title: Kubernetes Google OAuth2 Sign In
body: <p>I'm trying to figure this out for a while and can't seem to find an answer anywhere. Maybe someone here will have an idea.</p>
  
  <p>I have deployed an application on Kubernetes Cluster (in GCP). The Application is pretty much a micro-service type of app under a single domain. What I'm trying to achieve at the moment is to have a domain-wide-authentication via Google and OAuth2 protocol.
  So I have a main app under the main domain <code>https://example.com</code> and pretty much every single path under that domain will be a separate K8s Service + Deployment. So it's a different set of containers for <code>https://example.com/foo</code> and different for <code>https://example.com/bar</code> and obviously different set of containers for the main <code>https://example.com</code>. I don't want to "connect" each individual App to Google due to two reasons:</p>
  
  <ol>
  <li>Would require for me that each app has the OAuth2 Protocol implemented, and</li>
  <li>A token granted by one app would be invalid for the other one, so it would require the user to log in each time he/she changes the URL, kind bad UX if you ask me</li>
  </ol>
  
  <p>So, I'm trying to set up in the Kubernetes Cluster an Nginx Ingress Controller that would facilitate authentication and validate all incoming requests before they would reach any of the backend apps. This is where the problem lies...</p>
  
  <p>I've managed to set up <a href="https://github.com/pusher/oauth2_proxy/" rel="nofollow noreferrer">OAuth2 Proxy</a> in my Nginx Ingress Controller and the user can log in. The whole OAuth2 Flow works. HOWEVER, the user is not forced to log in. The user can navigate to the <code>https://example.com</code> but he/she won't be required to have an Authentication cookie granted after successful login via Google.</p>
  
  <p>Here is my YAML config for Ingress:</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
      nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
      kubernetes.io/ingress.class: "nginx"
      ingress.kubernetes.io/force-ssl-redirect: "true"
    name: example-com-ingress
    namespace: default
  spec:
    tls:
      - hosts:
          - example.com
        secretName: example-com-tls
    rules:
    - host: example.com
      http:
        paths:
          - backend:
              serviceName: oauth2-proxy
              servicePort: http-proxy
            path: /oauth2
          - backend:
              serviceName: example-com-nginx-service
              servicePort: 80
            path: /
  </code></pre>
  
  <p>Any ideas anyone?</p>