website/docs: fix nginx ingress proxy example

[eliottness]

Details

👋 Hey,

I was trying to add an ingress for my k8s cluster to setup a proxy application and copy-pasting the example clearly did not work. Here is a fix for that.

---

Checklist

• Local tests pass (ak test authentik/)
• The code has been formatted (make lint-fix)

If an API change has been made

• The API schema has been updated (make gen-build)

If changes to the frontend have been made

• The code has been formatted (make web)
• The translation files have been updated (make i18n-extract)

If applicable

• The documentation has been updated
• The documentation has been formatted (make website)

[netlify]

✅ Deploy Preview for authentik-storybook canceled.

Name	Link
🔨 Latest commit	58e59d0
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/65ae20ea5c36d90008bf0fbd

[netlify]

✅ Deploy Preview for authentik ready!

Name	Link
🔨 Latest commit	58e59d0
🔍 Latest deploy log	https://app.netlify.com/sites/authentik/deploys/65ae20ea54edad0008eceb3e
😎 Deploy Preview	https://deploy-preview-8245--authentik.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[rissson]

Hello Elliot, fancy seeing you here! Thank you for your contribution!

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (0467df1) 92.29% compared to head (58e59d0) 92.31%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8245      +/-   ##
==========================================
+ Coverage   92.29%   92.31%   +0.01%     
==========================================
  Files         608      608              
  Lines       30262    30262              
==========================================
+ Hits        27929    27935       +6     
+ Misses       2333     2327       -6     

Flag	Coverage Δ
e2e	50.59% <ø> (+0.01%)	⬆️
integration	26.39% <ø> (ø)
unit	89.46% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[drg-tanasescu]

@eliottness Do you have any working example of a nginx ingress with authentik on it ? (Authentik deployed with helm on a different cluster, external Outpost)

[eliottness]

I don't have an external outpost but I have this if it can help:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app
  namespace: app
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
    nginx.ingress.kubernetes.io/auth-signin: https://app.domain.com/outpost.goauthentik.io/start?rd=$escaped_request_uri
    nginx.ingress.kubernetes.io/auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
    nginx.ingress.kubernetes.io/auth-snippet: |
      proxy_set_header X-Forwarded-Host $http_host;
  labels:
    name: app
spec:
  rules:
  - host: app.domain.com
    http:
      paths:
      - pathType: Prefix
        path: "/outpost.goauthentik.io"
        backend:
          service:
            name: authentik
            port: 
              number: 9000
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: app
            port: 
              number: 80
  tls:
    - hosts:
      - app.domain.com
      secretName: letsencrypt

I had to add controller.allowSnippetAnnotations=true to the nginx ingress helm chart deployment to register the auth-snippet annotation

[eliottness]

@drg-tanasescu ☝️

[drg-tanasescu]

Thank you, but for this to work you need to have the app and the authentik in same namespace or am i wrong ?

    http:
      paths:
      - pathType: Prefix
        path: "/outpost.goauthentik.io"
        backend:
          service:
            name: authentik
            port: 
              number: 9000

[eliottness]

Thank you, but for this to work you need to have the app and the authentik in same namespace or am i wrong ?

@drg-tanasescu Ah yes, you made me remember that there is a little trickery: an ExternalName service.

apiVersion: v1
kind: Service
metadata:
  name: authentik
  namespace: app
spec:
  externalName: ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local
  type: ExternalName

[drg-tanasescu]

I tried with a service like this and didn't work.

apiVersion: v1
kind: Service
metadata:
  name: authentik-external-service
spec:
  type: ExternalName
  externalName: auth.dev.example.com

This svc is not created automatically: ak-outpost-authentik-embedded-outpost

$ ktools get svc
authentik-postgresql        ClusterIP 
authentik-postgresql-hl    ClusterIP   
authentik-redis-headless  ClusterIP  
authentik-redis-master     ClusterIP  
authentik-server                ClusterIP  

---

And this worked (with traefik ingress)

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamiv1
  labels:
    name: whoamiv1
spec:
  replicas: 1
  selector:
    matchLabels:
      task: whoamiv1
  template:
    metadata:
      labels:
        task: whoamiv1
    spec:
      containers:
        - name: whoamiv1
          image: traefik/traefikee-webapp-demo:v2
          args:
            - -ascii
            - -name=whoami-traefik
          ports:
            - containerPort: 80
          readinessProbe:
            httpGet:
              path: /ping
              port: 80
            failureThreshold: 1
            initialDelaySeconds: 2
            periodSeconds: 3
            successThreshold: 1
            timeoutSeconds: 2
---
apiVersion: v1
kind: Service
metadata:
  name: whoamiv1
spec:
  ports:
    - name: http
      port: 80
  selector:
    task: whoamiv1

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: middlewares-authentik
  namespace: internal-tools
spec:
  forwardAuth:
    address: https://auth.dev.example.com/outpost.goauthentik.io/auth/traefik
    trustForwardHeader: true
    authResponseHeaders:
      - X-authentik-username
      - X-authentik-groups
      - X-authentik-email
      - X-authentik-name
      - X-authentik-uid
      - X-authentik-jwt
      - X-authentik-meta-jwks
      - X-authentik-meta-outpost
      - X-authentik-meta-provider
      - X-authentik-meta-app
      - X-authentik-meta-version
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: whoami-http-ing
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
    kubernetes.io/ingress.class: traefik-internal
    traefik.ingress.kubernetes.io/router.middlewares: internal-tools-middlewares-authentik@kubernetescrd
spec:
  rules:
    - host: whoami-internal.dev.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: whoamiv1
                port:
                  number: 80

I will create tomorrow an issue if i get no answers on the Discord channel and ping you there, hope we can create a working example like this one with traefik.

[eliottness]

@drg-tanasescu All the mentions to ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local in my code are referring to the embedded outpost (e.g. authentik itself). It should be changed to the url of your outpost.