<p>We have a microservice architecture based on Kubernetes in Amazon EKS with Ambassador as API Gateway. </p>

<p>We have 2 Ambassadors: 1 public and 1 private. So we have services that are only accessible by services in the cluster or VPN, and we have some services that are public.</p>

<p>We have the need for making private some URL paths in the public services. For example, we have a public API that is accessible in <code>api.company.com</code>, and we want to leave all paths public like <code>api.company.com/createuser</code>, <code>api.company.com/login</code>, etc... but for other paths we want to make them private, for example: <code>api.company.com/swagger.html</code>. </p>

<p>We know that we could enable authentication for those paths in the API, but we are looking for a solution without auth.</p>

<p>An example of how we configure K8s service with Ambassador for public services:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  annotations:
    getambassador.io/config: |
      ---
      apiVersion: ambassador/v0
      kind:  Mapping
      name:  backends_mapping
      prefix: /
      ambassador_id: ambassador-public
      service: backends.svc:8080
      host: api.mycompany.com
  labels:
    app: backends
  name: backends
  namespace: svc
spec:
  ports:
  - name: http-backends
    port: 8080
    protocol: TCP
    targetPort: http-api
  selector:
    app: backends
  type: ClusterIP
</code></pre>

Adrián
<p>Not sure what do you mean by without auth. You will need some sort of check to serve internal content. </p>

<p>One approach to achieve this can be(Note this is a high level overview). </p>

<p>You can make the service private, do not expose this service directly.</p>

<p>Prefix all your internal routes with say <code>/internal/</code> or <code>/private/</code> prefix.<br>
So <code>api.company.com/swagger.html</code> becomes <code>api.company.com/internal/swagger.html</code></p>

<p>You can create a load balancer that points to this middleware.
Middleware(public service) will intercept all the requests. I think Nginx can be used here. If the request has <code>/internal/</code> path check if it satisfies the condition(origin, internal network etc).</p>

<p>If the check passes, redirect to private service.
If the check fails return 403 forbidden or whatever response code that fits.</p>
