位于oauth2-proxy之后的Auth0常规网页应用

后端开发 2026-07-09

我们正在尝试在我们的Kubernetes集群中部署kafkaui应用，放在oauth2-proxy之后；使用Auth0作为身份提供者（IDP）。为此，我们为kafkaui准备了以下清单（manifest）：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kafka-ui-deployment
  labels:
    app: kafka-ui
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kafka-ui
  template:
    metadata:
      labels:
        app: kafka-ui
    spec:
      containers:
      - name: kafka-ui
        image: provectuslabs/kafka-ui:latest
        env:
        - name: KAFKA_CLUSTERS_0_NAME
          value: "kafka-cluster"
        - name: KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS
          value: "10.6.0.0:9094"
        - name: KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL
          value: "SASL_PLAINTEXT"
        - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM
          value: "SCRAM-SHA-512"
        - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG
          value: 'org.apache.kafka.common.security.scram.ScramLoginModule required username="kafka-username" password="kafka-password";'
        imagePullPolicy: Always
        resources:
          requests:
            memory: "1Gi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "1"
        ports:
          - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: kafka-ui-service
  labels:
    app: kafka-ui
spec:
  selector:
    app: kafka-ui
  type: LoadBalancer
  ports:
    - port: 80
      targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kafkaui-ingress
  annotations:
    haproxy.ingress.kubernetes.io/ssl-redirect: "true"
    haproxy.ingress.kubernetes.io/service-upstream: "true"
    # cert-manager.io/issuer: letsencrypt
    # cert-manager.io/issuer-kind: ClusterIssuer
    external-dns.alpha.kubernetes.io/hostname: mydomain.ca
    external-dns.alpha.kubernetes.io/ttl: "120"
    external-dns.alpha.kubernetes.io/target: "my-public-ip"
    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
    haproxy.ingress.kubernetes.io/auth-url: "http://kafka-ui-oauth2-proxy.default.svc.cluster.local:4180/oauth2/auth"
    haproxy.ingress.kubernetes.io/auth-signin: "http://kafka-ui-oauth2-proxy.default.svc.cluster.local:4180/oauth2/start?rd=http://kafka-ui-oauth2-proxy.default.svc.cluster.local:4180/oauth2/callback"
    haproxy.ingress.kubernetes.io/auth-response-headers: "X-Auth-Request-Email:email,X-Auth-Request-User:user,authorization"
  labels:
    app: kafkaui-ingress
spec:
  ingressClassName: haproxy
  rules:
  - host: mydomain.ca
    http:
      paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: kafka-ui-service
              port:
                number: 80
  tls:
    - hosts:
      - mydomain.ca
      secretName: kafkaui-ingress

以及下面的oauth2-proxy清单：

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s-app: kafka-ui-oauth2-proxy
  name: kafka-ui-oauth2-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: kafka-ui-oauth2-proxy
  template:
    metadata:
      labels:
        k8s-app: kafka-ui-oauth2-proxy
    spec:
      containers:
      - args:
        - --provider=oidc
        - --oidc-issuer-url=https://my-auth0-domain.com/ # replace with your OIDC IdP's issuer url
        - --scope=openid profile email
        - --email-domain=*
        - --upstream=http://kafka-ui-service.default.svc.cluster.local:80
        - --pass-authorization-header=true
        - --set-authorization-header=true
        - --pass-access-token=true
        - --reverse-proxy=true
        - --cookie-refresh=1h
        - --cookie-expire=24h
        - --cookie-samesite=lax
        - --skip-provider-button=true
        - --skip-oidc-discovery=true
        - --oidc-jwks-url=https://my-auth0-domain.com/.well-known/jwks.json
        - --set-xauthrequest=true
        - --redirect-url=https://mydomain.ca/oauth2/callback
        env:
        - name: OAUTH2_PROXY_HTTP_ADDRESS
          value: "0.0.0.0:4180"
        - name: OAUTH2_PROXY_CLIENT_ID
          value: "client-id"
        - name: OAUTH2_PROXY_CLIENT_SECRET
          value: "client-secret"
        - name: OAUTH2_PROXY_COOKIE_SECRET
          value: "cookie-secret"
        - name: OAUTH2_PROXY_LOGIN_URL
          value: "https://my-auth0-domain.com/authorize"
        - name: OAUTH2_PROXY_REDEEM_URL
          value: "https://my-auth0-domain.com/oauth/token"
        - name: OAUTH2_PROXY_VALIDATE_URL
          value: "https://my-auth0-domain.com/userinfo"
        - name: OAUTH2_PROXY_PROFILE_URL
          value: "https://my-auth0-domain.com/userinfo"
        - name: OAUTH2_PROXY_OIDC_EXTRA_AUDIENCES
          value: "https://mydomain.ca"
        image: quay.io/oauth2-proxy/oauth2-proxy:latest
        imagePullPolicy: Always
        name: oauth2-proxy
        ports:
        - containerPort: 4180
          protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 128Mi
          requests:
            cpu: 100m
            memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: kafka-ui-oauth2-proxy
  name: kafka-ui-oauth2-proxy
spec:
  ports:
  - name: http
    port: 4180
    protocol: TCP
    targetPort: 4180
  selector:
    k8s-app: kafka-ui-oauth2-proxy

