Skip to content
Merged
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 38 additions & 9 deletions crowdsec-docs/unversioned/bouncers/ingress-nginx.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,6 @@ import RemediationSupportBadges from '@site/src/components/remediation-support-b

A lua Remediation Component for Ingress Nginx Controller.

:::warning
Ingress Nginx Version **1.12** or higher currently is not supported due to removal of Lua plugins support see [this issue](https://github.com/crowdsecurity/cs-openresty-bouncer/issues/60) for latest news.
:::

## How does it work ?

This component leverages OpenResty lua's API, used the ingress nginx controller as a [plugin](https://github.com/kubernetes/ingress-nginx/blob/main/rootfs/etc/nginx/lua/plugins/README.md).
Expand All @@ -57,10 +53,23 @@ The Ingress nginx controller should be installed using the [official helm chart]

### Using Helm

First you need to create new ingress-nginx chart values file (`crowdsec-ingress-bouncer.yaml`) to upgrade the ingress controller with the crowdsec plugin.
First you need to create new ingress-nginx chart values file (`crowdsec-ingress-values.yaml`) to upgrade the ingress controller with the crowdsec plugin.

:::warning

It is of the utmost importance to note that lua support has been removed from
mainline ingress nginx in version 1.12. As crowdsec remediation highly depends
on lua support, one has to use our controller image as show an in the following
values example.
:::


```yaml
controller:
image:
PullPolicy: IfNotPresent
image: crowdsecurity/controller
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add a comment above that line to highlight its importance ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

tag: latest
extraVolumes:
- name: crowdsec-bouncer-plugin
emptyDir: {}
Expand Down Expand Up @@ -115,14 +124,34 @@ controller:
resolver local=on ipv6=off;
```

This values upgrade your ingress deployment to add crowdsec lua lib as a plugin and run with the ingress controller.
It used [this docker image](https://hub.docker.com/r/crowdsecurity/lua-bouncer-plugin) to copy the crowdsec lua library.
<details>
<summary>You already have a deployed ingress nginx</summary>

This values.yaml upgrade your ingress deployment to add crowdsec lua lib as a
plugin and run with the crowdsec maintained nginx ingress controller with lua
support. It uses [this docker
image](https://hub.docker.com/r/crowdsecurity/lua-bouncer-plugin) to copy the
crowdsec lua library. You can upgrade the ingress-nginx using this `crowdsec-ingress-values.yaml`

```bash
helm -n ingress-nginx upgrade -f ingress-nginx-values.yaml -f crowdsec-ingress-values.yaml ingress-nginx/ingress-nginx
```

</details>

<details>
<summary>You don't have a deployed ingress nginx</summary>

Once you have this patch we can upgrade the ingress-nginx chart.
This values.yaml install your ingress deployment to add crowdsec lua lib as a
plugin and run with the crowdsec maintained nginx ingress controller with lua
support. It uses [this docker
image](https://hub.docker.com/r/crowdsecurity/lua-bouncer-plugin) to copy the
crowdsec lua library. You can install the ingress-nginx using this `crowdsec-ingress-values.yaml`

```bash
helm -n ingress-nginx upgrade -f ingress-nginx-values.yaml -f crowdsec-ingress-bouncer.yaml ingress-nginx ingress-nginx
helm -n ingress-nginx install -f crowdsec-ingress-values.yaml ingress-nginx ingress-nginx/ingress-nginx
```
</details>

And then check if the ingress controller is running well.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we link to healthcheck ? is it relevant for that usecase ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not yet, will do when healthcheck will be ready


Expand Down