Move `X-Accel-Redirect` pattern for protected static in kubernetes setup

Question

We are moving to kubernetes and we are totally new to it.

In our current mono service setup we have: Nginx -> Web application. These way we can protect some static assets via authentication in the web application and use internal and X-Accel-Redirect of Nginx to serve static files after authentication takes place.

Now in kubernetes we have Ingress and behind these services:

• web app
• private static service

Is there a way to tell in ingress from the web application to "redirect" the request as we kind of do with sendfile, so that the private static service will reply to it? Or somehow to achieve protecting our static while keeping the static service separate and independent in kubernetes setup?

We kind of made it work by chaining the private static service in front of the web application, but it feels there must be a better way to do it.

Answer 1

Here is how I managed to make it work.

I created two ingresses. First:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
        internal;
    nginx.ingress.kubernetes.io/rewrite-target: /some/path/$1
  name: static-service-internal
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: private-static-service
          servicePort: 80
        path: /protected/(.*)

and second service:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
  name: web-app
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: web-app
          servicePort: 80
        path: /

What you see above is supposed to work as in this example from nginx documentation

When receiving X-Accel-Redirect: /protected/iso.img from web-app then it will request /some/path/iso.img from private static service.

Let me know if this solves you problem.