使用 Azure Active Directory 的 NGINX Ingress 外部 oauth

Question

我想使用 Azure Active Directory 作为外部 oauth2 提供程序来保护入口级别的服务。过去，我使用基本的誓言，一切都按预期进行。但是nginx提供了extern ouath方法，听起来舒服多了！

为此我创建了一个 SP：

$ az ad sp create-for-rbac  --skip-assignment --name test -o table

AppId                 DisplayName        Name               Password                   Tenant
<AZURE_CLIENT_ID>     test               http://test        <AZURE_CLIENT_SECRET>      <TENANT_ID>

我的入口资源：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: nginx-ingress
  namespace: ingress-nginx
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
    # nginx.ingress.kubernetes.io/auth-type: basic
    # nginx.ingress.kubernetes.io/auth-secret: basic-auth
    # nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required'

和 externel-oauth：

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: oauth2-proxy
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: oauth2-proxy
  template:
    metadata:
      labels:
        app: oauth2-proxy
    spec:
      containers:
      - args:
        - --provider=azure
        - --email-domain=microsoft.com
        - --upstream=file:///dev/null
        - --http-address=0.0.0.0:4180
        - --azure-tenant=$AZURE_TENANT_ID
        env:
          - name: OAUTH2_PROXY_CLIENT_ID
            value: $API_CLIENT_ID
          - name: OAUTH2_PROXY_CLIENT_SECRET
            value: $API_CLIENT_SECRET
          - name: OAUTH2_PROXY_COOKIE_SECRET
            value: $API_COOKIE_SECRET
          # created by docker run -ti --rm python:3-alpine python -c 'import secrets,base64; print(base64.b64encode(base64.b64encode(secrets.token_bytes(16))));
        image: docker.io/colemickens/oauth2_proxy:latest
        imagePullPolicy: Always
        name: oauth2-proxy
        ports:
        - containerPort: 4180
          protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  name: oauth2-proxy
  namespace: kube-system
spec:
  ports:
  - name: http
    port: 4180
    protocol: TCP
    targetPort: 4180
  selector:
    app: oauth2-proxy

看起来出了点问题，但我不知道我错过了什么。当我尝试进入该页面时，它最多加载一分钟并以“500 内部服务器错误”结束。入口控制器的日志显示以下无限循环：

10.244.2.1 - - [16/Jan/2020:15:32:30 +0000] "GET /oauth2/auth HTTP/1.1" 499 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/xxxxx Safari/xxxx" 727 0.003 [upstream-default-backend] [] - - - - <AZURE_CLIENT_ID>

Answer 1

因此您还需要另一个用于 oAuth 部署的入口。我的设置如下所示：

---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: grafana-ingress-oauth
  namespace: grafana 
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
    - host: xxx
      http:
        paths:
          - path: /oauth2
            backend:
              serviceName: oauth2-proxy
              servicePort: 4180
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: grafana-ingress
  namespace: grafana
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    certmanager.k8s.io/cluster-issuer: letsencrypt-production
    ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
spec:
  rules:
    - host: xxx
      http:
        paths:
          - path: /
            backend:
              serviceName: grafana
              servicePort: 80

这样第二个入口重定向到第一个，第一个进行身份验证并重定向回来

使用 Azure Active Directory 的 NGINX Ingress 外部 oauth

NGINX Ingress external oauth with Azure Active Directory

azure

azure-active-directory

kubernetes

nginx-ingress