K
Q

Kubernetes Google OAuth2 Sign In

3/17/2020

I'm trying to figure this out for a while and can't seem to find an answer anywhere. Maybe someone here will have an idea.

I have deployed an application on Kubernetes Cluster (in GCP). The Application is pretty much a micro-service type of app under a single domain. What I'm trying to achieve at the moment is to have a domain-wide-authentication via Google and OAuth2 protocol. So I have a main app under the main domain https://example.com and pretty much every single path under that domain will be a separate K8s Service + Deployment. So it's a different set of containers for https://example.com/foo and different for https://example.com/bar and obviously different set of containers for the main https://example.com. I don't want to "connect" each individual App to Google due to two reasons:

  1. Would require for me that each app has the OAuth2 Protocol implemented, and
  2. A token granted by one app would be invalid for the other one, so it would require the user to log in each time he/she changes the URL, kind bad UX if you ask me

So, I'm trying to set up in the Kubernetes Cluster an Nginx Ingress Controller that would facilitate authentication and validate all incoming requests before they would reach any of the backend apps. This is where the problem lies...

I've managed to set up OAuth2 Proxy in my Nginx Ingress Controller and the user can log in. The whole OAuth2 Flow works. HOWEVER, the user is not forced to log in. The user can navigate to the https://example.com but he/she won't be required to have an Authentication cookie granted after successful login via Google.

Here is my YAML config for Ingress:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
    kubernetes.io/ingress.class: "nginx"
    ingress.kubernetes.io/force-ssl-redirect: "true"
  name: example-com-ingress
  namespace: default
spec:
  tls:
    - hosts:
        - example.com
      secretName: example-com-tls
  rules:
  - host: example.com
    http:
      paths:
        - backend:
            serviceName: oauth2-proxy
            servicePort: http-proxy
          path: /oauth2
        - backend:
            serviceName: example-com-nginx-service
            servicePort: 80
          path: /

Any ideas anyone?

-- radical_edo
google-kubernetes-engine
kubernetes
kubernetes-ingress
nginx-ingress
oauth-2.0

Similar Questions

Can a GKE multi-zone cluster be migratd to a single-zone one?
Jenkins decrease in performance when moves to kubernetes
Find usage of ServceAccount in Kubernates cluster
p4 sync stuck in kubernetes pod

1 Answer

3/17/2020

Make sure that while configuring oauth2 proxy you set your cookie domain (set --cookie-domain=example.com to allow the cookie to be read).

You have to also add the whitelist-domain feature while configuring oauth2 proxy:

--whitelist-domain=example.com

Then have to create ingress' obects:

1. Expose endpoint /oauth2, look at the example below:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: oauth2-proxy
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          serviceName: oauth2-proxy
          servicePort: 4180
        path: /oauth2
  tls:
  - hosts:
    - example.com
    secretName: example-com-tls

2. Then create ingress for your application:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: example-com-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  tls:
  - hosts:
      - example.com
    secretName: example-com-tls
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: example-com-nginx-service
          servicePort: 80

It is clearly to create two separate ingresses, but you can also create just one with two defined backends as you wanted.

Take a look here: nginx-ingress-controller-oauth2, oauth2-dynamic-callbacks, oauth2-proxy.

Once again make sure that you have follow this instruction: external-OAUTH-authentication.

-- MaggieO
Source: StackOverflow