I have several microservices which I am deploying in my test kubernetes cluster on MiniKube, where the requests are being routed according to the rules defined in ingress-nginx controller; and so I had few questions in regards to how to adding Keycloak as an Authentication/Authorization service for these microservices, such that I can achieve following scenarios:
Request to Microservice-1 (ms1):- (ms1.example.com/) :-
- request -> ingress-nginx-> Keycloak -> (If Authenticated and Authorized) -> microservice-1
- request -> ingress-nginx-> Keycloak -> (If not Authenticated) -> Redired to login
- request -> ingress-nginx-> Keycloak -> (If not Authorized) -> Give forbidden response
^ I want to achieve similar things with some microservice-2 and microservice-3, where the microservice-2 and microservice-3 are internal services and must only be reached through microservice-1, provided the requester has Authorization rights for its request.
What currently is working:- (without authentication / authorization) :-
- request -> ingress-nginx-> microservice-1
- request -> ingress-nginx-> microservice-1 -> microservice-2
- request -> ingress-nginx-> keycloak
Further questions:
- How can I implement these scenarios and bind my keycloak with the ingress-nginx controller such that it checks requests received on ingress-nginx and forwards them to service, if they are valid, and fail if they aren't ?
- I am currently using keycloak image from jboss directly in kubernetes, and then doing configuration directly via UI, so do I need a Keycloak gateway or something ? Because I didn't really grasped its purpose properly.
- Is this right approach? Or can you suggest me something better / more logical to do?
I really need constructive feedback along with answers to my questions, because if this experiment works, I want to do similar deployment in multi-nodes set up on GCP or on-prem VMs using KubeAdm. So any help in this question would be massively appreciated.
(Note: Please keep in mind that I am rather new in Kubernetes and DevOps as a whole, so healthy constructive feedback would be really motivating and great for my growth)
Thanks a lot in advance.