Good day, everyone.

Today I'll show how to expose an internal site to the internet, but not to everyone - only to a chosen few. In other words, we'll add authentication where there was none and where it seemingly wasn't needed.

Where do I use this? Why bother?

I have a Kubernetes cluster that hosts a few projects. All of it faces the internet through traefik (the ingress controller). Or rather, the internet can look at the projects through traefik. But right now it matters less who looks where than the fact that traefik has a dashboard, and it is reachable from the internet too. That dashboard has no built-in authentication, and showing your routing internals to just anyone is not a good idea.

I created the problem myself and solved it myself. Now I want to tell you about it.

Where do the users come from?

Since I'm a devotee of the church of Microsoft, I have Azure Active Directory. That's where we'll take the users from. But not all of them - we'll create a separate group and add only the chosen users to it. After the user signs in with Azure AD, we'll check that they belong to that group.

How is this even possible?

Unlike other ingress controllers, Traefik lets us configure intermediate rules for requests (middleware). Among other things, there is a dedicated middleware type for external authentication. That's exactly what we need.

We need to implement an AuthServer, create and properly configure a middleware, and use it in an ingressroute.

A ready-made implementation of the server is in my github repository.

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: auth
spec:
  forwardAuth:
    address: "http://10.97.180.143/auth"
    trustForwardHeader: true  
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard
spec:
  entryPoints:
  - websecure
  routes:
  - kind: Rule
    match: Host(`traefik.example.com`)
    middlewares:
    - name: auth
    services:
    - kind: TraefikService
      name: api@internal
      namespace: default
  tls:
    certResolver: letsencrypt
```