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kafka-ui-oauth2-proxy
  annotations:
    haproxy.org/rate-limit-requests: "1000"             # Required: The limit
    haproxy.org/rate-limit-period: "1s"               # Recommended: The window
    haproxy.org/rate-limit-status-code: "429"         # Your desired status code
    haproxy.ingress.kubernetes.io/proxy-body-size: "2000m"
spec:
  ingressClassName: haproxy
  rules:
  - host: "mydomain.ca" # change to your domain
    http:
      paths:
      - path: /oauth2
        pathType: Prefix
        backend:
          service:
            name: kafka-ui-oauth2-proxy
            port:
              number: 4180

我们在仪表板中还创建了一个Auth0常规网页应用，配置参数如下：

Application Login URIs: https://mydomain.ca/oauth2/start
Allowed Callback URLs: https://mydomain.ca/oauth2/callback
Allowed Logout URLs: https://mydomain.ca
Allowed Web Origins: https://mydomain.ca

该应用启用了RBAC，并链接到一个API，该API的标识符/受众参数已设置为：

https://mydomain.ca

最后，我们在授权门户中创建了一个安全组，并为其分配了角色和权限。这些权限分配给了我们的网页应用；属于该安全组的用户将自动继承这些角色和权限。

部署这些清单后，我们可以访问网站并直接进入Kafkaui门户；但不会被要求先进行身份验证，这本应是正常的行为。有人能帮忙看看我们的清单或网页应用配置哪里配置错了吗？谢谢。

解决方案

因此，我通过将清单修改为如下内容使其生效：

  1. 首先，在我的kafkaui服务的清单中，将服务类型从 Loadbalancer 改为 ClusterIP；由于该服务将作为本地的上游后端服务器进行访问，因此无需让它对集群外部暴露。
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kafka-ui-deployment
  labels:
    app: kafka-ui
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kafka-ui
  template:
    metadata:
      labels:
        app: kafka-ui
    spec:
      containers:
      - name: kafka-ui
        image: provectuslabs/kafka-ui:latest
        env:
        - name: KAFKA_CLUSTERS_0_NAME
          value: "kafka-cluster"
        - name: KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS
          value: "10.6.0.0:9094"
        - name: KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL
          value: "SASL_PLAINTEXT"
        - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM
          value: "SCRAM-SHA-512"
        - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG
          value: 'org.apache.kafka.common.security.scram.ScramLoginModule required username="kafka-super-user" password="kafka-super-password";'
        imagePullPolicy: Always
        resources:
          requests:
            memory: "1Gi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "1"
        ports:
          - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: kafka-ui-service
  labels:
    app: kafka-ui
spec:
  selector:
    app: kafka-ui
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 8080
  1. 仅使用一个Ingress；如前所述，该Ingress只暴露 / 路径，并指向 kafka-ui-oauth2-proxy 服务：
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kafka-ui-ingresses
  annotations:
    # Rate limiting (from first ingress)
    haproxy.org/rate-limit-requests: "1000"
    haproxy.org/rate-limit-period: "1s"
    haproxy.org/rate-limit-status-code: "429"
    haproxy.ingress.kubernetes.io/proxy-body-size: "2000m"
    haproxy.ingress.kubernetes.io/ssl-redirect: "true"
    haproxy.ingress.kubernetes.io/service-upstream: "true"
    external-dns.alpha.kubernetes.io/hostname: mydomain.ca
    external-dns.alpha.kubernetes.io/ttl: "120"
    external-dns.alpha.kubernetes.io/target: "my-public-ip"
    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
    haproxy.ingress.kubernetes.io/auth-url: "https://mydomain.ca/oauth2/auth"
    haproxy.ingress.kubernetes.io/auth-signin: "https://mydomain.ca/oauth2/start?rd=https://mydomain.ca/oauth2/callback"
    haproxy.ingress.kubernetes.io/auth-response-headers: "X-Auth-Request-Email:email,X-Auth-Request-User:user,authorization"
    haproxy.org/cors-enable: "true"
    haproxy.org/cors-allow-origin: "https://mydomain.ca"
    haproxy.org/cors-allow-methods: "GET, POST, OPTIONS, POST, PUT"
    haproxy.org/cors-allow-headers: "DNT, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Range, Authorization, Accept, Access-Control-Allow-Origin, X-Correlation-ID, X-Request-ID, X-Process-Time, X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, X-XSS-Protection"
    haproxy.org/cors-allow-credentials: "true"
    haproxy.org/cors-max-age: "1728000"
    haproxy.ingress.kubernetes.io/proxy-read-timeout: "180"
spec:
  ingressClassName: haproxy
  rules:
  - host: mydomain.ca
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kafka-ui-oauth2-proxy
            port:
              number: 4180
  tls:
  - hosts:
    - mydomain.ca
    secretName: kafkaui-ingress
  1. 然后将oauth2-proxy改为如下：
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: kafka-ui-oauth2-proxy
  name: kafka-ui-oauth2-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kafka-ui-oauth2-proxy
  template:
    metadata:
      labels:
        app: kafka-ui-oauth2-proxy
    spec:
      containers:
      - args:
        - --provider=oidc
        - --oidc-issuer-url=https://myauth0-domain.ca/ # replace with your OIDC IdP's issuer url
        - --email-domain=*
        - --scope=openid profile email
        - --pass-authorization-header=true
        - --set-authorization-header=true
        - --pass-access-token=true
        - --reverse-proxy=true
        - --cookie-refresh=1h
        - --cookie-expire=24h
        - --cookie-samesite=lax
        - --skip-provider-button=true
        - --set-xauthrequest=true
        - --oidc-extra-audience=https://mydomain.ca
        - --redirect-url=https://mydomain.ca/oauth2/callback
        - --insecure-oidc-skip-issuer-verification=true
        - --skip-oidc-discovery=true
        - --login-url=https://myauth0-domain.ca/authorize?audience=https://mydomain.ca&organization=orgid
        - --oidc-jwks-url=https://myauth0-domain.ca/.well-known/jwks.json
        - --redeem-url=https://myauth0-domain.ca/oauth/token
        env:
        - name: OAUTH2_PROXY_HTTP_ADDRESS
          value: "0.0.0.0:4180"
        - name: OAUTH2_PROXY_CLIENT_ID
          value: "client-id"
        - name: OAUTH2_PROXY_CLIENT_SECRET
          value: "client-secret"
        - name: OAUTH2_PROXY_COOKIE_SECRET
          value: "cookie-secret"
        - name: OAUTH2_PROXY_UPSTREAMS
          value: "http://kafka-ui-service:80"
        image: quay.io/oauth2-proxy/oauth2-proxy:latest
        imagePullPolicy: Always
        name: oauth2-proxy
        ports:
        - containerPort: 4180
          protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 128Mi
          requests:
            cpu: 100m
            memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: kafka-ui-oauth2-proxy
  name: kafka-ui-oauth2-proxy
spec:
  ports:
  - name: http
    port: 4180
    protocol: TCP
    targetPort: 4180
  selector:
    app: kafka-ui-oauth2-proxy

