Remove the auth-proxy component when Cilium supports native forward auth (cilium/cilium#23797)

[github-actions]

platform-template/k8s/bases/infrastructure/controllers/auth-proxy/config-map.yaml

Line 1 in 39ac525

# TODO: Remove auth-proxy when Cilium supports native forward auth (https://github.com/cilium/cilium/issues/23797)

# TODO: Remove auth-proxy when Cilium supports native forward auth (https://github.com/cilium/cilium/issues/23797)
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: auth-proxy-config
  namespace: oauth2-proxy
data:
  traefik.yaml: |
    entryPoints:
      web:
        address: ":8080"
    providers:
      file:
        filename: /etc/traefik/dynamic.yaml
    log:
      level: INFO
  dynamic.yaml: |
    http:
      routers:
        homepage:
          rule: "Host(`${domain}`)"
          entryPoints: ["web"]
          service: homepage
        hubble:
          rule: "Host(`hubble.${domain}`)"
          entryPoints: ["web"]
          service: hubble-ui
        prometheus:
          rule: "Host(`prometheus.${domain}`)"
          entryPoints: ["web"]
          service: prometheus
        alertmanager:
          rule: "Host(`alertmanager.${domain}`)"
          entryPoints: ["web"]
          service: alertmanager
        opencost:
          rule: "Host(`opencost.${domain}`)"
          entryPoints: ["web"]
          service: opencost
      services:
        homepage:
          loadBalancer:
            servers:
              - url: "http://homepage.homepage.svc.cluster.local:80"
        hubble-ui:
          loadBalancer:
            servers:
              - url: "http://keda-add-ons-http-interceptor-proxy.keda.svc.cluster.local:8080"
        prometheus:
          loadBalancer:
            servers:
              - url: "http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090"
        alertmanager:
          loadBalancer:
            servers:
              - url: "http://kube-prometheus-stack-alertmanager.monitoring.svc.cluster.local:9093"
        opencost:
          loadBalancer:
            servers:
              - url: "http://opencost.opencost.svc.cluster.local:9090"

Blocker: cilium/cilium#23797 (native forward auth) | last-verified 2026-09-02: not shipped — stable is now Cilium 1.20.1 (docs.cilium.io/en/stable), a patch on the 1.20 line rather than the new minor the previous check named as the re-check trigger. The stable Gateway API support page has grown its supported set since 2026-08-17 — it now documents BackendTLSPolicy, ReferenceGrant, ListenerSet, TCPRoute, UDPRoute and the CiliumGatewayClassConfig CRD alongside GatewayClass/Gateway/HTTPRoute/GRPCRoute/TLSRoute (Gateway API v1.6.1) — but still carries no external-authorization / forward-auth / ext_authz capability. So the auth-proxy component still has no native replacement. Re-check the Gateway API page on the next Cilium minor (1.21.x).

[devantler]

🤖 Generated by the Daily AI Assistant

Promoting this to the single canonical tracker for removing the entire auth-proxy component once cilium/cilium#23797 ships native forward auth. The auth-proxy TODO had been auto-filed once per file in k8s/bases/infrastructure/controllers/auth-proxy/ (config-map, deployment, kustomization, networkpolicy, service), producing five identical issues (#8–#12). PR #16 already deduped the in-code TODO to a single component tracker; this consolidates the issue side to match. Closing #9–#12 as duplicates of this one.

Labelled blocked (gated on the upstream Cilium feature).