Skip to content

Commit 528f96f

Browse files
ADubhlaoichADubhlaoich
committed
feat: Convert K8s configuration to includes for both cases
1 parent 5e6509d commit 528f96f

File tree

8 files changed

+365
-327
lines changed

8 files changed

+365
-327
lines changed

‎content/includes/nap-waf/nap-k8s-mtls-deployment.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
To secure traffic between NGINX and App Protect Enforcer using mTLS, follow the steps below:
2+
3+
{{< note >}} Refer to the [Configuration Guide]({{< relref "/nap-waf/v5/configuration-guide/configuration.md#secure-traffic-between-nginx-and-app-protect-enforcer-using-mtls" >}}) to generate certificates and modify the `nginx.conf` for mTLS.
4+
{{< /note >}}
5+
6+
First, create a Kubernetes Secret that contains the certificate and key files:
7+
8+
```shell
9+
kubectl create secret generic enforcer-certificates \
10+
--from-file=app_protect_server.crt=/path/to/app_protect_server.crt \
11+
--from-file=app_protect_server.key=/path/to/app_protect_server.key \
12+
--from-file=app_protect_client_ca.crt=/path/to/app_protect_client_ca.crt
13+
```
14+
15+
Next, update or create the `nap5-deployment.yaml` to mount the Secret as a volume and set the environment variables to point to the mounted files:
16+
17+
```yaml
18+
apiVersion: apps/v1
19+
kind: Deployment
20+
metadata:
21+
name: nap5-deployment
22+
spec:
23+
selector:
24+
matchLabels:
25+
app: nap5
26+
replicas: 2
27+
template:
28+
metadata:
29+
labels:
30+
app: nap5
31+
spec:
32+
imagePullSecrets:
33+
- name: regcred
34+
containers:
35+
- name: nginx
36+
image: <your-private-registry>/nginx-app-protect-5:<your-tag>
37+
imagePullPolicy: IfNotPresent
38+
volumeMounts:
39+
- name: app-protect-bd-config
40+
mountPath: /opt/app_protect/bd_config
41+
- name: app-protect-config
42+
mountPath: /opt/app_protect/config
43+
- name: certs
44+
mountPath: /etc/ssl/certs
45+
readOnly: true
46+
- name: waf-enforcer
47+
image: private-registry.nginx.com/nap/waf-enforcer:<version-tag>
48+
imagePullPolicy: IfNotPresent
49+
env:
50+
- name: ENFORCER_PORT
51+
value: "4431"
52+
- name: ENFORCER_SERVER_CERT
53+
value: "/etc/ssl/certs/app_protect_server.crt"
54+
- name: ENFORCER_SERVER_KEY
55+
value: "/etc/ssl/certs/app_protect_server.key"
56+
- name: ENFORCER_CA_FILE
57+
value: "/etc/ssl/certs/app_protect_client_ca.crt"
58+
volumeMounts:
59+
- name: app-protect-bd-config
60+
mountPath: /opt/app_protect/bd_config
61+
- name: certs
62+
mountPath: /etc/ssl/certs
63+
readOnly: true
64+
- name: waf-config-mgr
65+
image: private-registry.nginx.com/nap/waf-config-mgr:<version-tag>
66+
imagePullPolicy: IfNotPresent
67+
securityContext:
68+
allowPrivilegeEscalation: false
69+
capabilities:
70+
drop:
71+
- all
72+
volumeMounts:
73+
- name: app-protect-bd-config
74+
mountPath: /opt/app_protect/bd_config
75+
- name: app-protect-config
76+
mountPath: /opt/app_protect/config
77+
- name: app-protect-bundles
78+
mountPath: /etc/app_protect/bundles
79+
volumes:
80+
- name: app-protect-bd-config
81+
emptyDir: {}
82+
- name: app-protect-config
83+
emptyDir: {}
84+
- name: app-protect-bundles
85+
persistentVolumeClaim:
86+
claimName: nap5-bundles-pvc
87+
- name: certs
88+
secret:
89+
secretName: enforcer-certificates
90+
```

