nginx.conf

js_include conf.d/nginx.js;
js_set     $authorization authorization;

charset UTF-8;

server {
    listen            8080;
    server_name       localhost;
    absolute_redirect off;
    gzip              on;
    root              /usr/share/nginx/html/;

    location /master/ {
        proxy_pass                    https://kubernetes.default/;
        rewrite                       /master/(.*) /$1 break;
        proxy_pass_request_headers    on;
        proxy_pass_request_body       on;
        proxy_ssl_trusted_certificate /var/run/secrets/kubernetes.io/serviceaccount/ca.crt;
        proxy_ssl_verify              on;
        proxy_ssl_session_reuse       on;
        proxy_set_header              Authorization $authorization;
        proxy_http_version            1.1;
        proxy_set_header              Upgrade $http_upgrade;
        proxy_set_header              Connection $http_connection;
        proxy_read_timeout            3600;
    }

    location = /master/oauth/authorize {
        proxy_pass                    https://kubernetes.default/;
        rewrite                       /master/(.*) /$1 break;
        proxy_pass_request_headers    on;
        proxy_hide_header             WWW-Authenticate;
        proxy_intercept_errors        on;
        error_page                    302 = @oauth_redirect;
    }

    location @oauth_redirect {
        add_header Location $upstream_http_location always;
        return 200;
    }

    location = /server {
        return 204;
    }
}