<p>I am trying to configure Basic Authentication on a Nginx example with Traefik as Ingress controller.</p>

<p>I just create the secret <code>"mypasswd"</code> on the Kubernetes secrets.</p>

<p>This is the Ingress I am using:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: nginxingress
  annotations:
    ingress.kubernetes.io/auth-type: basic
    ingress.kubernetes.io/auth-realm: traefik
    ingress.kubernetes.io/auth-secret: mypasswd
spec:
  rules:
  - host: nginx.mycompany.com
    http:
      paths:
      - path: /
        backend:
          serviceName: nginxservice
          servicePort: 80
</code></pre>

<p>I check in the Traefik dashboard and it appear, if I access to nginx.mycompany.com I can check the Nginx webpage, but without the basic authentication.</p>

<p>This is my nginx deployment:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.7.9
        ports:
        - containerPort: 80
</code></pre>

<p>Nginx service:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  labels:
    name: nginxservice
  name: nginxservice
spec:
  ports:
    # The port that this service should serve on.
    - port: 80
  # Label keys and values that must match in order to receive traffic for this service.
  selector:
    app: nginx
  type: ClusterIP
</code></pre>

<p>It is popular to use basic authentication. In reference to <a href="https://web.archive.org/web/20190529083601/https://docs.traefik.io/user-guide/kubernetes/#basic-authentication" rel="nofollow noreferrer">Kubernetes documentation</a>, you should be  able to protect access to Traefik using the following steps :</p>
<ol>
<li>Create authentication file using <code>htpasswd</code> tool. You'll be asked for a password for the user:</li>
</ol>
<blockquote>
<p>htpasswd -c ./auth </p>
</blockquote>
<ol start="2">
<li>Now use  <code>kubectl</code>  to create a secret in the  monitoring  namespace using the file created by  <code>htpasswd</code>.</li>
</ol>
<blockquote>
<p>kubectl create secret generic mysecret --from-file auth
--namespace=monitoring</p>
</blockquote>
<ol start="3">
<li>Enable basic authentication by attaching annotations to Ingress object:</li>
</ol>
<blockquote>
<p>ingress.kubernetes.io/auth-type: &quot;basic&quot;</p>
<p>ingress.kubernetes.io/auth-secret: &quot;mysecret&quot;</p>
</blockquote>
<p>So, full example config of basic authentication can looks like:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: prometheus-dashboard
  namespace: monitoring
  annotations:
    kubernetes.io/ingress.class: traefik
    ingress.kubernetes.io/auth-type: &quot;basic&quot;
    ingress.kubernetes.io/auth-secret: &quot;mysecret&quot;
spec:
  rules:
  - host: dashboard.prometheus.example.com
    http:
      paths:
      - backend:
          serviceName: prometheus
          servicePort: 9090
</code></pre>
<ol start="4">
<li>You can apply the example as following:</li>
</ol>
<blockquote>
<p>kubectl create -f prometheus-ingress.yaml -n monitoring</p>
</blockquote>
<p>This should work without any issues.</p>
