<p>I am running a gke cluster (v1.16.15gke.4300) and the nginx ingress authentication is failing. The below snippet is for external oauth2 authentication but even a basic auth is also not working. Seems that nginx is completely ignore these annotations.</p>
<p>The oauth2 proxy with google api <strong>is actually working fine</strong>, but nginx is not including the auth configuration on his own configuration. I can easily check that on the nginx running pods. No auth conf there.</p>
<p>nginx ingress controller:</p>
<pre><code>  repoURL: 'https://helm.nginx.com/stable'
  targetRevision: 0.6.1
  version: nginx/1.19.2

</code></pre>
<p>The live manifest for an ingress service protected by oauth2:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ingress.kubernetes.io/auth-signin: https://oauth2.####.net/oauth2/start?rd=$escaped_request_uri
    ingress.kubernetes.io/auth-url: https://oauth2.####.net/oauth2/auth
    kubectl.kubernetes.io/last-applied-configuration: |
      {&quot;apiVersion&quot;:&quot;extensions/v1beta1&quot;,&quot;kind&quot;:&quot;Ingress&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:##########}
  creationTimestamp: &quot;####&quot;
  finalizers:
  - networking.gke.io/ingress-finalizer-V2
  generation: 1
  labels:
    argocd.argoproj.io/instance: k8s-default
  name: dashboard-ingress
  namespace: kubernetes-dashboard
  resourceVersion: &quot;22174124&quot;
  selfLink: /apis/extensions/v1beta1/namespaces/kubernetes-dashboard/ingresses/dashboard-ingress
  uid: 34263f6b-6818-403f-####-4c6acb196c49
spec:
  rules:
  - host: dashboard.###.net
    http:
      paths:
      - backend:
          serviceName: kdashboard-kubernetes-dashboard
          servicePort: 8080
        path: /
  tls:
  - hosts:
    - dashboard.###.net
    secretName: reflect-certificate-secret-internal
status:
  loadBalancer:
    ingress:
    - ip: ##.##.##.##
</code></pre>
<p>When running the service i never get a 403/401:</p>
<pre><code>curl -I 'https://dashboard.###.net/'
HTTP/1.1 200 OK
Server: nginx/1.19.2
Date: Mon, 14 Dec 2020 19:50:05 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1272
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: no-store
Last-Modified: Mon, 22 Jun 2020 14:25:00 GMT
</code></pre>

David Oliveira
<p><strong>EDIT:</strong></p>
<p>Based on the info you provided it looks like that you are using the <a href="https://github.com/nginxinc/kubernetes-ingress#nginx-ingress-controller" rel="nofollow noreferrer">Nginxinc Ingress Controller</a> and not the <a href="https://github.com/kubernetes/ingress-nginx#nginx-ingress-controller" rel="nofollow noreferrer">NGINX Ingress Controller</a> which are not the same. Nginxinc Ingress Controller is different from the NGINX Ingress controller in <a href="https://github.com/kubernetes/ingress-nginx#nginx-ingress-controller" rel="nofollow noreferrer">kubernetes/ingress-nginx repo</a> and also different from the default <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress" rel="nofollow noreferrer">GKE Ingress Controller</a>. The main difference that would affect your use case is that they all use different annotations and those annotations can only be satisfied by a proper Controller. You can find the key differences between the mentioned above <a href="https://github.com/nginxinc/kubernetes-ingress/blob/master/docs/nginx-ingress-controllers.md" rel="nofollow noreferrer">here</a> and <a href="https://medium.com/omnius/kubernetes-ingress-gce-vs-nginx-controllers-1-3-d89d6dd3da73" rel="nofollow noreferrer">here</a>.</p>
<p>Below are some useful docs/guides:</p>
<ul>
<li><p><a href="https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/#external-oauth-authentication" rel="nofollow noreferrer">External OAUTH Authentication</a>: The <code>auth-url</code> and <code>auth-signin</code> annotations allow you to use an external authentication provider to protect your Ingress resources.</p>
</li>
<li><p><a href="https://toolbox.kurio.co.id/securing-your-website-with-oauth2-in-nginx-ingress-controller-c84984eae7fa" rel="nofollow noreferrer">Securing your website with OAuth2 using NGINX Ingress Controller</a>: NGINX Ingress Controller can be combined with <code>oauth2_proxy</code> to enable many OAuth providers like Google, GitHub and others.</p>
</li>
<li><p><a href="https://github.com/nginxinc/kubernetes-ingress/issues/982" rel="nofollow noreferrer">How to configure external OAuth authentication?</a></p>
</li>
</ul>
<p>To sum up:</p>
<ul>
<li><p>Choose the proper controller that would satisfy the annotations that you want to use.</p>
</li>
<li><p>Keep in mind that different Controllers might use different annotations (<a href="https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/" rel="nofollow noreferrer">nginxinc</a> vs <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/" rel="nofollow noreferrer">nginx</a>).</p>
</li>
<li><p>Use <code>kubernetes.io/ingress.class:</code> annotation to choose the controller installed on your GKE Cluster.</p>
</li>
</ul>
