<p>I'm containerizing an existing application and I need a basicauth for a single path prefix, currently I have the following Ingress configuration:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: service-auth
spec:
  basicAuth:
    secret: service-auth
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: service
  namespace: default
  annotations:
    kubernetes.io/ingress.class: &quot;traefik&quot;
    cert-manager.io/issuer: &quot;letsencrypt-prod&quot;
    traefik.ingress.kubernetes.io/frontend-entry-points: http, https
    traefik.ingress.kubernetes.io/redirect-entry-point: https

spec:
  tls:
  - hosts:
    - fqdn
    secretName: fqdn-tls
  rules:
    - host: fqdn
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: service
                port:
                  name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: service-auth
  namespace: default
  annotations:
    kubernetes.io/ingress.class: &quot;traefik&quot;
    cert-manager.io/issuer: &quot;letsencrypt-prod&quot;
    traefik.ingress.kubernetes.io/frontend-entry-points: http, https
    traefik.ingress.kubernetes.io/redirect-entry-point: https
    traefik.ingress.kubernetes.io/router.middlewares: default-service-auth@kubernetescrd

spec:
  tls:
  - hosts:
    - fqdn
    secretName: fqdn-tls
  rules:
    - host: fqdn
      http:
        paths:
          - path: /admin/
            pathType: Prefix
            backend:
              service:
                name: service
                port:
                  name: http
</code></pre>
<p>This seems to be working, but I just want to make sure - can I rely on the <code>/admin/</code> prefix to be always picked up by the second ingress or is there a chance that it will be picked up by the ingress with <code>/</code> prefix and thus displayed without basicauth?</p>

<p>As you can read in <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">this documentation</a>:</p>
<p>Each path in Ingress must have the appropriate path type. Paths without an explicit <code>pathType</code> will not be validated. There are three supported path types:</p>
<blockquote>
<p><code>ImplementationSpecific</code>: With this path type, matching is up to the IngressClass. Implementations can treat this as a separate  <code>pathType</code>  or treat it identically to  <code>Prefix</code>  or  <code>Exact</code>  path types.</p>
<p><code>Exact</code>: Matches the URL path exactly and with case sensitivity.</p>
<p><strong><code>Prefix</code>: Matches based on a URL path prefix split by <code>/</code>. Matching is case sensitive and done on a path element by element basis. A path element refers to the list of labels in the path split by the <code>/</code> separator. A request is a match for path <em>p</em> if every <em>p</em> is an element-wise prefix of <em>p</em> of the request path.</strong></p>
</blockquote>
<p><a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#examples" rel="nofollow noreferrer">Here</a> is also a link for examples in documentation.</p>
