ingress external auth

[vito21]

Hello all,

i`m currently testing the exposing of services with ingress and external auth like here described:

https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx/examples/external-auth

so i specified following ingress resource:

apiVersion: extensions/v1beta1

kind: Ingress

metadata:

  annotations:

    ingress.kubernetes.io/auth-url: "https://external.auth.de:5556"

    #kubernetes.io/ingress.allow-http: "true"

  name: ingress-monitoring

  namespace: monitoring

spec:

  #tls:

  #- hosts:

  #  - prometheus.example.com

  #  - grafana.example.com

  #  secretName: example-tls

  rules:

  - host: prometheus-svc.monitoring.xxxxxx.de

    http:

      paths:

      - path: /

        backend:

          serviceName: prometheus-svc

          servicePort: 9090

      - path: /alertmanager

        backend:

          serviceName: alertmanager

          servicePort: 9093

  - host: grafana.monitoring.xxxxxx.de

    http:

      paths:

      - path: /

        backend:

          serviceName: grafana

          servicePort: 3000

prometheus and grafana are accesible without any redirection or authentication to the external configured url.

could any one point me in right direction where i making mistakes? Are the fabric8 included ingress able to use external auth?

Thanks

[Roland Huss]

Hi,

the fabric8 ingress controller, which actually is the standard Nginx
provided by https://github.com/nginxinc/kubernetes-ingress controller,
does not support these annotations (afais).

These annotations seems to be specific to the Kubernetes contributed
Ingress controller at
https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx

I wonder, whether fabric8 should switch to this controller as on a first
sight it seems to support more options ?

regards ...
... roland

> --
> You received this message because you are subscribed to the Google
> Groups "fabric8" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to fabric8+u...@googlegroups.com
> <mailto:fabric8+u...@googlegroups.com>.
> For more options, visit https://groups.google.com/d/optout.

[vito21]

Thanks for your answer.

i had a deeper look in it. And yes you are going right. The mentioned nginx does not support this annotations. :-( Also the kubernetes ingress support many additional features for example:

exposing tcp services

exposing udp services

auth external

auth basic

https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx

maybe fabric8 will switch to the kubernetes ingress in the future?

[Jasmine Hegman]

For fabric8's exposecontroller to switch one important factor is Ingress vs ConfigMap.

The contrib nginx Ingress Controller does not support Ingress objects, but only ConfigMaps right now.

Fabric8's exposecontroller DOES provide the ability to modify ConfigMaps, but I think they have to be manually created with a special annotation that gets picked up. https://github.com/fabric8io/exposecontroller#configmap