使用 master - minion Nginx 入口和 oauth2-proxy 身份验证

Question

I have an app running in a kubernetes cluster that uses TLS and oauth2 authentication as part of the Nginx ingress. It all runs fine but I now want to split my ingresses so that I have a master and a number of minions, making sure that all the authentication is handles for the complete host domain. When I do this the forced signin breaks. I can still reach it if I add the path manually but it is no longer required to reach the application. Is this possible to solve?

Example
Regular ingress

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-app-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    nginx.ingress.kubernetes.io/auth-url: "https://my-app.com/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://my-app.com/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
spec:
  tls:
  - secretName: my-app-com-tls
    hosts:
    - my-app.com
  rules:
  - host: my-app.com
    http:
      paths:
      - path: /(.*)
        backend:
          serviceName: my-app
          servicePort: 80
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: oauth2-proxy
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    kubernetes.io/ingress.class: nginx
  labels:
    app: oauth2-proxy
    app.kubernetes.io/managed-by: Helm
    chart: oauth2-proxy-3.1.0
    heritage: Helm
    release: oauth2-proxy
spec:
  rules:
  - host: my-app.com
    http:
      paths:
      - backend:
          serviceName: oauth2-proxy
          servicePort: 80
        path: /oauth2
  tls:
  - hosts:
    - my-app.com
    secretName: my-app-com-tls

Master - minion

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-app-ingress-master
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.org/mergeable-ingress-type: "master"
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/auth-url: "https://my-app.com/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://my-app.com/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
spec:
  tls:
  - secretName: my-app-com-tls
    hosts:
    - my-app.com
  rules:
  - host: my-app.com
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-app-ingress-minion
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.org/mergeable-ingress-type: "minion"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
  - host: my-app.com
    http:
      paths:
      - path: /(.*)
        backend:
          serviceName: my-app
          servicePort: 80
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: oauth2-proxy
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.org/mergeable-ingress-type: minion
  labels:
    app: oauth2-proxy
    app.kubernetes.io/managed-by: Helm
    chart: oauth2-proxy-3.1.0
    heritage: Helm
    release: oauth2-proxy
spec:
  rules:
  - host: my-app.com
    http:
      paths:
      - backend:
          serviceName: oauth2-proxy
          servicePort: 80
        path: /oauth2

Answer 1

It turns out that I had unintentionally found features that were defined in two different nginx-ingress-controller packages ( nginxinc and kubernetes ). So the reason that it breaks is simply that there is no support for master - minion hierarchy in the controller I am actually using in my cluster. And there seems not to be any support for the authentication in the other package.

I have created a feature suggestion.