search

kubernetes-sigs / aws-load-balancer-controller

A Kubernetes controller for Elastic Load Balancers
https://kubernetes-sigs.github.io/aws-load-balancer-controller/
Apache License 2.0
3.93k stars 1.46k forks source link

[WAF] AWS resources disassociated issue of ALB ingress. #2219

Closed heungh closed 2 years ago

heungh commented 3 years ago

Hello.

I'm using EKS's cluster by uploading three. Each cluster exposes a front web page using an Application Load Balancer. We decided to introduce AWS WAF according to the company's security policy, and we plan to use it with ALB. I configured the AWS reference with the link below. How do I create an ALB Ingress in Amazon EKS and associate the ALB Ingress with AWS WAF?

Q1. AWS WAF WebACL was created, and three ALBs corresponding to Associated AWS resources were selected. It seemed to go well in the initial setup, but I don't know the exact time, but in about 30 minutes, the corresponding ALB disappeared from the Associated AWS resources item. Why? It can be seen that the corresponding waf-id is also entered in the EKS Ingress.

Q2. Looking through the guide documentation, I found these phrases. How do you interpret it correctly? Can you please tell me whether one ALB per WebACL or 3 ALBs per WebACL is allowed? https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.html As stated in the documentation: 'You can associate each AWS resource with only one web ACL. The relationship between web ACL and AWS resources is one-to-many.'

Q3. Is there any part to add waf-id other than annotation in EKS Ingress?

Q4. From an architecture point of view, is it good to use WAF with EKS ALB or is it better to use WAF after connecting EKS ALB to CloudFront? I would like to give you opinions from various aspects such as security issues, network speed, etc.

kishorj commented 3 years ago

@heungh, can you confirm you use WAF v2? If so, do you mind sharing your controller logs?

For WAFv2 you need to specify the acl arn via the following ingress annotation 

alb.ingress.kubernetes.io/wafv2-acl-arn

Q2: You should be able share single ACL with multiple ALBs.

Q3: Ingress annotation is the only way for ALB

Q4: It depends whether you need cloudfront functionality. You could check from the following link https://aws.amazon.com/cloudfront/features/?whats-new-cloudfront.sort-by=item.additionalFields.postDateTime&whats-new-cloudfront.sort-order=desc. We are not able to provide further details without a clear understanding of the requirements.

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

k8s-ci-robot commented 2 years ago

@k8s-triage-robot: Closing this issue.

In response to [this](https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2219#issuecomment-1030712702): >The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. > >This bot triages issues and PRs according to the following rules: >- After 90d of inactivity, `lifecycle/stale` is applied >- After 30d of inactivity since `lifecycle/stale` was applied, `lifecycle/rotten` is applied >- After 30d of inactivity since `lifecycle/rotten` was applied, the issue is closed > >You can: >- Reopen this issue or PR with `/reopen` >- Mark this issue or PR as fresh with `/remove-lifecycle rotten` >- Offer to help out with [Issue Triage][1] > >Please send feedback to sig-contributor-experience at [kubernetes/community](https://github.com/kubernetes/community). > >/close > >[1]: https://www.kubernetes.dev/docs/guide/issue-triage/ Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.