<p>We are leveraging Kubernetes ingress with external service <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication" rel="nofollow noreferrer">JWT authentication</a> using <code>auth-url</code> as a part of the ingress.</p>
<p>Now we want to use the <code>auth-cache-key</code> annotation to control the caching of JWT token.  At current our external auth service just respond with <code>200</code>/<code>401</code> by looking at the token. All our components are backend micro-services with rest api. Incoming request may not be the UI request. How do we fill in the `auth-cache-key' for a JWT token coming in.</p>
<pre><code>  annotations:
    nginx.ingress.kubernetes.io/auth-url: http://auth-service/validate
    nginx.ingress.kubernetes.io/auth-response-headers: &quot;authorization&quot;
    nginx.ingress.kubernetes.io/auth-cache-key: '$remote_user$http_authorization'
    nginx.ingress.kubernetes.io/auth-cache-duration: '1m'
    kubernetes.io/ingress.class: &quot;nginx&quot;

</code></pre>
<p>Looking at the example, <code>$remote_user$http_authorization</code> is specified as an example in K8s documentation. However not sure if <code>$remote_user</code> will be set in our case. Because this is not external basic auth. How do we decide on the auth cache key in case of this?</p>
<p>Not enough example/documentations exists around this.</p>

<p>Posting general answer as no further details and explanation provided.</p>
<p>It's true that there is not so much documentation around, so I decided to dig into <a href="https://github.com/kubernetes/ingress-nginx" rel="nofollow noreferrer">NGINX Ingress source code</a>.</p>
<p>The value set in annotation <code>nginx.ingress.kubernetes.io/auth-cache-key</code> is a variable <code>$externalAuth.AuthCacheKey</code> <a href="https://github.com/kubernetes/ingress-nginx/blob/07e54431ff069a5452a1f68ca3dbb98da0e0f35b/rootfs/etc/nginx/template/nginx.tmpl#L986" rel="nofollow noreferrer">in code</a>:</p>
<pre><code>{{ if $externalAuth.AuthCacheKey }}
set $tmp_cache_key '{{ $server.Hostname }}{{ $authPath }}{{ $externalAuth.AuthCacheKey }}';
set $cache_key '';
</code></pre>
<p>As can see, <code>$externalAuth.AuthCacheKey</code> is used by variable <code>$tmp_cache_key</code>, which is encoded to <code>base64</code> format and set as variable <code>$cache_key</code> using <a href="https://github.com/openresty/lua-nginx-module#name" rel="nofollow noreferrer">lua NGINX module</a>:</p>
<pre><code>rewrite_by_lua_block {
    ngx.var.cache_key = ngx.encode_base64(ngx.sha1_bin(ngx.var.tmp_cache_key))
}
</code></pre>
<p>Then <code>$cache_key</code> is used to set <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_key" rel="nofollow noreferrer">variable <code>$proxy_cache_key</code> which defines a key for caching</a>:</p>
<pre><code>proxy_cache_key &quot;$cache_key&quot;;
</code></pre>
<p>Based on the above code, we can assume that we can use any <a href="https://www.javatpoint.com/nginx-variables" rel="nofollow noreferrer">NGINX variable</a> to set <code>nginx.ingress.kubernetes.io/auth-cache-key</code> annotation. Please note that some variables are only available if the <a href="http://nginx.org/en/docs/varindex.html" rel="nofollow noreferrer">corresponding module is loaded</a>.</p>
<p>Example - I set following <code>auth-cache-key</code> annotation:</p>
<pre><code>nginx.ingress.kubernetes.io/auth-cache-key: '$proxy_host$request_uri'
</code></pre>
<p>Then, on the NGINX Ingress controller pod, in the file <code>/etc/nginx/nginx.conf</code> there is following line:</p>
<pre><code>set $tmp_cache_key '{my-host}/_external-auth-Lw-Prefix$proxy_host$request_uri';
</code></pre>
<p>If you will set <code>auth-cache-key</code> annotation to nonexistent NGINX variable, the NGINX will throw following error:</p>
<pre><code>nginx: [emerg] unknown &quot;nonexistent_variable&quot; variable
</code></pre>
<p>It's up to you which variables you need.</p>
<p>Please check also following articles and topics:</p>
<ul>
<li><a href="https://www.nginx.com/blog/nginx-caching-guide/" rel="nofollow noreferrer">A Guide to Caching with NGINX and NGINX Plus</a></li>
<li><a href="https://github.com/kubernetes/ingress-nginx/issues/2862" rel="nofollow noreferrer">external auth provider results in a <em>lot</em> of external auth requests</a></li>
</ul>
