North/South Authentication GAPI/Cilium

[Smana]

Enhancement Title

Being able to provide an authentication mechanism with Gateway API and Cilium

Summary

Currently there's no way to add an authentication layer on top of our applications using Gateway API and Cilium.
It has to be implemented by the application itself.
We'd like to have a standard way to declare an authentication step before reaching the app.
Preferably using OIDC and Zitadel for our current repo.

Motivation

Enhance security level by adding authentication mechanism for North/South traffic

Detailed Explanation

The feature is being discussed in this GEP: kubernetes-sigs/gateway-api#1494
Cilium implementation: cilium/cilium#23797

[aqemia-smaine-kahlouch]

Status: not implemented — keep open.

Only app-level OIDC exists (app-wizard, SPEC-008). Gateway-level North/South auth is still missing: Envoy AI Gateway uses API-key auth only (infrastructure/base/envoy-ai-gateway/security-policy.yaml), and docs/ingress.md explicitly states "No authentication at Gateway level (handled by application)". No OIDC/OAuth2 SecurityPolicy at the Gateway API + Cilium layer.

(Status reviewed 2026-07-14.)