<p>I have got NGINX in place as of now which acts as a load balancer. When i was creating the Ingress for my Nginx Controller, the details that i had provided in Ingress file were updated in the containers nginx.conf file.</p>

<p>For example:  </p>

<pre><code>upstream default-hello-8123   
{ # Load balance algorithm; empty for round robin, which is the default
 least_conn;  
  keepalive 32;  
  server x.x.x.x:xx max_fails=0 fail_timeout=0;  
}
</code></pre>

<p>I had above details in the Ingress file. Once I deployed my Ingress service / Controller / Ingress. nginx.conf was updated automatically.</p>

<p>I was trying to configure JWT for authentication now. But i could not figure if there is a way to that configuration as well such as below to be updated automatically in the nginx.conf instead of writing it manually.</p>

<pre><code>server {  
    listen 80;   
    location /products/ {  
        auth_jwt "Products API";
        auth_jwt_key_file conf/api_secret.jwk;  
        proxy_pass http://api_server;  
    }
}
</code></pre>

<p>I assume you have configured your ingress via annotations. If not, read here:</p>
<p><a href="https://github.com/nginxinc/kubernetes-ingress/tree/master/examples/jwt" rel="nofollow noreferrer">https://github.com/nginxinc/kubernetes-ingress/tree/master/examples/jwt</a></p>
<p><strong>IMPORTANT</strong>: this whole answer is only applicable by using the <a href="https://github.com/nginxinc/kubernetes-ingress" rel="nofollow noreferrer">NGINX Ingress Controller</a> as opposed to the Kubernetes Ingress Controller. Read about the key differences <a href="https://github.com/nginxinc/kubernetes-ingress/blob/master/docs/nginx-ingress-controllers.md" rel="nofollow noreferrer">here</a>.</p>
<p>Basically, there are two minimum requirements:</p>
<p>Start by creating a <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Secret</a> first. There are multiple ways to do it but here is an example using <code>kubectl</code>:</p>
<pre><code>kubectl create secret generic my-jwk --from-file=/path/to/your/key
</code></pre>
<p>where the key file looks like</p>
<pre><code># Example from: https://www.nginx.com/blog/authenticating-api-clients-jwt-nginx-plus/#page-7
{&quot;keys&quot;:
    [{
        &quot;k&quot;:&quot;YOUR_BASE64_ENCODED_SECRET&quot;,
        &quot;kty&quot;:&quot;oct&quot;,
        &quot;kid&quot;:&quot;0001&quot;
    }]
}
</code></pre>
<p>In this case <strong>it is important your jwk file is named <code>jwk</code></strong> because the NGINX Ingress Controller expects the keys to exist in the <code>jwk</code> field and generating Secrets using the <code>--from-file</code> attribute assigns the file contents to a key matching the filename.</p>
<p>This fulfills the first hard requirement and the other requirement is to ensure that your authenticating app uses the expected JWT delivery. By default, a JWT is expected in the <code>Authorization</code> header as a Bearer Token.</p>
<p>Next, You should reference to that Secret, named <code>my-jwk</code> to the Ingress Controller via annotation:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    nginx.com/jwt-key: &quot;my-jwk&quot; 
spec:
# .. fill in the rest of your spec here.
</code></pre>
<p>That is the only annotation required.</p>
<p>There are other annotations you can use. However, they are optional. Taken from the first README link on this answer:</p>
<blockquote>
<ul>
<li>Optional: nginx.com/jwt-realm: &quot;realm&quot; -- specifies a realm.</li>
<li>Optional: nginx.com/jwt-token: &quot;token&quot; -- specifies a variable that<br />
contains JSON Web Token. By default, a JWT is expected in the<br />
Authorization header as a Bearer Token.</li>
<li>Optional:   nginx.com/jwt-login-url: &quot;url&quot; -- specifies a URL to which a client is redirected in case of an invalid or missing JWT.</li>
</ul>
</blockquote>
