<p>I am using nginx ingress with a setup like this:</p>
<pre><code>nginx.ingress.kubernetes.io/auth-url: http://api/v1/introspect
nginx.ingress.kubernetes.io/auth-method: POST
nginx.ingress.kubernetes.io/auth-response-headers: X-User-Auth
nginx.ingress.kubernetes.io/auth-snippet: |
  proxy_set_header  auth-header &quot;authheaderhere==&quot;;
</code></pre>
<p>My question is simple but not sure if the answer is:</p>
<p>how can I define the ingress without hardcoding the <code>auth-header</code> in the ingress definition?</p>
<p>The introspect endpoint (decodes JWT token and attaches it to original request that is proxied to other microservices) is not exposed outside of the cluster but I want the extra peace of mind knowing that the endpoint, even in the cluster, only responds to authenticated requests (auth-header is a base64 encoded string which contains a client secret and client id)</p>

<p>You can use the annotation <code>nginx.ingress.kubernetes.io/auth-proxy-set-headers</code> <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication</a> referring to a <code>ConfigMap</code> which contains headers.</p>
<p>Here you can find an example <a href="https://kubernetes.github.io/ingress-nginx/examples/customization/custom-headers" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/examples/customization/custom-headers</a></p>
