Skip to content

Add support for Basic Auth through AuthenticationFilter #4436

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
shaun-nx wants to merge 17 commits into
base: feat/authentication-filter-basic-auth
Choose a base branch
from
Draft

Add support for Basic Auth through AuthenticationFilter #4436

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
bb4607a
Add support for Basic Auth through AuthenticationFilter
shaun-nx Dec 10, 2025
23ab285
Merge branch 'feat/authentication-filter-basic-auth' into feat/basic-…
shaun-nx Dec 10, 2025
0a48fff
make generate-all
shaun-nx Dec 10, 2025
0e5f51e
Set dest from `location.AuthBasic.Data.FileName`
shaun-nx Dec 10, 2025
5a4903c
Update dest value
shaun-nx Dec 10, 2025
e35da99
Remove duplicate call to secret resolved
shaun-nx Dec 11, 2025
1b7dd25
Remove duplicate call to secret resolver
shaun-nx Dec 11, 2025
edb8348
Re-add removed comment
shaun-nx Dec 11, 2025
816382d
Process custom secret type
shaun-nx Dec 11, 2025
3fa25c0
Update basicAuthUserFile const
shaun-nx Dec 11, 2025
d2f170b
Ensure secrets are resolved
shaun-nx Dec 11, 2025
a681ba5
Resolve nil pointer error
shaun-nx Dec 12, 2025
5effdbc
Remove redundant error handling
shaun-nx Dec 12, 2025
b8f26a6
Do not resolve Opaque secrets
shaun-nx Dec 12, 2025
50dfd77
Add secret namespace to file path
shaun-nx Dec 12, 2025
5b6ccd1
Update status variable name
shaun-nx Dec 12, 2025
12d6e54
Update logic for generating auth basic user file
shaun-nx Dec 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions apis/v1alpha1/register.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
&SnippetsFilterList{},
&UpstreamSettingsPolicy{},
&UpstreamSettingsPolicyList{},
&AuthenticationFilter{},
&AuthenticationFilterList{},
)
// AddToGroupVersion allows the serialization of client types like ListOptions.
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
Expand Down
2 changes: 2 additions & 0 deletions charts/nginx-gateway-fabric/templates/clusterrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
{{- if .Values.nginxGateway.snippetsFilters.enable }}
- snippetsfilters
{{- end }}
Expand All @@ -142,6 +143,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
{{- if .Values.nginxGateway.snippetsFilters.enable }}
- snippetsfilters/status
{{- end }}
Expand Down
2 changes: 2 additions & 0 deletions deploy/azure/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
verbs:
- list
- watch
Expand All @@ -179,6 +180,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
verbs:
- update
- apiGroups:
Expand Down
2 changes: 2 additions & 0 deletions deploy/default/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
verbs:
- list
- watch
Expand All @@ -179,6 +180,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
verbs:
- update
- apiGroups:
Expand Down
2 changes: 2 additions & 0 deletions deploy/experimental-nginx-plus/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,6 +171,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
verbs:
- list
- watch
Expand All @@ -181,6 +182,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
verbs:
- update
- apiGroups:
Expand Down
2 changes: 2 additions & 0 deletions deploy/experimental/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,6 +171,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
verbs:
- list
- watch
Expand All @@ -181,6 +182,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
verbs:
- update
- apiGroups:
Expand Down
2 changes: 2 additions & 0 deletions deploy/inference-nginx-plus/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
verbs:
- list
- watch
Expand All @@ -179,6 +180,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
verbs:
- update
- apiGroups:
Expand Down
2 changes: 2 additions & 0 deletions deploy/inference/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
verbs:
- list
- watch
Expand All @@ -179,6 +180,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
verbs:
- update
- apiGroups:
Expand Down
2 changes: 2 additions & 0 deletions deploy/nginx-plus/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
verbs:
- list
- watch
Expand All @@ -179,6 +180,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
verbs:
- update
- apiGroups:
Expand Down
2 changes: 2 additions & 0 deletions deploy/nodeport/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
verbs:
- list
- watch
Expand All @@ -179,6 +180,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
verbs:
- update
- apiGroups:
Expand Down
2 changes: 2 additions & 0 deletions deploy/openshift/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
verbs:
- list
- watch
Expand All @@ -179,6 +180,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
verbs:
- update
- apiGroups:
Expand Down
2 changes: 2 additions & 0 deletions deploy/snippets-filters-nginx-plus/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
- snippetsfilters
verbs:
- list
Expand All @@ -180,6 +181,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
- snippetsfilters/status
verbs:
- update
Expand Down
2 changes: 2 additions & 0 deletions deploy/snippets-filters/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ rules:
- clientsettingspolicies
- observabilitypolicies
- upstreamsettingspolicies
- authenticationfilters
- snippetsfilters
verbs:
- list
Expand All @@ -180,6 +181,7 @@ rules:
- clientsettingspolicies/status
- observabilitypolicies/status
- upstreamsettingspolicies/status
- authenticationfilters/status
- snippetsfilters/status
verbs:
- update
Expand Down
4 changes: 2 additions & 2 deletions examples/basic-authentication/basic-auth.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v1
kind: Secret
metadata:
name: basic-auth1
type: Opaque
type: nginx.org/htpasswd
data:
# Base64 of "htpasswd -bn user1 password1"
auth: dXNlcjE6JGFwcjEkWEFKeU5yekgkY0Rjdy9YMVBCZTFmTjltQVBweXpxMA==
Expand All @@ -23,7 +23,7 @@ apiVersion: v1
kind: Secret
metadata:
name: basic-auth2
type: Opaque
type: nginx.org/htpasswd
data:
# Base64 of "htpasswd -bn user2 password2"
auth: dXNlcjI6JGFwcjEkd0lKUUpjZEUkSXUuYjVhMlBGODdtQi5zT0x4aUg5MQ==
Expand Down
6 changes: 6 additions & 0 deletions internal/controller/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -383,6 +383,11 @@ func (h *eventHandlerImpl) updateStatuses(ctx context.Context, gr *graph.Graph,
transitionTime,
h.cfg.gatewayCtlrName,
)
authenticationFilterReqs := status.PrepareAuthenticationFilterRequests(
gr.AuthenticationFilters,
transitionTime,
h.cfg.gatewayCtlrName,
)

