How to limit Azure Kubernetes nginx ingress access to specific endpoint via Azure Front Door only

Other Questions API
1

I need to configure my nginx ingress in Azure Kubernetes to allow access to a specific API endpoint only through Azure Front Door. I have this configuration snippet that works:

nginx.ingress.kubernetes.io/server-snippet: |
location /api/secured {
  if ($http_x_fd_health_probe != "my-frontdoor-id-12345") {
    return 401;
  }
  proxy_pass http://backend;
}

The problem is I’m not sure how to apply this restriction to just one particular route instead of the entire ingress. Right now it affects all paths but I only want to protect /api/secured endpoint. Other routes should remain accessible without Front Door validation. What’s the correct way to implement path-specific access control in this scenario?

2

just have 2 ingress configs, one for /api/secured that checks if its going tru front door, and another for everything else. makes it easier to manage without mixing up rules.

3

You can handle this with nginx location blocks at different priorities. Put your protected endpoint in its own location block and create a separate one for everything else:

nginx.ingress.kubernetes.io/server-snippet: |
  location = /api/secured {
    if ($http_x_fd_health_probe != "my-frontdoor-id-12345") {
      return 401;
    }
    proxy_pass http://backend;
  }
  location / {
    proxy_pass http://backend;
  }

The location = directive matches your secured endpoint exactly, while location / lets all other requests through without Front Door validation. You’ll keep one ingress resource but get path-specific access control.

4

Hit this same issue a few months ago. Switched to configuration-snippet instead of server-snippet and it worked perfectly. The difference is configuration-snippet runs inside the location context that nginx-ingress creates automatically.

Try this:

nginx.ingress.kubernetes.io/configuration-snippet: |
  if ($request_uri ~ "^/api/secured") {
    if ($http_x_fd_health_probe != "my-frontdoor-id-12345") {
      return 401;
    }
  }

You’re checking the request URI inside the existing location block instead of overriding everything. The nested ifs handle this conditional logic nicely and won’t mess with your other paths. Way cleaner than juggling multiple ingress objects.