如何在Kubernetes的Nginx Ingress中配置自定义单用户登录页面

要实现自定义登录页面且仅支持单个用户，可通过Nginx Ingress的认证注解+轻量自定义认证服务的方式完成，替代Basic Auth，具体步骤如下：

1. 搭建自定义认证服务 #

编写一个极简的HTTP服务，处理登录页面渲染、凭据验证和会话管理。以下是Python Flask实现的示例：

服务代码（app.py） #

from flask import Flask, render_template_string, request, redirect, make_response

app = Flask(__name__)

# 配置单个用户凭据（可根据需求修改）
USERNAME = "admin"
PASSWORD = "your-secure-password"
SESSION_COOKIE_NAME = "app_auth"

# 自定义登录页面模板
LOGIN_PAGE = """
<!DOCTYPE html>
<html>
<head>
    <title>专属登录入口</title>
    <style>
        body { display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; font-family: sans-serif; }
        .login-card { padding: 2rem; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
        .login-card h2 { margin-top: 0; text-align: center; }
        .form-group { margin: 1rem 0; }
        .form-group input { width: 100%; padding: 0.8rem; border: 1px solid #ddd; border-radius: 4px; box-sizing: border-box; }
        .submit-btn { width: 100%; padding: 0.8rem; background-color: #2563eb; color: white; border: none; border-radius: 4px; cursor: pointer; }
        .error-msg { color: #dc2626; font-size: 0.9rem; text-align: center; margin-top: 0.5rem; }
    </style>
</head>
<body>
    <div class="login-card">
        <h2>请登录</h2>
        {% if error %}
        <div class="error-msg">{{ error }}</div>
        {% endif %}
        <form method="POST" action="/login">
            <div class="form-group">
                <input type="text" name="username" placeholder="用户名" required>
            </div>
            <div class="form-group">
                <input type="password" name="password" placeholder="密码" required>
            </div>
            <button class="submit-btn" type="submit">登录</button>
        </form>
    </div>
</body>
</html>
"""

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        input_user = request.form.get('username')
        input_pwd = request.form.get('password')
        if input_user == USERNAME and input_pwd == PASSWORD:
            # 登录成功，设置会话Cookie并跳转回原请求页面
            redirect_url = request.args.get('redirect', '/')
            resp = make_response(redirect(redirect_url))
            resp.set_cookie(
                SESSION_COOKIE_NAME,
                "valid_session",
                httponly=True,
                secure=True,  # 生产环境需启用HTTPS
                max_age=3600  # Cookie有效期1小时
            )
            return resp
        # 登录失败，返回带错误提示的登录页
        return render_template_string(LOGIN_PAGE, error="用户名或密码错误")
    # GET请求直接返回登录页
    return render_template_string(LOGIN_PAGE)

@app.route('/auth-check')
def auth_check():
    # 验证会话Cookie是否有效
    session_cookie = request.cookies.get(SESSION_COOKIE_NAME)
    if session_cookie == "valid_session":
        return '', 200  # 验证通过
    return '', 401  # 验证失败，触发跳转登录页

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8080)

打包成Docker镜像 #

创建Dockerfile：

FROM python:3.11-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir flask
COPY app.py .
CMD ["python", "app.py"]

requirements.txt内容：

flask==2.3.3

构建并推送镜像至你的容器仓库：

docker build -t your-registry/auth-service:v1 .
docker push your-registry/auth-service:v1

2. 在Kubernetes中部署认证服务 #

创建auth-service.yaml：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: auth-service
spec:
  replicas: 1
  selector:
    matchLabels:
      app: auth-service
  template:
    metadata:
      labels:
        app: auth-service
    spec:
      containers:
      - name: auth-service
        image: your-registry/auth-service:v1
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: auth-service
spec:
  selector:
    app: auth-service
  ports:
  - port: 80
    targetPort: 8080

部署到集群：

kubectl apply -f auth-service.yaml

3. 配置Nginx Ingress #

修改你的业务服务Ingress配置，添加认证注解，并将登录路径指向认证服务：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: your-app-ingress
  annotations:
    # 指向认证服务的验证接口
    nginx.ingress.kubernetes.io/auth-url: "http://auth-service.default.svc.cluster.local/auth-check"
    # 未认证时跳转的登录页面，$request_uri保留原请求地址
    nginx.ingress.kubernetes.io/auth-signin: "https://your-domain.com/login?redirect=$request_uri"
    # 允许传递认证服务返回的Set-Cookie头
    nginx.ingress.kubernetes.io/auth-response-headers: "Set-Cookie"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - your-domain.com
    secretName: your-tls-secret  # 配置HTTPS证书密钥
  rules:
  - host: your-domain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: your-app-service
            port:
              number: 80
      # 将登录路径转发到认证服务
      - path: /login
        pathType: Prefix
        backend:
          service:
            name: auth-service
            port:
              number: 80

部署Ingress配置：

kubectl apply -f your-app-ingress.yaml

4. 验证功能 #

1. 访问https://your-domain.com，会自动跳转到自定义登录页面
2. 配置的用户名密码输入正确后，会跳转回原业务页面
3. 未登录或Cookie过期时，会被重新拦截到登录页

内容的提问来源于stack exchange，提问作者Ali Rezvani