// unfortunately, status is not on clusterState stored by the change processor, so we need to make a k8sAPI call here
ipList := &inference.InferencePoolList{}
Expand Down Expand Up @@ -418,6 +423,7 @@ func (h *eventHandlerImpl) updateStatuses(ctx context.Context, gr *graph.Graph,
reqs = append(reqs, polReqs...)
reqs = append(reqs, ngfPolReqs...)
reqs = append(reqs, snippetsFilterReqs...)
reqs = append(reqs, authenticationFilterReqs...)
reqs = append(reqs, inferencePoolReqs...)

h.cfg.statusUpdater.UpdateGroup(ctx, groupAllExceptGateways, reqs...)
Expand Down
7 changes: 7 additions & 0 deletions internal/controller/manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -529,6 +529,12 @@ func registerControllers(
controller.WithK8sPredicate(k8spredicate.GenerationChangedPredicate{}),
},
},
{
objectType: &ngfAPIv1alpha1.AuthenticationFilter{},
options: []controller.Option{
controller.WithK8sPredicate(k8spredicate.GenerationChangedPredicate{}),
},
},
}

if cfg.ExperimentalFeatures {
Expand Down Expand Up @@ -770,6 +776,7 @@ func prepareFirstEventBatchPreparerArgs(cfg config.Config) ([]client.Object, []c
&ngfAPIv1alpha1.ClientSettingsPolicyList{},
&ngfAPIv1alpha2.ObservabilityPolicyList{},
&ngfAPIv1alpha1.UpstreamSettingsPolicyList{},
&ngfAPIv1alpha1.AuthenticationFilterList{},
partialObjectMetadataList,
}

