Skip to content

Commit 603417c

Browse files
shaun-nxshaun-nx
authored
Add examples for app protect waf v5 (nginx#5784)
1 parent 4f578ec commit 603417c

File tree

5 files changed

+188
-0
lines changed

5 files changed

+188
-0
lines changed

‎examples/custom-resources/app-protect-waf-v5/README.md

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# WAF
2+
3+
In this example we deploy the NGINX Plus Ingress Controller with [NGINX App
4+
Protect WAF version 5](https://www.nginx.com/products/nginx-app-protect/), a simple web application and then configure load balancing
5+
and WAF protection for that application using the VirtualServer resource.
6+
7+
Before applying a policy and security log configuration, a WAF v5 policy and logconf bundle must be created, then copied to a volume mounted to `/etc/app_protect/bundles`.
8+
9+
## Prerequisites
10+
11+
1. Follow the installation [instructions](https://docs.nginx.com/nginx-ingress-controller/installation) to deploy the
12+
Ingress Controller with NGINX App Protect version 5.
13+
14+
1. Save the public IP address of the Ingress Controller into a shell variable:
15+
16+
```console
17+
IC_IP=XXX.YYY.ZZZ.III
18+
```
19+
20+
1. Save the HTTP port of the Ingress Controller into a shell variable:
21+
22+
```console
23+
IC_HTTP_PORT=<port number>
24+
```
25+
26+
## Step 1. Deploy a Web Application
27+
28+
Create the application deployment and service:
29+
30+
```console
31+
kubectl apply -f webapp.yaml
32+
```
33+
34+
## Step 2 - Create and Deploy the WAF Policy Bundle
35+
36+
1. Create a WAF v5 policy bundle (`<your_policy_bundle.tgz>`) and copy the bundle to a volume mounted to `/etc/app_protect/bundles`.
37+
38+
## Step 3 - Create and Deploy the WAF Policy
39+
40+
1. Create the syslog service and pod for the App Protect security logs:
41+
42+
```console
43+
kubectl apply -f syslog.yaml
44+
```
45+
46+
1. Create the WAF policy
47+
48+
```console
49+
kubectl apply -f waf.yaml
50+
```
51+
52+
## Step 4 - Configure Load Balancing
53+
54+
1. Create the VirtualServer Resource:
55+
56+
```console
57+
kubectl apply -f virtual-server.yaml
58+
```
59+
60+
Note that the VirtualServer references the policy `waf-policy` created in Step 3.
61+
62+
## Step 5 - Test the Application
63+
64+
To access the application, curl the coffee and the tea services. We'll use the --resolve option to set the Host header
65+
of a request with `webapp.example.com`
66+
67+
1. Send a request to the application:
68+
69+
```console
70+
curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP http://webapp.example.com:$IC_HTTP_PORT/
71+
```
72+
73+
```text
74+
Server address: 10.12.0.18:80
75+
Server name: webapp-7586895968-r26zn
76+
...
77+
```
78+
79+
1. Now, let's try to send a request with a suspicious URL:
80+
81+
```console
82+
curl --resolve webapp.example.com:$IC_HTTP_PORT:$IC_IP "http://webapp.example.com:$IC_HTTP_PORT/<script>"
83+
```
84+
85+
```text
86+
<html><head><title>Request Rejected</title></head><body>
87+
...
88+
```
89+
90+
1. To check the security logs in the syslog pod:
91+
92+
Note that this step applies only if the `syslog.yaml` was created (Step 2).
93+
94+
```console
95+
kubectl exec -it <SYSLOG_POD> -- cat /var/log/messages
96+
```

‎examples/custom-resources/app-protect-waf-v5/syslog.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: syslog
5+
spec:
6+
replicas: 1
7+
selector:
8+
matchLabels:
9+
app: syslog
10+
template:
11+
metadata:
12+
labels:
13+
app: syslog
14+
spec:
15+
containers:
16+
- name: syslog
17+
image: balabit/syslog-ng:4.3.0
18+
ports:
19+
- containerPort: 514
20+
- containerPort: 601
21+
---
22+
apiVersion: v1
23+
kind: Service
24+
metadata:
25+
name: syslog-svc
26+
spec:
27+
ports:
28+
- port: 514
29+
targetPort: 514
30+
protocol: TCP
31+
selector:
32+
app: syslog

‎examples/custom-resources/app-protect-waf-v5/virtual-server.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: k8s.nginx.org/v1
2+
kind: VirtualServer
3+
metadata:
4+
name: webapp
5+
spec:
6+
host: webapp.example.com
7+
policies:
8+
- name: waf-policy
9+
upstreams:
10+
- name: webapp
11+
service: webapp-svc
12+
port: 80
13+
routes:
14+
- path: /
15+
action:
16+
pass: webapp

‎examples/custom-resources/app-protect-waf-v5/waf.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: k8s.nginx.org/v1
2+
kind: Policy
3+
metadata:
4+
name: waf-policy
5+
spec:
6+
waf:
7+
enable: true
8+
apPolicy: "<your_policy_bundle_name.tgz>"
9+
securityLogs:
10+
- enable: true
11+
apLogConf: "<your_bundle_name>.tgz"
12+
logDest: "syslog:server=syslog-svc.default:514"

‎examples/custom-resources/app-protect-waf-v5/webapp.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: webapp
5+
spec:
6+
replicas: 1
7+
selector:
8+
matchLabels:
9+
app: webapp
10+
template:
11+
metadata:
12+
labels:
13+
app: webapp
14+
spec:
15+
containers:
16+
- name: webapp
17+
image: nginxdemos/nginx-hello:plain-text
18+
ports:
19+
- containerPort: 8080
20+
---
21+
apiVersion: v1
22+
kind: Service
23+
metadata:
24+
name: webapp-svc
25+
spec:
26+
ports:
27+
- port: 80
28+
targetPort: 8080
29+
protocol: TCP
30+
name: http
31+
selector:
32+
app: webapp

0 commit comments

Comments
 (0)