1. In the General Settings section, enter a Client ID. For this example, we've chosen nginx-client as the Client ID.

The client ID is used in OpenID Connect (OIDC) to uniquely identify an application to the OIDC provider, ensuring proper security, configuration, and authorization. It helps link requests and responses, validates the correct client, and ensures the right permissions are granted.

2. In the Capability Configuration section, enable the Client Authentication option. Keep the default Standard flow enabled, which enables support of the OpenID Connect Authorization Code Flow.

3. In the Login Settings section, set the Valid Redirect URIs to https://flink-ui.<hostname>/redirect_uri, replacing <hostname> with the value obtained in the “Expose a secure endpoint that the Web UI can use - Configure Route/Ingress” section.

Note down the Nginx client credentials for use in Nginx configuration

After creating the client, you'll be redirected to the client details page. Here, you can retrieve the necessary information to configure Nginx.

Navigate to the Credentials tab and ensure that the Client Authenticator is set to Client ID and Secret. Then, click the copy link to copy the client's secret.

Make sure to note down the Client ID and Client Secret, as you’ll need them in the next step when configuring Nginx.

Additionally, record the Keycloak Discovery URL (as shown here). With these three pieces of information — the Client ID, Client Secret, and Discovery URL — you’ll be ready to configure Nginx.

6. Configure Nginx with OIDC authentication

Step1 - Configure Nginx OIDC provider SSL certificate

1. You’ll need the OIDC provider’s certificate for Nginx to communicate with it. If you don’t have the certificate, you can extract it using the following command. Be sure to replace the placeholder <oidc-provider-url> with the hostname of your OIDC provider:
   

   openssl s_client -connect <oidc-provider-url>:443 < /dev/null | openssl x509 > oidc.crt

The above command extract the OIDC provider certificate to a file oidc.crt

2. Once you have the certificate, use the following command to create a secret named oidc-tls-secret.
   

   oc create secret generic oidc-tls-secret --from-file=./oidc.crt

Output in the terminal is:

secret/oidc-tls-secret created

Step2 - Get the DNS resolution IP address

oc describe dns.operator/default  | grep "Cluster IP:"

 Cluster IP:      172.30.0.30

kubectl describe svc kube-dns -n kube-system | grep "IP:"

 IP:                10.96.0.10

Step3 - Get the URL of the Route/Ingress Flink Web UI

OCP

echo "https://$(oc get route flink-ui -o jsonpath='{.spec.host}')"

The output of the previous command should resemble the following:

https://flink-ui-mynamespace.mycluster.mydomain.com

K8s

• If you created the Ingress resource with a host
  

  echo "https://$(kubectl get ingress flink-ui-ingress -o jsonpath='{.spec.rules[0].host}')"

   

The output of the previous command should resemble the following:

https://flink-ui.mycluster.mydomain.com

• If you created the Ingress resource without a host
  

  echo "https://$(kubectl get ingress flink-ui-ingress -o jsonpath='{.status.loadBalancer.ingress[0].ip}')"

   

The output of the previous command should resemble the following:

https://9.30.100.30

Step4 - Create the ConfigMap handling Nginx configuration

Now that you have all the necessary information, proceed by creating the Nginx configuration. First, create a ConfigMap to handle the configuration using the command below.

Be sure to replace the following placeholders with the corresponding values:

• flink-rest-ui: Replace with the value from the "Determine the URL of the JobManager Service" section.

• redirect_uri: Replace with the value from the "Step3 - Get the URL of the Route/Ingress Flink Web UI", suffixed by "/redirect_uri".

• discovery: Replace with the value from the "Configure OIDC provider > Getting required client information" section.

• client_id: Replace with the value from the "Configure OIDC provider > Getting required client information" section.

• client_secret: Replace with the value from the "Configure OIDC provider > Getting required client information" section.

• resolver_ip: Replace with the value from the "Step2 - Get the DNS resolution IP address" section.

cat <<EOF | kubectl apply -f -
kind: ConfigMap
apiVersion: v1
metadata:
  name: nginx-config
data:
  default.conf: |-
    server {
      listen       8443 ssl;
      server_name  localhost;
      ssl_certificate /etc/nginx/tls/nginx.crt;   
      ssl_certificate_key /etc/nginx/tls/nginx.key;  
      
      access_by_lua '
        local opts = {
          redirect_uri = "<redirect_uri>",
          discovery = "<discovery>",
          client_id = "<client_id>",
          client_secret = "<client_secret>",
          logout_path = "/logout",
          accept_none_alg = true,
          session_contents = {id_token=true}
        }
    
