2017-10-13 13:55:03 +00:00
|
|
|
# Basic Authentication
|
2017-07-16 20:22:08 +00:00
|
|
|
|
|
|
|
|
This example shows how to add authentication in a Ingress rule using a secret that contains a file generated with `htpasswd`.
|
2018-05-30 07:52:47 +00:00
|
|
|
It's important the file generated is named `auth` (actually - that the secret has a key `data.auth`), otherwise the ingress-controller returns a 503.
|
2017-07-16 20:22:08 +00:00
|
|
|
|
2022-01-17 00:57:28 +00:00
|
|
|
## Create htpasswd file
|
|
|
|
|
|
2017-10-13 13:55:03 +00:00
|
|
|
```console
|
2017-07-16 20:22:08 +00:00
|
|
|
$ htpasswd -c auth foo
|
|
|
|
|
New password: <bar>
|
|
|
|
|
New password:
|
|
|
|
|
Re-type new password:
|
|
|
|
|
Adding password for user foo
|
|
|
|
|
```
|
|
|
|
|
|
2022-01-17 00:57:28 +00:00
|
|
|
## Convert htpasswd into a secret
|
|
|
|
|
|
2017-10-13 13:55:03 +00:00
|
|
|
```console
|
2017-07-16 20:22:08 +00:00
|
|
|
$ kubectl create secret generic basic-auth --from-file=auth
|
|
|
|
|
secret "basic-auth" created
|
|
|
|
|
```
|
|
|
|
|
|
2022-01-17 00:57:28 +00:00
|
|
|
## Examine secret
|
|
|
|
|
|
2017-10-13 13:55:03 +00:00
|
|
|
```console
|
2017-07-16 20:22:08 +00:00
|
|
|
$ kubectl get secret basic-auth -o yaml
|
|
|
|
|
apiVersion: v1
|
|
|
|
|
data:
|
|
|
|
|
auth: Zm9vOiRhcHIxJE9GRzNYeWJwJGNrTDBGSERBa29YWUlsSDkuY3lzVDAK
|
|
|
|
|
kind: Secret
|
|
|
|
|
metadata:
|
|
|
|
|
name: basic-auth
|
|
|
|
|
namespace: default
|
|
|
|
|
type: Opaque
|
|
|
|
|
```
|
|
|
|
|
|
2022-01-17 00:57:28 +00:00
|
|
|
## Using kubectl, create an ingress tied to the basic-auth secret
|
|
|
|
|
|
2017-10-13 13:55:03 +00:00
|
|
|
```console
|
2022-01-17 00:57:28 +00:00
|
|
|
$ echo "
|
2021-08-21 20:42:00 +00:00
|
|
|
apiVersion: networking.k8s.io/v1
|
2017-07-16 20:22:08 +00:00
|
|
|
kind: Ingress
|
|
|
|
|
metadata:
|
|
|
|
|
name: ingress-with-auth
|
|
|
|
|
annotations:
|
|
|
|
|
# type of authentication
|
2017-11-24 18:46:51 +00:00
|
|
|
nginx.ingress.kubernetes.io/auth-type: basic
|
2017-07-16 20:22:08 +00:00
|
|
|
# name of the secret that contains the user/password definitions
|
2017-11-24 18:46:51 +00:00
|
|
|
nginx.ingress.kubernetes.io/auth-secret: basic-auth
|
2018-02-07 15:22:34 +00:00
|
|
|
# message to display with an appropriate context why the authentication is required
|
2018-07-16 18:22:19 +00:00
|
|
|
nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'
|
2017-07-16 20:22:08 +00:00
|
|
|
spec:
|
2021-11-09 15:43:49 +00:00
|
|
|
ingressClassName: nginx
|
2017-07-16 20:22:08 +00:00
|
|
|
rules:
|
|
|
|
|
- host: foo.bar.com
|
|
|
|
|
http:
|
|
|
|
|
paths:
|
|
|
|
|
- path: /
|
2021-11-02 00:12:58 +00:00
|
|
|
pathType: Prefix
|
2017-07-16 20:22:08 +00:00
|
|
|
backend:
|
2021-11-02 00:12:58 +00:00
|
|
|
service:
|
|
|
|
|
name: http-svc
|
|
|
|
|
port:
|
|
|
|
|
number: 80
|
2017-07-16 20:22:08 +00:00
|
|
|
" | kubectl create -f -
|
|
|
|
|
```
|
|
|
|
|
|
2022-01-17 00:57:28 +00:00
|
|
|
## Use curl to confirm authorization is required by the ingress
|
|
|
|
|
|
2017-07-16 20:22:08 +00:00
|
|
|
```
|
|
|
|
|
$ curl -v http://10.2.29.4/ -H 'Host: foo.bar.com'
|
|
|
|
|
* Trying 10.2.29.4...
