0

I can't get http basic auth working with nginxinc ingress controller docs: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication

My usecase: I have a Ingress running at web.mydomain.com. I need to add basic HTTP auth to this endpoint. Does anyone have a running example for it?

Here's my basic web Ingress:

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.org/server-snippets: |
      location /auth {
      auth_basic           "Administrator’s Area";
      auth_basic_user_file "/home/madhu/auth";
      }
spec:
  ingressClassName: nginx # use only with k8s version >= 1.18.0
  rules:
  - host: web.mydomain.com
    http:
      paths:
      - path: /
        backend:
          serviceName: web
          servicePort: 80
mayankchutani
  • 273
  • 3
  • 14

2 Answers2

0

You have to create a kubernetes secret :

$ htpasswd -c auth foo
New password: <bar>
New password:
Re-type new password:
Adding password for user foo

$ kubectl create secret generic basic-auth --from-file=auth

$ kubectl get secret basic-auth -o yaml
apiVersion: v1
data:
  auth: Zm9vOiRhcHIxJE9GRzNYeWJwJGNrTDBGSERBa29YWUlsSDkuY3lzVDAK
kind: Secret
metadata:
  name: basic-auth
  namespace: default
type: Opaque

If you use helm copy this output in a file secret.yaml on template folder.

After that, you have to use the auth-secret annotation like this :

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-with-auth
  annotations:
    # type of authentication
    nginx.ingress.kubernetes.io/auth-type: basic
    # name of the secret that contains the user/password definitions
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    # message to display with an appropriate context why the authentication is required
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'
spec:
  rules:
  - host: foo.bar.com
    http:
      paths:
      - path: /
        backend:
          serviceName: http-svc
          servicePort: 80

To see more, read this documentation : https://kubernetes.github.io/ingress-nginx/examples/auth/basic/

Yagora
  • 108
  • 1
  • 1
  • 7
0

I found this post while looking for the same answer, a working basic auth config for nginxinc ingress, using nginx.org. Most everything I found was for Kubernetes nginx ingress, using nginx.ingress.kubernetes.io and that wasn't what I was looking for. This is what I found, specifically for nginxinc and worked for me, hopefully someone else can benefit from it.

Create a secret to hold the username and password

install the htpasswd tool

on Centos

$ sudo yum install httpd-tools

on Debian

$ sudo apt install apache2-utils

generate a new htpasswd file

$ htpasswd -c <filename> <username>  
$ htpasswd -c auth foo  
  New password:  
  Re-type new password:

Create a yaml file to add a kubernetes secret

$ vi kube_auth_secret.yaml  

apiVersion: v1  
kind: Secret  
metadata:  
  name: basic-auth  
type: nginx.org/htpasswd  
stringData:  
  htpasswd: <copy the contents of the htpasswd file here>

  example 
  htpasswd: foo:$apr1$T6zUs/pB$xvCvBUfMvvIk8r12lZz9C0

apply the yaml file to Kubernetes

apply to the default namespace

$ kubectl apply -f kube_auth_secret.yaml

or specify the namespace

$ kubectl apply -f kube_auth_secret.yaml -n <namespace>

create a yaml file to add a kubernetes ingress

$ vi kube_ingress.yaml

apiVersion:networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    nginx.org/basic-auth-realm: Authentication Required   (optional)
    nginx.org/basic-auth-secret: basic-auth   (required - this is the name of the secret)
spec:
  ingressClassName: nginx
  rules:
  - host: web.mydomain.com
    http:
      paths:
      - path: /
        backend:
          serviceName: web
          servicePort: 80

apply the yaml file to Kubernetes

apply to the default namespace

$ kubectl apply -f kube_ingress.yaml

or specify the namespace

$ kubectl apply -f kube_ingress.yaml -n <namespace>

Couple of things...

My Version of kubectl: v4.5.7
My Version of Kubernetes: AWS EKS 1.25
The ingress and secret need to be in the same namespace.
The nginx-ingress namespace needs a service account with access to the secret via a role with access to secrets.

jbert
  • 162
  • 3