Trouble with enabling basic auth for Linkerd dashboard with nginx ingress

[nikhilcreddy]

Error:
When trying to access the dashboard, I am getting a pop-up as expected to enter the Basic Auth username and password. But after entering the details, it is not going through. It is endlessly showing the pop-up to enter the details again.

Hi!
I installed Linkerd 2.9.2 using CLI in Azure AKS and injected to my application. Its working fine for all the services but I am having trouble exposing dashboard using ngnix with basic auth.

This is the kubernetes secret I am using:

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: web-ingress-auth
  namespace: linkerd-viz
data:
  auth: YWRtaW46YWRtaW4K

This is the ingress file I am using:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: web-ingress
  namespace: linkerd-viz
  annotations:
    kubernetes.io/ingress.class: 'nginx'
    nginx.ingress.kubernetes.io/upstream-vhost: $service_name.$namespace.svc.cluster.local:8084
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Origin "";
      proxy_hide_header l5d-remote-ip;
      proxy_hide_header l5d-server-id;      
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: web-ingress-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required'
spec:
  rules:
    - host: dashboard.example.com
      http:
        paths:
          - backend:
              serviceName: web
              servicePort: 8084

Error:
When trying to access the dashboard, I am getting a pop-up as expected to enter the username and password. But after entering the details, it is not going through. It is again showing the pop-up to enter the details again.

Nginx Ingress-Controller Logs

[error] 2339#2339: *3994931 user "admin" was not found in "/etc/ingress-controller/auth/linkerd-viz-3dfd5756-460b-4258-87b1-dd6c6acedc2b-ba3eeade-3ad9-475c-bc95-14e29edd8481.passwd",

[error] 2414#2414: *4000298 user "admin": password mismatch,

Thank you!

[cpretzer]

hi @NikhilChandraReddy, I'd check the logs of the nginx ingress controller to see if there are any error messages there.

From the info that you provided, it's not clear whether the request is making it to the linkerd web service. In fact, you can check the logs for the web pod to see if there is any additional info there.

The other thing that I can think of is to do a sanity check on the credentials you defined in the web-ingress-auth secret. I've seen the behavior that you describe with just plain nginx basic auth was due to invalid credentials.

[nikhilcreddy]

Hi @cpretzer , Thanks for the reply.

I added the logs for nginx ingress controller above, Yes I see an error that says can't find the credentials in .passwd file and also password mismatch. Nothing bizarre in the Linkerd-viz web pod logs.

So far I just have my credentials web-ingress-auth in the secret, I did not add it anywhere else. May be this is the reason why I am getting the error.

How do I add credentials in the .passwd file and in what format so that the authentication goes through?

[cpretzer]

Hi @cpretzer , Thanks for the reply.

I added the logs for nginx ingress controller above, Yes I see an error that says can't find the credentials in .passwd file and also password mismatch.

This is strange because the ingress is configured to use the secret, not a .passwd file. I'd check the nginx ingress for any custom configurations made at install time

Nothing bizarre in the Linkerd-viz web pod logs.

Since the request isn't getting past the ingress, I wouldn't expect to see anything in the web logs

So far I just have my credentials web-ingress-auth in the secret, I did not add it anywhere else. May be this is the reason why I am getting the error.

The auth data is supposed to be in a secret. Did you follow the ingress docs for creating the secret?

How do I add credentials in the .passwd file and in what format so that the authentication goes through?

The steps in the docs will do this for you and put the file into the secret

[nikhilcreddy]

@cpretzer, I followed ingress docs and created the secret the Authentication worked. Thanks for helping me here I really appreciate it.

[nikhilcreddy]

Hello @cpretzer, I am trying to setup path based routing on ingress controller for Linkerd Dashboard. So instead of using hostname directly I want to use hostname/linkerd. I am applying below web-ingress.yaml file.

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: web-ingress
  namespace: linkerd-viz
  annotations:
    kubernetes.io/ingress.class: 'nginx'
    nginx.ingress.kubernetes.io/upstream-vhost: $service_name.$namespace.svc.cluster.local:8084
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Origin "";
      proxy_hide_header l5d-remote-ip;
      proxy_hide_header l5d-server-id;      
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: web-ingress-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required'
spec:
  rules:
    - host: dashboard.example.com
      http:
        paths:
          - path: /linkerd
             backend:
               serviceName: web
               servicePort: 8084

This gives me 404 page not found when I hit hostname/linkerd

Any help is appreciated, Thank You!