<p>I configured authentication through nginx to a specific service in k8s.</p>

<p>It works fine with WUI.</p>

<p>I saw some examples</p>

<p>This works fine too:</p>

<p><code>curl -v http://10.2.29.4/ -H 'Host: foo.bar.com' -u 'foo:bar'</code></p>

<p>But i need to close other part my url same.</p>

<p>For example /api/v1/upload</p>

<p>I deployd 2nd ingress with path:</p>

<pre><code>spec:
  rules:
  - host: foo.bar.com
    http:
      paths:
      - backend:
          serviceName: service
          servicePort: 8000
        path: /api/v1/upload
</code></pre>

<p>Without nginx i got to type:</p>

<p><code>curl -XPOST 'file=@/file' http://10.2.29.4:8000/api/v1/upload -H "Authorization:key"</code></p>

<p>How do i need to try use curl for hide real ip or port and get a good result?</p>

<p>I would really appreciate if you could help me figure it out.</p>

<p>ingress1:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: mobsf
  namespace: default
  labels:
    app: mobsf
#    env: dev
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: mobsf-basic-auth
    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"
spec:
  rules:
  - host: worker1.mydomain.local
    http:
      paths:
      - path: /
      - backend:
          serviceName: mobsf
          servicePort: 8000
</code></pre>

<p>Ingress 2:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: mobsf2
  namespace: default
  labels:
    app: mobsf2
#    env: dev
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: mobsf-basic-auth
    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"
spec:
  rules:
  - host: worker1.mydomain.local
    http:
      paths:
      - backend:
          serviceName: mobsf2
          servicePort: 8000
        path: /api/v1/
</code></pre>

<p>DNS check (correct):</p>

<pre><code> nslookup worker1.mydomain.local
Server:         10.2.67.10
Address:        10.2.67.10#53

Name:   worker1.mydomain.local
Address: 10.2.67.203
</code></pre>

<p>Services:</p>

<pre><code>kubectl get svc
NAME            TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
kubernetes      ClusterIP      10.233.0.1      &lt;none&gt;        443/TCP          159d
minio-service   LoadBalancer   10.233.32.19    &lt;pending&gt;     9001:30809/TCP   104d
mobsf           NodePort       10.233.18.34    &lt;none&gt;        8000:30426/TCP   8d
vault           NodePort       10.233.43.134   &lt;none&gt;        8200:30820/TCP   69
</code></pre>

<p>Ing:</p>

<pre><code> kubectl get ing
NAME     HOSTS                  ADDRESS   PORTS   AGE
mobsf    worker1.dev002.local             80      2d1h
mobsf2   worker1.dev002.local             80      23h
</code></pre>

cryptoparty
<p>In bare metal installations is not possible to use <code>Ingress</code> and <code>LoadBalancer</code> services by default. You can't get <code>EXTERNAL-IP</code>, as displayed in the outputs that you provided. </p>

<p>The first <code>curl</code> command you provided show that you are using your service <code>mobsf</code> as <code>NodePort</code>, it means you are able to reach your application typing IP of your node + port like this <code>http://&lt;NODE_IP&gt;:8080</code>, but without authentication since you are not accessing the server through the ingress. </p>

<p>Here is all service types and how that works:</p>

<blockquote>
  <ul>
  <li><code>ClusterIP</code>: Exposes the Service on a cluster-internal IP. Choosing this value makes the Service only reachable from within the cluster. This is the default  <code>ServiceType</code>.</li>
  <li><a href="https://kubernetes.io/docs/concepts/services-networking/service/#nodeport" rel="nofollow noreferrer"><code>NodePort</code></a>: Exposes the Service on each Node’s IP at a static port (the  <code>NodePort</code>). A  <code>ClusterIP</code>  Service, to which the  <code>NodePort</code>  Service routes, is automatically created. You’ll be able to contact the  <code>NodePort</code>  Service, from outside the cluster, by requesting  <code>&lt;NodeIP&gt;:&lt;NodePort&gt;</code>.</li>
  <li><a href="https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer" rel="nofollow noreferrer"><code>LoadBalancer</code></a>: Exposes the Service externally using a cloud provider’s load balancer.  <code>NodePort</code>  and  <code>ClusterIP</code>  Services, to which the external load balancer routes, are automatically created.</li>
  </ul>
</blockquote>

<h3>How to use LoadBalancer and Ingress in bare metal installations?</h3>

<p>The Nginx <a href="https://kubernetes.github.io/ingress-nginx/deploy/baremetal/" rel="nofollow noreferrer">docs</a> shows how to setup <strong>MetalLB</strong> to allow your bare metal cluster the usage of LoadBalancer Services.</p>

<blockquote>
  <p><a href="https://metallb.universe.tf/" rel="nofollow noreferrer">MetalLB</a> provides a network load-balancer implementation for Kubernetes clusters that do not run on a supported cloud provider, effectively allowing the usage of LoadBalancer Services within any cluster.</p>
</blockquote>

<p>Basically, the setup is easy:</p>

<pre><code>kubectl apply -f https://raw.githubusercontent.com/google/metallb/v0.8.3/manifests/metallb.yaml
</code></pre>

<p>And then create a ConfigMap to configure:
<em>- Edit the ip range according yout network</em></p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  namespace: metallb-system
  name: config
data:
  config: |
    address-pools:
    - name: default
      protocol: layer2
      addresses:
      - 192.168.1.240-192.168.1.250 &lt;= EDIT IP RANGE
</code></pre>

<p>Check the installation typing <code>kubectl get pods -n metallb-system</code>, this is an expected output:</p>

<pre><code>$ kubectl get pods -n metallb-system
NAME                          READY   STATUS    RESTARTS   AGE
controller-65895b47d4-6wzfr   1/1     Running   0          9d
speaker-v52xj                 1/1     Running   0          9d
</code></pre>

<p>After <strong>MetalLB</strong> installed and configured you should be able to use your ingress and Loadbalancer services.</p>

<p>Here there's an example of how setup a Service (ClusterIP) and Ingress:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: mobsf
spec:
  selector:
    app: mobsf
  ports:
    - protocol: TCP
      port: 8000
      targetPort: 8000
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: mobsf-ing
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'
spec:
  rules:
  - host: worker1.mydomain.local
    http:
      paths:
      - path: "/"
        backend:
          serviceName: mobsf
          servicePort: 8000
      - path: "/api/v1"
        backend:
          serviceName: mobsf
          servicePort: 8080
</code></pre>

<p>Check your ingress with the command <code>kubectl get ing</code> and look for in <code>EXTERNAL-IP</code> column.</p>

<p>After that make sure you configure in your local DNS an entry for <code>worker1.mydomain.local</code> pointing to the ip above.</p>

<p>Please let me know if that helped</p>
