<p>It's possible to perform an authorization(rule-based like) into Kubernetes ingress(like kong, nginx).
For example, i have this:</p>

<p>apiVersion: extensions/v1beta1</p>

<pre><code>kind: Ingress
metadata:
  name: foo-bar
spec:
  rules:
  - host: api.foo.bar
    http:
      paths:
      - path: /service
        backend:
          serviceName: service.foo.bar
          servicePort: 80
</code></pre>

<p>But before redirect to /service, I need to perform a call in my authorization api to valid if the request token has the rule to pass for /service.</p>

<p>Or I really need to use an API gateway behind ingress like a spring zuul to do this?</p>

<p><code>Ingress</code> manifest is just input for a controller. You also need an <a href="https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/" rel="nofollow noreferrer">Ingress Controller</a>, an proxy that understand the <code>Ingress</code> object. Kong and Nginx is two examples of implementation.</p>

<p><a href="https://github.com/kubernetes/ingress-nginx" rel="nofollow noreferrer">Nginx  Ingress Controller</a> is provided from the Kubernetes community and it has an example of <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/auth/oauth-external-auth" rel="nofollow noreferrer">configuring an external oauth2 proxy</a> using annotations</p>

<pre><code>annotations:
  nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
  nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
</code></pre>
