asm-managed config map. So I tried adding the config to that but when I do I am not sure how to restart ASM as this command I am used to using isn't working kubectl rollout restart deployment/istiod -n istio-system.

When I try to go to the site instead of being redirected I see...

RBAC: access denied

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source

'Can I use `envoyExtAuthzHttp` with Anthos for OIDC?

Sources

Related Questions