Can I use `envoyExtAuthzHttp` with Anthos for OIDC?

Question

Currently I am handling OIDC using OAuth2-proxy and Istio. We would now like to upgrade to Anthos since we are mainly on GCP. Everything works but I need to configure envoyExtAuthzHttp. Previously I would run kubectl edit configmap istio -n istio-system and add the following...

extensionProviders:
  - name: oauth2-proxy    
    envoyExtAuthzHttp:
      service: http-oauth-proxy.istio-system.svc.cluster.local    
      port: 4180
      includeRequestHeadersInCheck: ['cookie']      
      headersToUpstreamOnAllow: ['authorization']      
      headersToDownstreamOnDeny: ['content-type', 'set-cookie']

However, ASM does not seem to install that config map...

Error from server (NotFound): configmaps "istio" not found

I noticed there is an istio-asm-managed config map. So I tried adding the config to that but when I do I am not sure how to restart ASM as this command I am used to using isn't working kubectl rollout restart deployment/istiod -n istio-system.

When I try to go to the site instead of being redirected I see...

RBAC: access denied

Answer 1

What worked for me, after studying what asmcli does when you follow the migration steps here, is setting this configmap in istio-system before enabling the Anthos Service Mesh:

apiVersion: v1
data:
  mesh: |
    extensionProviders:
        ...<your settings here>...
kind: ConfigMap
metadata:
  name: istio-asm-managed-rapid
  namespace: istio-system

I have not verified whether it was actually necessary to do this before enabling the ASM, but that is how I did it.