‎content/includes/nap-waf/nap-k8s-readonly-context.md‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
The first step is to add the `readOnlyRootFilesystem` value (as *true*) to your Kubernetes pod security context as follows:
2+
3+
```yaml
4+
containers:
5+
- name: nginx
6+
...
7+
securityContext:
8+
readOnlyRootFilesystem: true
9+
- name: waf-enforcer
10+
...
11+
securityContext:
12+
readOnlyRootFilesystem: true
13+
- name: waf-config-mgr
14+
...
15+
securityContext:
16+
readOnlyRootFilesystem: true
17+
```
18+
19+
With a read-only root file system, you will likely still require write access for certain directories, such as logs and temporary files. You can add these directories by mounting them as writable volumes in your Kubernetes deployment.
20+
21+
In this example, `/tmp` and `/var/log/nginx` are writable directories, essential for NGINX and App Protect operations.
22+
23+
```yaml
24+
containers:
25+
- name: nginx
26+
...
27+
volumeMounts:
28+
- name: app-protect-bd-config
29+
mountPath: /opt/app_protect/bd_config
30+
- name: app-protect-config
31+
mountPath: /opt/app_protect/config
32+
- name: tmp-volume
33+
mountPath: /tmp
34+
- name: nginx-log
35+
mountPath: /var/log/nginx
36+
- name: app-protect-bundles
37+
mountPath: /etc/app_protect/bundles
38+
...
39+
40+
volumes:
41+
- name: app-protect-bd-config
42+
emptyDir: {}
43+
- name: app-protect-config
44+
emptyDir: {}
45+
- name: nginx-log
46+
emptyDir: {}
47+
- name: tmp-volume
48+
emptyDir: {}
49+
- name: app-protect-bundles
50+
persistentVolumeClaim:
51+
claimName: nap5-bundles-pvc
52+
```
53+
54+
A full example might look like the following:
55+
56+
```yaml
57+
apiVersion: apps/v1
58+
kind: Deployment
59+
metadata:
60+
name: nap5-deployment
61+
spec:
62+
selector:
63+
matchLabels:
64+
app: nap5
65+
replicas: 2
66+
template:
67+
metadata:
68+
labels:
69+
app: nap5
70+
spec:
71+
imagePullSecrets:
72+
- name: regcred
73+
containers:
74+
- name: nginx
75+
image: <your-private-registry>/nginx-app-protect-5:<your-tag>
76+
imagePullPolicy: IfNotPresent
77+
securityContext:
78+
readOnlyRootFilesystem: true
79+
volumeMounts:
80+
- name: app-protect-bd-config
81+
mountPath: /opt/app_protect/bd_config
82+
- name: app-protect-config
83+
mountPath: /opt/app_protect/config
84+
- name: tmp-volume
85+
mountPath: /tmp
86+
- name: nginx-log
87+
mountPath: /var/log/nginx
88+
- name: app-protect-bundles
89+
mountPath: /etc/app_protect/bundles
90+
- name: waf-enforcer
91+
image: private-registry.nginx.com/nap/waf-enforcer:<version-tag>
92+
imagePullPolicy: IfNotPresent
93+
securityContext:
94+
readOnlyRootFilesystem: true
95+
env:
96+
- name: ENFORCER_PORT
97+
value: "50000"
98+
volumeMounts:
99+
- name: app-protect-bd-config
100+
mountPath: /opt/app_protect/bd_config
101+
- name: waf-config-mgr
102+
image: private-registry.nginx.com/nap/waf-config-mgr:<version-tag>
103+
imagePullPolicy: IfNotPresent
104+
securityContext:
105+
allowPrivilegeEscalation: false
106+
readOnlyRootFilesystem: true
107+
capabilities:
108+
drop:
109+
- all
110+
volumeMounts:
111+
- name: app-protect-bd-config
112+
mountPath: /opt/app_protect/bd_config
113+
- name: app-protect-config
114+
mountPath: /opt/app_protect/config
115+
- name: app-protect-bundles
116+
mountPath: /etc/app_protect/bundles
117+
volumes:
118+
- name: app-protect-bd-config
119+
emptyDir: {}
120+
- name: app-protect-config
121+
emptyDir: {}
122+
- name: nginx-log
123+
emptyDir: {}
124+
- name: tmp-volume
125+
emptyDir: {}
126+
- name: app-protect-bundles
127+
persistentVolumeClaim:
128+
claimName: nap5-bundles-pvc
129+
```