Expand Down
5 changes: 5 additions & 0 deletions internal/controller/manager_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ func TestPrepareFirstEventBatchPreparerArgs(t *testing.T) {
&ngfAPIv1alpha1.ClientSettingsPolicyList{},
&ngfAPIv1alpha2.ObservabilityPolicyList{},
&ngfAPIv1alpha1.UpstreamSettingsPolicyList{},
&ngfAPIv1alpha1.AuthenticationFilterList{},
},
},
{
Expand Down Expand Up @@ -96,6 +97,7 @@ func TestPrepareFirstEventBatchPreparerArgs(t *testing.T) {
&ngfAPIv1alpha1.ClientSettingsPolicyList{},
&ngfAPIv1alpha2.ObservabilityPolicyList{},
&ngfAPIv1alpha1.UpstreamSettingsPolicyList{},
&ngfAPIv1alpha1.AuthenticationFilterList{},
},
},
{
Expand Down Expand Up @@ -124,6 +126,7 @@ func TestPrepareFirstEventBatchPreparerArgs(t *testing.T) {
partialObjectMetadataList,
&inference.InferencePoolList{},
&gatewayv1.GatewayList{},
&ngfAPIv1alpha1.AuthenticationFilterList{},
},
},
{
Expand Down Expand Up @@ -152,6 +155,7 @@ func TestPrepareFirstEventBatchPreparerArgs(t *testing.T) {
&ngfAPIv1alpha2.ObservabilityPolicyList{},
&ngfAPIv1alpha1.SnippetsFilterList{},
&ngfAPIv1alpha1.UpstreamSettingsPolicyList{},
&ngfAPIv1alpha1.AuthenticationFilterList{},
},
},
{
Expand Down Expand Up @@ -184,6 +188,7 @@ func TestPrepareFirstEventBatchPreparerArgs(t *testing.T) {
&ngfAPIv1alpha2.ObservabilityPolicyList{},
&ngfAPIv1alpha1.SnippetsFilterList{},
&ngfAPIv1alpha1.UpstreamSettingsPolicyList{},
&ngfAPIv1alpha1.AuthenticationFilterList{},
},
},
}
Expand Down
19 changes: 19 additions & 0 deletions internal/controller/nginx/config/generator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,9 @@ func (g GeneratorImpl) Generate(conf dataplane.Configuration) []agent.File {
files = append(files, generateCertBundle(id, bundle))
}

for id, data := range conf.AuthBasicSecrets {
files = append(files, generateAuthBasicUserFile(id, data))
}
return files
}

Expand Down Expand Up @@ -252,3 +255,19 @@ func generateCertBundle(id dataplane.CertBundleID, cert []byte) agent.File {
func generateCertBundleFileName(id dataplane.CertBundleID) string {
return filepath.Join(secretsFolder, string(id)+".crt")
}

func generateAuthBasicUserFile(id dataplane.AuthBasicUserFileID, data []byte) agent.File {
return agent.File{
Meta: &pb.FileMeta{
Name: generateAuthBasicUserFileName(id),
Hash: filesHelper.GenerateHash(data),
Permissions: file.SecretFileMode,
Size: int64(len(data)),
},
Contents: data,
}
}

func generateAuthBasicUserFileName(id dataplane.AuthBasicUserFileID) string {
return filepath.Join(secretsFolder, string(id))
}
12 changes: 12 additions & 0 deletions internal/controller/nginx/config/http/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,8 @@ type Location struct {
Type LocationType
// Path is the NGINX location path.
Path string
// AuthBasic contains the configuration for basic authentication.
AuthBasic *AuthBasic
// ResponseHeaders are custom response headers to be sent.
ResponseHeaders ResponseHeaders
// ProxySetHeaders are headers to set when proxying requests upstream.
Expand Down Expand Up @@ -158,6 +160,16 @@ type ProxySSLVerify struct {
Name string
}

type AuthBasic struct {
Realm string
Data AuthBasicData
}

type AuthBasicData struct {
FileName string
FileData []byte
Copy link
Collaborator

@sjberman sjberman Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The file data isn't needed on the location block. I wonder if we can structure this better. For example, the way we currently process TLS secret files. The server sets the file path, but the data isn't stored on the server Go struct at all. It's a separate field in the dataplane conf. See how we handle generateCertBundle.

Copy link
Contributor Author

@shaun-nx shaun-nx Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @sjberman ! This is exactly the kind of thing I wanted to find in this review. 😄
I'll take a dig into that part of the code and see if we can simplify this.

}
Comment on lines +163 to +171
Copy link
Collaborator

@sjberman sjberman Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will need comments.


// ServerConfig holds configuration for an HTTP server and IP family to be used by NGINX.
type ServerConfig struct {
Servers []Server
Expand Down
Loading
Loading