I'm looking for someone to help set up oathkeeper behind k8s ingress-nginx. We have rules that work perfectly fine when routing straight through oathkeeper as a proxy, but as soon as we do the same request using nginx auth_request, it rejects it saying no rules are matched. We're tearing our hair out here. We've looked at the examples here: https://github.com/gen1us2k/ory_workshop/tree/master/oathkeeper/05_nginx_oathkeeper and tried to ensure that our nginx has the same basic details as the example. We've tried curling from other containers to the decisions endpoint, and every time, it fails saying the rules don't exist. We know for definite they do, as like I say, it works over the standard proxy. Anyone done this before and can help out?

Hello John, I am not on K8S, but here is my config for nginx.conf. I am running it locally on my computer via podman compose. Names should be self-explanatory. My nginx is exposed on host port 7443 via https. That is why the port 7443 is present in the rule, but I need to make test to see if it works without. Anyway, the below config works

location /api/cs/ {
        auth_request /decisions;
        auth_request_set $next_uri $upstream_http_X_Original_URI;
        # Capture Authorization header returned by Oathkeeper
        auth_request_set $auth_header $upstream_http_authorization;

        # Forward the Authorization Bearer token received from
        # Oathkeeper to our backend service.
        # Remove the initial cookies.
        proxy_set_header Authorization $auth_header; 
        proxy_set_header Cookie "";

        set $upstream_cs_api <http://cs-api:8080>;

        rewrite ^/api/cs/(.*)$ /$1 break;
        proxy_pass $upstream_cs_api;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    location = /decisions {
        internal;
        set $upstream_oathkeeper <http://cs-oathkeeper:4456>;
        proxy_pass $upstream_oathkeeper/decisions;
        proxy_pass_request_body   off;
        proxy_set_header Content-Length   "";
        proxy_set_header Host $http_host;
        proxy_set_header X-Original-URI $request_uri;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Method $request_method;
        proxy_set_header X-Forwarded-Uri $request_uri;
        proxy_set_header Cookie $http_cookie;
    }

Oathkeeper:

serve:
  proxy:
    port: 4455 # run the proxy at port 4455
  api:
    port: 4456 # run the api at port 4456

access_rules:
  matching_strategy: regexp
  repositories:
    - file:///etc/config/oathkeeper/rules.json

errors:
  fallback:
    - json
  handlers:
    json:
      enabled: true
      config:
        verbose: true

authenticators:
  cookie_session:
    enabled: true
    config:
      check_session_url: <http://cs-kratos:4433/sessions/whoami>
      preserve_path: true
      extra_from: "@this"
      subject_from: "identity.id"
      only:
        - ory_kratos_session

authorizers:
  allow:
    enabled: true

mutators:
  id_token:
    enabled: true
    config:
      issuer_url: <http://cs-oathkeeper:4456/>
      jwks_url: file:///etc/config/oathkeeper/secrets/id_token.jwks.json
      claims: |
        {
          "session": {{ .Extra | toJson }}
        }

Rules:

[
  {
    "id": "api-cs-rule",
    "upstream": {
      "url": "<http://cs-api:8080>"
    },
    "match": {
      "url": "<^https?://localhost(:7443)?/api/cs/.*$>",
      "methods": ["GET", "POST", "PATCH", "PUT", "DELETE"]
    },
    "authenticators": [{ "handler": "cookie_session" }],
    "authorizer": { "handler": "allow" },
    "mutators": [{ "handler": "id_token" }]
  }
]

I really appreciate that, thank you.