<p>I have a use case that I need to expose</p>
<p>/swagger-ui.html without authentication and</p>
<p>/apis/* with authentication</p>
<p>I created 2 ingress files in helm chart</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-method: POST
    nginx.ingress.kubernetes.io/auth-url: {{ .Values.service.authServerUrl }}/authorization
    nginx.ingress.kubernetes.io/cors-allow-methods: &quot;PUT, PATCH, GET, POST, DELETE, OPTIONS&quot;
    nginx.ingress.kubernetes.io/cors-allow-origin: &quot;*&quot;
    nginx.ingress.kubernetes.io/cors-allow-headers: '*'
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
  labels:
    app: {{ .Chart.Name }}
    appVersion: {{ .Chart.AppVersion | quote }}
    chartVersion: {{ .Chart.Version | quote }}
  name: {{ .Chart.Name }}
spec:
  rules:
    - host: &quot;example.com&quot;
      http:
        paths:
          - backend:
              serviceName: service
              servicePort: 8080
            path: /apis

</code></pre>
<p>And another ingress file without authentication</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
  labels:
    app: {{ .Chart.Name }}
    appVersion: {{ .Chart.AppVersion | quote }}
    chartVersion: {{ .Chart.Version | quote }}
  name: {{ .Chart.Name }}
spec:
  rules:
    - host: &quot;example.com&quot;
      http:
        paths:
          - backend:
              serviceName: service
              servicePort: 8080
            path: /swagger-ui.html
</code></pre>
<p>But seems like the second ingress does not work.</p>
<p>================================================================</p>
<p>Sagar Velankar's answer is correct. Just need to change different service name</p>
<p>Below is my final ingress file</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-method: POST
    nginx.ingress.kubernetes.io/auth-url: {{ .Values.service.authServerUrl }}/authorization
    nginx.ingress.kubernetes.io/cors-allow-methods: &quot;PUT, PATCH, GET, POST, DELETE, OPTIONS&quot;
    nginx.ingress.kubernetes.io/cors-allow-origin: &quot;*&quot;
    nginx.ingress.kubernetes.io/cors-allow-headers: '*'
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
  labels:
    app: {{ .Chart.Name }}
    appVersion: {{ .Chart.AppVersion | quote }}
    chartVersion: {{ .Chart.Version | quote }}
  name: {{ .Chart.Name }}-api
spec:
  rules:
    - host: &quot;example.com&quot;
      http:
        paths:
          - backend:
              serviceName: service
              servicePort: 8080
            path: /apis

</code></pre>
<p>And another ingress file with swagger</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
  labels:
    app: {{ .Chart.Name }}
    appVersion: {{ .Chart.AppVersion | quote }}
    chartVersion: {{ .Chart.Version | quote }}
  name: {{ .Chart.Name }}-swagger
spec:
  rules:
    - host: &quot;example.com&quot;
      http:
        paths:
          - backend:
              serviceName: service
              servicePort: 8080
            path: /swagger-ui.html
          - backend:
              serviceName: {{ .Chart.Name }}
              servicePort: 8080
            path: /webjars
          - backend:
              serviceName: {{ .Chart.Name }}
              servicePort: 8080
            path: /swagger-resources
          - backend:
              serviceName: {{ .Chart.Name }}
              servicePort: 8080
            path: /v2/api-docs
</code></pre>

<p>Please try changing the Ingress name for both templates to be unique. Currently I see both are set to below</p>
<pre><code>name: {{ .Chart.Name }}
</code></pre>
<p>I just changed apiVersion from extensions/v1beta1 to networking.k8s.io/v1beta1 and added below yaml files to my kubernetes cluster</p>
<pre><code>---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-method: POST
    nginx.ingress.kubernetes.io/auth-url: &quot;http://www.gool.com/authorization&quot;
    nginx.ingress.kubernetes.io/cors-allow-methods: &quot;PUT, PATCH, GET, POST, DELETE, OPTIONS&quot;
    nginx.ingress.kubernetes.io/cors-allow-origin: &quot;*&quot;
    nginx.ingress.kubernetes.io/cors-allow-headers: '*'
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
  labels:
    app: nginx
    appVersion: &quot;1&quot;
    chartVersion: &quot;1&quot;
  name: nginx1
spec:
  rules:
    - host: &quot;example.com&quot;
      http:
        paths:
          - backend:
              serviceName: service
              servicePort: 8080
            path: /apis
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
  labels:
    app: nginx
    appVersion: &quot;1&quot;
    chartVersion: &quot;1&quot;
  name: nginx2
spec:
  rules:
    - host: &quot;example.com&quot;
      http:
        paths:
          - backend:
              serviceName: service
              servicePort: 8080
            path: /swagger-ui.html
</code></pre>
<p>And it created below server in Nginx Controller /etc/nginx/nginx.conf which sets internal location for authorization and points location /apis auth_request to it.</p>
<pre><code>
## start server example.com
server {
server_name example.com ;

listen 80  ;
listen [::]:80  ;
listen 442 proxy_protocol  ssl http2 ;
listen [::]:442 proxy_protocol  ssl http2 ;

set $proxy_upstream_name &quot;-&quot;;

ssl_certificate_by_lua_block {
        certificate.call()
}

location /swagger-ui.html/ {

        set $namespace      &quot;kt&quot;;
        set $ingress_name   &quot;nginx2&quot;;
        set $service_name   &quot;service&quot;;
        set $service_port   &quot;8080&quot;;
        set $location_path  &quot;/swagger-ui.html&quot;;
        set $global_rate_limit_exceeding n;

        rewrite_by_lua_block {
                lua_ingress.rewrite({
                        force_ssl_redirect = false,
                        ssl_redirect = false,
                        force_no_ssl_redirect = false,
                        use_port_in_redirects = false,
                global_throttle = { namespace = &quot;&quot;, limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
                })
                balancer.rewrite()
                plugins.run()
        }

        # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
        # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
        # other authentication method such as basic auth or external auth useless - all requests will be allowed.
        #access_by_lua_block {
        #}

        header_filter_by_lua_block {
                lua_ingress.header()
                plugins.run()
        }

        body_filter_by_lua_block {
                plugins.run()
        }

        log_by_lua_block {
                balancer.log()

                monitor.call()

                plugins.run()
        }

        port_in_redirect off;

        set $balancer_ewma_score -1;
        set $proxy_upstream_name &quot;kt-service-8080&quot;;
        set $proxy_host          $proxy_upstream_name;
        set $pass_access_scheme  $scheme;

        set $pass_server_port    $server_port;

        set $best_http_host      $http_host;
        set $pass_port           $pass_server_port;

        set $proxy_alternative_upstream_name &quot;&quot;;

        client_max_body_size                    1m;

        proxy_set_header Host                   $best_http_host;

        # Pass the extracted client certificate to the backend

        # Allow websocket connections
        proxy_set_header                        Upgrade           $http_upgrade;

        proxy_set_header                        Connection        $connection_upgrade;

        proxy_set_header X-Request-ID           $req_id;
        proxy_set_header X-Real-IP              $remote_addr;

        proxy_set_header X-Forwarded-For        $remote_addr;

        proxy_set_header X-Forwarded-Host       $best_http_host;
        proxy_set_header X-Forwarded-Port       $pass_port;
        proxy_set_header X-Forwarded-Proto      $pass_access_scheme;

        proxy_set_header X-Scheme               $pass_access_scheme;

        # Pass the original X-Forwarded-For
        proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;

        # mitigate HTTPoxy Vulnerability
        # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
        proxy_set_header Proxy                  &quot;&quot;;

        # Custom headers to proxied server

        proxy_connect_timeout                   5s;
        proxy_send_timeout                      60s;
        proxy_read_timeout                      60s;

        proxy_buffering                         off;
        proxy_buffer_size                       4k;
        proxy_buffers                           4 4k;

        proxy_max_temp_file_size                1024m;

        proxy_request_buffering                 on;
        proxy_http_version                      1.1;

        proxy_cookie_domain                     off;
        proxy_cookie_path                       off;

        # In case of errors try the next upstream server before returning an error
        proxy_next_upstream                     error timeout;
        proxy_next_upstream_timeout             0;
        proxy_next_upstream_tries               3;

        proxy_pass http://upstream_balancer;

        proxy_redirect                          off;

}

location = /swagger-ui.html {

        set $namespace      &quot;kt&quot;;
        set $ingress_name   &quot;nginx2&quot;;
        set $service_name   &quot;service&quot;;
        set $service_port   &quot;8080&quot;;
        set $location_path  &quot;/swagger-ui.html&quot;;
        set $global_rate_limit_exceeding n;

        rewrite_by_lua_block {
                lua_ingress.rewrite({
                        force_ssl_redirect = false,
                        ssl_redirect = false,
                        force_no_ssl_redirect = false,
                        use_port_in_redirects = false,
                global_throttle = { namespace = &quot;&quot;, limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
                })
                balancer.rewrite()
                plugins.run()
        }

        # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
        # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
        # other authentication method such as basic auth or external auth useless - all requests will be allowed.
        #access_by_lua_block {
        #}

        header_filter_by_lua_block {
                lua_ingress.header()
                plugins.run()
        }

        body_filter_by_lua_block {
                plugins.run()
        }

        log_by_lua_block {
                balancer.log()

                monitor.call()

                plugins.run()
        }

        port_in_redirect off;

        set $balancer_ewma_score -1;
        set $proxy_upstream_name &quot;kt-service-8080&quot;;
        set $proxy_host          $proxy_upstream_name;
        set $pass_access_scheme  $scheme;

        set $pass_server_port    $server_port;

        set $best_http_host      $http_host;
        set $pass_port           $pass_server_port;

        set $proxy_alternative_upstream_name &quot;&quot;;

        client_max_body_size                    1m;

        proxy_set_header Host                   $best_http_host;

        # Pass the extracted client certificate to the backend

        # Allow websocket connections
        proxy_set_header                        Upgrade           $http_upgrade;

        proxy_set_header                        Connection        $connection_upgrade;

        proxy_set_header X-Request-ID           $req_id;
        proxy_set_header X-Real-IP              $remote_addr;

        proxy_set_header X-Forwarded-For        $remote_addr;

        proxy_set_header X-Forwarded-Host       $best_http_host;
        proxy_set_header X-Forwarded-Port       $pass_port;
        proxy_set_header X-Forwarded-Proto      $pass_access_scheme;

        proxy_set_header X-Scheme               $pass_access_scheme;

        # Pass the original X-Forwarded-For
        proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;

        # mitigate HTTPoxy Vulnerability
        # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
        proxy_set_header Proxy                  &quot;&quot;;

        # Custom headers to proxied server

        proxy_connect_timeout                   5s;
        proxy_send_timeout                      60s;
        proxy_read_timeout                      60s;

        proxy_buffering                         off;
        proxy_buffer_size                       4k;
        proxy_buffers                           4 4k;

        proxy_max_temp_file_size                1024m;

        proxy_request_buffering                 on;
        proxy_http_version                      1.1;

        proxy_cookie_domain                     off;
        proxy_cookie_path                       off;

        # In case of errors try the next upstream server before returning an error
        proxy_next_upstream                     error timeout;
        proxy_next_upstream_timeout             0;
        proxy_next_upstream_tries               3;

        proxy_pass http://upstream_balancer;

        proxy_redirect                          off;

}

location = /_external-auth-L2FwaXMv-Prefix {
        internal;

        # ngx_auth_request module overrides variables in the parent request,
        # therefore we have to explicitly set this variable again so that when the parent request
        # resumes it has the correct value set for this variable so that Lua can pick backend correctly
        set $proxy_upstream_name &quot;kt-service-8080&quot;;

        proxy_pass_request_body     off;
        proxy_set_header            Content-Length          &quot;&quot;;
        proxy_set_header            X-Forwarded-Proto       &quot;&quot;;
        proxy_set_header            X-Request-ID            $req_id;

        proxy_method                POST;
        proxy_set_header            X-Original-URI          $request_uri;
        proxy_set_header            X-Scheme                $pass_access_scheme;

        proxy_set_header            Host                    www.gool.com;
        proxy_set_header            X-Original-URL          $scheme://$http_host$request_uri;
        proxy_set_header            X-Original-Method       $request_method;
        proxy_set_header            X-Sent-From             &quot;nginx-ingress-controller&quot;;
        proxy_set_header            X-Real-IP               $remote_addr;

        proxy_set_header            X-Forwarded-For        $remote_addr;

        proxy_set_header            X-Auth-Request-Redirect $request_uri;

        proxy_buffering                         off;

        proxy_buffer_size                       4k;
        proxy_buffers                           4 4k;
        proxy_request_buffering                 on;
        proxy_http_version                      1.1;

        proxy_ssl_server_name       on;
        proxy_pass_request_headers  on;

        client_max_body_size        1m;

        # Pass the extracted client certificate to the auth provider

        set $target http://www.gool.com/authorization;
        proxy_pass $target;
}

location /apis/ {

        set $namespace      &quot;kt&quot;;
        set $ingress_name   &quot;nginx1&quot;;
        set $service_name   &quot;service&quot;;
        set $service_port   &quot;8080&quot;;
        set $location_path  &quot;/apis&quot;;
        set $global_rate_limit_exceeding n;

        rewrite_by_lua_block {
                lua_ingress.rewrite({
                        force_ssl_redirect = false,
                        ssl_redirect = false,
                        force_no_ssl_redirect = false,
                        use_port_in_redirects = false,
                global_throttle = { namespace = &quot;&quot;, limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
                })
                balancer.rewrite()
                plugins.run()
        }

        # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
        # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
        # other authentication method such as basic auth or external auth useless - all requests will be allowed.
        #access_by_lua_block {
        #}

        header_filter_by_lua_block {
                lua_ingress.header()
                plugins.run()
        }

        body_filter_by_lua_block {
                plugins.run()
        }

        log_by_lua_block {
                balancer.log()

                monitor.call()

                plugins.run()
        }

        port_in_redirect off;

        set $balancer_ewma_score -1;
        set $proxy_upstream_name &quot;kt-service-8080&quot;;
        set $proxy_host          $proxy_upstream_name;
        set $pass_access_scheme  $scheme;

        set $pass_server_port    $server_port;

        set $best_http_host      $http_host;
        set $pass_port           $pass_server_port;

        set $proxy_alternative_upstream_name &quot;&quot;;

        # this location requires authentication
        auth_request        /_external-auth-L2FwaXMv-Prefix;
        auth_request_set    $auth_cookie $upstream_http_set_cookie;
        add_header          Set-Cookie $auth_cookie;

        client_max_body_size                    1m;

        proxy_set_header Host                   $best_http_host;

        # Pass the extracted client certificate to the backend

        # Allow websocket connections
        proxy_set_header                        Upgrade           $http_upgrade;

        proxy_set_header                        Connection        $connection_upgrade;

        proxy_set_header X-Request-ID           $req_id;
        proxy_set_header X-Real-IP              $remote_addr;

        proxy_set_header X-Forwarded-For        $remote_addr;

        proxy_set_header X-Forwarded-Host       $best_http_host;
        proxy_set_header X-Forwarded-Port       $pass_port;
        proxy_set_header X-Forwarded-Proto      $pass_access_scheme;

        proxy_set_header X-Scheme               $pass_access_scheme;

        # Pass the original X-Forwarded-For
        proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;

        # mitigate HTTPoxy Vulnerability
        # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
        proxy_set_header Proxy                  &quot;&quot;;

        # Custom headers to proxied server

        proxy_connect_timeout                   5s;
        proxy_send_timeout                      60s;
        proxy_read_timeout                      60s;

        proxy_buffering                         off;
        proxy_buffer_size                       4k;
        proxy_buffers                           4 4k;

        proxy_max_temp_file_size                1024m;

        proxy_request_buffering                 on;
        proxy_http_version                      1.1;

        proxy_cookie_domain                     off;
        proxy_cookie_path                       off;

        # In case of errors try the next upstream server before returning an error
        proxy_next_upstream                     error timeout;
        proxy_next_upstream_timeout             0;
        proxy_next_upstream_tries               3;

        proxy_pass http://upstream_balancer;

        proxy_redirect                          off;

}

location = /_external-auth-L2FwaXM-Exact {
        internal;

        # ngx_auth_request module overrides variables in the parent request,
        # therefore we have to explicitly set this variable again so that when the parent request
        # resumes it has the correct value set for this variable so that Lua can pick backend correctly
        set $proxy_upstream_name &quot;kt-service-8080&quot;;

        proxy_pass_request_body     off;
        proxy_set_header            Content-Length          &quot;&quot;;
        proxy_set_header            X-Forwarded-Proto       &quot;&quot;;
        proxy_set_header            X-Request-ID            $req_id;

        proxy_method                POST;
        proxy_set_header            X-Original-URI          $request_uri;
        proxy_set_header            X-Scheme                $pass_access_scheme;

        proxy_set_header            Host                    www.gool.com;
        proxy_set_header            X-Original-URL          $scheme://$http_host$request_uri;
        proxy_set_header            X-Original-Method       $request_method;
        proxy_set_header            X-Sent-From             &quot;nginx-ingress-controller&quot;;
        proxy_set_header            X-Real-IP               $remote_addr;

        proxy_set_header            X-Forwarded-For        $remote_addr;

        proxy_set_header            X-Auth-Request-Redirect $request_uri;

        proxy_buffering                         off;

        proxy_buffer_size                       4k;
        proxy_buffers                           4 4k;
        proxy_request_buffering                 on;
        proxy_http_version                      1.1;

        proxy_ssl_server_name       on;
        proxy_pass_request_headers  on;

        client_max_body_size        1m;

        # Pass the extracted client certificate to the auth provider

        set $target http://www.gool.com/authorization;
        proxy_pass $target;
}

location = /apis {

        set $namespace      &quot;kt&quot;;
        set $ingress_name   &quot;nginx1&quot;;
        set $service_name   &quot;service&quot;;
        set $service_port   &quot;8080&quot;;
        set $location_path  &quot;/apis&quot;;
        set $global_rate_limit_exceeding n;

        rewrite_by_lua_block {
                lua_ingress.rewrite({
                        force_ssl_redirect = false,
                        ssl_redirect = false,
                        force_no_ssl_redirect = false,
                        use_port_in_redirects = false,
                global_throttle = { namespace = &quot;&quot;, limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
                })
                balancer.rewrite()
                plugins.run()
        }

        # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
        # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
        # other authentication method such as basic auth or external auth useless - all requests will be allowed.
        #access_by_lua_block {
        #}

        header_filter_by_lua_block {
                lua_ingress.header()
                plugins.run()
        }

        body_filter_by_lua_block {
                plugins.run()
        }

        log_by_lua_block {
                balancer.log()

                monitor.call()

                plugins.run()
        }

        port_in_redirect off;

        set $balancer_ewma_score -1;
        set $proxy_upstream_name &quot;kt-service-8080&quot;;
        set $proxy_host          $proxy_upstream_name;
        set $pass_access_scheme  $scheme;

        set $pass_server_port    $server_port;

        set $best_http_host      $http_host;
        set $pass_port           $pass_server_port;

        set $proxy_alternative_upstream_name &quot;&quot;;

        # this location requires authentication
        auth_request        /_external-auth-L2FwaXM-Exact;
        auth_request_set    $auth_cookie $upstream_http_set_cookie;
        add_header          Set-Cookie $auth_cookie;

        client_max_body_size                    1m;

        proxy_set_header Host                   $best_http_host;

        # Pass the extracted client certificate to the backend

        # Allow websocket connections
        proxy_set_header                        Upgrade           $http_upgrade;

        proxy_set_header                        Connection        $connection_upgrade;

        proxy_set_header X-Request-ID           $req_id;
        proxy_set_header X-Real-IP              $remote_addr;

        proxy_set_header X-Forwarded-For        $remote_addr;

        proxy_set_header X-Forwarded-Host       $best_http_host;
        proxy_set_header X-Forwarded-Port       $pass_port;
        proxy_set_header X-Forwarded-Proto      $pass_access_scheme;

        proxy_set_header X-Scheme               $pass_access_scheme;

        # Pass the original X-Forwarded-For
        proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;

        # mitigate HTTPoxy Vulnerability
        # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
        proxy_set_header Proxy                  &quot;&quot;;

        # Custom headers to proxied server

        proxy_connect_timeout                   5s;
        proxy_send_timeout                      60s;
        proxy_read_timeout                      60s;

        proxy_buffering                         off;
        proxy_buffer_size                       4k;
        proxy_buffers                           4 4k;

        proxy_max_temp_file_size                1024m;

        proxy_request_buffering                 on;
        proxy_http_version                      1.1;

        proxy_cookie_domain                     off;
        proxy_cookie_path                       off;

        # In case of errors try the next upstream server before returning an error
        proxy_next_upstream                     error timeout;
        proxy_next_upstream_timeout             0;
        proxy_next_upstream_tries               3;

        proxy_pass http://upstream_balancer;

        proxy_redirect                          off;

}

location = /_external-auth-Lw-Prefix {
        internal;