‎content/includes/nap-waf/nap-k8s-readonly-introduction.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
NGINX App Protect WAF v5 allows you to enable the `readOnlyRootFilesystem` option in your [Kubernetes Configuration](
2+
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). This option restricts the root filesystem to read-only mode, which improves security by limiting potential write access in case of compromise.
3+
4+
To enable this feature, you will need a Kubernetes cluster that supports read-only root file systems, and you access to the NGINX and NGINX App Protect WAF configurations.
5+
6+
You may need to identify any extra paths that need to be writable by App Protect during runtime: the following steps assume you are using the defaults path.

‎content/includes/nap-waf/nap-k8s-readonly-issues.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
**Permission denied errors**
2+
3+
If you encounter file permission issues, verify that the paths requiring write access are correctly configured as writable volumes in the pod manifest.
4+
5+
**NGINX App Protect WAF initialization errors**:
6+
7+
Check the NGINX and NGINX App Protect Logs to ensure that App Protect can write to necessary files like logs and temporary directories.
8+
9+
For general issues, read the [Troubleshooting]({{< ref "/nap-waf/v5/troubleshooting-guide/troubleshooting.md" >}}) topic.

‎content/includes/nap-waf/nap-k8s-readonly-paths.md‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
Once you have created writable paths in your Kubernetes cluster, you should update your NGINX configuration to use these paths.
2+
3+
The following are fields in `nginx.conf` you should update, which correspond to writable volumes configured during the last step:
4+
5+
```nginx
6+
pid /tmp/nginx.pid;
7+
...
8+
http {
9+
...
10+
# Temporary directories for kubernetes "readonlyfilesystem"
11+
client_body_temp_path /tmp/nginx-client-body;
12+
proxy_temp_path /tmp/nginx-proxy;
13+
fastcgi_temp_path /tmp/nginx-fastcgi;
14+
uwsgi_temp_path /tmp/nginx-uwsgi;
15+
scgi_temp_path /tmp/nginx-scgi;
16+
...
17+
}
18+
```
19+
20+
A full example might look like the following:
21+
22+
```nginx
23+
user nginx;
24+
worker_processes auto;
25+
26+
# NGINX App Protect WAF
27+
load_module modules/ngx_http_app_protect_module.so;
28+
29+
error_log /var/log/nginx/error.log debug;
30+
pid /tmp/nginx.pid;
31+
32+
events {
33+
worker_connections 1024;
34+
}
35+
36+
http {
37+
include /etc/nginx/mime.types;
38+
default_type application/octet-stream;
39+
40+
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
41+
'$status $body_bytes_sent "$http_referer" '
42+
'"$http_user_agent" "$http_x_forwarded_for"';
43+
44+
access_log /var/log/nginx/access.log;
45+
46+
# Temporary directories for kubernetes "readonlyfilesystem"
47+
client_body_temp_path /tmp/nginx-client-body;
48+
proxy_temp_path /tmp/nginx-proxy;
49+
fastcgi_temp_path /tmp/nginx-fastcgi;
50+
uwsgi_temp_path /tmp/nginx-uwsgi;
51+
scgi_temp_path /tmp/nginx-scgi;
52+
53+
sendfile on;
54+
#tcp_nopush on;
55+
56+
keepalive_timeout 65;
57+
58+
#gzip on;
59+
60+
# NGINX App Protect WAF
61+
app_protect_enforcer_address 127.0.0.1:50000;
62+
63+
include /etc/nginx/conf.d/*.conf;
64+
}
65+
```

‎content/includes/nap-waf/nap-k8s-use-compiled-bundles.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
In this setup, copy your compiled policy and logging profile bundles to `/mnt/nap5_bundles_pv_data` on a cluster node. Make sure that input files are accessible to UID 101. Then, in your NGINX configuration, refer to these files from `/etc/app_protect/bundles`.
2+
3+
For example, to apply `custom_policy.tgz` that you've placed in `/mnt/nap5_bundles_pv_data/`, use:
4+
5+
```nginx
6+
app_protect_policy_file "/etc/app_protect/bundles/custom_policy.tgz";
7+
```

0 commit comments

Comments
 (0)