<p>I wish I could have found my answer elsewhere, but the lack of documentation has sent me groveling for help :)</p>

<p>I have been following <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer" rel="nofollow noreferrer">this tutorial</a> as a starting point. I can follow the steps through to the end with great success. But when I modify the ingress to do what I am trying to accomplish, nothing happens.</p>

<p>The tutorial has you create an ingress with the following .yaml</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: basic-ingress
spec:
  backend:
    serviceName: nginx
    servicePort: 80
</code></pre>

<p>What I am trying to do is modify the ingress so that it can utilize the <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/annotations.md#external-authentication" rel="nofollow noreferrer">auth-url annotation</a> and in the end my ingress.yaml I am failing with looks like</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: basic-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/auth-url: https://someauth.com/path/to/my/auth
spec:
  backend:
    serviceName: nginx
    servicePort: 80
</code></pre>

<p>In order to use the annotation, I found that I needed to include the <code>kubernetes.io/ingress.class: "nginx"</code> annotation to use the appropriate ingress. Basically though, this does nothing. I can hit the backend nginx cluster without my auth getting touched. Like these annotations are not even there.</p>

<p>Does GKE not support the <code>nginx</code> ingress controller? Is something fundamentally wrong with my yaml? Does the gce ingress controller have an annotation that could accomplish the same thing?</p>

<p>What I am trying to accomplish is: A client makes a call to my service, the loadbalancer/proxy first authenticates the request with an external endpoint, if auth is successful, the proxy sends the call along to my service (all without a single redirect response sent to the client). Basically what <a href="http://nginx.org/en/docs/http/ngx_http_auth_request_module.html" rel="nofollow noreferrer">nginx auth_request</a> does which is what I assume this <code>auth-url</code> annotation leverages under the covers.</p>

<p>Thanks!</p>

<p>GKE has its own Ingress Controller. It is called GKE Ingress Controller. If you want to use Nginx Ingress Controller, you need to manage it yourself.</p>

<p>Looks like <code>auth-url annotation</code> works only on Nginx Ingress Controller. So, you have to run Nginx Ingress Controller first.</p>

<p>See <a href="http://rahmonov.me/posts/nginx-ingress-controller/" rel="nofollow noreferrer">this post</a> on how to do that on GKE.</p>

<p>Hope it helps. </p>
