Admin authentication & RBAC

Minimal Admin Console login with local Basic auth (opt-in; default auth type is none).

Source: examples/admin-auth/.

Open mode (default)

When admin.auth.type is omitted, ingress uses none — no login page. Example:

version: v1
port: 8080

# Admin API/UI without login — local development only.
# Do not expose on untrusted networks.
admin:
  enabled: true
  port: 9080
  database:
    driver: sqlite
    dsn: file:./admin-open.db?cache=shared&_fk=1
  auth:
    type: none

rules:
  - host: app.example.com
    backend:
      service:
        name: app-service
        port: 8080

Use none only on localhost or trusted networks. For production, set basic or oauth.

Basic login (recommended for production)

version: v1
port: 8080

# Minimal Admin Console with local login + RBAC.
# Default UI login: admin / admin (see admin.auth.basic below).
admin:
  enabled: true
  port: 9080
  database:
    driver: sqlite
    dsn: file:./admin-auth.db?cache=shared&_fk=1
  auth:
    type: basic
    basic:
      username: admin
      password: admin

rules:
  - host: app.example.com
    backend:
      service:
        name: app-service
        port: 8080

Item	Value
Admin URL	http://127.0.0.1:9080
Default login	admin / admin (from admin.auth.basic)
RBAC database	./admin-auth.db next to this YAML

Validate and run

ingress validate -c examples/admin-auth/ingress.yaml
ingress run -c examples/admin-auth/ingress.yaml

After login, open 权限 in the sidebar to manage users, roles, and permissions.

Related docs

• Admin console guide · Authentication & RBAC
• Full demo bundle with sample logs and WAF: Admin console example