With OpenID Discovery support (https://openid.net/specs/openid-connect-discovery-1_0.html), users do not need to manually enter public key URL. Instead, the public key URL will be automatically discovered. This will simplify the authentication policy configuration.

According to Wayne, Envoy does not support dynamic cluster today. So we probably need to implement it in Pilot.