<p>Okay, I have a DB consisting of several nodes deployed to GKE.</p>

<p>The deployment.yaml adds each node as ClusterIP, which makes sense. Here is the complete deployment  file:</p>

<p><a href="https://github.com/dgraph-io/dgraph/blob/master/contrib/config/kubernetes/dgraph-ha/dgraph-ha.yaml" rel="nofollow noreferrer">https://github.com/dgraph-io/dgraph/blob/master/contrib/config/kubernetes/dgraph-ha/dgraph-ha.yaml</a></p>

<p>For whatever reason, the DB has zero security functionality, so I cannot expose any part using a LoadBalancer service because doing so would give unsecured access to the entire DB. The vendor argues that security is solely the user's problem. The AlphaNode comes with an API endpoint, which is also unsecured, but I actually want to connect to that API endpoint from an external IP.    </p>

<p>So, the best I can do is adding an NGNIX as a (reverse) proxy with authentication to secure access to the API endpoint of the Alpha node(s). Practically, I have three alpha nodes so adding load balancing makes sense. I found a config that does load balancing to three alpha nodes in Docker Compose although, without authenication.:</p>

<p><a href="https://gist.github.com/MichelDiz/42954e321620159c872c35c20e9d85c6" rel="nofollow noreferrer">https://gist.github.com/MichelDiz/42954e321620159c872c35c20e9d85c6</a></p>

<p>Now, the million-dollar question I have is, how do I add an NGNIX load balance to Kubernetes that authenticates and load balances incoming traffic to my (ClusterIP) alpha nodes? </p>

<p>Any pointers? 
Any help? </p>

Marvin.Hansen
<p>If you want to do it that hard way, you can deploy your own nginx deployment and expose it as <code>LoadBalancer Service</code>. You can configure it with different authentication mechanisms that nginx support. </p>

<p>Instead, you can use <code>Ingress</code> resource backed by an <code>IngressController</code> that supports authentication. Check if your kubernetes distribution provides an <code>IngressController</code> and if it is supports auth. If not, you can install <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/basic/" rel="nofollow noreferrer">nginx</a> or <a href="https://docs.traefik.io/v1.7/configuration/backends/kubernetes/#authentication" rel="nofollow noreferrer">Traefik</a> IngressControllers which supports authentication. </p>

<p>Looks like GKE ingress has recently added support for IAP bassed authentication which is still in beta - <a href="https://cloud.google.com/iap/docs/enabling-kubernetes-howto" rel="nofollow noreferrer">https://cloud.google.com/iap/docs/enabling-kubernetes-howto</a></p>

<p>If you are looking for more traditional type of authentication with ingress, install nginx or traefik and use the <code>kubernetes.io/ingress.class</code> annotation so that only IngressController claims your ingress resource - <a href="https://kubernetes.github.io/ingress-nginx/user-guide/multiple-ingress/" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/user-guide/multiple-ingress/</a></p>
