<p>I'm trying to figure out how to create a simple API key protected proxy with Ambassador on k8s, yet can't seem to find any docs on this. </p>

<p>Specifically, I just want to set it up so it can take a request with API-KEY header, authenticate it, and if API-KEY is valid for some client, pass it onto my backend. </p>

<p>I suggest you do the following:</p>

<ol>
<li><p>Create an Authentication Application: for each protected endpoint, this app will be responsible for validating the Api Key.</p></li>
<li><p>Configuring Ambassador to redirect requests to this service: you just need to annotate your authentication app service definition. Example:</p></li>
</ol>

<pre><code>    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: auth-app
      annotations:
        getambassador.io/config: |
          ---
          apiVersion: ambassador/v1
          kind:  AuthService
          name:  authentication
          auth_service: "auth-app:8080"
          allowed_request_headers:
          - "API-KEY"
    spec:
      type: ClusterIP
      selector:
        app: auth-app
      ports:
      - port: 8080
        name: auth-app
        targetPort: auth-app
</code></pre>

<ol start="3">
<li>Configure an endpoint in <em>auth-app</em> corresponding to the endpoint of the app you want to authenticate. Suppose you have an app with a Mapping like this:</li>
</ol>

<pre><code>    apiVersion: ambassador/v1
    kind:  Mapping
    name:  myapp-mapping
    prefix: /myapp/
    service: myapp:8000
</code></pre>

<p>Then you need to have an endpoint "<em>/myapp/</em>" in <em>auth-app</em>. You will read your <em>API-KEY</em> header there. If the key is valid, return a HTTP 200 (OK). Ambassador will then send the original message to <em>myapp</em>. If <em>auth-app</em> returns any other thing besides a HTTP 200, Ambassador will return that response to the client.</p>

<ol start="4">
<li>Bypass the authentication in needed apps. For example you might need a login app, responsible for providing an API Key to the clients. You can bypass authentication for these apps using <strong>bypass_auth: true</strong> in the mapping:</li>
</ol>

<pre><code>    apiVersion: ambassador/v1
    kind:  Mapping
    name:  login-mapping
    prefix: /login/
    service: login-app:8080
    bypass_auth: true
</code></pre>

<p><a href="https://www.getambassador.io/reference/services/auth-service/" rel="nofollow noreferrer">Check this</a> if you want to know more about authentication in Ambassador</p>

<p>EDIT: <a href="https://stackoverflow.com/a/33281233/8971507">According to this answer</a> it is a good practice if you use as header <code>Authorization: Bearer {base64-API-KEY}</code>. In Ambassador the <em>Authorization</em> header is allowed by default, so you don't need to pass it in the <em>allowed_request_headers</em> field.</p>
