Centralise legacy auth at the ingress gateway
summary
Built a Flask auth service running as a standalone Kubernetes deployment behind Emissary Ingress that normalizes five legacy auth types (Basic, bearer, API keys, company-scoped tokens, others) into compact JSON identity headers, returning simple allow/deny (200/401). Demo uses three pods on a local k8s cluster, injects user id/name into downstream headers, and blocks unauthenticated requests before they reach services. Works but creates a critical-path dependency requiring strict SLIs/SLOs and caching.
AI-written summary · about
chapters (13)
- 0:00Introduction to legacy auth centralization
- 2:07Why not use off-the-shelf auth solutions
- 5:33Identifying existing auth mechanisms
- 7:40Handling mixed auth types and frameworks
- 9:05Standardizing identity data for downstream
- 11:31Where to handle authorization logic
- 13:56Running auth as a standalone service
- 16:27Practical demo setup
- 18:16Live demo of centralized auth
- 21:47Key takeaways and considerations
- 23:53Operational impact and SLIs/SLOs
- 24:14About the speaker and company
- 24:35Q&A session
related talks
36mAdvanced Authentication patterns at the Edge
26mOne Auth Gateway to authenticate them all
17mLessons Learned: Four Years with Emissary-ingress and Envoy
28mEnabling Kubeflow with Enterprise-Grade Auth for On-Prem Deployments
25mKubernetes Ingress-Nginx Security from Beginner to Expert
22mUnlock Kubernetes & Envoy: Master Your API Ecosystem!
45mZero Trusting as a True Cloud Native Dev
18mMake Auth great again with Ory