使用 oauth2-proxy 为任意程序增加认证鉴权，结合 K8S、traefik、keycloak、backstage 部署配置详解

# service 默认 port 4180
service:
  port: 4180

## Configuration section
##
configuration:
  clientID: oauth2-proxy
  clientSecret: <%= 替换成上面创建的 clientSecret %>
  # cookieSecret 创建命令： openssl rand -base64 32 | tr -- '+/' '-_'
  cookieSecret: "iSGfyi0EbDrkg6eNJpAXGLmwN1jZDZossmElq5GgXeI="
  ## content 会映射到 oauth2-proxy.cfg 配置文件里
  ## 各个参数含义请参考 https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview
  content: |
    reverse_proxy = true
    provider = "keycloak-oidc"
    provider_display_name = "Keycloak"
    email_domains = "*"
    set_xauthrequest = true
    set_authorization_header = true
    ssl_insecure_skip_verify = true
    insecure_oidc_allow_unverified_email = true
    code_challenge_method = "S256"
    upstreams = "file:///dev/null"    

  # 填你自己的 keycloak 服务地址
  oidcIssuerUrl: https://keycloak.example.com/realms/master
  # 不需要填 redirectUrl，由 Traefik 帮我们处理
  redirectUrl: ""

  redirectUrl: ""
  content: |
    reverse_proxy = true
    upstreams = "file:///dev/null"    

  content: |
    set_xauthrequest = true
    set_authorization_header = true    

x-auth-request-user: af188bba-0388-2623-8cdb-39422e8be30a # user database id
x-auth-request-preferred-username: lisan123 # user login name
x-auth-request-groups: role:admin,role:developer,role:account:manage-account
authorization: Bearer xxx token
cookie: xxx

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: errors-sign-in
  namespace: oauth2-proxy
spec:
  errors:
    status:
      - "401-403"
    service:
      name: oauth2-proxy
      namespace: oauth2-proxy
      port: 4180
    query: "/oauth2/sign_in"
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: forward-auth
  namespace: oauth2-proxy
spec:
  forwardAuth:
    # oauth2-proxy k8s service 地址
    address: http://oauth2-proxy.oauth2-proxy.svc:4180/oauth2/auth
    trustForwardHeader: true
    # 增加 header，可用 header 参考 oauth2-proxy 文档
    authResponseHeaders:
      - X-Auth-Request-User
      - X-Auth-Request-Preferred-Username
      - Authorization
      - Set-Cookie
      # - X-Auth-Request-Groups
      # - X-Auth-Request-Access-Token

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: app-ingress-route
  namespace: oauth2-proxy
  # annotations:
  #   cert-manager.io/issuer: selfsigned-issuer
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - match: "Host(`app.example.com`) && PathPrefix(`/oauth2`)"
      kind: Rule
      services:
        - name: oauth2-proxy
          namespace: oauth2-proxy
          port: http
      middlewares:
        - name: errors-sign-in
    # 需要代理的应用对外暴露服务
    - match: Host(`app.example.com`)
      kind: Rule
      middlewares:
        - name: errors-sign-in
        - name: forward-auth
      services:
        # 后端应用
        - name: backstage
          namespace: oauth2-proxy
          port: http-backend

# 第一个 ingress，对应 match: "Host(`app.example.com`) && PathPrefix(`/oauth2`)"，使用 errors-sign-in middleware
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: oauth2-proxy-errors-sign-in@kubernetescrd
  name: errors-sign-in
  # namespace: oauth2-proxy
spec:
  ingressClassName: traefik
  rules:
    # traefik 支持泛域名拦截，如果你想给所有的 ingress 都设置 oauth2，此处可以设置为 "*.example.com"
    - host: "app.example.com"
      http:
        paths:
          - backend:
              service:
                name: oauth2-proxy
                port:
                  name: http
            path: /oauth2
            pathType: Prefix
  # 根据你自己的情况设置 TLS
  # tls:
  #   - hosts:
  #       - "app.example.com"
  #     secretName: "app.example.com-tls"
---
# 第二个 ingress，对应 match: "Host(`app.example.com`)，使用 errors-sign-in,oauth2-proxy 两个 middleware
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    # 这里设置 errors-sign-in,oauth2-proxy 两个 middleware
    traefik.ingress.kubernetes.io/router.middlewares: oauth2-proxy-errors-sign-in@kubernetescrd,oauth2-proxy-forward-auth@kubernetescrd
  name: errors-sign-in-ingress
  namespace: oauth2-proxy
spec:
  ingressClassName: traefik
  rules:
    # traefik 支持泛域名拦截，如果你想给所有的 ingress 都设置 oauth2，此处可以设置为 "*.example.com"
    - host: "app.example.com"
      http:
        paths:
          - backend:
              service:
                name: backstage
                port:
                  name: http-backend
            path: /
            pathType: Prefix

{{define "sign_in.html"}}
<!DOCTYPE html>
<html lang="en" charset="utf-8">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
    <title>Redirecting</title>
    <script>
        window.location = "{{.ProxyPrefix}}/start?rd=" + encodeURI(window.location)
    </script>
  </head>
  <body>
  </body>
</html>
{{end}}

initContainers:
  # copy 自定义模板，不需要点击 `Sign in` 按钮，自动重定向到登录页
  - name: auto-sign-in
    # 源码： https://github.com/l10178/x-container
    image: docker.io/nxest/oauth2-proxy-auto-sign-in:v7.7.1
    imagePullPolicy: IfNotPresent
    env:
    - name: OAUTH2_PROXY_CUSTOM_TEMPLATES_DIR
      value: /bitnami/oauth2-proxy/templates
    volumeMounts:
      - mountPath: /bitnami/oauth2-proxy/templates
        name: templates

server {

  location /oauth2/ {
    proxy_pass       http://oauth2-proxy.svc:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
  }
  location = /oauth2/auth {
    proxy_pass       http://oauth2-proxy.svc:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

  location / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
    # limit and so the OAuth2 Proxy splits these into multiple parts.
    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

    # Extract the Cookie attributes from the first Set-Cookie header and append them
    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
    if ($auth_cookie ~* "(; .*)") {
        set $auth_cookie_name_0 $auth_cookie;
        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
    }

    # Send both Set-Cookie headers now if there was a second part
    if ($auth_cookie_name_upstream_1) {
        add_header Set-Cookie $auth_cookie_name_0;
        add_header Set-Cookie $auth_cookie_name_1;
    }

    proxy_pass http://backend/;
    # or "root /path/to/site;" or "fastcgi_pass ..." etc
  }
}

nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth