Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rewrite NGINX App Protect WAF Integration Section #4726

Merged
merged 12 commits into from
Dec 13, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions docs/content/includes/installation/create-custom-resources.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
To make sure your NGINX Ingress Controller pods reach the `Ready` state, you'll need to create custom resource definitions (CRDs) for various components.

Alternatively, you can disable this requirement by setting the `-enable-custom-resources` command-line argument to `false`.

There are two ways you can install the custom resource definitions:

1. Using a URL to apply a single CRD yaml file, which we recommend.
1. Applying your local copy of the CRD yaml files, which requires you to clone the repository.

{{<tabs name="install-crds">}}

{{%tab name="Install CRDs from single YAML"%}}

This single YAML file creates CRDs for the following resources:

- [VirtualServer and VirtualServerRoute]({{< relref "configuration/virtualserver-and-virtualserverroute-resources.md" >}})
- [TransportServer]({{< relref "configuration/transportserver-resource.md" >}})
- [Policy]({{< relref "configuration/policy-resource.md" >}})
- [GlobalConfiguration]({{< relref "configuration/global-configuration/globalconfiguration-resource.md" >}})

```shell
kubectl apply -f https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.3.2/deploy/crds.yaml
```

{{%/tab%}}

{{%tab name="Install CRDs after cloning the repo"%}}

{{< note >}} If you are installing the CRDs this way, ensure you have first cloned the repository. {{< /note >}}

These YAML files create CRDs for the following resources:

- [VirtualServer and VirtualServerRoute]({{< relref "configuration/virtualserver-and-virtualserverroute-resources.md" >}})
- [TransportServer]({{< relref "configuration/transportserver-resource.md" >}})
- [Policy]({{< relref "configuration/policy-resource.md" >}})
- [GlobalConfiguration]({{< relref "configuration/global-configuration/globalconfiguration-resource.md" >}})

```shell
kubectl apply -f config/crd/bases/k8s.nginx.org_virtualservers.yaml
kubectl apply -f config/crd/bases/k8s.nginx.org_virtualserverroutes.yaml
kubectl apply -f config/crd/bases/k8s.nginx.org_transportservers.yaml
kubectl apply -f config/crd/bases/k8s.nginx.org_policies.yaml
kubectl apply -f config/crd/bases/k8s.nginx.org_globalconfigurations.yaml
```

{{%/tab%}}

{{</tabs>}}
10 changes: 10 additions & 0 deletions docs/content/includes/installation/deploy-controller.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
---
docs:
---

You have two options for deploying NGINX Ingress Controller:

- **Deployment**. Choose this method for the flexibility to dynamically change the number of NGINX Ingress Controller replicas.
- **DaemonSet**. Choose this method if you want NGINX Ingress Controller to run on all nodes or a subset of nodes.

Before you start, update the [command-line arguments]({{< relref "configuration/global-configuration/command-line-arguments.md" >}}) for the NGINX Ingress Controller container in the relevant manifest file to meet your specific requirements.
Original file line number Diff line number Diff line change
Expand Up @@ -55,76 +55,8 @@ This guide assumes you are using the latest release.

## Create custom resources {#create-custom-resources}

To make sure your NGINX Ingress Controller pods reach the `Ready` state, you'll need to create custom resource definitions (CRDs) for various components. Alternatively, you can disable this requirement by setting the `-enable-custom-resources` command-line argument to `false`.
There are two ways you can install the custom resource definitions:
1. Using a URL to apply a single CRD yaml file. We recommend this approach.
2. Applying your local copy of the CRD yaml files. This requires that you [clone the repository](#lone-the-repository).
{{< include "installation/create-custom-resources.md" >}}

{{<tabs name="install-crds">}}

{{%tab name="Install CRDs from single YAML"%}}

### Core custom resource definitions

1. Create CRDs for [VirtualServer and VirtualServerRoute]({{< relref "configuration/virtualserver-and-virtualserverroute-resources.md" >}}), [TransportServer]({{< relref "configuration/transportserver-resource.md" >}}), [Policy]({{< relref "configuration/policy-resource.md" >}}) and [GlobalConfiguration]({{< relref "configuration/global-configuration/globalconfiguration-resource.md" >}}):

```shell
kubectl apply -f https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.3.2/deploy/crds.yaml
```

### Optional custom resource definitions

1. For the NGINX App Protect WAF module, create CRDs for `APPolicy`, `APLogConf` and `APUserSig`:

```shell
kubectl apply -f https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.3.2/deploy/crds-nap-waf.yaml
```

