f75cb8aab2
- Introduced multiple detailed plugin examples for Cloudflare IP restoration, IP whitelisting, JWT validation, and combined usage. - Added configurations for `docker-compose`, `Kubernetes`, and `Swarm` showcasing individual and multi-plugin use cases. - Included clear prerequisites, setup steps, and testing procedures for each example. - Documented advanced scenarios like path blocking, custom IP lists, and JWT validation for production environments.
113 lines
2.8 KiB
YAML
113 lines
2.8 KiB
YAML
# JWT Validator Plugin Example for Kubernetes
|
|
#
|
|
# This example demonstrates JWT token validation for API protection in Kubernetes
|
|
#
|
|
# Prerequisites:
|
|
# 1. EasyHAProxy installed in your cluster
|
|
# 2. Generate RSA key pair:
|
|
# openssl genrsa -out jwt_private.pem 2048
|
|
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
|
|
#
|
|
# 3. Create ConfigMap with public key:
|
|
# kubectl create configmap jwt-keys --from-file=api_pubkey.pem=jwt_pubkey.pem
|
|
#
|
|
# 4. Mount the ConfigMap in EasyHAProxy deployment (add to volumeMounts and volumes):
|
|
# volumeMounts:
|
|
# - name: jwt-keys
|
|
# mountPath: /etc/haproxy/jwt_keys
|
|
# volumes:
|
|
# - name: jwt-keys
|
|
# configMap:
|
|
# name: jwt-keys
|
|
#
|
|
# 5. Apply this manifest:
|
|
# kubectl apply -f jwt-validator.yml
|
|
#
|
|
# 6. Test without token (should fail):
|
|
# curl http://api.example.local/
|
|
# # Response: Missing Authorization HTTP header
|
|
#
|
|
# 7. Generate test JWT at https://jwt.io with:
|
|
# - Algorithm: RS256
|
|
# - Payload: {"iss":"https://auth.example.com/","aud":"https://api.example.com","exp":9999999999}
|
|
# - Use your jwt_private.pem for signing
|
|
#
|
|
# 8. Test with token:
|
|
# TOKEN="eyJhbGc..."
|
|
# curl -H "Authorization: Bearer $TOKEN" http://api.example.local/
|
|
# # Response: Success
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: api-service
|
|
namespace: default
|
|
spec:
|
|
ports:
|
|
- port: 8080
|
|
targetPort: 8080
|
|
selector:
|
|
app: api
|
|
type: ClusterIP
|
|
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: api
|
|
namespace: default
|
|
spec:
|
|
replicas: 3
|
|
selector:
|
|
matchLabels:
|
|
app: api
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: api
|
|
spec:
|
|
containers:
|
|
- name: api
|
|
image: byjg/static-httpserver
|
|
ports:
|
|
- containerPort: 8080
|
|
env:
|
|
- name: TITLE
|
|
value: "Protected API - JWT Required"
|
|
resources:
|
|
limits:
|
|
cpu: '0.1'
|
|
memory: '64Mi'
|
|
requests:
|
|
cpu: '0.05'
|
|
memory: '32Mi'
|
|
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
annotations:
|
|
kubernetes.io/ingress.class: easyhaproxy-ingress
|
|
|
|
# Enable JWT validator plugin
|
|
easyhaproxy.plugins: "jwt_validator"
|
|
|
|
# JWT validator configuration
|
|
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
|
|
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
|
|
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
|
|
easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
|
|
name: api-ingress-jwt
|
|
namespace: default
|
|
spec:
|
|
rules:
|
|
- host: api.example.local
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: api-service
|
|
port:
|
|
number: 8080
|
|
pathType: ImplementationSpecific
|