<p>I am using nginx ingress controller (<a href="https://kubernetes.github.io/ingress-nginx/deploy/" rel="noreferrer">https://kubernetes.github.io/ingress-nginx/deploy/</a>) on AWS. The backend service (kibana from ECK: <a href="https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-operator-config.html" rel="noreferrer">https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-operator-config.html</a>) uses HTTP basic auth mechanics. </p>

<p>Is there a way to tune nginx so that it appends Authorization: Basic header to every request forwarded to my service so that users won't have to type the password?</p>

<p>This solution did not work for me:</p>

<pre><code>nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "Authorization: Basic encoded_credentals";
</code></pre>

<p>as I am still being prompted for a password.   </p>

Łukasz
<p>Here is an ingress rule using a secret that contains a file generated with htpasswd. It's important the file generated is named auth (actually - that the secret has a key data.auth), otherwise the ingress-controller returns a 503.</p>

<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-with-auth
  annotations:
    # type of authentication
    nginx.ingress.kubernetes.io/auth-type: basic
    # name of the secret that contains the user/password definitions
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    # message to display with an appropriate context why the authentication is required
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'
spec:
  rules:
  - host: foo.bar.com
    http:
      paths:
      - path: /
        backend:
          serviceName: http-svc
          servicePort: 80
</code></pre>

<p>Secret creation</p>

<pre><code>$ htpasswd -c auth foo
New password: &lt;bar&gt;
New password:
Re-type new password:
Adding password for user foo
$ kubectl create secret generic basic-auth --from-file=auth
secret "basic-auth" created
$ kubectl get secret basic-auth -o yaml
apiVersion: v1
data:
  auth: Zm9vOiRhcHIxJE9GRzNYeWJwJGNrTDBGSERBa29YWUlsSDkuY3lzVDAK
kind: Secret
metadata:
  name: basic-auth
  namespace: default
type: Opaque
</code></pre>

<p>Access it using curl and you should get 200 Ok.</p>

<pre><code>$ curl -v http://10.2.29.4/ -H 'Host: foo.bar.com' -u 'foo:bar'
</code></pre>

<p>Check this example <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/auth/basic" rel="noreferrer">here</a></p>
