K8s -> nginx 入口：SSO

Question

我有一项具有 HTTP 基本身份验证的服务。在它前面我有nginx Ingress，他也有basic-auth。如何在使用 Ingress 登录后将授权 header 附加到凭据，以实现 Single-Sign-On?

这是我 Ingress 的配置：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-realm: Authentication Required
    nginx.ingress.kubernetes.io/auth-secret: kibana-user-basic-auth
    nginx.ingress.kubernetes.io/auth-type: basic
  name: kibana-user
  namespace: {{.Release.Namespace}}
spec:
  tls:
  - secretName: kibana-tls
    hosts:
    - {{.Values.ingress.user.host}}
  rules:
  - host: {{.Values.ingress.user.host}}
    http:
      paths:
      - backend:
          serviceName: kibana-logging
          servicePort: {{ .Values.kibana.service.internalPort }}
        path: /

Answer 1

我想您可以在 nginx.ingress.kubernetes.io/auth-response-headers annotation:

中传播授权 header

nginx.ingress.kubernetes.io/auth-response-headers: Authorization

或者，您可以通过 configuration snippet annotation as described here 在目标 Ingress 位置应用 proxy_set_header 来实现相同的方法：

annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
        proxy_set_header Authorization "Basic base64 encode value";

Answer 2

您可以使用注释 nginx.ingress.kubernetes.io/configuration-snippet: proxy_set_header Authorization $http_authorization; 将 Authorization header 转发到后端服务。

Ingress 资源应如下所示

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-realm: Authentication Required
    nginx.ingress.kubernetes.io/auth-secret: kibana-user-basic-auth
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/configuration-snippet: "proxy_set_header Authorization $http_authorization;"
  name: kibana-user
  namespace: {{.Release.Namespace}}
spec:
  tls:
  - secretName: kibana-tls
    hosts:
    - {{.Values.ingress.user.host}}
  rules:
  - host: {{.Values.ingress.user.host}}
    http:
      paths:
      - backend:
          serviceName: kibana-logging
          servicePort: {{ .Values.kibana.service.internalPort }}
        path: /

K8s -> nginx 入口：SSO

K8s -> nginx Ingress: SSO

authentication

kubernetes

single-sign-on

nginx-ingress