Closed heungh closed 2 years ago
@heungh, can you confirm you use WAF v2? If so, do you mind sharing your controller logs?
For WAFv2 you need to specify the acl arn via the following ingress annotation
alb.ingress.kubernetes.io/wafv2-acl-arn
Q2: You should be able share single ACL with multiple ALBs.
Q3: Ingress annotation is the only way for ALB
Q4: It depends whether you need cloudfront functionality. You could check from the following link https://aws.amazon.com/cloudfront/features/?whats-new-cloudfront.sort-by=item.additionalFields.postDateTime&whats-new-cloudfront.sort-order=desc. We are not able to provide further details without a clear understanding of the requirements.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
lifecycle/stale
is appliedlifecycle/stale
was applied, lifecycle/rotten
is appliedlifecycle/rotten
was applied, the issue is closedYou can:
/remove-lifecycle stale
/lifecycle rotten
/close
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
lifecycle/stale
is appliedlifecycle/stale
was applied, lifecycle/rotten
is appliedlifecycle/rotten
was applied, the issue is closedYou can:
/remove-lifecycle rotten
/close
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
lifecycle/stale
is appliedlifecycle/stale
was applied, lifecycle/rotten
is appliedlifecycle/rotten
was applied, the issue is closedYou can:
/reopen
/remove-lifecycle rotten
Please send feedback to sig-contributor-experience at kubernetes/community.
/close
@k8s-triage-robot: Closing this issue.
Hello.
I'm using EKS's cluster by uploading three. Each cluster exposes a front web page using an Application Load Balancer. We decided to introduce AWS WAF according to the company's security policy, and we plan to use it with ALB. I configured the AWS reference with the link below. How do I create an ALB Ingress in Amazon EKS and associate the ALB Ingress with AWS WAF?
Q1. AWS WAF WebACL was created, and three ALBs corresponding to Associated AWS resources were selected. It seemed to go well in the initial setup, but I don't know the exact time, but in about 30 minutes, the corresponding ALB disappeared from the Associated AWS resources item. Why? It can be seen that the corresponding waf-id is also entered in the EKS Ingress.
Q2. Looking through the guide documentation, I found these phrases. How do you interpret it correctly? Can you please tell me whether one ALB per WebACL or 3 ALBs per WebACL is allowed? https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.html As stated in the documentation: 'You can associate each AWS resource with only one web ACL. The relationship between web ACL and AWS resources is one-to-many.'
Q3. Is there any part to add waf-id other than annotation in EKS Ingress?
Q4. From an architecture point of view, is it good to use WAF with EKS ALB or is it better to use WAF after connecting EKS ALB to CloudFront? I would like to give you opinions from various aspects such as security issues, network speed, etc.