springspring-securitykubernetessticky-session

Kubernetes ingress-nginx sticky session isn't working with spring security


I have a stateful spring application and I want to deploy it to kubernetes cluster. There will be more than one instance of the application so i need to enable sticy session using ingress-nginx controller. I made the following configuration:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-nginx
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/session-cookie-name: "JSESSIONID"
    nginx.ingress.kubernetes.io/session-cookie-expires: "172800"
    nginx.ingress.kubernetes.io/session-cookie-max-age: "172800"
    nginx.ingress.kubernetes.io/session-cookie-path: /ingress-test
    # UPDATE THIS LINE ABOVE
spec:
  rules:
     - http:
        paths:
          - path: /ingress-test
            backend:
              serviceName: ingress-test
              servicePort: 31080

ingress-nginx redirect subsequent request to correct pod if login is successful. However, it sometimes switches to other pod just after JSESSIONID is changed (JSESSIONID cookie is changed by spring-security afer successful login) and frontend redirects back to login page even user credentials are correct. Is there anyone that tried ingress-nginx with spring-security?

Best Regards


Solution

  • Following change fixed the problem. Without a host definition in rules, ingress-nginx doesn't set session cookie.

    There is an open issue: https://github.com/kubernetes/ingress-nginx/issues/3989

    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: ingress-nginx
      annotations:
        kubernetes.io/ingress.class: nginx
        nginx.ingress.kubernetes.io/ssl-redirect: "false"
        nginx.ingress.kubernetes.io/affinity: "cookie"
        nginx.ingress.kubernetes.io/session-cookie-name: "route"
        nginx.ingress.kubernetes.io/session-cookie-expires: "172800"
        nginx.ingress.kubernetes.io/session-cookie-max-age: "172800"
        nginx.ingress.kubernetes.io/session-cookie-path: /ingress-test
        # UPDATE THIS LINE ABOVE
    spec:
      rules:
         - host: www.domainname.com
           http:
            paths:
              - path: /ingress-test
                backend:
                  serviceName: ingress-test
                  servicePort: 31080