<p>Right now I'm using Ingress-Nginx as the routing service for the traffic externally. However, there are few articles introduce how Ingress plays JWT authentications to protect internal APIs.
Can someone share some information about it?</p>

<p>As per research:</p>
<blockquote>
<p>Different authenticating API calls were has merged in the form of  OAuth 2.0 access tokens.</p>
</blockquote>
<blockquote>
<p>These are authentication credentials passed from client to API server, and typically carried as an HTTP header.</p>
</blockquote>
<p>JSON Web Token (JWT) as defined by <a href="https://www.rfc-editor.org/rfc/rfc7519" rel="nofollow noreferrer">RFC 7519</a> is one of those.</p>
<p>As per docs:</p>
<blockquote>
<p>JSON Web Token (JWT) is a compact, URL-safe means of representing
claims to be transferred between two parties.  The claims in a JWT
are encoded as a JSON object that is used as the payload of a JSON
Web Signature (JWS) structure or as the plaintext of a JSON Web
Encryption (JWE) structure, enabling the claims to be digitally
signed or integrity protected with a Message Authentication Code
(MAC) and/or encrypted.</p>
</blockquote>
<p>This mechanism can be applied using different ingress controllers like <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/" rel="nofollow noreferrer">kubernetes nginx-ingress</a> or <a href="https://github.com/nginxinc/kubernetes-ingress/blob/master/docs/configmap-and-annotations.md#auth-and-ssltls" rel="nofollow noreferrer">nginxinc ingress controller</a>.</p>
<p>As per nginx inc docs:</p>
<blockquote>
<p>NGINX auth_request Module is used to Validate Tokens on behalf of backend sercvices.</p>
</blockquote>
<p>Requests reach the backend services only when the client has presented a valid token
Existing backend services can be protected with access tokens, without requiring code changes
Only the NGINX instance (not every app) need be registered with the IdP
Behavior is consistent for every error condition, including missing or invalid tokens</p>
<blockquote>
</blockquote>
<p>So for NGINX acting as a reverse proxy for one or more applications, we can use the auth_request module to trigger an API call to an IdP before proxying a request to the backend.</p>
<ul>
<li>In the kubernetes ingress you can find information about <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md#external-authentication" rel="nofollow noreferrer">External Authentication</a></li>
</ul>
<blockquote>
<p>To use an existing service that provides authentication the Ingress rule can be annotated with <strong>nginx.ingress.kubernetes.io/auth-url</strong> to indicate the URL where the HTTP request should be sent.</p>
</blockquote>
<p>Here you can find <a href="https://github.com/carlpett/nginx-subrequest-auth-jwt" rel="nofollow noreferrer">working example nginx-subrequest-auth-jwt</a></p>
<blockquote>
<p>This project implements a simple JWT validation endpoint meant to be used     with NGINX's subrequest authentication, and specifically work well with the Kubernetes NGINX Ingress Controller external auth annotations</p>
</blockquote>
<blockquote>
<p>It validates a JWT token passed in the Authorization header against a configured public key, and further validates that the JWT contains appropriate claims.</p>
</blockquote>
<p>This example is using <a href="https://github.com/veonua/jwt_auth" rel="nofollow noreferrer">PyJwt python library</a> which allows you to encode and decode JSON Web Tokens (JWT)</p>
<p>Additional resource:</p>
<ul>
<li><a href="https://www.nginx.com/blog/authenticating-api-clients-jwt-nginx-plus/" rel="nofollow noreferrer">nginxinc controler</a></li>
<li><a href="https://github.com/kubernetes/ingress-nginx/issues/1850" rel="nofollow noreferrer">kubernetes on github JWT Authentication</a></li>
</ul>
<p>Hope this help.</p>
