Installing NGINX Ingress Controller + Signal Sciences next-gen WAF (Using Signal Sciences NGINX Native Module)
This repository contains an example of embedding the Signal Sciences Agent in the ingress-nginx Ingress controller:
- /sigsci-module-nginx-ingress/Dockerfile
- This container is a "wrapper" for the default
nginx-ingress-controller
container and serves to add the Signal Sciences nginx Module files. You can set the image version in the Dockerfile, version used here is 0.22.0
- This container is a "wrapper" for the default
- /sigsci-agent/Dockerfile
- This container is a sidecar, running the Signal Sciences Agent, that will be included in the same pod as the nginx-ingress-controller
- mandatory.yaml
- This file contains a modified template of the Generic Ingress Controller Deployment as described at https://kubernetes.github.io/ingress-nginx/deploy/#prerequisite-generic-deployment-command. The main additions are:
- Changing the ingress container to load the custom Signal Sciences Module/ingress container and adding Volume mounts for socket file communication between the Module/ingress container and Agent sidecar container:
containers: - name: nginx-ingress-controller image: myregistry/sigsci-module-nginx-ingress:0.22.0 ... volumeMounts: - name: sigsci-socket mountPath: /var/run/
- Loading the Signal Sciences Module in nginx.conf via ConfigMap:
kind: ConfigMap apiVersion: v1 data: main-snippet: load_module /usr/lib/nginx/modules/ngx_http_sigsci_module.so; metadata: name: nginx-configuration
- Adding a container for the Signal Sciences Agent:
- name: sigsci-agent image: myregistry/sigsci-agent:3.21.0 volumeMounts: - name: sigsci-socket mountPath: /var/run/ env: - name: SIGSCI_ACCESSKEYID value: SETME - name: SIGSCI_SECRETACCESSKEY value: SETMETOO
- And defining the volume used above:
volumes: - name: sigsci-socket emptyDir: {}
- This file contains a modified template of the Generic Ingress Controller Deployment as described at https://kubernetes.github.io/ingress-nginx/deploy/#prerequisite-generic-deployment-command. The main additions are:
Set whatever registry + repository name you'd like here, just be sure to set the image to match in mandatory.yaml
docker build -t myregistry/sigsci-module-nginx-ingress:0.22.0 sigsci-module-nginx-ingress/
Again, set whatever registry + repository name you'd like here, just be sure to set the image to match in mandatory.yaml
docker build -t myregistry/sigsci-agent:3.21.0 sigsci-agent/
kubectl apply -f mandatory.yaml
Steps depend on cloud provider: https://kubernetes.github.io/ingress-nginx/deploy/#provider-specific-steps