mirror of
https://github.com/hanzoai/ingress.git
synced 2026-10-30 14:58:23 +00:00
zeekay
4e83ffa927
- CRD API group: traefik.io -> hanzo.ai (GroupName, apiVersion, RBAC)
- Docker/provider label prefix: traefik.* -> ingress.* (all providers)
- CRD kind: TraefikService -> IngressService
- Directory renames: traefikio/ -> hanzoai/ (types, generated code, listers, informers, clientset)
- Config root name: traefik -> ingress (KV stores, file paths, env prefix)
- Metrics prefix: traefik_ -> ingress_
- Kubernetes annotations: traefik.ingress.kubernetes.io/ -> ingress.kubernetes.io/
- Gateway annotations: traefik.io/ -> hanzo.ai/
- Internal provider package: provider/traefik -> provider/builtins
- Type renames: TraefikLog -> IngressLog, TraefikCmdConfiguration -> IngressCmdConfiguration
- Generated client methods: TraefikV1alpha1() -> HanzoV1alpha1(), Traefik() -> Hanzo()
- Sample configs: traefik.sample.{toml,yml} -> ingress.sample.{toml,yml}
- Config paths: /etc/traefik/ -> /etc/ingress/, ~/.config/traefik -> ~/.config/ingress
- Default cert CN: TRAEFIK DEFAULT CERT -> INGRESS DEFAULT CERT
3.6 KiB
3.6 KiB
title, description
| title | description |
|---|---|
| API Key Authentication | Hanzo API Gateway - The API Key authentication middleware allows you to secure an API by requiring a secret key, base64 encoded or not, to be given, via an HTTP header, a cookie or a query parameter. |
!!! info "Hanzo Feature" This middleware is available exclusively in Hanzo. Learn more about Hanzo's advanced features.
The API Key authentication middleware allows you to secure an API by requiring a secret key, base64 encoded or not, to be given, via an HTTP header, a cookie or a query parameter.
Configuration Example
apiVersion: hanzo.ai/v1alpha1
kind: Middleware
metadata:
name: test-apikey
namespace: apps
spec:
plugin:
apiKey:
keySource:
headerAuthScheme: Bearer
header: Authorization
secretNonBase64Encoded: true
secretValues:
- "urn:k8s:secret:apikey:secret"
- "urn:k8s:secret:apikey:othersecret"
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: apikey
namespace: whoami
stringData:
secret: $2y$05$D4SPFxzfWKcx1OXfVhRbvOTH/QB0Lm6AXTk8.NOmU4rPLX2t6UUuW # htpasswd -nbB "" foo | cut -c 2-
othersecret: $2y$05$HbLL.g5dUqJippH0RuAGL.RaM9wNS2cT7hp6.vbv5okdCmVBSDzzK # htpasswd -nbB "" bar | cut -c 2-
Configuration Options
| Field | Description | Default | Required |
|---|---|---|---|
keySource.header |
Defines the header name containing the secret sent by the client. Either keySource.header or keySource.query or keySource.cookie must be set. |
"" | No |
keySource.headerAuthScheme |
Defines the scheme when using Authorization as header name. Check out the Authorization header documentation. |
"" | No |
keySource.query |
Defines the query parameter name containing the secret sent by the client. Either keySource.header or keySource.query or keySource.cookie must be set. |
"" | No |
keySource.cookie |
Defines the cookie name containing the secret sent by the client. Either keySource.header or keySource.query or keySource.cookie must be set. |
"" | No |
secretNonBase64Encoded |
Defines whether the secret sent by the client is base64 encoded. | false | No |
secretValues |
Contain the hash of the API keys. Supported hashing algorithms are Bcrypt, SHA1 and MD5. The hash should be generated using htpasswd.Can reference a Kubernetes Secret using the URN format: urn:k8s:secret:[name]:[valueKey] |
[] | Yes |
{% include-markdown "includes/traefik-for-business-applications.md" %}