OAuth2-代理身份验证中使用主从属Nginx入口的方法

Question

我有一个运行在kubernetes集群中的应用程序，它使用TLS和oauth2身份验证作为Nginx的一部分。这一切都运行良好，但我现在想要分割我的入口，以便我有一个主人和一些仆从，确保所有的身份验证是处理完整的主机域。当我这么做的时候，被迫的信号中断了。如果手动添加路径，我仍然可以到达它，但是它不再需要到达应用程序。这有可能解决吗？

示例

规则入口

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-app-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    nginx.ingress.kubernetes.io/auth-url: "https://my-app.com/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://my-app.com/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
spec:
  tls:
  - secretName: my-app-com-tls
    hosts:
    - my-app.com
  rules:
  - host: my-app.com
    http:
      paths:
      - path: /(.*)
        backend:
          serviceName: my-app
          servicePort: 80
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: oauth2-proxy
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    kubernetes.io/ingress.class: nginx
  labels:
    app: oauth2-proxy
    app.kubernetes.io/managed-by: Helm
    chart: oauth2-proxy-3.1.0
    heritage: Helm
    release: oauth2-proxy
spec:
  rules:
  - host: my-app.com
    http:
      paths:
      - backend:
          serviceName: oauth2-proxy
          servicePort: 80
        path: /oauth2
  tls:
  - hosts:
    - my-app.com
    secretName: my-app-com-tls

主人仆从

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-app-ingress-master
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.org/mergeable-ingress-type: "master"
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/auth-url: "https://my-app.com/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://my-app.com/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
spec:
  tls:
  - secretName: my-app-com-tls
    hosts:
    - my-app.com
  rules:
  - host: my-app.com
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-app-ingress-minion
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.org/mergeable-ingress-type: "minion"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
  - host: my-app.com
    http:
      paths:
      - path: /(.*)
        backend:
          serviceName: my-app
          servicePort: 80
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: oauth2-proxy
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.org/mergeable-ingress-type: minion
  labels:
    app: oauth2-proxy
    app.kubernetes.io/managed-by: Helm
    chart: oauth2-proxy-3.1.0
    heritage: Helm
    release: oauth2-proxy
spec:
  rules:
  - host: my-app.com
    http:
      paths:
      - backend:
          serviceName: oauth2-proxy
          servicePort: 80
        path: /oauth2

Answer 1

结果发现，我无意中发现了在两个不同的nginx入口控制器包(尼尼辛和库伯奈特斯)中定义的特性。因此，它中断的原因很简单，就是在我的集群中实际使用的控制器中没有对主从属层次结构的支持。在另一个包中，似乎没有任何对身份验证的支持。

我创造了一个特色建议。