2. For the NGINX App Protect DoS module, create CRDs for `APDosPolicy`, `APDosLogConf` and `DosProtectedResource`:

```shell
kubectl apply -f https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.3.2/deploy/crds-nap-dos.yaml
```

{{%/tab%}}

{{%tab name="Install CRDs after cloning the repo"%}}

If you are installing the CRDs this way, ensure that you have first [cloned the repository](#clone-the-repository)

### Core custom resource definitions

1. Create CRDs for [VirtualServer and VirtualServerRoute]({{< relref "configuration/virtualserver-and-virtualserverroute-resources.md" >}}), [TransportServer]({{< relref "configuration/transportserver-resource.md" >}}), [Policy]({{< relref "configuration/policy-resource.md" >}}) and [GlobalConfiguration]({{< relref "configuration/global-configuration/globalconfiguration-resource.md" >}}):

```shell
kubectl apply -f config/crd/bases/k8s.nginx.org_virtualservers.yaml
kubectl apply -f config/crd/bases/k8s.nginx.org_virtualserverroutes.yaml
kubectl apply -f config/crd/bases/k8s.nginx.org_transportservers.yaml
kubectl apply -f config/crd/bases/k8s.nginx.org_policies.yaml
kubectl apply -f config/crd/bases/k8s.nginx.org_globalconfigurations.yaml
```
### Optional custom resource definitions

{{< note >}} This step can be skipped if you are using App Protect WAF module with policy bundles. {{< /note >}}

1. For the NGINX App Protect WAF module, create CRDs for `APPolicy`, `APLogConf` and `APUserSig`:

```shell
kubectl apply -f config/crd/bases/appprotect.f5.com_aplogconfs.yaml
kubectl apply -f config/crd/bases/appprotect.f5.com_appolicies.yaml
kubectl apply -f config/crd/bases/appprotect.f5.com_apusersigs.yaml
```

2. For the NGINX App Protect DoS module, create CRDs for `APDosPolicy`, `APDosLogConf` and `DosProtectedResource`:

```shell
kubectl apply -f config/crd/bases/appprotectdos.f5.com_apdoslogconfs.yaml
kubectl apply -f config/crd/bases/appprotectdos.f5.com_apdospolicy.yaml
kubectl apply -f config/crd/bases/appprotectdos.f5.com_dosprotectedresources.yaml
```
{{%/tab%}}

{{</tabs>}}

---

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -116,14 +116,53 @@ make push PREFIX=<my-docker-registry>/nginx-plus-ingress

---

## Deploy NGINX Ingress Controller {#deploy-ingress-controller}
## Create custom resources {#create-custom-resources}

{{< include "installation/create-custom-resources.md" >}}

---

## Create App Protect DoS custom resources

{{<tabs name="install-dos-crds">}}

{{%tab name="Install CRDs from single YAML"%}}

This single YAML file creates CRDs for the following resources:

- `APDosPolicy`
- `APDosLogConf`
- `DosProtectedResource`

```shell
kubectl apply -f https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.3.2/deploy/crds-nap-dos.yaml
```

You have two options for deploying NGINX Ingress Controller:
{{%/tab%}}

- **Deployment**. Choose this method for the flexibility to dynamically change the number of NGINX Ingress Controller replicas.
- **DaemonSet**. Choose this method if you want NGINX Ingress Controller to run on all nodes or a subset of nodes.
{{%tab name="Install CRDs after cloning the repo"%}}

These YAML files create CRDs for the following resources:

- `APDosPolicy`
- `APDosLogConf`
- `DosProtectedResource`

```shell
kubectl apply -f config/crd/bases/appprotectdos.f5.com_apdoslogconfs.yaml
kubectl apply -f config/crd/bases/appprotectdos.f5.com_apdospolicy.yaml
kubectl apply -f config/crd/bases/appprotectdos.f5.com_dosprotectedresources.yaml
```

{{%/tab%}}

{{</tabs>}}

---

## Deploy NGINX Ingress Controller {#deploy-ingress-controller}

Before you start, update the [command-line arguments]({{< relref "configuration/global-configuration/command-line-arguments.md" >}}) for the NGINX Ingress Controller container in the relevant manifest file to meet your specific requirements.
{{< include "installation/deploy-controller.md" >}}

### Using a Deployment

Expand Down
Loading
Loading