External Auth across multiple clusters / centralized auth service support

*Description*:
Hi,

I'm trying to implement OAuth2/OIDC authentication across multiple Kubernetes clusters using Envoy Gateway, and I'm running into limitations with both available approaches.

Method 1: External Auth (HTTPExtAuthService)

The issue is that backendRefs requires a Kubernetes Service, which effectively forces the external auth service to run inside the same cluster (or be exposed via a Service abstraction).

This prevents me from using a centralized authentication service shared across multiple clusters, which was possible with other solutions like ingress-nginx (using external URLs).

Questions:

Is there any recommended way to reference an external (non-cluster) auth service in Envoy Gateway?
Are there plans to support direct URL-based backends or a more flexible backend type for ExtAuth?

Method 2: Native OIDC support

The built-in OIDC support works well, but it requires configuring a separate client/application per cluster in the Identity Provider.

In a multi-cluster environment, this becomes operationally difficult to maintain.

Questions:

Is there a recommended pattern for reusing the same OIDC client across multiple Envoy Gateway instances?

Ideally, I would like to:

Keep authentication centralized
Avoid deploying oauth2-proxy in every cluster
Avoid creating multiple OIDC clients in the IdP