Ingress to apps secured by Microsoft Entra ID in Kubernetes

​

What you’ll need

• An ngrok account.
• A Microsoft Azure account with access to an existing Microsoft Entra ID tenant or the ability to create a new tenant with a Microsoft Entra ID P1 or P2 license.
• A Kubernetes cluster (local or in a public cloud) with an app you want to make publicly accessible to specific users.
• kubectl and Helm 3.0.0+ installed on your local workstation.
• The ngrok Kubernetes Operator installed on your cluster.
• A reserved domain from the ngrok dashboard or API; this guide refers to it as <NGROK_DOMAIN>.

​

1. Create a cluster and deploy an example app

kubectl get pods

​

2. Add the ngrok Kubernetes Operator

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: boutique-ingress
  namespace: default
spec:
  ingressClassName: ngrok
  rules:
    - host: NGROK_DOMAIN
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: frontend
                port:
                  number: 80

kubectl apply -f boutique-ingress.yaml

​

3. Enable SAML with a Traffic Policy

• Create a file named saml-policy.yaml with the following content:
  apiVersion: ngrok.k8s.ngrok.com/v1alpha1
  kind: NgrokTrafficPolicy
  metadata:
    name: saml
    namespace: default
  spec:
    policy:
      on_http_request:
        - actions:
            - type: saml
              config:
                idp_metadata: 'YOUR_IDP_METADATA_XML'
  
• Apply the Traffic Policy CR:
  kubectl apply -f saml-policy.yaml
  
• Update your boutique-ingress.yaml to reference this policy with an annotation:
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: boutique-ingress
    namespace: default
    annotations:
      k8s.ngrok.com/traffic-policy: saml
  spec:
    ingressClassName: ngrok
    rules:
      - host: NGROK_DOMAIN
        http:
          paths:
            - path: /
              pathType: Prefix
              backend:
                service:
                  name: frontend
                  port:
                    number: 80
  
• Re-apply the Ingress manifest:
  kubectl apply -f boutique-ingress.yaml
  
• Refer to the SAML action documentation to retrieve your SP Entity ID and ACS URL values, which you’ll need in the next step.

​

4. Create an enterprise app in Microsoft Entra ID

• Open your Microsoft Entra ID tenant in the Azure console.
• Click Enterprise applications in the left-hand sidebar, then + New application, then + Create your own application. Give your app a name (for example, online-boutique) and select Integrate any other application you don’t find in the gallery (Non-gallery).
• Click Create to create your enterprise app; you’ll be taken to its Overview dashboard.
• To give specific users or groups access to your app, click Assign users and groups and follow the steps, then go back to Overview.
• Click Set up single sign on so users can sign in with their Microsoft Entra credentials, then choose SAML as the single sign-on protocol.
• Click Edit in the Basic SAML Configuration box. Refer to the SAML action documentation to retrieve your SP Entity ID and ACS URL, then copy them into the Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) fields respectively. Click Save before closing the modal.
• In the SAML Certificates box, download the Federation Metadata XML.

​

5. Update the Traffic Policy with the IdP metadata

• Open your saml-policy.yaml and replace YOUR_IDP_METADATA_XML with the contents of the Federation Metadata XML file you downloaded.
• Re-apply the updated Traffic Policy:
  kubectl apply -f saml-policy.yaml
  

​

6. Test authorization to your app using Microsoft Entra ID

• Open an incognito or private browser window (or a different browser) and go to your NGROK_DOMAIN. You should see a single sign-on screen from Microsoft.
• Enter credentials for a Microsoft account you assigned to your enterprise application in Microsoft Entra ID in step 4. Behind the scenes, ngrok redirects you to your identity provider, Microsoft Entra ID, for authentication. Once you sign in, or are already logged in, Microsoft Entra ID then returns a SAML assertion to ngrok, telling ngrok your authentication is confirmed and you have authorization to access the app. Microsoft Entra ID will then redirect you back to your app.

​

What’s next?

​

Clean up

​

Extend your ngrok Kubernetes Operator and Microsoft Entra ID integration