Unable to setup auth-url in nginx ingress as IPV6 always failed

[abhishek-ch]

I wanna add authentication using auth-url and auth-signin but nginx is unable to connect to IPV6.
I dont want https://dashboard.testdomain.com/ to be accessible unless its not authorized using https://hot.testdomain.com/api/auth/session

2024/09/10 10:41:05 [error] 26#26: *1490 connect() to [2606:4700:3037::ac43:adf5]:443 failed (101: Network unreachable) while connecting to upstream, client: 162.158.159.32, server: dashboard.testdomain.com, request: "GET /settings HTTP/2.0", subrequest: "/_external-auth-Lw-Prefix", upstream: "https://[2606:4700:3037::ac43:adf5]:443/auth", host: "dashboard.testdomain.com", referrer: "https://dashboard.testdomain.com/"
2024/09/10 10:41:05 [warn] 26#26: *1490 upstream server temporarily disabled while connecting to upstream, client: 162.158.159.32, server: dashboard.testdomain.com, request: "GET /settings HTTP/2.0", subrequest: "/_external-auth-Lw-Prefix", upstream: "https://[2606:4700:3037::ac43:adf5]:443/auth", host: "dashboard.testdomain.com", referrer: "https://dashboard.testdomain.com/"
2024/09/10 10:41:05 [error] 26#26: *1490 connect() to [2606:4700:3033::6815:1edb]:443 failed (101: Network unreachable) while connecting to upstream, client: 162.158.159.32, server: dashboard.testdomain.com, request: "GET /settings HTTP/2.0", subrequest: "/_external-auth-Lw-Prefix", upstream: "https://[2606:4700:3033::6815:1edb]:443/auth", host: "dashboard.testdomain.com", referrer: "https://dashboard.testdomain.com/"

I tried turning off/on IPV6 in nginx but nothing changed,
load-balancer.hetzner.cloud/ipv6-disabled: "true"

My ingress controller

controller:
  kind: DaemonSet
  service:
    annotations:
      load-balancer.hetzner.cloud/location: nbg1
      load-balancer.hetzner.cloud/name: lb-test-k8s
      load-balancer.hetzner.cloud/use-private-ip: "true"
      load-balancer.hetzner.cloud/uses-proxyprotocol: 'true'
      load-balancer.hetzner.cloud/hostname: lb.testdomain.com
      load-balancer.hetzner.cloud/http-redirect-https: 'false'
      load-balancer.hetzner.cloud/ipv6-disabled: "true" # Tried false as well

  # Enable custom configuration snippets
  config:
    use-forwarded-headers: "true"
    compute-full-forwarded-for: "true"
    use-proxy-protocol: "true"

  # Enable configuration snippets in ingress resources
  allowSnippetAnnotations: true

  extraArgs:
    enable-ssl-passthrough: ""

  # Add custom configuration snippets
  snippets:
    main-snippet: |
      # Your main nginx.conf customizations
      proxy_buffer_size 8k;
       # Enable listening on both IPv4 and IPv6
      listen [::]:80 default_server ipv6only=off;
      listen [::]:443 ssl default_server ipv6only=off;

    http-snippet: |
      # Your http block customizations
      server_tokens off;

    server-snippet: |
      # Your server block customizations
      proxy_ssl_server_name on;
      proxy_ssl_name $host;

  # If you need to add custom headers
  proxySetHeaders:
    X-Forwarded-Proto: $scheme
    X-Real-IP: $remote_addr

My Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dashboard-ingress
  namespace: kubernetes-dashboard
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    cert-manager.io/cluster-issuer: "letsencrypt-dns01-issuer"
    nginx.ingress.kubernetes.io/auth-url: "https://hot.testdomain.com/api/auth/session"
    nginx.ingress.kubernetes.io/auth-signin: "https://hot.testdomain.com/app/login"
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - "*.testdomain.com"
    - "testdomain.com"
    secretName: dashboard-tls-secret
  rules:
  - host: dashboard.testdomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: dashboard-proxy
            port:
              name: proxy-tls

trying to curl inside nginx pod worked fine but curl on ipv6 failed inside nginx pod examplecurl -v https://[2606:4700:3033::6815:1edb]/api/auth/session

[vitobotta]

I think you need to disable ipv6 and ipv6 dns resolution in nginx itself, not the load balancer. See https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#disable-ipv6