Currently, the external authorization support in Contour will allow users to implement an Oauth2 flow, however, users need to find an implementation as well as manage that inside their cluster.

An alternative could be to allow the Oauth2 filter in Envoy to do the same thing and not require the additional deployment / management of the external auth service.

We'd just need to figure out an api configuration spec to enable.

Originally posted by @stevesloka in #2664 (comment)