OP here.

We use the envoy authz filter.

For every incoming request envoy first calls out to a custom auth check service with all the request metadata like path and http headers.

The auth service can return a “fail” response which indicates to not forward the original request any further. Or it can return a “pass” response plus data to add to the original request headers.

Docs here:

https://www.envoyproxy.io/docs/envoy/latest/configuration/ht...

Can't speak for OP, but we have a similar stack and use middleware on the actual services since they need to decide which permissions are needed instead of centralized auth at the gateway level.

The funny thing with envoy is that you can take the source of the authz service and build your own auth-mechanism for other protocols. We are doing that for MQTT