Create an Ingress with Basic Authentication (nginx)

If you install Longhorn on a Kubernetes cluster with kubectl or Helm, you will need to create an Ingress to allow external traffic to reach the Longhorn UI.

Authentication is not enabled by default for kubectl and Helm installations. In these steps, you’ll learn how to create an Ingress with basic authentication using annotations for the nginx ingress controller.

  1. Create a basic auth file auth. It’s important the file generated is named auth (actually - that the secret has a key data.auth), otherwise the Ingress returns a 503.

    1. $ USER=<USERNAME_HERE>; PASSWORD=<PASSWORD_HERE>; echo "${USER}:$(openssl passwd -stdin -apr1 <<< ${PASSWORD})" >> auth

  2. Create a secret:

    1. $ kubectl -n longhorn-system create secret generic basic-auth --from-file=auth

  3. Create an Ingress manifest longhorn-ingress.yml :

    Since v1.2.0, Longhorn supports uploading backing image from the UI, so please specify nginx.ingress.kubernetes.io/proxy-body-size: 10000m as below to ensure uploading images work as expected.

    1. apiVersion: networking.k8s.io/v1
    2. kind: Ingress
    3. metadata:
    4.   name: longhorn-ingress
    5.   namespace: longhorn-system
    6.   annotations:
    7.     # type of authentication
    8.     nginx.ingress.kubernetes.io/auth-type: basic
    9.     # prevent the controller from redirecting (308) to HTTPS
    10.     nginx.ingress.kubernetes.io/ssl-redirect: 'false'
    11.     # name of the secret that contains the user/password definitions
    12.     nginx.ingress.kubernetes.io/auth-secret: basic-auth
    13.     # message to display with an appropriate context why the authentication is required
    14.     nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required '
    15.     # custom max body size for file uploading like backing image uploading
    16.     nginx.ingress.kubernetes.io/proxy-body-size: 10000m
    17. spec:
    18.   ingressClassName: nginx
    19.   rules:
    20.   - http:
    21.       paths:
    22.       - pathType: Prefix
    23.         path: "/"
    24.         backend:
    25.           service:
    26.             name: longhorn-frontend
    27.             port:
    28.               number: 80

  4. Create the Ingress:

    1. $ kubectl -n longhorn-system apply -f longhorn-ingress.yml

e.g.:

  1. $ USER=foo; PASSWORD=bar; echo "${USER}:$(openssl passwd -stdin -apr1 <<< ${PASSWORD})" >> auth
  2. $ cat auth
  3. foo:$apr1$FnyKCYKb$6IP2C45fZxMcoLwkOwf7k0
  5. $ kubectl -n longhorn-system create secret generic basic-auth --from-file=auth
  6. secret/basic-auth created
  7. $ kubectl -n longhorn-system get secret basic-auth -o yaml
  8. apiVersion: v1
  9. data:
  10.   auth: Zm9vOiRhcHIxJEZueUtDWUtiJDZJUDJDNDVmWnhNY29Md2tPd2Y3azAK
  11. kind: Secret
  12. metadata:
  13.   creationTimestamp: "2020-05-29T10:10:16Z"
  14.   name: basic-auth
  15.   namespace: longhorn-system
  16.   resourceVersion: "2168509"
  17.   selfLink: /api/v1/namespaces/longhorn-system/secrets/basic-auth
  18.   uid: 9f66233f-b12f-4204-9c9d-5bcaca794bb7
  19. type: Opaque
  21. $ echo "
  22. apiVersion: networking.k8s.io/v1
  23. kind: Ingress
  24. metadata:
  25.   name: longhorn-ingress
  26.   namespace: longhorn-system
  27.   annotations:
  28.     # type of authentication
  29.     nginx.ingress.kubernetes.io/auth-type: basic
  30.     # prevent the controller from redirecting (308) to HTTPS
  31.     nginx.ingress.kubernetes.io/ssl-redirect: 'false'
  32.     # name of the secret that contains the user/password definitions
  33.     nginx.ingress.kubernetes.io/auth-secret: basic-auth
  34.     # message to display with an appropriate context why the authentication is required
  35.     nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required '
  36. spec:
  37.   rules:
  38.   - http:
  39.       paths:
  40.       - pathType: Prefix
  41.         path: "/"
  42.         backend:
  43.           service:
  44.             name: longhorn-frontend
  45.             port:
  46.               number: 80
  47. " | kubectl -n longhorn-system create -f -
  48. ingress.networking.k8s.io/longhorn-ingress created
  50. $ kubectl -n longhorn-system get ingress
  51. NAME               HOSTS   ADDRESS                                     PORTS   AGE
  52. longhorn-ingress   *       45.79.165.114,66.228.45.37,97.107.142.125   80      2m7s
  54. $ curl -v http://97.107.142.125/
  55. *   Trying 97.107.142.125...
  56. * TCP_NODELAY set
  57. * Connected to 97.107.142.125 (97.107.142.125) port 80 (#0)
  58. > GET / HTTP/1.1
  59. > Host: 97.107.142.125
  60. > User-Agent: curl/7.64.1
  61. > Accept: */*
  62. >
  63. < HTTP/1.1 401 Unauthorized
  64. < Server: openresty/1.15.8.1
  65. < Date: Fri, 29 May 2020 11:47:33 GMT
  66. < Content-Type: text/html
  67. < Content-Length: 185
  68. < Connection: keep-alive
  69. < WWW-Authenticate: Basic realm="Authentication Required"
  70. <
  71. <html>
  72. <head><title>401 Authorization Required</title></head>
  73. <body>
  74. <center><h1>401 Authorization Required</h1></center>
  75. <hr><center>openresty/1.15.8.1</center>
  76. </body>
  77. </html>
  78. * Connection #0 to host 97.107.142.125 left intact
  79. * Closing connection 0
  81. $ curl -v http://97.107.142.125/ -u foo:bar
  82. *   Trying 97.107.142.125...
  83. * TCP_NODELAY set
  84. * Connected to 97.107.142.125 (97.107.142.125) port 80 (#0)
  85. * Server auth using Basic with user 'foo'
  86. > GET / HTTP/1.1
  87. > Host: 97.107.142.125
  88. > Authorization: Basic Zm9vOmJhcg==
  89. > User-Agent: curl/7.64.1
  90. > Accept: */*
  91. >
  92. < HTTP/1.1 200 OK
  93. < Date: Fri, 29 May 2020 11:51:27 GMT
  94. < Content-Type: text/html
  95. < Content-Length: 1118
  96. < Last-Modified: Thu, 28 May 2020 00:39:41 GMT
  97. < ETag: "5ecf084d-3fd"
  98. < Cache-Control: max-age=0
  99. <
  100. <!DOCTYPE html>
  101. <html lang="en">
  102. ......

Additional Steps for AWS EKS Kubernetes Clusters

You will need to create an ELB (Elastic Load Balancer) to expose the nginx Ingress controller to the Internet. Additional costs may apply.

  1. Create pre-requisite resources according to the nginx ingress controller documentation.

  2. Create an ELB by following these steps.

References

https://kubernetes.github.io/ingress-nginx/