search

hyperadev / kani

A fast Traefik forward-auth server for validating Cloudflare Access requests
MIT License
15 stars 1 forks source link

ingress-nginx example #86

Open clrxbl opened 4 months ago

clrxbl commented 4 months ago

Hi.

Thanks for creating this project. While it was intended to be used for Traefik, this project seems to work well when using ingress-nginx (and presumably other ingress controllers) aswell. I think it would be beneficial to provide an example for other reverse proxies, or at least ingress-nginx as it tends to be a pretty popular ingress controller.

For ingress-nginx, an ingress can be annotated with 

nginx.ingress.kubernetes.io/auth-url: "http://kani.kube-system.svc.cluster.local:3000/<AUD>"

With an invalid AUD set, it will 401 as expected. Headers can probably be forwarded aswell with an auth-snippet of some sort, but haven't looked into it yet as I don't have a usecase for it.

joshuasing commented 4 months ago

@clrxbl Hi, thank you so much!

I wasn't aware that the Nginx ingress also supported a similar concept, as I have primarily used Traefik. Thank you for bringing this to my attention, I will add an example for Nginx soon, and if I can figure out the header forwarding, I'll try to include an example with that too.