basic auth for traefik dashboard

[thisIsLoading]

Hi,

i am pretty new to the whole k8s thing and found this repo through google (thank you for the awesome tool)

However, there is one thing that i just cant get to work, which is basic auth for the traefik dashboard. i am googling, reading and working on this for days now, but i just cant come up with a solution.

being a total newbie all kubernetes related doesnt help here either.

i have the following definitions:

---
apiVersion: v1
kind: Secret
metadata:
  name: example-auth-secret
  namespace: traefik
type: kubernetes.io/basic-auth
data:
  username: dGVzdAo=
  password: dGVzdAo=

---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: example-auth
  namespace: traefik
spec:
  basicAuth:
    removeHeader: true
    secret: example-auth-secret

---
apiVersion: v1
kind: Service
metadata:
  name: traefik-dashboard
  namespace: traefik
  labels:
    app.kubernetes.io/instance: traefik
    app.kubernetes.io/name: traefik-dashboard
spec:
  type: ClusterIP
  ports:
    - name: traefik
      port: 9000
      targetPort: traefik
      protocol: TCP
  selector:
    app.kubernetes.io/instance: traefik-traefik
    app.kubernetes.io/name: traefik

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: traefik-ingress
  namespace: traefik
  annotations:
    kubernetes.io/ingress.className: traefik
    cert-manager.io/cluster-issuer: letsencrypt-prod
    traefik.ingress.kubernetes.io/router.middlewares: traefik-example-auth@kubernetescrd
spec:
  rules:
    - host: traefik-staging.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: traefik-dashboard
                port:
                  number: 9000
  tls:
    - hosts:
        - traefik-staging.example.com
      secretName: traefik-staging-example-com

traefik is set up in the namespace traefik

without the traefik-example-auth enabled in the ingress, it loads the dashboard just fine, obviously without auth

user / pass are base64 encoded test / test. i have that verified directly via checking the secret.

however, the error i get is:

traefik-abcd-nd9tr traefik time="xxx" level=debug msg="Authentication failed" middlewareName=traefik-example-auth@kubernetescrd middlewareType=BasicAuth

traefik-abcd-nd9tr traefik time="xxx" level=debug msg="Authentication failed" middlewareType=BasicAuth middlewareName=traefik-example-auth@kubernetescrd

and the result is, that it doesnt accept test / test as user / pass.

can someone please check and help me out?

thanks!

[thisIsLoading]

after days now i decided to ask chat gpt. it told me that the encoded string is wrong and needed a double = as a terminator.

so, it needed to be dGVzdA== 🤦

letting this in here for future reference

[M4t7e]

Actually the padding was okay for your base64 string.

Because Base64 is a six-bit encoding, and because the decoded values are divided into 8-bit octets, every four characters of Base64-encoded text (4 sextets = 4 × 6 = 24 bits) represents three octets of unencoded text or data (3 octets = 3 × 8 = 24 bits). This means that when the length of the unencoded input is not a multiple of three, the encoded output must have padding added so that its length is a multiple of four. The padding character is =, which indicates that no further bits are needed to fully encode the input. (This is different from A, which means that the remaining bits are all zeros.)

See: https://en.wikipedia.org/wiki/Base64#Output_padding

Examples:

❯ echo -n "test" |  base64 -w 0 | xxd
00000000: 6447 567a 6441 3d3d                      dGVzdA==
❯ echo -n "test1" | base64 -w 0 | xxd
00000000: 6447 567a 6444 453d                      dGVzdDE=
❯ echo -n "test12" | base64 -w 0 | xxd
00000000: 6447 567a 6444 4579                      dGVzdDEy

Your initial base64 string (dGVzdAo=) contained a newline character at the end. So your decoded string was not test but test\n. You probably accidentally added a newline to you input string like that:

❯ echo "test" | base64 -w 0 | xxd
00000000: 6447 567a 6441 6f3d                      dGVzdAo=