|
|
|
|
|
* Connected to 10.2.29.4 (10.2.29.4) port 80 (#0)
|
|
|
|
|
> GET / HTTP/1.1
|
|
|
|
|
> Host: foo.bar.com
|
|
|
|
|
> User-Agent: curl/7.43.0
|
|
|
|
|
> Accept: */*
|
|
|
|
|
>
|
|
|
|
|
< HTTP/1.1 401 Unauthorized
|
|
|
|
|
< Server: nginx/1.10.0
|
|
|
|
|
< Date: Wed, 11 May 2016 05:27:23 GMT
|
|
|
|
|
< Content-Type: text/html
|
|
|
|
|
< Content-Length: 195
|
|
|
|
|
< Connection: keep-alive
|
|
|
|
|
< WWW-Authenticate: Basic realm="Authentication Required - foo"
|
|
|
|
|
<
|
|
|
|
|
<html>
|
|
|
|
|
<head><title>401 Authorization Required</title></head>
|
|
|
|
|
<body bgcolor="white">
|
|
|
|
|
<center><h1>401 Authorization Required</h1></center>
|
|
|
|
|
<hr><center>nginx/1.10.0</center>
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
|
|
|
|
* Connection #0 to host 10.2.29.4 left intact
|
|
|
|
|
```
|
|
|
|
|
|
2022-01-17 00:57:28 +00:00
|
|
|
## Use curl with the correct credentials to connect to the ingress
|
|
|
|
|
|
2017-07-16 20:22:08 +00:00
|
|
|
```
|
|
|
|
|
$ curl -v http://10.2.29.4/ -H 'Host: foo.bar.com' -u 'foo:bar'
|
|
|
|
|
* Trying 10.2.29.4...
|
|
|
|
|
* Connected to 10.2.29.4 (10.2.29.4) port 80 (#0)
|
|
|
|
|
* Server auth using Basic with user 'foo'
|
|
|
|
|
> GET / HTTP/1.1
|
|
|
|
|
> Host: foo.bar.com
|
|
|
|
|
> Authorization: Basic Zm9vOmJhcg==
|
|
|
|
|
> User-Agent: curl/7.43.0
|
|
|
|
|
> Accept: */*
|
|
|
|
|
>
|
|
|
|
|
< HTTP/1.1 200 OK
|
|
|
|
|
< Server: nginx/1.10.0
|
|
|
|
|
< Date: Wed, 11 May 2016 06:05:26 GMT
|
|
|
|
|
< Content-Type: text/plain
|
|
|
|
|
< Transfer-Encoding: chunked
|
|
|
|
|
< Connection: keep-alive
|
|
|
|
|
< Vary: Accept-Encoding
|
|
|
|
|
<
|
|
|
|
|
CLIENT VALUES:
|
|
|
|
|
client_address=10.2.29.4
|
|
|
|
|
command=GET
|
|
|
|
|
real path=/
|
|
|
|
|
query=nil
|
|
|
|
|
request_version=1.1
|
|
|
|
|
request_uri=http://foo.bar.com:8080/
|
|
|
|
|
|
|
|
|
|
SERVER VALUES:
|
|
|
|
|
server_version=nginx: 1.9.11 - lua: 10001
|
|
|
|
|
|
|
|
|
|
HEADERS RECEIVED:
|
|
|
|
|
accept=*/*
|
|
|
|
|
connection=close
|
|
|
|
|
host=foo.bar.com
|
|
|
|
|
user-agent=curl/7.43.0
|
2020-11-26 02:51:15 +00:00
|
|
|
x-request-id=e426c7829ef9f3b18d40730857c3eddb
|
2017-07-16 20:22:08 +00:00
|
|
|
x-forwarded-for=10.2.29.1
|
|
|
|
|
x-forwarded-host=foo.bar.com
|
|
|
|
|
x-forwarded-port=80
|
|
|
|
|
x-forwarded-proto=http
|
|
|
|
|
x-real-ip=10.2.29.1
|
2020-11-26 02:51:15 +00:00
|
|
|
x-scheme=http
|
2017-07-16 20:22:08 +00:00
|
|
|
BODY:
|
|
|
|
|
* Connection #0 to host 10.2.29.4 left intact
|
|
|
|
|
-no body in request-
|
|
|
|
|
```
|
