NGINX Plus 기반 K8s 인증형 Forward Proxy 구축 가이드

docker build --no-cache --secret id=nginx-key,src=[nginx-repo.key 경로] --secret id=nginx-crt,src=[nginx-repo.crt 경로] --secret id=nginx-jwt,src=[license.jwt 경로] -t nginxplus .

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-conf
  namespace: devopschan 
data:
  nginx.conf: |
    load_module /etc/nginx/modules/ndk_http_module.so; # lua script 모듈을 불러오기 전 NGINX Developer kit 모듈을 먼저 불러옵니다.
    load_module /etc/nginx/modules/ngx_http_lua_module.so; # lua script 모듈을 불러옵니다.
    user  nginx;
    worker_processes  auto;
    
    error_log  /var/log/nginx/error.log notice;
    pid        /var/run/nginx.pid;
    
    events {
        worker_connections  1024;
    }   
    
    
    http {
        include       /etc/nginx/mime.types;
        default_type  application/octet-stream;
    
        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" $upstream_addr $http_Host $host body=$request_body'
                          '"$http_user_agent" "$http_x_forwarded_for"';
    
        access_log  /var/log/nginx/access.log  main;
    
        sendfile        on;
        #tcp_nopush     on;
        keepalive_timeout  65; 
        include /etc/nginx/conf.d/*.conf;
    } 

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-sites-config
  namespace: devopschan 
data:
  proxy.conf: |
        server {
            listen 3128;
            resolver 8.8.8.8 ipv6=off valid=60s;
                
            error_log  /var/log/nginx/error.log info;
            # 401이 떴을 경우 인증 로직으로 이동합니다.
            error_page 401 = @proxy_auth_fail;
            location / { 
                # 요청을 조작하여 Header를 변경합니다.
                rewrite_by_lua_block {
                    -- request header를 req_headers로 저장합니다.
                    local req_headers = ngx.req.get_headers()
                    -- proxy-authorization 헤더 값을 proxy_auth로 저장합니다.
                    local proxy_auth = req_headers["proxy-authorization"] 
                    
                    -- proxy_auth 값이 있을 경우 Authorization에 proxy-authorization 값을 넣습니다.
                    if proxy_auth then
                        ngx.log(ngx.INFO, "## DEBUG: Found Proxy-Auth header, copying")
                        ngx.req.set_header("Authorization", proxy_auth)
                    -- proxy_auth 값이 없을 경우 @proxy_auth_fail로 리다이렉트 됩니다.
                    else
                        ngx.log(ngx.INFO, "## DEBUG: No Proxy-Auth header found.")
                    end
                }
                auth_basic "Restricted Proxy";
                auth_basic_user_file /etc/nginx/auth/auth;
                tunnel_pass; 
            }
            location @proxy_auth_fail {
                return 407;
                header_filter_by_lua_block {
                     -- 웹 인증이 아닌 프록시 인증 로그인 창을 띄웁니다.
                     ngx.header["WWW-Authenticate"] = nil 
                     ngx.header["Proxy-Authenticate"] = "Basic realm=\"Restricted Proxy\""
                }
            }
        }

kubectl create secret generic basic-auth --from-file=auth -n devopschan

kubectl create secret generic license-token --from-file=license.jwt=license.jwt --type=nginx.com/license -n devopschan

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  namespace: devopschan 
  labels:
    app: nginx-proxy
spec:
  replicas: 1 
  selector:
    matchLabels:
      app: nginx-proxy
  template:
    metadata:
      labels:
        app: nginx-proxy
    spec:
      containers:
        - name: nginx
          image: [Custom NGINX Plus Image]
          ports:
          - containerPort: 3128 
          volumeMounts:
            - name: nginx-conf # NGINX 모듈 구성을 마운트합니다.
              mountPath: /etc/nginx/nginx.conf 
              subPath: nginx.conf
            - name: nginx-license # NGINX 라이선스를 마운트합니다.
              mountPath: /etc/nginx/license.jwt
              subPath: license.jwt
            - name: nginx-sites-config # Forward Proxy Configmap을 마운트합니다.
              mountPath: /etc/nginx/conf.d 
              readOnly: true
            - name: auth-volume # Basic 유저 파일을 마운트합니다
              mountPath: /etc/nginx/auth
              readOnly: true
      imagePullSecrets:
      - name: regcred # Custom NGINX Image를 Private Registry에서 가져오기 위한 자격증명입니다.
      volumes:
        - name: nginx-conf 
          configMap:
            name: nginx-conf
        - name: nginx-sites-config
          configMap:
            name: nginx-sites-config
        - name: nginx-license
          secret:
            defaultMode: 420 
            secretName: license-token
        - name: auth-volume
          secret:
            secretName: basic-auth

apiVersion: v1
kind: Service
metadata:
  name: nginx-proxy-svc 
  namespace: devopschan  
  labels:
    app: nginx-proxy 
spec:
  type: NodePort 
  ports:
    - protocol: TCP 
      name: http 
      port: 3128 
  selector:
    app: nginx-proxy 
  type: LoadBalancer 

k logs [NGINX Pods] -n devopschan | grep [접속 사이트]

10.0.27.0 - user [19/Dec/2025:04:34:27 +0000] "CONNECT www.google.com:443 HTTP/1.1" 200 739125 "-" 142.250.194.68:443 www.google.com:443 www.google.com body=-"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" "-"