Migrating from NGINX Ingress to ALB: Handling oauth2-proxy
The post describes two ways to keep OIDC authentication working when migrating from NGINX Ingress to the AWS Load Balancer Controller on Amazon EKS: running oauth2-proxy in reverse proxy mode behind an ALB, or using the ALB's native authenticate-oidc action. It notes that NGINX auth subrequest annotations are silently ignored by the ALB, and that the native option sends the token in x-amzn-oidc-accesstoken instead of Authorization: Bearer.
What changes for platform teams
Platform teams migrating off NGINX Ingress must choose between keeping oauth2-proxy with minimal changes or removing it and adapting backends to ALB headers and register the /oauth2/idpresponse callback with their identity provider. Without these changes, auth annotations are dropped and traffic reaches backends unauthenticated.
Read the original at AWS Containers Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules