<p>I have a project on k8s with 3 services, that I want to cover with basic auth, and 1 service that I'd like to be public.
In ingress 4 services devided by url rules, that have different prefixes.
I had found tutorial about basic auth setup in ingress for all rules, but not about excluded, included urls.</p>

<p>Unfortunately <code>GCP Ingress</code> does not provide <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/basic/" rel="nofollow noreferrer">basic auth</a> authentication as this feature is specific for <a href="https://kubernetes.github.io/ingress-nginx/" rel="nofollow noreferrer">Nginx Ingress</a>.</p>
<p>As workaround for <code>basic auth</code> in <code>GCP Ingress</code> you can use <code>IAP</code>. Detailed <code>How To</code> information can be found in <a href="https://cloud.google.com/iap/docs/enabling-kubernetes-howto" rel="nofollow noreferrer">Enabling IAP for GKE</a> article.</p>
<p>If you would still like to use <code>Nginx Ingress basic auth</code> you can do it on <code>GKE</code> but you need specify <code>nginx</code> annotation.</p>
<pre><code>metadata:
  name: foo
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
</code></pre>
<p>Regarding using <code>basic auth</code> on only one service out of four, you can createa 2 <code>Ingress</code>. Very similar issue was discussed in another stackoverflow thread, which contains good solution - <a href="https://stackoverflow.com/a/63355476/11148139">Nginx-ingress Kubernetes routing with basic auth</a>.</p>
<h3>Basic Auth Ingress</h3>
<p>First <code>Ingress</code> should be without annotations:</p>
<ul>
<li>nginx.ingress.kubernetes.io/auth-type</li>
<li>nginx.ingress.kubernetes.io/auth-secret</li>
<li>nginx.ingress.kubernetes.io/auth-realm</li>
</ul>
<p>Second <code>Ingress</code> should contain proper annotations and should look similar to below YAML.</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: auth-ingress
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required'
    #cert-manager.io/cluster-issuer: if you would use cert manager like letsencrypt
spec:
  tls:
    - hosts:
        - example.com
      secretName: example-tls
  rules:
    - host: example.com
      http:
        paths:
          - path: /auth
            backend:
              serviceName: auth-service
              servicePort: &lt;auth-service-port&gt;
</code></pre>
<h3>Aditional information</h3>
<p>There is an option to deny all traffic to specific path. It can be achieved by <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet" rel="nofollow noreferrer">configuration-snippet</a> annotation.</p>
<pre><code>   annotations:
      nginx.ingress.kubernetes.io/configuration-snippet: |

      location /specificpath {

           deny all;  
      }
</code></pre>
