K8s -> nginx 入口:SSO
K8s -> nginx Ingress: SSO
我有一项具有 HTTP 基本身份验证的服务。在它前面我有nginx Ingress,他也有basic-auth。如何在使用 Ingress 登录后将授权 header 附加到凭据,以实现 Single-Sign-On?
这是我 Ingress 的配置:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/auth-realm: Authentication Required
nginx.ingress.kubernetes.io/auth-secret: kibana-user-basic-auth
nginx.ingress.kubernetes.io/auth-type: basic
name: kibana-user
namespace: {{.Release.Namespace}}
spec:
tls:
- secretName: kibana-tls
hosts:
- {{.Values.ingress.user.host}}
rules:
- host: {{.Values.ingress.user.host}}
http:
paths:
- backend:
serviceName: kibana-logging
servicePort: {{ .Values.kibana.service.internalPort }}
path: /
我想您可以在 nginx.ingress.kubernetes.io/auth-response-headers
annotation:
中传播授权 header
nginx.ingress.kubernetes.io/auth-response-headers: Authorization
或者,您可以通过 configuration snippet annotation as described here 在目标 Ingress 位置应用 proxy_set_header
来实现相同的方法:
annotations:
nginx.ingress.kubernetes.io/configuration-snippet: |
proxy_set_header Authorization "Basic base64 encode value";
您可以使用注释 nginx.ingress.kubernetes.io/configuration-snippet: proxy_set_header Authorization $http_authorization;
将 Authorization
header 转发到后端服务。
Ingress 资源应如下所示
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/auth-realm: Authentication Required
nginx.ingress.kubernetes.io/auth-secret: kibana-user-basic-auth
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
name: kibana-user
namespace: {{.Release.Namespace}}
spec:
tls:
- secretName: kibana-tls
hosts:
- {{.Values.ingress.user.host}}
rules:
- host: {{.Values.ingress.user.host}}
http:
paths:
- backend:
serviceName: kibana-logging
servicePort: {{ .Values.kibana.service.internalPort }}
path: /
我有一项具有 HTTP 基本身份验证的服务。在它前面我有nginx Ingress,他也有basic-auth。如何在使用 Ingress 登录后将授权 header 附加到凭据,以实现 Single-Sign-On?
这是我 Ingress 的配置:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/auth-realm: Authentication Required
nginx.ingress.kubernetes.io/auth-secret: kibana-user-basic-auth
nginx.ingress.kubernetes.io/auth-type: basic
name: kibana-user
namespace: {{.Release.Namespace}}
spec:
tls:
- secretName: kibana-tls
hosts:
- {{.Values.ingress.user.host}}
rules:
- host: {{.Values.ingress.user.host}}
http:
paths:
- backend:
serviceName: kibana-logging
servicePort: {{ .Values.kibana.service.internalPort }}
path: /
我想您可以在 nginx.ingress.kubernetes.io/auth-response-headers
annotation:
nginx.ingress.kubernetes.io/auth-response-headers: Authorization
或者,您可以通过 configuration snippet annotation as described here 在目标 Ingress 位置应用 proxy_set_header
来实现相同的方法:
annotations:
nginx.ingress.kubernetes.io/configuration-snippet: |
proxy_set_header Authorization "Basic base64 encode value";
您可以使用注释 nginx.ingress.kubernetes.io/configuration-snippet: proxy_set_header Authorization $http_authorization;
将 Authorization
header 转发到后端服务。
Ingress 资源应如下所示
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/auth-realm: Authentication Required
nginx.ingress.kubernetes.io/auth-secret: kibana-user-basic-auth
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
name: kibana-user
namespace: {{.Release.Namespace}}
spec:
tls:
- secretName: kibana-tls
hosts:
- {{.Values.ingress.user.host}}
rules:
- host: {{.Values.ingress.user.host}}
http:
paths:
- backend:
serviceName: kibana-logging
servicePort: {{ .Values.kibana.service.internalPort }}
path: /