http basic auth example with nginx ingress controller (nginxinc) - nginx-config

Question

I can't get http basic auth working with nginxinc ingress controller docs: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication
My usecase:
I have a Ingress running at web.mydomain.com. I need to add basic HTTP auth to this endpoint.
Does anyone have a running example for it?
Here's my basic web Ingress:
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: cafe-ingress
annotations:
kubernetes.io/ingress.class: nginx
nginx.org/server-snippets: |
location /auth {
auth_basic "Administrator’s Area";
auth_basic_user_file "/home/madhu/auth";
}
spec:
ingressClassName: nginx # use only with k8s version >= 1.18.0
rules:
- host: web.mydomain.com
http:
paths:
- path: /
backend:
serviceName: web
servicePort: 80

Answer 1

You have to create a kubernetes secret :
$ htpasswd -c auth foo
New password: <bar>
New password:
Re-type new password:
Adding password for user foo
$ kubectl create secret generic basic-auth --from-file=auth
$ kubectl get secret basic-auth -o yaml
apiVersion: v1
data:
auth: Zm9vOiRhcHIxJE9GRzNYeWJwJGNrTDBGSERBa29YWUlsSDkuY3lzVDAK
kind: Secret
metadata:
name: basic-auth
namespace: default
type: Opaque
If you use helm copy this output in a file secret.yaml on template folder.
After that, you have to use the auth-secret annotation like this :
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: ingress-with-auth
annotations:
# type of authentication
nginx.ingress.kubernetes.io/auth-type: basic
# name of the secret that contains the user/password definitions
nginx.ingress.kubernetes.io/auth-secret: basic-auth
# message to display with an appropriate context why the authentication is required
nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'
spec:
rules:
- host: foo.bar.com
http:
paths:
- path: /
backend:
serviceName: http-svc
servicePort: 80
To see more, read this documentation : https://kubernetes.github.io/ingress-nginx/examples/auth/basic/