title: Securing specific nginx-ingress location with client cert verification
body: <p>I'm setting up an instance of ghost and I'm trying to secure the /ghost path with client cert verification. </p>
  
  <p>I've got an initial ingress up and running that serves the site quite happily with the path specified as /. </p>
  
  <p>I'm trying to add a second ingress (that's mostly the same) for the /ghost path. If I do this and add the annotations for basic auth, everything seems to work. i.e. If I browse to /ghost I am prompted for credentials in the basic-auth secret, if I browse to any other URL it is served without auth. </p>
  
  <p>I then switched to client cert verification based on this example: <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/auth/client-certs" rel="nofollow noreferrer">https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/auth/client-certs</a></p>
  
  <p>When I try this either the whole site or none of the site is secured, rather than the path-based separation, I got with basic-auth. Looking at the nginx.conf from the running pod the  <code>proxy_set_header ssl-client-verify</code>, <code>proxy_set_header ssl-client-subject-dn</code> &amp; <code>proxy_set_header ssl-client-issuer-dn</code> elements are added under the root / path and the /ghost path. I've tried removing those (from the root only) and copying the config directly back to the pod but not luck there either.</p>
  
  <p>I'm pulling nginx-ingress (Chart version 0.23.0) in as a dependency via Helm</p>
  
  <p>Ingress definition for <code>/</code> location - this one works</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      certmanager.k8s.io/cluster-issuer: letsencrypt-staging
      kubernetes.io/ingress.class: nginx
      kubernetes.io/tls-acme: "true"
    labels:
      app: my-app
      chart: my-app-0.1.1
      heritage: Tiller
      release: my-app
    name: my-app
    namespace: default
  spec:
    rules:
    - host: example.com
      http:
        paths:
        - backend:
            serviceName: my-app
            servicePort: http
          path: /
    tls:
    - hosts:
      - example.com
      secretName: mysite-tls
  </code></pre>
  
  <p>Ingress definition for <code>/ghost</code> location - this one doesn't work</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
      nginx.ingress.kubernetes.io/auth-tls-secret: "default/auth-tls-chain"
      nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"
      nginx.ingress.kubernetes.io/auth-tls-error-page: "http://www.example.com/error-cert.html"
      nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "false"
      kubernetes.io/ingress.class: "nginx"
    labels:
      app: my-app
      chart: my-app-0.1.1
      heritage: Tiller
      release: my-app
    name: my-app-secure
    namespace: default
  spec:
    rules:
    - host: example.com
      http:
        paths:
        - backend:
            serviceName: my-app
            servicePort: http
          path: /ghost
    tls:
    - hosts:
      - example.com
      secretName: mysite-tls
  </code></pre>