        # ngx_auth_request module overrides variables in the parent request,
        # therefore we have to explicitly set this variable again so that when the parent request
        # resumes it has the correct value set for this variable so that Lua can pick backend correctly
        set $proxy_upstream_name &quot;upstream-default-backend&quot;;

        proxy_pass_request_body     off;
        proxy_set_header            Content-Length          &quot;&quot;;
        proxy_set_header            X-Forwarded-Proto       &quot;&quot;;
        proxy_set_header            X-Request-ID            $req_id;

        proxy_method                POST;
        proxy_set_header            X-Original-URI          $request_uri;
        proxy_set_header            X-Scheme                $pass_access_scheme;

        proxy_set_header            Host                    www.gool.com;
        proxy_set_header            X-Original-URL          $scheme://$http_host$request_uri;
        proxy_set_header            X-Original-Method       $request_method;
        proxy_set_header            X-Sent-From             &quot;nginx-ingress-controller&quot;;
        proxy_set_header            X-Real-IP               $remote_addr;

        proxy_set_header            X-Forwarded-For        $remote_addr;

        proxy_set_header            X-Auth-Request-Redirect $request_uri;

        proxy_buffering                         off;

        proxy_buffer_size                       4k;
        proxy_buffers                           4 4k;
        proxy_request_buffering                 on;
        proxy_http_version                      1.1;

        proxy_ssl_server_name       on;
        proxy_pass_request_headers  on;

        client_max_body_size        1m;

        # Pass the extracted client certificate to the auth provider

        set $target http://www.gool.com/authorization;
        proxy_pass $target;
}

location / {

        set $namespace      &quot;kt&quot;;
        set $ingress_name   &quot;nginx1&quot;;
        set $service_name   &quot;&quot;;
        set $service_port   &quot;&quot;;
        set $location_path  &quot;/&quot;;
        set $global_rate_limit_exceeding n;

        rewrite_by_lua_block {
                lua_ingress.rewrite({
                        force_ssl_redirect = false,
                        ssl_redirect = false,
                        force_no_ssl_redirect = false,
                        use_port_in_redirects = false,
                global_throttle = { namespace = &quot;&quot;, limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
                })
                balancer.rewrite()
                plugins.run()
        }

        # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
        # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
        # other authentication method such as basic auth or external auth useless - all requests will be allowed.
        #access_by_lua_block {
        #}

        header_filter_by_lua_block {
                lua_ingress.header()
                plugins.run()
        }

        body_filter_by_lua_block {
                plugins.run()
        }

        log_by_lua_block {
                balancer.log()

                monitor.call()

                plugins.run()
        }

        port_in_redirect off;

        set $balancer_ewma_score -1;
        set $proxy_upstream_name &quot;upstream-default-backend&quot;;
        set $proxy_host          $proxy_upstream_name;
        set $pass_access_scheme  $scheme;

        set $pass_server_port    $server_port;

        set $best_http_host      $http_host;
        set $pass_port           $pass_server_port;

        set $proxy_alternative_upstream_name &quot;&quot;;

        # this location requires authentication
        auth_request        /_external-auth-Lw-Prefix;
        auth_request_set    $auth_cookie $upstream_http_set_cookie;
        add_header          Set-Cookie $auth_cookie;

        client_max_body_size                    1m;

        proxy_set_header Host                   $best_http_host;

        # Pass the extracted client certificate to the backend

        # Allow websocket connections
        proxy_set_header                        Upgrade           $http_upgrade;

        proxy_set_header                        Connection        $connection_upgrade;

        proxy_set_header X-Request-ID           $req_id;
        proxy_set_header X-Real-IP              $remote_addr;

        proxy_set_header X-Forwarded-For        $remote_addr;

        proxy_set_header X-Forwarded-Host       $best_http_host;
        proxy_set_header X-Forwarded-Port       $pass_port;
        proxy_set_header X-Forwarded-Proto      $pass_access_scheme;

        proxy_set_header X-Scheme               $pass_access_scheme;

        # Pass the original X-Forwarded-For
        proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;

        # mitigate HTTPoxy Vulnerability
        # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
        proxy_set_header Proxy                  &quot;&quot;;

        # Custom headers to proxied server

        proxy_connect_timeout                   5s;
        proxy_send_timeout                      60s;
        proxy_read_timeout                      60s;

        proxy_buffering                         off;
        proxy_buffer_size                       4k;
        proxy_buffers                           4 4k;

        proxy_max_temp_file_size                1024m;

        proxy_request_buffering                 on;
        proxy_http_version                      1.1;

        proxy_cookie_domain                     off;
        proxy_cookie_path                       off;

        # In case of errors try the next upstream server before returning an error
        proxy_next_upstream                     error timeout;
        proxy_next_upstream_timeout             0;
        proxy_next_upstream_tries               3;

        proxy_pass http://upstream_balancer;

        proxy_redirect                          off;

}

}
## end server example.com
</code></pre>
