Kubernetes Nginx Ingress Oauth question #135
Replies: 4 comments 3 replies
-
|
Not sure but I am wondering if the issue has already been discussed here with regards to this perhaps? Nginx Ingress service |
Beta Was this translation helpful? Give feedback.
-
|
Hi @sonamsamdupkhangsar, let me take a look at this and get back to you. Thanks. |
Beta Was this translation helpful? Give feedback.
-
|
Ok, I managed to make it work by following the official example. Initially, I was hit by the same issue as yours. Then, I checked the kubectl get pods -l k8s-app=oauth2-proxy -AThe output looks similar to: So basically, the Going further, I figured out that I set the
You cannot put a piece of executable code in an environment variable from a YAML manifest, and expect for the underlying application to execute it, no ? Going a little bit off topic here - this is a big security risk in general, because we don't want to let users to have the flexibility to execute arbitrary code via environment variables. So, I went back and python -c 'import os,base64; print(base64.b64encode(os.urandom(16)).decode("ascii"))'Note: The Then, I pasted the result in the Went back to the web browser, and when I entered the Please let me know how it goes, and if this is the same issue you are facing. Thanks. |
Beta Was this translation helpful? Give feedback.
-
|
Just to be on the same page, here is my ---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-echo
namespace: backend
annotations:
nginx.ingress.kubernetes.io/auth-url: "https://echo.starter-kit.online/oauth2/auth"
nginx.ingress.kubernetes.io/auth-signin: "https://echo.starter-kit.online/oauth2/start?rd=$escaped_request_uri"
spec:
tls:
- hosts:
- "*.starter-kit.online"
secretName: starter-kit.online
rules:
- host: echo.starter-kit.online
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: echo
port:
number: 8080
ingressClassName: nginx
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: oauth2-proxy
namespace: kube-system
spec:
ingressClassName: nginx
rules:
- host: echo.starter-kit.online
http:
paths:
- path: /oauth2
pathType: Prefix
backend:
service:
name: oauth2-proxy
port:
number: 4180
tls:
- hosts:
- "*.starter-kit.online"
secretName: starter-kit.online |
Beta Was this translation helpful? Give feedback.
-
|
Hi @v-ctiutiu However, I had to update my Ingress Nginx to get this working by doing a upgrade with my new nginx-values-v4.0.17.yaml values with the following annotation (mydomain is my domain name to replaced): My Nginx Ingress values has the following contents now: Did you have to add that annotation too? thanks |
Beta Was this translation helpful? Give feedback.
-
|
Yes, I had to add the Initially, it worked for me because I didn't use the proxy protocol feature. But, after enabling proxy protocol, I started to receive 500 errors just as you did. Explanations for why that special annotation is needed can be found here, and here. Quoting the official explanation:
In your case (and mine as well), it's a broken communication between the two main Pods that are implied in the transaction: If you take a look at the logs of one of the Dissecting the above, you will notice this part: You can clearly see that the Pods try to communicate over the external LB IP address (in my case it's The SSL handshake issue can be noticed below, where we got some broken headers: Hope it helps. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you @v-ctiutiu for the helpful clarification. |
Beta Was this translation helpful? Give feedback.
-
I am not sure if this is the right place to ask this question but I was curious if you have any ideas about securing an ingress with oauth.
I have followed your tutorials on setting up Nginx Ingress controller with widlcard certificates for subdomains.
I am trying to secure my echo.mydomain.com using Oauth with Github application.
I am following this example from Nginx documentation for external authentication .
I have the following in my 'ingress-echo.yaml':
When I open echo.sonam.cloud I see 500 errors. It seems like it doesn't like external https or http endpoints outside of my k8 cluster. Not sure if you have any ideas.
Thanks
Beta Was this translation helpful? Give feedback.
All reactions