Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support APIKey authentication #5292

Closed
brianehlert opened this issue Mar 21, 2024 Discussed in #5089 · 0 comments
Closed

Support APIKey authentication #5292

brianehlert opened this issue Mar 21, 2024 Discussed in #5089 · 0 comments
Labels
backlog Pull requests/issues that are backlog items epic Issues that need to be broken into smaller issues
Milestone

Comments

@brianehlert
Copy link
Collaborator

brianehlert commented Mar 21, 2024

Discussed in #5089

Originally posted by brianehlert February 13, 2024
NGINX Plus offers a number of capabilities that align with API Gateway use cases.
One of those capabilities is APIKey based authentication.

This would introduce a new APIKey Policy object, the necessary configuration / NJS functions, the ability to associate a key or set of keys with a server or location block, support for VirtualServer and VirtualServerRoute, and a pattern for customers to follow when defining a single or set of APIKeys that is consistent with the NGINX implementation.

NGINX Ingress Controller supports both single and multi-tenant use cases.
In the single tenant use case, one team is responsible for the ingress controller configuration and all of the managed hostnames and paths.
In this case a single team would maintain the secret(s) that contain the key(s) and the header the application supports when passing the key(s) in the request.

In the multi-tenant use case, there might be multiple application teams that define different unique keys for their users, but share a single ingress controller deployment.

It is believed that the complicated workflow is supporting how customers allocate and assign key(s) in a way that is compatible with Kubernetes and that allows the customer to segment key management among multiple teams.
The ingress controller should not be a key management system itself. It should not generate or assign keys, but rather support the use if APIKeys as a method of enforcement for allow/deny of access to server and location blocks.

Initial Policy proposal:

apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: api-key-policy
spec:
  apiKeyAuth:
    header: my-app-api-key
    secret: api-key

(imagine the values are base64 strings)

apiVersion: v1
kind: Secret
metadata:
  name: nginx-keys-secret
type: Opaque
data:
  keys: [1,22,333,4444,55555,666666,7777777]
apiVersion: v1
kind: Secret
metadata:
  name: nginx-keys-secret
type: Opaque
data:
  keys:
  - 1
  - 22
  - 333
  - 4444
  - 55555
  - 666666
  - 7777777

Additional suggestions and learnings can be extracted from: https://docs.nginx.com/nginx-management-suite/acm/how-to/policies/apikey-authn/#create-an-api-key-authentication-policy which contains some good high value options.
A consideration needs to be made for supporting multiple APIKeys on a single server or location.

### Tasks
- [ ] https://github.com/nginxinc/kubernetes-ingress/issues/5351
- [ ] https://github.com/nginxinc/kubernetes-ingress/issues/5484
@brianehlert brianehlert added the epic Issues that need to be broken into smaller issues label Mar 21, 2024
@brianehlert brianehlert added this to the v3.6.0 milestone Mar 21, 2024
@jasonwilliams14 jasonwilliams14 self-assigned this Mar 21, 2024
@brianehlert brianehlert added the ready for refinement An issue that was triaged and it is ready to be refined label Apr 3, 2024
@danielnginx danielnginx added backlog Pull requests/issues that are backlog items and removed ready for refinement An issue that was triaged and it is ready to be refined labels Apr 4, 2024
@brianehlert brianehlert changed the title Epic - Support APIKey authentication Epic - Support APIKey authentication test Apr 4, 2024
@brianehlert brianehlert changed the title Epic - Support APIKey authentication test Epic - Support APIKey authentication Apr 8, 2024
@shaun-nx shaun-nx changed the title Epic - Support APIKey authentication Support APIKey authentication Jun 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backlog Pull requests/issues that are backlog items epic Issues that need to be broken into smaller issues
Projects
None yet
Development

No branches or pull requests

4 participants