Protect Kubernetes Services with OAuth2 Proxy, Gateway API, Traefik, and Pocket ID

The latest guide demonstrates how to secure Kubernetes services using OAuth2 Proxy, Gateway API, Traefik, and Pocket ID. Previously, the configuration was managed using ingress-nginx annotations, but now the Kubernetes community recommends Gateway API for new traffic management work. This guide rebuilds the authentication flow with the suggested tools.

Traefik is utilized for browser-based OIDC login and external-auth filter since Gateway API does not standardize these features. If another implementation like Envoy Gateway, Kong, or Cilium is preferred, only the authentication adapter needs to be changed.

The setup exposes three HTTPS hostnames under a single domain: pocket-id.k8s.example.com for the Pocket ID UI and OIDC issuer, auth.k8s.example.com for OAuth2 Proxy endpoints, and whoami.k8s.example.com for a protected demo service. This single domain approach allows OAuth2 Proxy to use a narrow-scoped shared session cookie (.k8s.example.com).

A working K3s cluster is required to verify the authentication flow. The commands are standard Kubernetes and Helm commands and can be used in various environments. A domain must be set up for *.k8s.example.com pointing to the Traefik endpoint, which handles HTTPS traffic. LoadBalancer is used for Traefik's service type, and DNS should be configured accordingly.

Step 0 involves installing Gateway API, which is an add-on API and needs CRDs installed before using it. Step 1 requires installing Traefik and creating a Gateway resource. Step 2 installs and configures Pocket ID as the OIDC provider for authentication.