nginx-cookie-auth-repro.sh

# myapp.local is the hostname of the application being protected with external auth

# extauth.local is the hostname of the external auth endpoint

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/baremetal/service-nodeport.yaml

echo '
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  labels:
    app: myapplication
data:
  default.conf: |
    server {
        server_name _;
        listen 80;
        location /check {
            if ($cookie_authed = "yes") {
                return 200;
            }

            if ($http_x_original_url ~ "authed=yes") {
                add_header Set-Cookie "authed=yes" always;
                return 401;    
            }
            
            return 401;
        }

        location /sign-in {
            return 302 $arg_uri?authed=yes;
        }
    }

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: extauth
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: extauth
    spec:
      containers:
        - image: nginx
          name: nginx
          ports:
            - containerPort: 80
              name: http
          volumeMounts:
            - mountPath: /etc/nginx/conf.d
              name: nginx-config
      volumes:
        - name: nginx-config
          configMap:
            name: nginx-config
---
kind: Service
apiVersion: v1
metadata:
  name: extauth
spec:
  selector:
    app: extauth
  ports:
    - name: http
      port: 80
      targetPort: 80
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: extauth
spec:
  rules:
    - host: extauth.local
      http:
        paths:
          - path: /
            backend:
              serviceName: extauth
              servicePort: http
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - image: nginx
          name: nginx
          ports:
            - containerPort: 80
              name: http
---
kind: Service
apiVersion: v1
metadata:
  name: myapp
spec:
  selector:
    app: myapp
  ports:
    - name: http
      port: 80
      targetPort: 80
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: myapp
  annotations:
    nginx.ingress.kubernetes.io/auth-signin: http://extauth.local/sign-in?uri=$scheme://$host$request_uri
    nginx.ingress.kubernetes.io/auth-url: http://extauth.default.svc.cluster.local/check?uri=$scheme://$host$request_uri
spec:
  rules:
    - host: myapp.local
      http:
        paths:
          - path: /
            backend:
              serviceName: myapp
              servicePort: http
' | kubectl apply -f -

POD_NAME=$(k get pods -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx -o NAME)

# Curl should return a 200 + welcome page but, instead, Maximum (50) redirects followed
kubectl exec -it -n ingress-nginx ${POD_NAME} -- \
  curl -L --cookie-jar '$(mktemp)' \
  --resolve myapp.local:80:localhost \
  --resolve extauth.local:80:localhost \
  http://myapp.local