<p>I implemented a Spring backend which is responsible to store different data (users, lectures, ...). This backend is secured with a JWT and everything is working fine. For my studies I want to enhance the backend and now I want to use a microservice architecture instead of a monolith. For this purpose I have the requirements to use Docker and Kubernetes. I always read articles which write that I need a Authorization Server and a Ressource Server when I want to use the JWT in a microservice architecture. Is that correct? And do I need a Gateway (e.g. Zuul) for my purpose? Can someone help me to structure the project and give advice for the technology stack. At the end the whole project will run in one single server.</p>

<p>I implemented a molotithical backend, secured with JWT.</p>

softwareUser
<p>Kubernetes officially supports <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens" rel="nofollow noreferrer">authentication</a> to API server within JSON Web Tokens(JWT) through <a href="https://openid.net/connect/" rel="nofollow noreferrer">OpenID Connect</a> tool using OAuth 2.0 protocol for user request identification. However, this only represents a part of <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#authorization-modules" rel="nofollow noreferrer">Authorization</a> model, which determines how authenticated user can be granted with appropriate security policies or roles to manage Kubernetes cluster resources.</p>

<p>In order to build or migrate application to Kubernetes, you might consider to expose application outside the cluster, for that purpose <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Ingress</a> proxies requests to exact service by matching request path. Actually, <code>Ingress</code> is a logical resource element which describes a set of rules for traffic management via <a href="https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/" rel="nofollow noreferrer">Ingress Controller</a>. Therefore, Ingress controller can play a role of API Gateway by delivering L7 network facilities like: load balancing, SSL termination and HTTP/HTTPS traffic routing for nested application services.</p>

<p>As you mentioned <a href="https://github.com/Netflix/zuul" rel="nofollow noreferrer">Zuul</a> gateway can be one of the option for the edge proxying service in front of Kubernetes cluster, however I would recommend to look for some more Kubernetes oriented solutions. <a href="https://istio.io/" rel="nofollow noreferrer">Istio</a> is a good example, as it brings a wide set of network router functions with a quite simple integration into Kubernetes cluster via its core <a href="https://istio.io/docs/concepts/what-is-istio/#what-is-a-service-mesh" rel="nofollow noreferrer">Service mesh</a> design. Istio provides end user authentication via JWT within declared authentication <a href="https://istio.io/docs/tasks/security/authn-policy/#end-user-authentication" rel="nofollow noreferrer">policy</a>.</p>

<p>Alternativelly, you can get through <a href="https://www.nginx.com/products/nginx/" rel="nofollow noreferrer">Nginx plus</a> features with announced JWT authentication as well.</p>
