Nginx Ingress双认证场景下X-User请求头丢失问题求助

核心问题在于：API-Key认证的Ingress通过auth-url调用Basic Auth端点时，Basic Auth的Ingress里的X-User是在代理到WebAPI阶段设置的，并非Basic Auth认证服务返回的响应头。而auth-response-headers仅能捕获认证服务返回的响应头，因此这个X-User无法被传递到API-Key Ingress的后端服务。

以下两种修改方式任选其一即可：

方式一：调整Basic Auth Ingress，让认证阶段返回X-User头 #

修改ingress-basic-auth的注解，在Basic Auth认证成功后，直接在认证响应中返回X-User头，这样API-Key Ingress就能通过auth-response-headers捕获并传递给后端：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-basic-auth
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required'
    nginx.ingress.kubernetes.io/auth-snippet: |
      # 将认证后的用户名存入变量，添加到认证响应头中
      auth_request_set $auth_user $remote_user;
      add_header X-User $auth_user;
    nginx.ingress.kubernetes.io/auth-response-headers: X-User
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header X-User $remote_user;
spec:
  rules:
  - host: basic-auth.localdev.me
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: webapi
            port:
              number: 80
  ingressClassName: nginx

方式二：在API-Key Ingress中直接传递捕获到的X-User头 #

API-Key Ingress调用Basic Auth端点后，Nginx会将认证响应中的X-User头存入$upstream_http_x_user变量，直接在configuration-snippet中设置代理头即可：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-apikey
  annotations:
    nginx.ingress.kubernetes.io/auth-url: https://basic-auth.localdev.me/
    nginx.ingress.kubernetes.io/auth-snippet: |
      proxy_set_header Authorization "Basic $http_x_api_key"; 
    nginx.ingress.kubernetes.io/auth-response-headers: X-User
    nginx.ingress.kubernetes.io/configuration-snippet: |
      # 将认证响应中的X-User设置到代理头，传递给后端
      proxy_set_header X-User $upstream_http_x_user;
spec:
  rules:
  - host: api-key.localdev.me
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: webapi
            port:
              number: 80
  ingressClassName: nginx

重新应用Ingress配置后，调用API-Key端点时，Nginx会从Basic Auth的认证响应中获取X-User并传递给WebAPI，即可解决请求头丢失的问题。

内容的提问来源于stack exchange，提问作者Mario Rossi