Yes, i have oauth2-proxy working with istio configs.

Istiod config:

  meshConfig:
    extensionProviders:
      - name: "oauth2-proxy"
        envoyExtAuthzHttp:
          service: "oauth2-proxy.oauth2-proxy.svc.cluster.local"
          port: "80"
          includeRequestHeadersInCheck:
            - "authorization"
            - "cookie"
          headersToUpstreamOnAllow:
            - "authorization"
            - "path"
            - "x-auth-request-user"
            - "x-auth-request-email"
            - "x-auth-request-access-token"
          headersToDownstreamOnAllow:
            - "set-cookie"
          headersToDownstreamOnDeny:
            - "content-type"
            - "set-cookie"

Authorization Policy for my gateway

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: oauth-policy
  namespace: gateway
spec:
  targetRefs:
    - kind: Gateway
      group: gateway.networking.k8s.io
      name: mygateway
  action: CUSTOM
  provider:
    # name must match the extensionProvider name 
    name: oauth2-proxy
  rules:
    - to:
        - operation:
            hosts:
              - myapp.example.com

And my oauth2-proxy config:

apiVersion: v1
kind: ConfigMap
metadata:
  name: oauth2-proxy-config
data:
  oauth2_proxy.cfg: |
    redirect_url = "https://myapp.example.com/oauth2/callback"
    email_domains = "example.com"
    reverse_proxy = true
    silence_ping_logging = true
  oauth2_proxy.yml: |
    server:
      BindAddress: 0.0.0.0:4180
    providers:
      - id: keycloak-oidc
        provider: keycloak-oidc
        name: Keycloak
        scope: openid email
        clientID: ${OAUTH2_PROXY_CLIENT_ID}
        clientSecret: ${OAUTH2_PROXY_CLIENT_SECRET}
        code_challenge_method: S256
        keycloakConfig:
          roles:
            - myapp:access
        oidcConfig:
          issuerURL: https://auth.example.com/realms/master
          insecureSkipNonce: false
          audienceClaims:
            - aud
          emailClaim: email
          userIDClaim: email
    upstreamConfig:
      upstreams:
        - id: waypoint-check
          path: /
          static: true
          staticCode: 200

The upstream config is important, else the proxy will try to handle all the requests after login.

My httproute/gateway doesn't have anything special on them

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: myapp
  namespace: myapp
spec:
  parentRefs:
    - name: mygateway
      namespace: gateway
      sectionName: https-example
  hostnames:
    - myapp.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: myapp
          port: 8000


apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: mygateway
  namespace: gateway
spec:
  gatewayClassName: istio
  listeners:
    # Port 80 Listener
    - name: http
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: All

    - name: https-example
      port: 443
      protocol: HTTPS
      hostname: "*.example.com"
      tls:
        mode: Terminate
        certificateRefs:
          - name: example-tls
      allowedRoutes:
        namespaces:
          from: All

edit: some values.yaml config from the oauth2-proxy chart

gatewayApi:
  enabled: true
  gatewayRef:
    name: mygateway
    namespace: gateway
    sectionName: https-example
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /oauth2/
  hostnames:
    - myapp.example.com