Add auth response caching for both NGINX Ingress Controller and authSidecar deployments

Summary

This PR adds support for caching Houston/v1/authorization responses in both deployment modes:

• NGINX Ingress Controller deployments (via ingress annotations)
• authSidecar deployments (via nginx ConfigMaps)

This reduces Houston load for customers with high numbers of concurrent Airflow users.

Related Issue

https://github.com/astronomer/issues/issues/8056

Problem

Every request to the Airflow webserver, Flower UI, or dag-server triggers an auth subrequest to Houston's/v1/authorization endpoint. This includes page loads, static assets, API calls, and AJAX requests. For customers with many active Airflow users, this creates significant load on Houston.

Lab testing showed that a single user browsing the Airflow UI generated 385 auth requests to Houston in 60 seconds (6.4 requests/second). For customers with 50-100 concurrent users, this can result in hundreds of requests per second to Houston.

Solution

NGINX Ingress Controller Deployments

For deployments using NGINX Ingress Controller, this PR adds thenginx.ingress.kubernetes.io/auth-cache-key andnginx.ingress.kubernetes.io/auth-cache-duration annotations to the Airflow, Flower, and dag-server Ingress resources when:

• authSidecar.enabled: false (uses NGINX Ingress Controller)
• ingress.auth.enabled: true (authentication is enabled)
• ingress.authCache.enabled: true (new configuration, enabled by default)

authSidecar Deployments

For deployments using authSidecar (OpenShift customers who cannot use NGINX Ingress Controller due to ClusterRole restrictions), this PR implements caching directly in the authSidecar nginx ConfigMaps by adding:

1. proxy_cache_path directive in the http block
2. proxy_cache directives in the /auth location
3. Cookie header pass-through (required for cache key)
4. Conditionalproxy_buffering on (required for caching to work)

This applies when:

• authSidecar.enabled: true
• authSidecar.authCache.enabled: true (new configuration, enabled by default)

Configuration

New values invalues.yaml:

# For NGINX Ingress Controller deploymentsingress:authCache:enabled:truekey:"$http_cookie"duration:"200 15m, 401 403 1m"# For authSidecar deploymentsauthSidecar:authCache:enabled:truekey:"$http_cookie"duration:"200 15m, 401 403 1m"

Cache Key: Uses$http_cookie to uniquely identify users by their session cookies.

Cache Duration:

• Success responses (200): Cached for 15 minutes
• Auth failures (401, 403): Cached for 1 minute

The 15-minute TTL is conservative compared to the default JWT validity of 24 hours. This provides a significant performance improvement while maintaining reasonable security posture.

Testing

NGINX Ingress Controller

Lab testing with APC 0.35.0 on EKS demonstrated:

• Before: 385 Houston auth requests in 60 seconds
• After: 2 Houston auth requests in 60 seconds
• Reduction: 99.5%

authSidecar

Lab testing with APC 0.35.0 showed:

• Before: 113 auth requests to Houston in 5 minutes
• After: 1 initial auth request, then 100% cache hits
• Reduction: ~99.5% fewer Houston requests

Test results show the first request after login is a cache miss (validates with Houston), and all subsequent requests within 15 minutes are cache hits (served from NGINX cache).

Bug Fix

Fixed ingress annotation merging when authSidecar is enabled. Previously, enabling authSidecar would cause the loss of critical ingress annotations likekubernetes.io/ingress.class. This PR properly mergeswebserverAnnotations withauthSidecar.annotations.

Security Considerations

Trade-off: Cached auth responses mean that revoked credentials or changed permissions may remain valid for up to the cache TTL (default 15 minutes).

Rationale:

• JWT tokens are already valid for 24 hours (default)
• 15-minute caching is significantly more conservative
• User permission changes are infrequent
• Emergency access revocations are rare
• Platform stability benefits outweigh the marginal security risk

Customers can adjust the TTL by configuring theduration values or disable caching entirely by settingenabled: false.

Breaking Changes

None. This is opt-in functionality that defaults to enabled. Customers with custom configurations will have these settings added automatically, which should be transparent to both NGINX Ingress Controller and authSidecar deployments.

Files Changed

• values.yaml: Addingress.authCache andauthSidecar.authCache configuration
• templates/ingress.yaml: Add conditional auth cache annotations and fix annotation merging
• templates/webserver/webserver-auth-sidecar-configmap.yaml: Add auth caching directives
• templates/api-server/api-server-auth-sidecar-configmap.yaml: Add auth caching directives
• templates/dag-deploy/dag-server-auth-sidecar-configmap.yaml: Add auth caching directives
• templates/flower/flower-auth-sidecar-configmap.yaml: Add auth caching directives