Ingress annotation for WAF policy behaviour for NAP v5

[shaun-nx]

As a user of NGINX Ingress Controller, I would like to enhance the security of my ingress resources by configuring WAF style annotation settings

UACs:

• Add additional annotations for WAF to enable compatibility with tar bundles
• Mirror fields in WAF Policy
• Support only WAF v5
• Ensure all AppProtect related annotations are validated
• Ensure Ingress resource is rejected correctly if an AppProtect related annotations is miss-configured

Decision Log:

• No implementation needed for Master/Minion pattern

Example configuration:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe
  namespace: cafe
  annotations:
    custom.nginx.org/app-protect-policy: "/etc/app_protect/bundles/policy-cafe.tgz"
    custom.nginx.org/app-protect-enable: "true"
    custom.nginx.org/app-protect-security-log-enable: "true"
    custom.nginx.org/app-protect-security-log: "log_all"
    custom.nginx.org/app-protect-security-log-destination: "syslog:server=127.0.0.1:514"
spec:
  ingressClassName: nginxplus
  tls:
  - hosts:
    - cafe.example.com
    secretName: cafe-secret
  rules:
  - host: cafe.example.com
    http:
      paths:
      - path: /coffee
        pathType: Prefix
        backend:
          service:
            name: coffee-svc
            port:
              number: 80

[github-actions]

Hi @shaun-nx thanks for reporting!

Be sure to check out the docs and the Contributing Guidelines while you wait for a human to take a look at this 🙂

Cheers!