Feature request: satisfy annotation

[JorritSalverda]

FEATURE REQUEST

When combining annotations nginx.ingress.kubernetes.io/auth-type and nginx.ingress.kubernetes.io/whitelist-source-range on a single ingress the resulting config doesn't use the satisfy - http://nginx.org/en/docs/http/ngx_http_core_module.html#satisfy - keyword, defaulting to the all value, which requires all checks to be valid.

I would like to be able to specify the any value by setting nginx.ingress.kubernetes.io/satisfy: any so either the whitelisted ips is good enough to get you in or the basic authentication is presented otherwise.

NGINX Ingress controller version:

0.22.0

Kubernetes version:

v1.11.2-gke.26

Environment:

Google Kubernetes Engine 1.11.2-gke.26

[aledbf]

@JorritSalverda in the meantime you can use

nginx.ingress.kubernetes.io/auth-type: .........
nginx.ingress.kubernetes.io/configuration-snippet: |-
  allow 127.0.0.0/8;
  allow 10.0.0.0/8;
  deny all;
  satisfy any;

[rmuehlbauer]

for me this configuration is not working - once I've added the configuration-snippet access to the site is open for everyone...not only for the explicitly allowed ip address

[aledbf]

@rmuehlbauer please make sure you are using 0.22.0

Edit: previous versions have a bug #3649

[rmuehlbauer]

ok! good point - at the moment I have installed 0.21.0 ... will upgrade and check again!
thanks for the clue

[rmuehlbauer]

ok, i can confirm - upgrading to 0.22.0 solved my issue. Now basic auth ist working along with the ip whitelist the way it should - perfect!

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[aledbf]

Closing. Added in 0.23.0