Configure WAF association through ingress annotations?

[athal7]

I'm curious if it is feasible to add a feature to attach an AWS Web Application Firewall (WAF) rule to an ALB created by the ingress resource by specifying the rule name in an annotation.

Thanks!

[joshrosso]

Hi @athal7,

We had a PR from @dix-icomys https://github.com/coreos/alb-ingress-controller/pull/115

But unfortunately fell through the cracks. Can you validate the functionality described in that PR is what you're looking for?

If so, perhaps we can try to integrate this in 1.1.

[athal7]

@joshrosso thanks for the quick response! That functionality is exactly what I'm looking for. Let me know if I can be of help getting it across the finish line.

[joshrosso]

At this point, it's a matter of rebasing or reworking that PR into the continued_stabilization branch. If you have cycles to bring that up to speed and create a PR against the branch I'm open to testing it and getting it in for 1.0.

On Sep 15, 2017 12:52 PM, "Andrew Thal" notifications@github.com wrote:

@joshrosso https://github.com/joshrosso thanks for the quick response! That functionality is exactly what I'm looking for. Let me know if I can be of help getting it across the finish line.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/coreos/alb-ingress-controller/issues/211#issuecomment-329869464, or mute the thread https://github.com/notifications/unsubscribe-auth/AF6a-SO9dEffv9eQ3MxF2UqlvBC7MHEBks5sisdRgaJpZM4PZRDl .

[athal7]

I'll see what I can do, what sort of timing are you looking at in terms of cutting the release?

[athal7]

Tracking here https://github.com/coreos/alb-ingress-controller/pull/214

[joshrosso]

We don't have a hard date yet. I'll keep you posted.

Intuition tells me trying to get a preview out end of this week and possibly cutting something the following week.

[joshrosso]

Thanks for the work btw!

[jkinkead]

It looks like this work has been picked up a couple of times - in #214 by @athal7 , and in #278 by @masterzen .

Any chance that one of those two PRs could get looked at? This is a feature we'd really like to have available.

[masterzen]

@jkinkead #214 is a work in progress that I finished in #278. FWIW We're using #278 in production for more than one month without any issues.

But yes that would be great to have the feature land in mainline :)

[r0fls]

Should this issue be closed?

[juancho85]

Hi,

I had manually associated an existing WAF with ALBs created using the ingress controller, but I've seen that those load balancers are no longer associated to the WAF after a while. I don't understand why, but I guess it has something to do with the alb-ingress-controller.

Could you please tell confirm in which version is the feature avaiable (I'm currently using 487-https-loops).

I haven't found information in the documentation on how to configure it. Is it described somewhere?

Thank you

[juancho85]

I think I have found the way to configure it from the source code

So in the annotations of the ingress you have to specify the WAF_ACL_ID:

alb.ingress.kubernetes.io/waf-acl-id: $WAF_ACL_ID

Cheers

[bigkraig]

@juancho85 Thanks for finding that, definitely a gap in the documentation