Skip to content

Commit 1b4ec05

Browse files
committed
update traefik bouncer kubernetes section
1 parent 8202551 commit 1b4ec05

File tree

1 file changed

+63
-0
lines changed

1 file changed

+63
-0
lines changed

crowdsec-docs/unversioned/bouncers/traefik.mdx

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,69 @@ spec:
4949
crowdsecLapiKey: mysecretkey12345
5050
```
5151
52+
### Traefik with WAF(appsec) on kubernetes
53+
54+
We supposed you already have working crowdsec values configuration, basically here is the important configuration to put in crowdsec values :
55+
56+
```yaml
57+
config:
58+
config.yaml.local: |
59+
api:
60+
server:
61+
auto_registration:
62+
enabled: true
63+
token: "${REGISTRATION_TOKEN}" # /!\ Do not modify this variable (auto-generated and handled by the chart)
64+
allowed_ranges:
65+
- "127.0.0.1/32"
66+
- "192.168.0.0/16"
67+
- "10.0.0.0/8"
68+
- "172.16.0.0/12"
69+
appsec:
70+
enabled: true
71+
acquisitions:
72+
- source: appsec
73+
listen_addr: "0.0.0.0:7422"
74+
path: /
75+
appsec_configs:
76+
- crowdsecurity/appsec-default
77+
- crowdsecurity/crs
78+
labels:
79+
type: appsec
80+
env:
81+
- name: COLLECTIONS
82+
value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs crowdsecurity/appsec-generic-rules"
83+
lapi:
84+
env:
85+
- name: BOUNCER_KEY_traefik
86+
value: <YOUR-BOUNCER-KEY>
87+
```
88+
89+
Then the configuration for the middleware :
90+
91+
```yaml
92+
kind: Middleware
93+
apiVersion: traefik.io/v1alpha1
94+
metadata:
95+
name: bouncer
96+
namespace: traefik
97+
spec:
98+
plugin:
99+
bouncer:
100+
enabled: true
101+
crowdsecMode: stream
102+
crowdsecLapiScheme: http
103+
crowdsecLapiHost: crowdsec-service.default.svc.cluster.local:8080
104+
crowdsecAppsecEnabled: true
105+
crowdsecAppsecHost: crowdsec-appsec-service.default.svc.cluster.local:7422
106+
crowdsecAppsecPath: "/"
107+
crowdsecAppsecFailureBlock: true
108+
crowdsecAppsecUnreachableBlock: true
109+
crowdsecAppsecBodyLimit: 10485760
110+
crowdsecLapiKey: <YOUR-BOUNCER-KEY>
111+
crowdsecLapiPath: "/"
112+
crowdsecLapiTLSInsecureVerify: true
113+
```
114+
52115
You can see all the configuration options in the [bouncer documentation](https://plugins.traefik.io/plugins/6335346ca4caa9ddeffda116/crowdsec-bouncer-traefik-plugin).
53116
You can also refer to a [full traefik and CrowdSec stack on kubernetes](https://raw.githubusercontent.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/main/examples/kubernetes/README.md)
54117

0 commit comments

Comments
 (0)