<p>I've been setting up a kubernetes cluster and want to protect the dashboard (running at <code>kube.example.com</code>) behind the <code>bitly/oauth2_proxy</code> (running at <code>example.com/oauth2</code> on image <code>a5huynh/oauth2_proxy:latest</code>) as I want to re-use the OAuth proxy for other services I will be running. Authentication is working perfectly but after a user logs in, i.e. the callback returns, they are sent to <code>example.com</code> where instead they should be sent to the original host <code>kube.example.com</code> that initiated the flow. How can I do this? (I am using the nginx-ingress-controller).</p>

<p>Annotation on OAuth2 Proxy:</p>

<pre><code>kubernetes.io/ingress.class: "nginx",
nginx.ingress.kubernetes.io/force-ssl-redirect: "true",
nginx.ingress.kubernetes.io/secure-backends: "true",
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
</code></pre>

<p>Annotation on Dashboard:</p>

<pre><code>kubernetes.io/ingress.class: "nginx",
nginx.ingress.kubernetes.io/auth-signin: "https://example.com/oauth2/start",
nginx.ingress.kubernetes.io/auth-url: "https://example.com/oauth2/auth",
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS",
nginx.ingress.kubernetes.io/force-ssl-redirect: "true",
nginx.ingress.kubernetes.io/secure-backends: "true",
nginx.ingress.kubernetes.io/ssl-passthrough: "true",
nginx.ingress.kubernetes.io/ssl-redirect: "true"
</code></pre>

<p>I expect to be redirected to the original host <code>kube.example.com</code> after OAuth flow is complete but am being sent back to the OAuth2 host <code>example.com</code></p>

<p>After searching for a bit I came across a <a href="https://www.callumpember.com/Kubernetes-A-Single-OAuth2-Proxy-For-Multiple-Ingresses/" rel="noreferrer">blog post</a> about performing this in a super simple manor. Unfortunately I found the provided <a href="https://www.callumpember.com/assets/attachments/github-oauth2/full-deployment.yml.txt" rel="noreferrer">yaml</a> did not quite work correctly as the oauth2_proxy was never being hit due to nginx intercepting all requests (I am not sure if mine was not working due to me wanting the oauth-proxy url to be <code>example.com/oauth2</code> rather than <code>oauth2.example.com</code>). To fix this I added back the oauth2-proxy path to the Ingress for the proxy i.e.</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: oauth2-proxy
  namespace: default
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
    - host: example.com
      http:
        paths:
          - backend:
              serviceName: oauth2-proxy
              servicePort: 80
            path: /
          - backend:
              serviceName: oauth2-proxy
              servicePort: 4180
            path: /oauth2
</code></pre>

<p>and made sure that the service was also still exposed i.e.</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: default
spec:
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
    - name: http-proxy
      port: 4180
      protocol: TCP
      targetPort: 4180
  selector:
    k8s-app: oauth2-proxy

</code></pre>

<p>Then to protect services behind the oauth proxy I just need to place the following in the Ingress annotations:</p>

<pre><code>    nginx.ingress.kubernetes.io/auth-url: "https://example.com/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://example.com/oauth2/start?rd=/redirect/$http_host$request_uri"
</code></pre>
