1、Basic Auth
1.在 Ingress 对象上配置Basic Auth
==💘 实战：在 Ingress 对象上配置Basic Auth-2023.3.12(测试成功)==
- 实验环境
bash
实验环境：1、win10,vmwrokstation虚机；2、k8s集群：3台centos7.61810虚机，1个master节点,2个node节点k8sversion：v1.22.2containerd:v1.5.5- 实验软件
部署并观察：
bash
[root@master1 ingress-nginx]#kubectl apply -f nginx.yaml deployment.apps/nginxcreatedservice/nginxcreated[root@master1 ingress-nginx]#kubectl get po,svcNAMEREADYSTATUSRESTARTSAGEpod/nginx-7848d4b86f-ftznq1/1Running026sNAMETYPECLUSTER-IPEXTERNAL-IPPORT(S) AGEservice/kubernetesClusterIP10.96.0.1<none>443/TCP18dservice/nginxClusterIP10.98.22.153<none>80/TCP26s- 我们可以在 Ingress 对象上配置一些基本的 Auth 认证，比如 Basic Auth。可以用
htpasswd生成一个密码文件来验证身份验证。
bash
[root@master1 ingress-nginx]#yum install -y httpd-tools #记得安装下httpd-tools软件包，htpasswd命令依赖于这个软件包[root@master1 ingress-nginx]#htpasswd -c auth foo #当前密码是foo321Newpassword:Re-typenewpassword:Addingpasswordforuserfoo[root@master1 ingress-nginx]#ll total8-rw-r--r--1rootroot42Mar1221:47auth-rw-r--r--1rootroot441Mar806:29nginx.yaml- 然后根据上面的 auth 文件创建一个 secret 对象：
bash
[root@master1 ingress-nginx]# kubectl create secret generic basic-auth --from-file=authsecret/basic-authcreated[root@master1 ingress-nginx]# kubectl get secret basic-auth -o yamlapiVersion:v1data:auth:Zm9vOiRhcHIxJE9reFhCMTV3JGNZR1NMYnpBWDhTNklkNHo3WTRlWi8Kkind:Secretmetadata:creationTimestamp:"2023-03-12T13:48:52Z"name:basic-authnamespace:defaultresourceVersion:"242528"uid:b9c37dd7-3fac-43af-b5bc-3388114d9cc0type:Opaque- 然后对上面的 my-nginx 应用创建一个具有 Basic Auth 的 Ingress 对象：
yaml
# ingress-basic-auth.yamlapiVersion:networking.k8s.io/v1kind:Ingressmetadata:name:ingress-with-authnamespace:defaultannotations:nginx.ingress.kubernetes.io/auth-type:basic# 认证类型nginx.ingress.kubernetes.io/auth-secret:basic-auth# 包含 user/password 定义的 secret对象名nginx.ingress.kubernetes.io/auth-realm:"Authentication Required - foo"# 要显示的带有适当上下文的消息，说明需要身份验证的原因 spec:ingressClassName:nginx# 使用 nginx 的 IngressClass（关联的 ingress-nginx 控制器）rules:- host:auth.172.29.9.60.nip.io# 将域名映射到 nginx 服务,注意，这里的ip是ingress-controller svc的EXTERNAL-IPhttp:paths:- path:/pathType:Prefixbackend:service:# 将所有请求发送到 nginx 服务的 80 端口name:nginxport:number:80- 直接创建上面的资源对象
bash
[root@master1 ingress-nginx]#kubectl apply -f ingress-basic-auth.yaml ingress.networking.k8s.io/ingress-with-authcreated[root@master1 ingress-nginx]#kubectl get ingressNAMECLASSHOSTSADDRESSPORTSAGEingress-with-authnginxauth.172.29.9.60.nip.io172.29.9.608021s- 然后通过下面的命令或者在浏览器中直接打开配置的域名
bash
[root@master1 ingress-nginx]#curl -v http:*About to connect() to auth.172.29.9.60.nip.io port 80 (#0)*Trying172.29.9.60...*Connected to auth.172.29.9.60.nip.io (172.29.9.60) port 80 (#0)>GET/HTTP/1.1>User-Agent:curl/7.29.0>Host:auth.172.29.9.60.nip.io>Accept:*/*><HTTP/1.1 401 Unauthorized<Date:Sun,12 Mar 2023 14:22:31 GMT<Content-Type:text/html<Content-Length:172<Connection:keep-alive<WWW-Authenticate:Basic realm="Authentication Required - foo"<<html><head><title>401 Authorization Required</title></head><body><center><h1>401 Authorization Required</h1></center><hr><center>nginx</center></body></html>*Connection #0 to host auth.172.29.9.60.nip.io left intact我们可以看到出现了 401 认证失败错误。
- 然后带上我们配置的用户名和密码进行认证：
bash
[root@master1 ingress-nginx]#curl -v http:*About to connect() to auth.172.29.9.60.nip.io port 80 (#0)*Trying172.29.9.60...*Connected to auth.172.29.9.60.nip.io (172.29.9.60) port 80 (#0)*ServerauthusingBasicwithuser'foo'>GET / HTTP/1.1>Authorization:Basic Zm9vOmZvbzMyMQ==>User-Agent:curl/7.29.0>Host:auth.172.29.9.60.nip.io>Accept:*/*><HTTP/1.1 200 OK<Date:Sun,12 Mar 2023 14:23:50 GMT<Content-Type:text/html<Content-Length:615<Connection:keep-alive<Last-Modified:Tue,28 Dec 2021 15:28:38 GMT<ETag:"61cb2d26-267"<Accept-Ranges:bytes<<!DOCTYPEhtml><html><head><title>Welcome to nginx!</title><style>html{color-scheme:lightdark;}body{width:35em;margin:0auto;font-family:Tahoma,Verdana,Arial,sans-serif;}</style></head><body><h1>Welcome to nginx!</h1><p>If you see this page,the nginx web server is successfully installed andworking.Furtherconfigurationisrequired.</p><p>For online documentation and support please refer to<a href="http:Commercialsupportisavailableat<a href="http:<p><em>Thank you forusing nginx.</em></p></body></html>*Connection #0 to host auth.172.29.9.60.nip.io left intact可以看到已经认证成功了。
浏览器测试效果：是ok的，符合预期。
⚠️ 注意：nginx.ingress.kubernetes.io/auth-realm:"Authentication Required - foo"参数的含义
这里以密码写错为例举例：
测试结束。😘
2.使用外部的 Basic Auth 认证信息
==💘 实战：使用外部的 Basic Auth 认证信息-2023.3.12(测试成功)==
- 实验环境
bash
实验环境：1、win10,vmwrokstation虚机；2、k8s集群：3台centos7.61810虚机，1个master节点,2个node节点k8sversion：v1.22.2containerd:v1.5.5- 实验软件
