WebACL should recognize resource generated by ack-waf

[powerpower2005]

Is your feature request related to a problem?

ack-waf can make WAF resource but some resource like webacl can't make a association with WAF resources on its own

• webacl - ipset
• webacl - regrex pattern

Describe the solution you'd like

• webacl should recognize resource by CR name or something identifier things.
• It enables ack-waf to control all the WAF resource dynamically.

That feature can make ack-waf independent from Iac tool.
I don't want to do post-processing job like getting a ARN each WAF resource (ipset, regex pattern)
I want regex pattern, ipset with webacl first

Describe alternatives you've considered

I dropped the migration work from terraform to ack.

similar issue is here #2173

[github-actions]

Hello @powerpower2005 👋 Thank you for opening an issue in ACK! A maintainer will triage this issue soon.

We encourage community contributions, so if you're interested in tackling this yourself or suggesting a solution, please check out our Contribution and Code of Conduct guidelines.

You can find more information about ACK on our website.

[powerpower2005]

As I know, case of ack-ddb
hold data below

status:
ackResourceMetadata:
arn: >-
arn:aws:dynamodb:ap-northeast-2:123412341234:table/example-resource

Can I use this? with kube api?

[talsh-oasis]

Is your feature request related to a problem?

ack-waf can make WAF resource but some resource like webacl can't make a association with WAF resources on its own

• webacl - ipset
• webacl - regrex pattern

Describe the solution you'd like

• webacl should recognize resource by CR name or something identifier things.
• It enables ack-waf to control all the WAF resource dynamically.

That feature can make ack-waf independent from Iac tool. I don't want to do post-processing job like getting a ARN each WAF resource (ipset, regex pattern) I want regex pattern, ipset with webacl first

Describe alternatives you've considered

I dropped the migration work from terraform to ack.

similar issue is here #2173

I’m trying to attach an IPSet to a WebACL using ACK (wafv2).
When the IPSet CR is created, the controller creates an AWS IP set whose Name gets a generated suffix (e.g. office-ips-abc123). The WebACL rule requires an ARN for ipSetReferenceStatement, so I can’t reference the IP set by a stable name and I don’t know the ARN at authoring time.

[powerpower2005]

@talsh-oasis

I think WAF Controller can get ipset arn dynamically and WebACL can wait for assigning ipset's arn from waf controller.

As a result, All the resource refered by WebACL should have been created before WebACL resource create. (ipset, rulegroup, etc.)

I think WAF controller can do this.

I try to use field export and helm lookup function to handle this problem.

[powerpower2005]

@a-hilaly Could I modify the logic? If so, Could you explain controller cycle and How does ACK-controller run a bit?
At least, I want to know. what script do I need to edit.