Some applications do not need complicated authentication, but nevertheless its good OpSec to provide some baseline authentication. For these applications forward-auth is a great solution. My homelab uses Authentik for authn/authz/sso, and Envoy Gateway for ingress and routing. I’ll show the steps to get these components working together for forward auth at the domain level.

NOTE: Envoy Gateway 1.7.0 breaks forward auth, specifically Envoy Gateway Controller 1.37.0. Hopefully there will be a patch soon, but as of this writing I’ve downgraded to 1.6.1. Envoy Gateway 1.7.1 has addressed this issue.

Configure Authentik

A few things need to be configured in Authentik before we move on to Envoy Gateway configurations. We need an Application and Provider for Envoy, a new httproute in the helm chart, and a reference grant.

Create the App and Provider

This is straight forward. Call it “envoy” and use a proxy provider. I recommend the “implicit” authorization flow. You’ll see an option to select between “proxy”, “forward auth (single application)”, and “forward auth (domain level)”. Select “forward auth (domain level)”.

The authentication domain should be your Authentik domain, and the cookie domain should be the most specific subdomain common to both Authentik and your target applications. For example if Authentik is at “auth.example.com” and your target app is “echo.internal.example.com” then you would use “example.com”. If Authentik is instead at “auth.internal.example.com” then you could use “internal.example.com” as the cookie domain.

You shouldn’t need to change any other settings.

Now find the embedded outpost, edit it, and add the new “envoy” application to it.

Add the HttpRoute

The Authentik Helm chart provides an “additionalRules” block for adding extra routing rules. We’ll utilize this to route for our outpost. Perhaps this should be part of the default configuration, but as of 2026.2 it doesn’t.

# your helm configuration should already have something like this if you are relying on it to create the httproute
route:
  main:
    enabled: true
    hostnames: [ "auth.example.com" ]
    parentRefs:
      - name: envoy-external
        namespace: networking
    # This rule will correctly route traffic to the embedded outpost
    additionalRules:
      - backendRefs:
          - name: ak-outpost-authentik-embedded-outpost
            port: 9000
        matches:
          - path:
              type: PathPrefix
              value: /outpost.goauthentik.io

Create a Reference Grant

Envoy will need a ReferenceGrant object to allow SecurityPolicies to reference things in this namespace. Each namespace will need its own block in the “from” list. This example assumes the target application is in the “default” namespace.

apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: ext-auth-outpost
  namespace: authentik
spec:
  from:
    - group: gateway.envoyproxy.io
      kind: SecurityPolicy
      namespace: default
  to:
    - group: ""
      kind: Service
      name: ak-outpost-authentik-embedded-outpost

Configure Envoy Gateway

Now that Authentik is configured, all that is necessary is a SecurityPolicy for the application. Assuming the target httproute is named “example”, then you would create a policy that looks like this.

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: "example-forward-auth"
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: "example"
  extAuth:
    failOpen: false
    recomputeRoute: true
    headersToExtAuth:
      - "X-Forwarded-For"
      - "X-Real-Ip"
      - "accept"
      - "cookie"
      - "authorization"
      - "proxy-authorization"
      - "x-forwarded-proto"
    http:
      backendRefs:
        - kind: Service
          name: ak-outpost-authentik-embedded-outpost
          namespace: authentik
          port: 9000
      # despite the "envoy" portion here matching the app slug created earlier, it is unrelated. This path is hardcoded in Authentik for Envoy support.
      path: /outpost.goauthentik.io/auth/envoy
      headersToBackend:
        - "Set-Cookie"
        - "X-authentik-uid"
        - "X-authentik-username"
        - "X-authentik-name"
        - "X-authentik-email"
        - "X-authentik-groups"
        - "X-authentik-entitlements"