<p>I created a basic react/express app with IAP authentication and deployed to google app engine and everything works as expected. Now i'm moving from app engine deployment to kubernetes, all things work except the user authentication with IAP on kubernetes. How do I enable IAP user authentication with kubernetes?</p>

<p>Do I have to create a kubernetes secret to get user authentication to work? <a href="https://cloud.google.com/iap/docs/enabling-kubernetes-howto" rel="nofollow noreferrer">https://cloud.google.com/iap/docs/enabling-kubernetes-howto</a></p>

<p>Authentication code in my server.js <a href="https://cloud.google.com/nodejs/getting-started/authenticate-users#cloud-identity-aware-proxy" rel="nofollow noreferrer">https://cloud.google.com/nodejs/getting-started/authenticate-users#cloud-identity-aware-proxy</a></p>

Machine Learning
<p>In order for Cloud IAP to be working with Kubernetes, you will need a group of one or more GKE instances, served by an HTTPS load balancer. The load balancer should be created automatically when you create an <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer" rel="nofollow noreferrer">Ingress object</a> in a GKE cluster.</p>

<p>Also required for enabling Cloud IAP in GKE: a domain name registered to the address of your load balancer and an App code to verify that all requests have an <a href="https://cloud.google.com/iap/docs/identity-howto" rel="nofollow noreferrer">identity</a>.</p>

<p>Once these requirements have been achieved, you can move forward with <a href="https://cloud.google.com/iap/docs/enabling-kubernetes-howto#enabling_iap" rel="nofollow noreferrer">enabling Cloud IAP</a> on Kubernetes Engine. This includes the steps to set up Cloud IAP access and creating OAuth credentials.</p>

<p>You will need to create a Kubernetes Secret to <a href="https://cloud.google.com/iap/docs/enabling-kubernetes-howto#kubernetes-configure" rel="nofollow noreferrer">configure BackendConfig for Cloud IAP</a>. The BackendConfig uses a Kubernetes Secret to wrap the OAuth client that you create when enabling the Cloud IAP.</p>
