<p>I have the following the scenario:</p>

<p><a href="https://i.stack.imgur.com/ByWbQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ByWbQ.png" alt="enter image description here"></a></p>

<p>The user1 is going to have access to the services only in the <code>namespace1</code> but not in the <code>namespace2</code>.
I am going to use <strong>OAuth2</strong> as identity server. 
The question is, how to configure the ingress controller, that only <code>user1</code> is authorized to access services in <code>namespace1</code>.</p>

<p>When the <code>user2</code> is trying to access services in the <code>namespace1</code>, then it will reject the request.  </p>

<p>Any other solution?</p>

softshipper
<p>You can't do it at Ingress Controller level. You would do it through RBAC rules.</p>

<p>Something like this:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: namespace1
  name: deployment-manager
rules:
- apiGroups: ["", "extensions", "apps"]
  resources: ["deployments", "replicasets", "pods"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
</code></pre>

<hr>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: deployment-manager-binding
  namespace: namespace1
subjects:
- kind: User
  name: user1
  apiGroup: ""
roleRef:
  kind: Role
  name: deployment-manager
  apiGroup: ""
</code></pre>

<p>At Ingress Controller level (and depending on Ingress Controller), you could reject requests based on the host, the path; the user is trying to reach, headers and other attributes, but not based on the identity of the user.</p>

<p>Note that the Ingress Controller itself is going to be running in a namespace, so your user needs to first reach it (after being authenticated and authorized), and then be rejected, which doesn't really sound right.</p>