这些修改主要包括：
a.将受众（API受众）和组织添加到 login-url：

--login-url=https://myauth0-domain.ca/authorize?audience=https://mydomain.ca&organization=orgid

请注意，我们在这里将安全组的用法切换到了Auth0的组织（organizations）；我们提供要让用户成为成员的组织标识符，以便访问kafkaui-service；如果他们不是成员，将返回403错误。

b.设置后端服务器（kafka-ui-service）的服务地址：

- name: OAUTH2_PROXY_UPSTREAMS
  value: "http://kafka-ui-service:80"

请注意，由于我们与后端上游服务处于同一个Kubernetes命名空间，因此无需使用格式 kafka-ui-service.kafka.cluster.local，因为那样不会工作。

  1. 在Auth0仪表板中，我们为常规网页应用更改了以下配置参数：
Allowed Callback URLs: https://mydomain.ca/oauth2/callback, https://mydomain.ca

以上便是所有修改，现在一切如预期工作。希望能帮助到计划在oauth2-proxy后端使用Auth0作为IdP搭建Kubernetes服务的朋友。

站内所有文章版权归属LeftHeroAI导航站，无授权禁止任何主体转载、抄袭、复制内容，亦不得私自架设镜像站点。一经侵权，本站将通过法律途径追责。

相关文章

在使用Playwright设置Langchain代理时遇到的问题
3
WebView中的内容闪烁
1
Azure Web App | 部署错误 - 基于框架的部署是ProcessFrameworkReferences的 SelfContained参数的无效取值
1
ASP.NET Web API发布失败：构建失败。请在输出窗口查看详细信息
1
在Selenium中，使用By.ID查找元素可用，但使用By.XPATH就不可用
1
如何让一个Minimal API返回布尔值？
0
汇集全球数千款 AI 工具，每日持续更新，配套 AI 开发学习资源，轻松用 AI 提升工作效率。快捷键 Ctrl+D/⌘+D 一键收藏本站。

超人AI导航关于我们免责声明

Copyright © 超人AI导航  辽ICP备2024029316号-4