如何配置Kong Ingress Controller实现Nginx Ingress的auth-url与auth-signin认证逻辑

核心思路 #

复用现有oauth2-proxy的OIDC能力，通过Kong开源免费插件模拟Nginx auth_request的验证流程：

• 对目标服务（如kubernetes-dashboard）的请求，先转发到oauth2-proxy的/oauth2/auth端点做身份验证
• 验证通过时，提取oauth2-proxy返回的Authorization头并传递给上游服务
• 验证失败（4xx状态）时，重定向到oauth2-proxy的/oauth2/start登录页，携带原请求地址作为跳转回源

具体实现步骤 #

1. 确保oauth2-proxy已接入Kong #

先为oauth2-proxy创建Kong Service和Route，让Kong能转发/oauth2/*路径的请求到oauth2-proxy服务：

apiVersion: v1
kind: Service
metadata:
  name: oauth2-proxy
  namespace: kube-system
spec:
  selector:
    app: oauth2-proxy
  ports:
  - port: 4180
    targetPort: 4180
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: oauth2-proxy-ingress
  namespace: kube-system
  annotations:
    konghq.com/strip-path: "true"
spec:
  ingressClassName: kong
  rules:
  - host: your-dashboard-domain.com
    http:
      paths:
      - path: /oauth2
        pathType: Prefix
        backend:
          service:
            name: oauth2-proxy
            port:
              number: 4180

2. 配置Kong Pre-Function插件实现验证逻辑 #

创建KongPlugin资源，用Lua代码模拟Nginx的身份验证和头信息传递逻辑：

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: oauth2-proxy-auth
plugin: pre-function
config:
  access:
  - |
    -- 调用oauth2-proxy的/auth端点验证用户身份
    local res = kong.client.request({
      method = "GET",
      path = "/oauth2/auth",
      headers = {
        ["Host"] = kong.request.get_host(),
        ["Cookie"] = kong.request.get_header("Cookie")
      }
    })

    -- 处理验证结果
    if res.status >= 400 then
      -- 验证失败，重定向到登录页并携带原请求地址
      local redirect_url = "https://" .. kong.request.get_host() .. "/oauth2/start?rd=" .. ngx.escape_uri(kong.request.get_path_with_query())
      return kong.response.exit(302, nil, {
        ["Location"] = redirect_url
      })
    else
      -- 验证通过，提取Authorization头并传递给上游服务
      local auth_token = res.headers["Authorization"]
      if auth_token then
        kong.service.request.set_header("Authorization", auth_token)
      end
    end

3. 为kubernetes-dashboard的Ingress绑定插件 #

修改dashboard的Ingress资源，添加注解绑定上述验证插件：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kubernetes-dashboard-ingress
  namespace: kube-system
  annotations:
    konghq.com/plugins: "oauth2-proxy-auth"
spec:
  ingressClassName: kong
  rules:
  - host: your-dashboard-domain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kubernetes-dashboard
            port:
              number: 443

关键说明 #

• pre-function插件：属于Kong开源核心插件，无需付费，支持通过Lua代码自定义请求处理逻辑，完全适配本次验证需求
• Cookie传递：验证过程中必须携带用户Cookie，oauth2-proxy通过Cookie识别已登录用户
• 地址转义：用ngx.escape_uri对原请求地址做转义，避免URL编码冲突问题

内容的提问来源于stack exchange，提问作者KMathmann