<p>I am trying to put some kind of authenticator in front of my kubernetes applications. I have been using the nginx-ldap-auth image with the traditional applications on docker containers.
But when on kubernetes and exposing applications on NodePort Services, what is the best way to put authentication around it?</p>

<p>Dex seems to be authentication solution for kubernetes as a whole, but does it also help in authenticating web UIservices hosted on Kubernetes?</p>

<p>Kubernetes provides a few fundamental <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authentication-strategies" rel="nofollow noreferrer">Authentication</a> concepts that actually manage <em>access-control</em> function. <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens" rel="nofollow noreferrer">OpenID Connect</a> as a part of authentication model represents a flexible way how to handle token ID based verification for user identity through a variety of <em>Identity Provider software's</em> protocols like <a href="https://oauth.net/2/" rel="nofollow noreferrer">OAuth2</a>, however K8s doesn't provide any OpenID Identity Provider in front of the cluster.</p>

<p><a href="https://github.com/dexidp/dex/blob/master/Documentation/kubernetes.md" rel="nofollow noreferrer">Dex</a> as OpenID service can be used for authentication purposes to Kubernetes API server through <em>OpenID K8s authentication <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#configuring-the-api-server" rel="nofollow noreferrer">plugin</a></em>, however hosted in Kubernetes web application needs to be supplied with any of OAuth2 client in order to determine user identity and obtain Token ID as described <a href="https://github.com/dexidp/dex/blob/master/Documentation/using-dex.md" rel="nofollow noreferrer">here</a>.</p>

<p>Assuming that you have exposed web application running on K8s cluster, <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Ingress</a> resource might extend L7 network features for the target application service, like Load balancing, SSL/TLS termination, network traffic routing, etc.; for that purpose <a href="https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/" rel="nofollow noreferrer">Ingress Controller</a> has to be implemented in K8s cluster, thus all HTTP/HTTPS requests will be routed and processed according to specified rules inside Ingress object. </p>

<p>Go further, and searching for <a href="https://kubernetes.github.io/ingress-nginx/" rel="nofollow noreferrer">NGINX</a> <em>Ingress Controller</em>, gives you an opportunity to adjust or extend some significant functionality of typical Ingress Controller via <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#annotations" rel="nofollow noreferrer">Annotations</a> and apply i.e. <a href="https://github.com/pusher/oauth2_proxy" rel="nofollow noreferrer">oauth2_proxy</a> as external authentication provider to handle user request identification on Ingress object, as described in Kubernetes dashboard <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/auth/oauth-external-auth" rel="nofollow noreferrer">example</a>.</p>

<p>By the way, <code>nginx-ldap-auth</code> module seems to be compatible with <em>NGINX Ingress Controller</em> as well, hence you can check it <a href="https://github.com/tiagoapimenta/nginx-ldap-auth" rel="nofollow noreferrer">tiagoapimenta/nginx-ldap-auth</a>.</p>
