From 2c47d71666a34b837f44b84d4ec6d2e8271c886d Mon Sep 17 00:00:00 2001 From: DesalLama <130358851+DesalLama@users.noreply.github.com> Date: Tue, 27 Jan 2026 20:45:05 +0545 Subject: [PATCH] Add support for auth-signin annotation --- .../kubernetes/ingress-nginx.md | 18 +++++++++--------- .../kubernetes/ingress-nginx/annotations.go | 1 + .../ingress-nginx/annotations_test.go | 4 ++++ .../ingresses/02-ingress-with-forwardauth.yml | 1 + .../kubernetes/ingress-nginx/kubernetes.go | 1 + .../ingress-nginx/kubernetes_test.go | 1 + 6 files changed, 17 insertions(+), 9 deletions(-) diff --git a/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md b/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md index d354047de..4e210fd8d 100644 --- a/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md +++ b/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md @@ -254,15 +254,16 @@ The following annotations are organized by category for easier navigation. ### Authentication -| Annotation | Limitations / Notes | -|-------------------------------------------------------|--------------------------------------------------------------------------------------------| -| `nginx.ingress.kubernetes.io/auth-type` | | -| `nginx.ingress.kubernetes.io/auth-secret` | | -| `nginx.ingress.kubernetes.io/auth-secret-type` | | -| `nginx.ingress.kubernetes.io/auth-realm` | | +| Annotation | Limitations / Notes | +|-------------------------------------------------------|-------------------------------------------------------------------------------------------| +| `nginx.ingress.kubernetes.io/auth-type` | | +| `nginx.ingress.kubernetes.io/auth-secret` | | +| `nginx.ingress.kubernetes.io/auth-secret-type` | | +| `nginx.ingress.kubernetes.io/auth-realm` | | | `nginx.ingress.kubernetes.io/auth-url` | Only URL and response headers copy supported. Forward auth behaves differently than NGINX. | -| `nginx.ingress.kubernetes.io/auth-method` | | -| `nginx.ingress.kubernetes.io/auth-response-headers` | | +| `nginx.ingress.kubernetes.io/auth-signin` | Redirects to signin URL on 401 response. | +| `nginx.ingress.kubernetes.io/auth-method` | | +| `nginx.ingress.kubernetes.io/auth-response-headers` | | ### SSL/TLS @@ -358,7 +359,6 @@ The following annotations are organized by category for easier navigation. | Annotation | Notes | |-----------------------------------------------------------------------------|------------------------------------------------------| | `nginx.ingress.kubernetes.io/affinity-canary-behavior` | | -| `nginx.ingress.kubernetes.io/auth-signin` | | | `nginx.ingress.kubernetes.io/auth-tls-secret` | | | `nginx.ingress.kubernetes.io/auth-tls-verify-depth` | | | `nginx.ingress.kubernetes.io/auth-tls-verify-client` | | diff --git a/pkg/provider/kubernetes/ingress-nginx/annotations.go b/pkg/provider/kubernetes/ingress-nginx/annotations.go index fbe3285ce..4d4b132c6 100644 --- a/pkg/provider/kubernetes/ingress-nginx/annotations.go +++ b/pkg/provider/kubernetes/ingress-nginx/annotations.go @@ -16,6 +16,7 @@ type ingressConfig struct { AuthSecretType *string `annotation:"nginx.ingress.kubernetes.io/auth-secret-type"` AuthURL *string `annotation:"nginx.ingress.kubernetes.io/auth-url"` + AuthSignin *string `annotation:"nginx.ingress.kubernetes.io/auth-signin"` AuthResponseHeaders *string `annotation:"nginx.ingress.kubernetes.io/auth-response-headers"` ForceSSLRedirect *bool `annotation:"nginx.ingress.kubernetes.io/force-ssl-redirect"` diff --git a/pkg/provider/kubernetes/ingress-nginx/annotations_test.go b/pkg/provider/kubernetes/ingress-nginx/annotations_test.go index 36ce89434..961b2b871 100644 --- a/pkg/provider/kubernetes/ingress-nginx/annotations_test.go +++ b/pkg/provider/kubernetes/ingress-nginx/annotations_test.go @@ -28,6 +28,8 @@ func Test_parseIngressConfig(t *testing.T) { "nginx.ingress.kubernetes.io/session-cookie-max-age": "3600", "nginx.ingress.kubernetes.io/backend-protocol": "HTTPS", "nginx.ingress.kubernetes.io/cors-expose-headers": "foo, bar", + "nginx.ingress.kubernetes.io/auth-url": "http://auth.example.com/verify", + "nginx.ingress.kubernetes.io/auth-signin": "https://auth.example.com/oauth2/start?rd=foo", }, expected: ingressConfig{ SSLPassthrough: ptr.To(true), @@ -40,6 +42,8 @@ func Test_parseIngressConfig(t *testing.T) { SessionCookieMaxAge: ptr.To(3600), BackendProtocol: ptr.To("HTTPS"), CORSExposeHeaders: ptr.To([]string{"foo", "bar"}), + AuthURL: ptr.To("http://auth.example.com/verify"), + AuthSignin: ptr.To("https://auth.example.com/oauth2/start?rd=foo"), }, }, { diff --git a/pkg/provider/kubernetes/ingress-nginx/fixtures/ingresses/02-ingress-with-forwardauth.yml b/pkg/provider/kubernetes/ingress-nginx/fixtures/ingresses/02-ingress-with-forwardauth.yml index 220499792..8187383c4 100644 --- a/pkg/provider/kubernetes/ingress-nginx/fixtures/ingresses/02-ingress-with-forwardauth.yml +++ b/pkg/provider/kubernetes/ingress-nginx/fixtures/ingresses/02-ingress-with-forwardauth.yml @@ -8,6 +8,7 @@ metadata: nginx.ingress.kubernetes.io/auth-url: "http://whoami.default.svc/" nginx.ingress.kubernetes.io/auth-method: "GET" nginx.ingress.kubernetes.io/auth-response-headers: "X-Foo" + nginx.ingress.kubernetes.io/auth-signin: "https://auth.example.com/oauth2/start?rd=foo" spec: ingressClassName: nginx diff --git a/pkg/provider/kubernetes/ingress-nginx/kubernetes.go b/pkg/provider/kubernetes/ingress-nginx/kubernetes.go index a95623ec6..355d6c2b8 100644 --- a/pkg/provider/kubernetes/ingress-nginx/kubernetes.go +++ b/pkg/provider/kubernetes/ingress-nginx/kubernetes.go @@ -1166,6 +1166,7 @@ func applyForwardAuthConfiguration(routerName string, ingressConfig ingressConfi ForwardAuth: &dynamic.ForwardAuth{ Address: *ingressConfig.AuthURL, AuthResponseHeaders: authResponseHeaders, + AuthSigninURL: ptr.Deref(ingressConfig.AuthSignin, ""), }, } rt.Middlewares = append(rt.Middlewares, forwardMiddlewareName) diff --git a/pkg/provider/kubernetes/ingress-nginx/kubernetes_test.go b/pkg/provider/kubernetes/ingress-nginx/kubernetes_test.go index 5170c38f8..3839d8d94 100644 --- a/pkg/provider/kubernetes/ingress-nginx/kubernetes_test.go +++ b/pkg/provider/kubernetes/ingress-nginx/kubernetes_test.go @@ -250,6 +250,7 @@ func TestLoadIngresses(t *testing.T) { ForwardAuth: &dynamic.ForwardAuth{ Address: "http://whoami.default.svc/", AuthResponseHeaders: []string{"X-Foo"}, + AuthSigninURL: "https://auth.example.com/oauth2/start?rd=foo", }, }, },