Currently I have a webpage which is freely accessible from certain networks an requires HTTP basic auth otherwise. This behaviour is set in the nginx config. It looks something like this:

geo $authentication {
    default "Authentication required";
    SOME-IP "off";
    SOME-NETWORK1 "off";
    SOME-NETWORK2 "off"; 

auth_basic $authentication;

Now I want to move this webpage to a k8s cluster under ingress-nginx ingress controller. As I can see from the docs it has support for basic auth but provides no ways to allow access from specific ips/networks. Is there a way/another ingress controller/tool to configure said behaviour?

1 Answer 1


The thing I was looking for was external-auth in ingress-nginx. I created a simple service with nodejs which took over all the basic-auth logic. Then I used an external link to this service in k8s annotations for restricted resources.

annotation snippet:

    nginx.ingress.kubernetes.io/auth-url: http://service-name.default.svc.cluster.local:3000/auth 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.