Play With Ingress Authentication

$ cat <<EOF | kubectl create -f -
apiVersion: v1 kind: Secret type: Opaque metadata: name:
myingressauthsecret data: auth:
dXNlcjE6LzRldUkxTS9MWXVvdXhmdVB5TkcuN2cuZzE= EOF

Finally, we create the Ingress based on the annotations. 

$ cat <<EOF | kubectl create -f -
apiVersion: extensions/v1beta1 kind: Ingress metadata: name:
<ingress-name> annotations: ingress.kubernetes.io/auth-type:
basic # name of the secret that contains the user/password
definitions ingress.kubernetes.io/auth-secret:
myingressauthsecret ingress.kubernetes.io/auth-realm:
"Authentication Required - foo" spec: rules:

- host: <yourchoice>.<cluster-id>.k8s.gigantic.io http:
  paths: - path: / backend: serviceName: <service-name>
  servicePort: <service-port> EOF

The problem with this solution

Great, we now have a very simple, though not extremely secure, functioning authentication. Unfortunately it's not very practical, making it difficult to manage and to change access. To overcome this problem we created a small application called Ingress Auth Generator that helps manage passwords. It works according to a simple principle. It specifically scans the Ingresses for the auth-secret annotation. After it looks up the secret and finds a username/password field, it generates the correct values instead of the auth attribute. This tool comes in handy when performing a manual release or testing. For example, manually setting the password when deploying a Helm chart

$ helm install --set global.password=example

Add Banzai Cloud Helm repository

Add Banzai Cloud Helm repo and build the dependencies

Install the demo chart with params

Test the login

Conclusion

First, keep in mind that when using Basic authentication https is required. The simplest way of dealing with this in Kubernetes is the Cert-manager. We definitely need a stronger solution for production - check out how we are accomplishing this in Pipeline using OAuth2 and Vault. If you'd like your clusters and deployments to be provisioned on multiple cloud providers and to have their security automatically set up for you, you should consider Pipeline.