Secret in ingress snippet

General Discussions
1

Has anyone setup an ingress yml file to use a secret? I authenticate using a client cert but then I need to authenticate to Kibana using basic authentication. (fyi - i send the client cert info as run_user_as in a different header). So instead of hard coding the Authorization part i’d like to grab the username and password from a cert. Has anyone been able to make this work?

Specifically i’m sending to Kibana the Authentication header:

nginx.ingress.kubernetes..io/configuration-snippet: |
   proxy_set_header Authorization 'Basic @#$@$@#$@#@#';

What i’d like is:

nginx.ingress.kubernetes..io/configuration-snippet: |
   proxy_set_header Authentication <some value from a secret>
2

Please check https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#authentication

3

Thanks for the suggestion but I believe this is if I want basic authentication with nginx. I already have a setup for authentication using client certificates. What I need is to pass basic authentication to Kibana and that username password won’t be passed in from the user - it must be configured somewhere. And the only way I see configuring that is hardcoding it in a snippet.

4

Did you ever find a workaround for this @data-smith? I’m in the same boat - using elastic’s impersonation feature so the proxy needs to provide an authorization header and that can’t come from the client.

5

No. If I have time I’ll try maybe using an environment variable somehow.

6

I’m in the process of trying something ugly:

  • Added a secret with this fragment in as a ‘.conf’ file:
proxy_set_header Authentication <some value from a secret>
  • Reconfigure the nginx deployment to mount it
  • Still use a config snippet annotation, but now its an nginx include statement to reference the .conf in the secret.

This is awful because the controller’s deployment has to be adjusted, it’s not self contained on the ingress, but i can’t see how else you could do it.

7

Patching as part of the update might be better: