My issue: Regarding the deprecation announcement of ingress-nginx, I want to move to something else now to give time for the Gateway API to get mature enough so I can move to that later. NGINX Ingress Controller > NGINX Gateway Fabric seems like the perfect path forward for me. However, after deploying the controller I am having issues with my SSO setup, I never get redirected to the SSO login page and instead I get the login page of my app. This works with the ingress-nginx controller but not with the NGINX Ingress Controller.
Here is the config I am moving away from:
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: opennms
namespace: opennms
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
nginx.ingress.kubernetes.io/app-root: /opennms/
nginx.ingress.kubernetes.io/auth-signin: "https://oauthproxy.myprovider.com/oauth2/start"
nginx.ingress.kubernetes.io/auth-url: "https://oauthproxy.myprovider.com/oauth2/auth"
nginx.ingress.kubernetes.io/proxy-read-timeout: "240"
nginx.ingress.kubernetes.io/proxy-connect-timeout: "240"
nginx.ingress.kubernetes.io/proxy-send-timeout: "240"
nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-email, x-auth-request-user"
nginx.ingress.kubernetes.io/configuration-snippet: |
more_clear_input_headers "x-auth-request-preferred-username";
more_clear_input_headers "x-auth-request-user";
more_clear_input_headers "x-remote-roles";
spec:
ingressClassName: "nginx"
tls:
- hosts:
- opennms.mydomain.network
secretName: opennms-tls
rules:
- host: opennms.mydomain.network
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: opennms
port:
number: 8980
I migrated the above to:
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: opennms
namespace: opennms
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
nginx.org/app-root: "/opennms/"
nginx.org/auth-signin: "https://oauthproxy.myprovider.com/oauth2/start"
nginx.org/auth-url: "https://oauthproxy.myprovider.com/oauth2/auth"
nginx.org/proxy-read-timeout: "240s"
nginx.org/proxy-connect-timeout: "240s"
nginx.org/proxy-send-timeout: "240s"
nginx.org/auth-response-headers: "x-auth-request-email, x-auth-request-user"
nginx.org/config-snippet: |
more_clear_input_headers "x-auth-request-preferred-username";
more_clear_input_headers "x-auth-request-user";
more_clear_input_headers "x-remote-roles";
spec:
ingressClassName: "nginx-oss"
tls:
- hosts:
- opennms.mydomain.network
secretName: opennms-tls
rules:
- host: opennms.mydomain.network
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: opennms
port:
number: 8980
And my values.yaml for the NGINX Ingress Controller:
controller:
replicaCount: 1
service:
annotations:
service.beta.kubernetes.io/linode-loadbalancer-preserve: "true"
service.beta.kubernetes.io/linode-loadbalancer-throttle: "20"
enableCustomResources: true
enableSnippets: true
proxyBufferSize: "32k"
largeClientHeaderBuffers: "4 32k"
How I encountered the problem: Requests not using SSO work fine, but anything that requires SSO doesn’t. I use oauth2-proxy in my K8s cluster which is working fine, and changed the ingressclass in there accordingly as well for the ingress, also added a specific path for /oauth2/ just in case:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
labels:
app: oauth2-proxy
helm.sh/chart: oauth2-proxy-7.12.16
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: authentication-proxy
app.kubernetes.io/part-of: oauth2-proxy
app.kubernetes.io/name: oauth2-proxy
app.kubernetes.io/instance: oauth2-proxy
app.kubernetes.io/version: "7.9.0"
name: oauth2-proxy
namespace: oauth2-proxy
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
ingressClassName: nginx-oss
rules:
- host: oauthproxy.myprovider.com
http:
paths:
- path: /oauth2/
pathType: Prefix
backend:
service:
name: oauth2-proxy
port:
number: 80
- path: /
pathType: ImplementationSpecific
backend:
service:
name: oauth2-proxy
port:
number: 80
tls:
- hosts:
- oauthproxy.myprovider.com
secretName: oauth2-proxy-tls
Solutions I’ve tried: There are no errors on the logs, it just doesn’t redirect to the SSO login page, like it is ignoring all the SSO settings. I have tried looking at the documentation but can’t find anything resembling this kind of integration. At most, what I could find is how to do the OIDC integration directly in the controller (which gotta say, was a little bit confusing to me since I didn’t find all of the flags I needed and also looks to be referencing NGINX plus), which would be overkill since I already have a working oauth2-proxy setup.
Version of NIC and/or NGINX: Helm Chart nginx-ingress-2.3.1, APP VERSION 5.2.1
Deployment environment: Kubernetes 1.33
Can you please provide some guidance on how to proceed here?
Or, If what I want to do is already supported in NGINX Gateway Fabric, I would happily give that a shot as well with some guidance. I also need mTLS authentication to work for another ingress I have, and NGF didn’t seem to support that yet.
PS: I have been following this: The Ingress NGINX Alternative: Open Source NGINX Ingress Controller for the Long Term – NGINX Community Blog
and this Migrate from Ingress-NGINX Controller to NGINX Ingress Controller | NGINX Documentation
Thank you!
). Today they can be configured via native NGINX directives in the server block, so may be possible with Snippets.