Using SecretProviderClass with Ingress basic Auth

Question

I'm trying to setup Basic auth in ingress. The "nginx.ingress.kubernetes.io/auth-secret" I have stored in K8s secrets using SecretProviderClass. The secret is mounted correctly. As per this documentation (https://kubernetes.github.io/ingress-nginx/examples/auth/basic/), the secret should have "data.auth" inside the key. Hence, in my deployment file I created an environment variable named "BASIC_AUTH_VALUE" to achieve this.

env:
        - name: SECRET_AUTH
          valueFrom:
            secretKeyRef:
              name: {{ include "ui.fullname" . }}-azure-csi
              key: FRONTEND_BASIC_AUTH
              optional: false
        - name: BASIC_AUTH_VALUE
          value: data.auth:$(SECRET_AUTH)

Then in my ingress file, I set the annotations as below

nginx.ingress.kubernetes.io/auth-secret: BASIC_AUTH_VALUE

Even then I still get 503 error. The pod is up and running and there isn't anything in the logs that I can find.

I have tried several options but all in vain so far. Any guidance will be of great help. Thanks.

Answer 1

I found a solution. I had to adapt the SecretProviderClass's secretObjects as below

secretObjects:
  - data:
    {{- range $secret := .Values.azureSecretsCSI.secrets }}
    - key: {{ $secret.k8sName }}
      objectName: {{ $secret.azName }}
    {{- end }}
    secretName: {{ include "ui.fullname" . }}-auth-azure-csi
    type: Opaque

Where "{{ $secret.k8sName }}" must be "auth" is derived from values.yaml file as below

azureSecretsCSI:
  tenantId: XXX
  kvName: XXX
  secrets: 
    - azName: XXX
      k8sName: auth

And then in ingress annotations add name of the secret provider class instead of a secret name or an environment variable (which I was trying to do and which wasn't working)

nginx.ingress.kubernetes.io/auth-secret: {{ include "ui.fullname" . }}-auth-azure-csi