<p>I'm trying to setup my Jenkins instance in <strong>Google Kubernetes Engine</strong>, also I am using <strong>Google login plugin</strong> so that I could login with my GCP user to Jenkins, I have installed Ingress controller which is <strong>NGINX</strong> and exposed Jenkins service using ingress.</p>

<p>Domain under which I want to access Jenkins is : <strong>util.my-app.com/jenkins</strong></p>

<p>In Jenkins config under parameter <em>Jenkins URL</em> I also set this domain name <strong>util.my-app.com/jenkins</strong></p>

<p>And here's my Ingress:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: jenkins-ing
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - host: util.my-app.com
    http:
      paths:
      - path: /jenkins/*
        backend:
          serviceName: jenkins-svc
          servicePort: 80
</code></pre>

<p>In GCP Credentials page under <em>Authorized JavaScript origins</em> I set <strong><a href="http://util.my-app.com" rel="nofollow noreferrer">http://util.my-app.com</a></strong> and under <em>Authorized redirect URIs</em> I set <strong><a href="http://util.my-app.com/jenkins/securityRealm/finishLogin" rel="nofollow noreferrer">http://util.my-app.com/jenkins/securityRealm/finishLogin</a></strong></p>

<p>It's either returning me 404 status or doing infinite redirects, what I noticed that when Jenkins Google login plugin does redirect it is like this <strong><a href="http://util.my-app.com/securityRealm/finishLogin" rel="nofollow noreferrer">http://util.my-app.com/securityRealm/finishLogin</a></strong> without "jenkins" part, what is wrong with my setup ?</p>

Laimis
<p>Welcome to Stack Laimis!</p>

<p>I tested your ingress object, and there one issue.</p>

<p><strong>Your Ingress is missing the <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#rewrite" rel="nofollow noreferrer">rewrite-target</a>:</strong></p>

<blockquote>
  <p>In some scenarios the exposed URL in the backend service differs from the specified path in the Ingress rule. Without a rewrite any request will return 404. Set the annotation nginx.ingress.kubernetes.io/rewrite-target to the path expected by the service.</p>
</blockquote>

<p>This example from documentation <a href="https://kubernetes.github.io/ingress-nginx/examples/rewrite/#rewrite" rel="nofollow noreferrer">shows the structure required</a>:</p>

<p>Here is your ingress with the edit:</p>

<ul>
<li>added the line <code>nginx.ingress.kubernetes.io/rewrite-target: /$1</code></li>
</ul>

<pre><code>apiVersion: networking.k8s.io/v1beta1 # for versions before 1.14 use extensions/v1beta1
kind: Ingress
metadata:
  name: jenkins-ing
  annotations:
     nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
    - host: util.my-app.com
      http:
        paths:
          - path: /jenkins/*
            backend:
              serviceName: jenkins-svc
              servicePort: 80
</code></pre>

<hr>

<p><strong>Reproduction:</strong></p>

<ul>
<li>First I created a deployment. For that I'm using  <code>echo-app</code> for it's elucidative output.</li>
<li>Add a service to expose it inside the cluster on <code>port 8080</code> and outside as <code>NodePort</code>.</li>
</ul>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
 name: echo1-deploy
spec:
 selector:
   matchLabels:
     app: echo1-app
 template:
   metadata:
     labels:
       app: echo1-app
   spec:
     containers:
     - name: echo1-app
       image: mendhak/http-https-echo
       ports:
       - name: http
         containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
 name: echo1-svc
spec:
 type: NodePort
 selector:
   app: echo1-app
 ports:
   - protocol: TCP
     port: 8080
     targetPort: 80
</code></pre>

<ul>
<li>I'll create one more deployment and service, this way we can try a little further with Ingress and to demonstrate what to do when you have more than one service that you need to expose on ingress</li>
</ul>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
 name: echo2-deploy
spec:
 selector:
   matchLabels:
     app: echo2-app
 template:
   metadata:
     labels:
       app: echo2-app
   spec:
     containers:
     - name: echo2-app
       image: mendhak/http-https-echo
       ports:
       - name: http
         containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
 name: echo2-svc
spec:
 type: NodePort
 selector:
   app: echo2-app
 ports:
   - protocol: TCP
     port: 8080
     targetPort: 80
</code></pre>

<ul>
<li>I'll use an ingress, just like yours, the only diferences are:

<ul>
<li>Changed the service to <code>echo1-svc</code> emulating your jenkins-svc</li>
<li>Added another service to <code>echo2-svc</code> to redirect all http requests except the ones that match the first rule.</li>
</ul></li>
</ul>

<pre><code>apiVersion: networking.k8s.io/v1beta1 # for versions before 1.14 use extensions/v1beta1
kind: Ingress
metadata:
  name: jenkins-ing
  annotations:
     nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
    - host: util.my-app.com
      http:
        paths:
          - path: /jenkins/*
            backend:
              serviceName: echo1-svc
              servicePort: 80
          - path: /(.*)
            backend:
              serviceName: echo2-svc
              servicePort: 80
</code></pre>

<ul>
<li>Now I'll deploy this apps and the ingress:</li>
</ul>

<pre><code>$ kubectl apply -f echo1-deploy.yaml 
deployment.apps/echo1-deploy created
service/echo1-svc created

$ kubectl apply -f echo2-deploy.yaml 
deployment.apps/echo2-deploy created
service/echo2-svc created

$ kubectl apply -f jenkins-ing.yaml 
ingress.networking.k8s.io/jenkins-ing created
</code></pre>

<ul>
<li>Now let's check if everything is running:</li>
</ul>

<pre><code>$ kubectl get all
NAME                               READY   STATUS    RESTARTS   AGE
pod/echo1-deploy-989766d57-8pmhj   1/1     Running   0          27m
pod/echo2-deploy-65b6ffbcf-lfgzk   1/1     Running   0          27m

NAME                 TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
service/echo1-svc    NodePort    10.101.127.78   &lt;none&gt;        8080:30443/TCP   27m
service/echo2-svc    NodePort    10.106.34.91    &lt;none&gt;        8080:32628/TCP   27m

NAME                           READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/echo1-deploy   1/1     1            1           27m
deployment.apps/echo2-deploy   1/1     1            1           27m

NAME                                     DESIRED   CURRENT   READY   AGE
replicaset.apps/echo1-deploy-989766d57   1         1         1       27m
replicaset.apps/echo2-deploy-65b6ffbcf   1         1         1       27m

$ kubectl get ingress
NAME          HOSTS             ADDRESS   PORTS   AGE
jenkins-ing   util.my-app.com             80      4s
</code></pre>

<ul>
<li>As you can see the <code>echo1-svc</code> is exposed outside kubernetes on <code>port 30443</code> and <code>echo2-svc</code> on <code>port 32628</code></li>
<li>With the ingress rule we can Curl on port 80 and it will redirect to the specified service.</li>
<li>Since I don't have this domain, I'll add a record on my <code>/etc/hosts</code> file to emulate the DNS resolution directing it to my kubernetes IP.</li>
</ul>

<pre><code>$ cat /etc/hosts
127.0.0.1       localhost
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters

192.168.39.240  util.my-app.com

$ curl util.my-app.com/jenkins
{
  "headers": {
    "host": "util.my-app.com",
    "x-real-ip": "192.168.39.1",
    "x-forwarded-host": "util.my-app.com",
    "x-forwarded-port": "80",
    "x-forwarded-proto": "http",
    "user-agent": "curl/7.52.1",
  },
  "method": "GET",
  "hostname": "util.my-app.com",
  "ip": "::ffff:172.17.0.6",
  "protocol": "http",
   "subdomains": [
    "util"
  ],
  "os": {
    "hostname": "echo1-deploy-989766d57-8pmhj"
  }
</code></pre>

<p>You can see the HTTP GET was redirected to the pod on the backend of <code>echo1-svc</code>
- Now let's check what happens when we curl the domain without the <code>/jenkins/</code></p>

<pre><code>$ curl util.my-app.com
{
  "headers": {
    "host": "util.my-app.com",
    "x-real-ip": "192.168.39.1",
    "x-forwarded-host": "util.my-app.com",
    "x-forwarded-port": "80",
    "x-forwarded-proto": "http",
    "user-agent": "curl/7.52.1",
 },
  "method": "GET",
  "hostname": "util.my-app.com",
  "ip": "::ffff:172.17.0.6",
  "protocol": "http",
  "subdomains": [
    "util"
  ],
  "os": {
    "hostname": "echo2-deploy-65b6ffbcf-lfgzk"
</code></pre>

<p>You can see the HTTP GET was redirected to the pod on the backend of <code>echo2-svc</code>.</p>

<hr>

<ul>
<li>I know your question also addresses issues about your google authentication, but I'd suggest you to first correct your ingress, then you can paste here the status it will return if you still have problems with the ingress redirecting correctly.</li>
</ul>

<p>If you have any doubt let me know in the comments.</p>
