<p>I'm confused about nginx ingress with Kubernetes. I've been able to use it with "basic nginx auth" (unable to do so with <code>oauth2</code> yet).</p>

<p>I've installed via helm:</p>

<p><code>helm install stable/nginx-ingress --name app-name --set rbac.create=true</code></p>

<p>This creates two services, an <code>nginx-ingress-controller</code> and an <code>nginx-ingress-backend</code>.</p>

<p>When I create an ingress, this ingress is targeted towards one and only one <code>nginx-ingress-controller</code>, but I have no idea how:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: tomcat
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required - foo"
    nginx.ingress.kubernetes.io/rewrite-target: /
  namespace: kube-system
spec:
  rules:
  - host:
    http:
      paths:
      - path: /
        backend:
          serviceName: tomcat-deployment-service 
          servicePort: 8080
</code></pre>

<p>When I get this Ingress from the output of <code>kubectl get ingress -n kube-system</code>, it has a public, external IP.</p>

<p>What's <strong><em>concerning</em></strong> is that <code>basic-auth</code> <strong>DOESN'T APPLY</strong> to that external IP; it's wide open! Nginx authentication only kicks in when I try to visit the <code>nginx-ingress-controller</code>'s IP.</p>

<p>I have a lot of questions.</p>

<ol>
<li>How do I made an ingress created from <code>kubectl apply -f
ingress.yaml</code> target a specific nginx-ingress-controller?</li>
<li>How do I keep this new <code>ingress</code> from having an external IP?</li>
<li>Why isn't <code>nginx</code> authentication kicking in?</li>
<li>What IP am I suppose to use (the <code>nginx-ingress-controller</code> or the
generated one?)</li>
<li>If I'm suppose to use the generated IP, what about the one from the controller?</li>
</ol>

<p>I have been searching for descent, working examples (and pouring over sparse, changing documentation, and github issues) for <em>literally</em> days.</p>

<p>EDIT:</p>

<p>In this "official" <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/basic/" rel="nofollow noreferrer">documentation</a>, it's unclear as to weather or not <code>http://10.2.29.4/</code> is the IP from the <code>ingress</code> or the <code>controller</code>. I assume the <code>controller</code> because when I run this, the other doesn't even authenticate (<em>it let's me in without asking for a password</em>). Both IP's I'm using are external IPs (publicly available) on GCP.</p>

Alexander Kleinhans
<p>I think you might have some concept definition misunderstanding. </p>

<ol>
<li>Ingress is not a job ( Nor a service, nor a pod ). It is just a configuration. It cannot have "IP". think of ingress as a routing rule or a routing table in your cluster.</li>
<li><code>Nginx-ingress-controller</code> is the service with type <code>Loadbalancer</code> with actual running pods behind it that facilitates those ingress rules that you created for your cluster.</li>
<li><code>Nginx-ingress-backend</code> is likely to be a <code>default-backend</code> that your <code>nginx-ingress-controller</code> will route to if no matching routes are found. see <a href="https://kubernetes.github.io/ingress-nginx/user-guide/default-backend/" rel="nofollow noreferrer">this</a></li>
<li>In general, your <code>nginx-ingress-controller</code> should be the only entry of your cluster. Other services in your cluster should have type <code>ClusterIP</code> such that they are not exposed to outside the cluster and only accessible through your <code>nginx-ingress-controller</code>. In you case, since your service could be access from outside directly, it should not be of type <code>ClusterIP</code>. Just change the service type to get it protected.</li>
</ol>

<p>Based on above understanding, I will glad to provide further help for the question you have.</p>

<p>Some readings:</p>

<ol>
<li>What is ingress: <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/ingress/</a></li>
<li>K8s Services and external accessibility: <a href="https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types</a></li>
</ol>
