Porting OAuth2 Proxy to Gateway API moves the login redirect into a Traefik-specific CRD

The redirect is the piece that has to be rebuilt. ForwardAuth calls `/oauth2/auth`, and that endpoint only checks a session: it answers 202 when the cookie is valid and 401 when it is not ^[4]. Traefik's `Errors` middleware catches the 401 and sends the browser to `/oauth2/sign_in?rd=...` ^[5]. The guide's author wrote: "That separate redirect step is the most important difference from the old ingress-nginx annotations." ^[6]

Two Traefik providers are on at once. The Helm install sets `providers.kubernetesGateway.enabled=true` for the standard objects ^[7], and the Kubernetes CRD provider stays enabled because the authentication middleware is a Traefik CRD ^[8]. Gateway API's standard channel, installed here from the v1.6.1 manifest ^[9], ships the stable `GatewayClass`, `Gateway` and `HTTPRoute` APIs ^[10]. Browser OIDC login and an external-auth filter are not among them ^[3].

Gateway is routing configuration; Traefik is the process that accepts the traffic, and the `Gateway` resource does not create the external listener by itself ^[11]. The address comes from Traefik's Service: type `LoadBalancer` on a managed cluster, MetalLB or an existing external load balancer on bare metal ^[12]. DNS for `*.k8s.example.com` points at whatever endpoint terminates that HTTPS traffic, and the guide checks the Service has an address before the record is added ^[13].

Count the exchanges in the published sequence diagram and OAuth2 Proxy handles four requests before the `whoami` backend sees anything: the first `/oauth2/auth` returning 401, the sign-in start, the callback carrying the authorization code, and the second `/oauth2/auth` returning 202 with identity headers ^[20]. Pocket ID authenticates the user with a passkey in between ^[19]. Once the session cookie exists, each request costs one ForwardAuth call ^[20]. That call is on the path of every protected request.

The flow was verified on a local K3s cluster, using standard kubectl and Helm commands the author says are not tied to that environment ^[16]. The parts that differ elsewhere are traffic entry and certificates: the guide assumes cert-manager and a `ClusterIssuer` named `letsencrypt-prod` already exist, and both the login callback and the session cookie need HTTPS ^[17]. Cookie scope is the other setting to get right locally. Three hostnames under one parent domain let OAuth2 Proxy share a narrowly scoped session cookie such as `.k8s.example.com`, and the guide tells you not to widen that domain when unrelated applications sit under it ^[14][15].

In my view this is the right trade where Traefik is already the gateway: the routing objects become portable and two middlewares are the bill. Teams on Envoy Gateway, Kong or Cilium keep the same `Gateway` and `HTTPRoute` and change the authentication adapter ^[18]. The guide does not measure what that change costs on any of those three.