         -- call introspect for OAuth 2.0 Bearer Access Token validation
        local res, err = require("resty.openidc").authenticate(opts)
    
         if err then
          ngx.status = 403
          ngx.say(err)
          ngx.exit(ngx.HTTP_FORBIDDEN)
        end
      ';
      location / {
        proxy_pass <flink-rest-ui>;
        proxy_set_header Host \$host;
      }
    }
  nginx.conf: |-
    #user  nobody;
    worker_processes  1;
    error_log  /dev/stderr  error;
    #pid        logs/nginx.pid;
    events {
        worker_connections  1024;
    }
    http {
        lua_package_path '/.luarocks/share/lua/5.1/?.lua;;';
        resolver <resolver_ip> valid=1s;
        lua_ssl_trusted_certificate /etc/nginx/oidc/tls/oidc.crt;
        include       mime.types;
        default_type  application/octet-stream;
        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for"';
        access_log  /dev/stdout  main;
        # See Move default writable paths to a dedicated directory (#119)
        # https://github.com/openresty/docker-openresty/issues/119
        client_body_temp_path /var/run/openresty/nginx-client-body;
        proxy_temp_path       /var/run/openresty/nginx-proxy;
        fastcgi_temp_path     /var/run/openresty/nginx-fastcgi;
        uwsgi_temp_path       /var/run/openresty/nginx-uwsgi;
        scgi_temp_path        /var/run/openresty/nginx-scgi;
        sendfile        on;
        #tcp_nopush     on;
        #keepalive_timeout  0;
        keepalive_timeout  65;
        #gzip  on;
        include /etc/nginx/conf.d/*.conf;
    }
EOF

Output in the terminal :

configmap/nginx-config created

Step5 - Create the Deployment

Now that you have all the required resources, you can proceed to create the Nginx deployment by running the command below:

cat <<EOF | kubectl apply -f -
kind: Deployment
apiVersion: apps/v1
metadata:
  name: nginx-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          command:
            - /bin/sh
            - '-c'
            - |
              luarocks config local_by_default true
              luarocks install lua-resty-openidc
              /usr/local/openresty/nginx/sbin/nginx -g "daemon off;"
          ports:
            - containerPort: 8443
              protocol: TCP
          volumeMounts:
            - name: nginx-config
              mountPath: /etc/nginx/conf.d/default.conf
              subPath: default.conf
            - name: nginx-config
              mountPath: /usr/local/openresty/nginx/conf/nginx.conf
              subPath: nginx.conf
            - name: nginx-tls
              mountPath: /etc/nginx/tls
            - name: oidc-tls
              mountPath: /etc/nginx/oidc/tls
            - name: shared-volume
              mountPath: /.luarocks
            - name: shared-volume
              mountPath: /.cache
            - name: shared-volume
              mountPath: /usr/local/openresty/nginx/logs
            - name: shared-volume
              mountPath: /usr/local/openresty/luajit/lib/luarocks
            - name: shared-volume
              mountPath: /var/run/openresty
          image: 'openresty/openresty:alpine-fat'
      volumes:
        - name: shared-volume
          emptyDir: { }
        - name: nginx-config
          configMap:
            name: nginx-config
        - name: oidc-tls
          secret:
            secretName: oidc-tls-secret
        - name: nginx-tls
          secret:
            secretName: nginx-tls-secret
EOF

Output in the terminal :

deployment.apps/nginx-deployment created

Verification

You can do a quick check for the state of the deployment using the command below to ensure that the deployment is ready, note that it may take several minutes to be available:

kubectl get deployment nginx-deployment
NAME               READY   UP-TO-DATE   AVAILABLE   AGE
nginx-deployment   1/1     1            1           50s

SecurityContext

In an enterprise environment, particularly in production, you should configure the securityContext of the Deployment to align with your organization's security policies.

7. Connect to the Flink WebUI

Now that you have all the pieces in place, visit the link from “Step3 - Get the URL of the Route/Ingress Flink Web UI” part with your browser.

Since we’re using a self-signed certificates you might get a browser error page which tells you that your connection is not private

 

You can proceed, as the errors are likely caused by the self-signed certificate and the CA not being recognized. In this case, the browser will be redirected to the OIDC provider's login page (see figure below), where the user will be prompted to enter a username and password, which will then be validated against the registered users.

 

Finally you’ll land on the Flink Web UI being authenticated as shown in the figure below and the experience remains the same as without authentication.

 

Conclusion

All the resources and configurations mentioned in this blog will be made available on GitHub for your convenience.