<p>I wanna have an ingress for all my service in the k8s, and give the ingress a basic auth. But for auth rotation, I want to support a secondary auth for user so the endpoint can be reached when they re-generate the primary key.</p>

<p>I currently can follow <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/basic/" rel="nofollow noreferrer">this guide</a> to set up an ingress with single basic auth.</p>

Yuwei Zhou
<p>Adapting <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/basic/" rel="noreferrer">the guide</a>, you can put multiple usernames and passwords in the <code>auth</code> file you're using to generate the basic auth secret.  Specifically, if you run the <code>htpasswd</code> command without the <code>-c</code> flag, so e.g. <code>htpasswd &lt;filename&gt; &lt;username&gt;</code> it will <strong>add</strong> an entry to the file rather than creating a new file from scratch:</p>

<pre><code>$ htpasswd -c auth foo
New password: &lt;bar&gt;
Re-type new password: &lt;bar&gt;
Adding password for user foo

$ cat auth
foo:$apr1$isCec65Z$JNaQ0GJCpPeG8mR1gYsgM1

$ htpasswd auth user2
New password: &lt;pass2&gt;
Re-type new password: &lt;pass2&gt;
Adding password for user user2

$ cat auth
foo:$apr1$isCec65Z$JNaQ0GJCpPeG8mR1gYsgM1
user2:$apr1$.FsOzlqA$eFxym7flDnoDtymRLraA2/
</code></pre>

<p>If you've already created the secret in the first place via the given command:</p>

<pre><code>$ kubectl create secret generic basic-auth --from-file=auth
</code></pre>

<p>You can then update the secret with <a href="https://stackoverflow.com/a/45881259/1061413">this trick</a>:</p>

<pre><code>$ kubectl create secret generic basic-auth --from-file=auth\
  --dry-run -o yaml | kubectl apply -f -
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
secret/basic-auth configured
</code></pre>

<p>You can confirm setting the secret worked:</p>

<pre><code>$ kubectl get secret basic-auth -ojsonpath={.data.auth} | base64 -D
foo:$apr1$isCec65Z$JNaQ0GJCpPeG8mR1gYsgM1
user2:$apr1$.FsOzlqA$eFxym7flDnoDtymRLraA2/
</code></pre>

<p>Finally, you can test basic auth with both usernames and passwords is working:</p>

<pre><code>$ curl http://&lt;minikube_ip&gt;/ -H 'Host: foo.bar.com' \
  -s -w"%{http_code}" -o /dev/null
401

$ curl http://&lt;minikube_ip&gt;/ -H 'Host: foo.bar.com' \
  -u 'wronguser:wrongpass' \
  -s -w"%{http_code}" -o /dev/null
401

$ curl http://&lt;minikube_ip&gt;/ -H 'Host: foo.bar.com' \
  -u 'foo:bar' \
  -s -w"%{http_code}" -o /dev/null
200

$ curl http://&lt;minikube_ip&gt;/ -H 'Host: foo.bar.com' \
  -u 'user2:pass2' \
  -s -w"%{http_code}" -o /dev/null
200
</code></pre>
