<p>I am deploying a EKS cluster to AWS and using alb ingress controller points to my K8S service. The ingress spec is shown as below.</p>
<p>There are two targets <code>path: /*</code> and <code>path: /es/*</code>. And I also configured <code>alb.ingress.kubernetes.io/auth-type</code> to use <code>cognito</code> as authentication method.</p>
<p>My question is how can I configure different <code>auth-type</code> for different target? I'd like to use <code>cognito</code> for <code>/*</code> and <code>none</code> for <code>/es/*</code>. How can I achieve that?</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: sidecar
  namespace: default
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/group.name: sidecar
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/group.order: '1'
    alb.ingress.kubernetes.io/healthcheck-path: /health
    alb.ingress.kubernetes.io/listen-ports: '[{&quot;HTTP&quot;: 80}, {&quot;HTTPS&quot;: 443}]'
    # Auth
    alb.ingress.kubernetes.io/auth-type: cognito
    alb.ingress.kubernetes.io/auth-idp-cognito: '{&quot;userPoolARN&quot;:&quot;xxxx&quot;,&quot;userPoolClientID&quot;:&quot;xxxx&quot;,&quot;userPoolDomain&quot;:&quot;xxxx&quot;}'
    alb.ingress.kubernetes.io/auth-scope: 'email openid aws.cognito.signin.user.admin'
    alb.ingress.kubernetes.io/certificate-arn: xxxx

spec:
  rules:
    - http:
        paths:
          - path: /es/*
            backend:
              serviceName: sidecar-entrypoint
              servicePort: 8080
          - path: /*
            backend:
              serviceName: server-entrypoint
              servicePort: 8081


</code></pre>

Joey Yi Zhao
<p>This question comes up a lot, so I guess it needs to be PR-ed into their documentation.</p>
<p>Ingress resources are cumulative, so you can separate your paths into two separate Ingress resources in order to annotate each one differently. They will be combined with all other Ingress resources across the entire cluster to form the final config</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: sidecar-star
  namespace: default
  annotations:
    kubernetes.io/ingress.class: alb
    # ... and the rest ...
spec:
  rules:
    - http:
        paths:
          - path: /*
            backend:
              serviceName: server-entrypoint
              servicePort: 8081
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: sidecar-es
  namespace: default
  annotations:
    kubernetes.io/ingress.class: alb
    # ... and the rest ...
spec:
  rules:
    - http:
        paths:
          - path: /es/*
            backend:
              serviceName: sidecar-entrypoint
              servicePort: 8080
</code></pre>
