Skip to content

Commit 14ebdc4

Browse files
authored
App Policy Bundle (#3560)
App Policy Bundle
1 parent 8ae8509 commit 14ebdc4

File tree

11 files changed

+506
-10
lines changed

11 files changed

+506
-10
lines changed

deployments/common/crds/k8s.nginx.org_policies.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,8 @@ spec:
160160
description: WAF defines an WAF policy.
161161
type: object
162162
properties:
163+
apBundle:
164+
type: string
163165
apPolicy:
164166
type: string
165167
enable:

deployments/helm-chart/crds/k8s.nginx.org_policies.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,8 @@ spec:
160160
description: WAF defines an WAF policy.
161161
type: object
162162
properties:
163+
apBundle:
164+
type: string
163165
apPolicy:
164166
type: string
165167
enable:

internal/configs/configurator.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232

3333
const (
3434
pemFileNameForWildcardTLSSecret = "/etc/nginx/secrets/wildcard" // #nosec G101
35+
appProtectBundleFolder = "/etc/nginx/waf/bundles/"
3536
appProtectPolicyFolder = "/etc/nginx/waf/nac-policies/"
3637
appProtectLogConfFolder = "/etc/nginx/waf/nac-logconfs/"
3738
appProtectUserSigFolder = "/etc/nginx/waf/nac-usersigs/"

internal/configs/version2/http.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ type OIDC struct {
126126
type WAF struct {
127127
Enable string
128128
ApPolicy string
129+
ApBundle string
129130
ApSecurityLogEnable bool
130131
ApLogConf []string
131132
}

internal/configs/version2/nginx-plus.virtualserver.tmpl

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,10 @@ server {
225225
app_protect_policy_file {{ .ApPolicy }};
226226
{{ end }}
227227

228+
{{ if .ApBundle }}
229+
app_protect_policy_file {{ .ApBundle }};
230+
{{ end }}
231+
228232
{{ if .ApSecurityLogEnable }}
229233
app_protect_security_log_enable on;
230234
{{ range $logconf := .ApLogConf }}
@@ -429,6 +433,10 @@ server {
429433
app_protect_policy_file {{ .ApPolicy }};
430434
{{ end }}
431435

436+
{{ if .ApBundle }}
437+
app_protect_policy_file {{ .ApBundle }};
438+
{{ end }}
439+
432440
{{ if .ApSecurityLogEnable }}
433441
app_protect_security_log_enable on;
434442
{{ range $logconf := .ApLogConf }}

0 commit comments

Comments
 (0)