Migrating from NGINX Ingress to ALB: Handling oauth2-proxy

This article guides teams migrating from retired NGINX Ingress Controller to AWS Load Balancer Controller on Amazon EKS, focusing on preserving OpenID Connect (OIDC) authentication flows with oauth2-proxy.

• Solution 1: ALB + oauth2-proxy in reverse proxy mode—minimal changes, preserves Authorization: Bearer header, backward-compatible
• Solution 2: ALB native OIDC—removes oauth2-proxy entirely, ALB handles authentication, uses x-amzn-oidc-accesstoken header
• Solution 1 requires three oauth2-proxy flags (--upstream, --reverse-proxy, --pass-authorization-header) and Ingress backend pointing to oauth2-proxy
• Solution 2 requires registering /oauth2/idpresponse callback URL with identity provider and backend adaptation to ALB headers
• Safe migration pattern: prepare infrastructure, deploy ALB in parallel with NGINX, validate authentication flow, cut over DNS, decommission NGINX
• Choose Solution 1 for minimal disruption and no backend changes; choose Solution 2 to remove oauth2-proxy when backend can adapt

Both solutions enable secure OIDC authentication during migration, with Solution 1 offering lower risk for existing NGINX + oauth2-proxy setups.