无法配置 Kubernetes nginx 入口基本身份验证

Question

我正在尝试为我的测试入口规则设置基本身份验证，但我不知道为什么它不起作用。我仍然可以在没有密码提示的情况下访问该站点。

版本： EKS 1.16
Helm 图表 nginx-ingress-0.5.2
Nginx 版本 1.7.2（也尝试使用 1.7.0 和最新版本）

basic-auth秘密内容：

kubectl get secret basic-auth -o yaml
apiVersion: v1
data:
  auth: Zm9vOiRhcHIxJHZ4RzVoc1VQJE1KZmpNcEQ2WHdPV1RaaTFDQUdlYTEK
kind: Secret
metadata:
  creationTimestamp: "2020-07-02T04:46:58Z"
  name: basic-auth
  namespace: default
  resourceVersion: "8252"
  selfLink: /api/v1/namespaces/default/secrets/basic-auth
  uid: e3b8a6d3-009b-4a4c-ad8b-b460381933d8
type: Opaque

入口规则：

Ingress rule:
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: hello-world-ing
  annotations:
    kubernetes.io/ingress.class: "nginx"
    # type of authentication
    nginx.ingress.kubernetes.io/auth-type: basic
    # name of the secret that contains the user/password definitions
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    # message to display with an appropriate context why the authentication is required
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'
spec:
  rules:
  - host: test.*****.com
    http:
      paths:
      - backend:
          serviceName: docker-hello-world-svc
          servicePort: 8088

此外，我还没有在 hello-world-ing 服务的 nginx 控制器配置文件中找到 basic-auth 部分：

kubectl -n nginx-ingress exec -it dev-nginx-ingress-6d5f459bf5-s4qqg -- cat /etc/nginx/conf.d/default-hello-world-ing.conf  
***
    location / {
        proxy_http_version 1.1;
        proxy_connect_timeout 60s;
        proxy_read_timeout 60s;
        proxy_send_timeout 60s;
        client_max_body_size 1m;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering on;
        proxy_pass http://default-hello-world-ing-***-docker-hello-world-svc-8088;
    }  
***

我在控制器日志中没有发现任何可疑的东西。

Answer 1

基本身份验证与另一个 helm repo stable/nginx-ingress 而不是 nginx-stable/nginx-ingress.

一起工作正常

nginx-stable repository is for the commercial Nginx/NginxPlus that uses different configurations while the official Helm stable/nginx-ingress使用开源的nginx ingress。

无法配置 Kubernetes nginx 入口基本身份验证

Can't configure Kubernetes nginx ingress basic auth

nginx

kubernetes

amazon-eks