Google Kubernetes Engine (GKE) Ingress w/auth-url

Question

I wish I could have found my answer elsewhere, but the lack of documentation has sent me groveling for help :)

I have been following this tutorial as a starting point. I can follow the steps through to the end with great success. But when I modify the ingress to do what I am trying to accomplish, nothing happens.

The tutorial has you create an ingress with the following .yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: basic-ingress
spec:
  backend:
    serviceName: nginx
    servicePort: 80

What I am trying to do is modify the ingress so that it can utilize the auth-url annotation and in the end my ingress.yaml I am failing with looks like

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: basic-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/auth-url: https://someauth.com/path/to/my/auth
spec:
  backend:
    serviceName: nginx
    servicePort: 80

In order to use the annotation, I found that I needed to include the kubernetes.io/ingress.class: "nginx" annotation to use the appropriate ingress. Basically though, this does nothing. I can hit the backend nginx cluster without my auth getting touched. Like these annotations are not even there.

Does GKE not support the nginx ingress controller? Is something fundamentally wrong with my yaml? Does the gce ingress controller have an annotation that could accomplish the same thing?

What I am trying to accomplish is: A client makes a call to my service, the loadbalancer/proxy first authenticates the request with an external endpoint, if auth is successful, the proxy sends the call along to my service (all without a single redirect response sent to the client). Basically what nginx auth_request does which is what I assume this auth-url annotation leverages under the covers.

Thanks!

Answer 1

GKE has its own Ingress Controller. It is called GKE Ingress Controller. If you want to use Nginx Ingress Controller, you need to manage it yourself.

Looks like auth-url annotation works only on Nginx Ingress Controller. So, you have to run Nginx Ingress Controller first.

See this post on how to do that on GKE.

Hope it helps.