authelia/docs/content/en/integration/kubernetes/traefik-ingress.md

title	description	lead	date	draft	images	menu	weight	toc
Traefik Ingress	A guide to integrating Authelia with the Traefik Kubernetes Ingress.	A guide to integrating Authelia with the Traefik Kubernetes Ingress.	2022-06-15T17:51:47+10:00	false		integration parent kubernetes	550	true

We officially support the Traefik 2.x Kubernetes ingress controllers. These come in two flavors:

• Traefik Kubernetes Ingress
• Traefik Kubernetes CRD

The Traefik documentation may also be useful for crafting advanced annotations to use with this ingress even though it's not specific to Kubernetes.

Get Started

It's strongly recommended that users setting up Authelia for the first time take a look at our Get Started guide. This takes you through various steps which are essential to bootstrapping Authelia.

Special Notes

Cross-Namespace Resources

Depending on your Traefik version you may be required to configure the allowCrossNamespace to reuse a Middleware from a Namespace different to the Ingress / IngressRoute. Alternatively you can create the Middleware in every Namespace you need to use it.

Middleware

Regardless if you're using the Traefik Kubernetes Ingress or purely the Traefik Kubernetes CRD, you must configure the Traefik Kubernetes CRD as far as we're aware at this time in order to configure a ForwardAuth Middleware.

This is an example Middleware manifest. This example assumes that you have deployed an Authelia Pod and you have configured it to be served on the URL https://auth.example.com and there is a Kubernetes Service with the name authelia in the default Namespace with TCP port 80 configured to route to the Authelia Pod's HTTP port and that your cluster is configured with the default DNS domain name of cluster.local.

Important Note: The Middleware should be applied to an Ingress / IngressRoute you wish to protect. It SHOULD NOT be applied to the Authelia Ingress / IngressRoute itself.

{{< details "middleware.yml" >}}

---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: forwardauth-authelia
  namespace: default
  labels:
    app.kubernetes.io/instance: authelia
    app.kubernetes.io/name: authelia
spec:
  forwardAuth:
    address: 'http://authelia.default.svc.cluster.local/api/authz/forward-auth'
    ## The following commented line is for configuring the Authelia URL in the proxy. We strongly suggest this is
    ## configured in the Session Cookies section of the Authelia configuration.
    # address: 'http://authelia.default.svc.cluster.local/api/authz/forward-auth?authelia_url=https%3A%2F%2Fauth.example.com%2F'
    authResponseHeaders:
      - 'Authorization'
      - 'Proxy-Authorization'
      - 'Remote-User'
      - 'Remote-Groups'
      - 'Remote-Email'
      - 'Remote-Name'
...

{{< /details >}}

Ingress

This is an example Ingress manifest which uses the above Middleware. This example assumes you have an application you wish to serve on https://app.example.com and there is a Kubernetes Service with the name app in the default Namespace with TCP port 80 configured to route to the application Pod's HTTP port.

{{< details "ingress.yml" >}}

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app
  namespace: default
  annotations:
    traefik.ingress.kubernetes.io/router.entryPoints: websecure
    traefik.ingress.kubernetes.io/router.middlewares: default-forwardauth-authelia@kubernetescrd
    traefik.ingress.kubernetes.io/router.tls: "true"
spec:
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /bar
            pathType: Prefix
            backend:
              service:
                name:  app
                port:
                  number: 80
...

{{< /details >}}

IngressRoute

This is an example IngressRoute manifest which uses the above Middleware. This example assumes you have an application you wish to serve on https://app.example.com and there is a Kubernetes Service with the name app in the default Namespace with TCP port 80 configured to route to the application Pod's HTTP port.

{{< details "ingressRoute.yml" >}}

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: app
  namespace: default
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`app.example.com`)
      middlewares:
        - name: forwardauth-authelia
          namespace: default
      services:
        - kind: Service
          name: app
          namespace: default
          port: 80
          scheme: http
          strategy: RoundRobin
          weight: 10
...

{{< /details >}}