[SPEC] UExternal auth for Gateway API routes: Cilium ExternalAuth filter (GEP-1494) with shared oauth2-proxy bridging to Zitadel

[aqemia-smaine-kahlouch]

Summary

External auth for Gateway API routes: Cilium ExternalAuth filter (GEP-1494) with shared oauth2-proxy bridging to Zitadel

Type

security

Spec Directory

docs/specs/013-external-auth-gateway-api/

The spec is a 3-file directory:

• spec.md — contract (WHAT + why)
• plan.md — design, tasks, 4-persona review checklist
• clarifications.md — append-only decisions log

---

Spec anchor for discussion. See docs/specs/013-external-auth-gateway-api/ for the full specification.

[aqemia-smaine-kahlouch]

Spec created — 3 artifacts under docs/specs/013-external-auth-gateway-api/:

• spec.md — contract (WHAT)
• plan.md — design + tasks + review checklist (HOW)
• clarifications.md — append-only decisions log