Skip to content

Commit 15691f6

Browse files
subashdsubashd
authored
Merge pull request #686 from arijitr-citrix/master
Adding WAF CRD changes
2 parents c674956 + b5d87ba commit 15691f6

File tree

5 files changed

+489
-0
lines changed

5 files changed

+489
-0
lines changed

‎crd/nsic-crds.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1808,6 +1808,28 @@ spec:
18081808
items:
18091809
type: string
18101810
description: "header name"
1811+
exclude:
1812+
description: 'To control what traffic to be excluded by Web Application Firewall. If you do not provide the exclude list, nothing will be skipped by default explicitly'
1813+
type: object
1814+
properties:
1815+
path:
1816+
type: array
1817+
description: "List of http urls to exclude"
1818+
items:
1819+
type: string
1820+
description: "URL path"
1821+
method:
1822+
type: array
1823+
description: "List of http methods to exclude"
1824+
items:
1825+
type: string
1826+
enum: ['GET', 'PUT', 'POST', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'UNKNOWN_METHOD']
1827+
header:
1828+
type: array
1829+
description: "List of http headers to exclude"
1830+
items:
1831+
type: string
1832+
description: "header name"
18111833
security_checks:
18121834
description: 'To enable/disable application firewall security checks'
18131835
type: object

‎crd/waf/waf-crd.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,28 @@ spec:
9595
items:
9696
type: string
9797
description: "header name"
98+
exclude:
99+
description: 'To control what traffic to be excluded by Web Application Firewall. If you do not provide the exclude list, nothing will be skipped by default explicitly'
100+
type: object
101+
properties:
102+
path:
103+
type: array
104+
description: "List of http urls to exclude"
105+
items:
106+
type: string
107+
description: "URL path"
108+
method:
109+
type: array
110+
description: "List of http methods to exclude"
111+
items:
112+
type: string
113+
enum: ['GET', 'PUT', 'POST', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'UNKNOWN_METHOD']
114+
header:
115+
type: array
116+
description: "List of http headers to exclude"
117+
items:
118+
type: string
119+
description: "header name"
98120
security_checks:
99121
description: 'To enable/disable application firewall security checks'
100122
type: object

‎deployment/baremetal/citrix-k8s-cpx-ingress.yml‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
kind: ClusterRole
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
metadata:
4+
name: cpx-ingress-k8s-role
5+
rules:
6+
- apiGroups: [""]
7+
resources: ["endpoints", "ingresses", "pods", "secrets", "nodes", "routes", "namespaces", "configmaps", "services"]
8+
verbs: ["get", "list", "watch"]
9+
# services/status is needed to update the loadbalancer IP in service status for integrating
10+
# service of type LoadBalancer with external-dns
11+
- apiGroups: [""]
12+
resources: ["services/status"]
13+
verbs: ["patch"]
14+
- apiGroups: [""]
15+
resources: ["events"]
16+
verbs: ["create"]
17+
- apiGroups: ["extensions"]
18+
resources: ["ingresses", "ingresses/status"]
19+
verbs: ["get", "list", "watch", "patch"]
20+
- apiGroups: ["networking.k8s.io"]
21+
resources: ["ingresses", "ingresses/status", "ingressclasses"]
22+
verbs: ["get", "list", "watch", "patch"]
23+
- apiGroups: ["apiextensions.k8s.io"]
24+
resources: ["customresourcedefinitions"]
25+
verbs: ["get", "list", "watch"]
26+
- apiGroups: ["apps"]
27+
resources: ["deployments"]
28+
verbs: ["get", "list", "watch"]
29+
- apiGroups: ["citrix.com"]
30+
resources: ["rewritepolicies", "authpolicies", "ratelimits", "listeners", "httproutes", "continuousdeployments", "apigatewaypolicies", "wafs", "bots", "wildcarddnsentries"]
31+
verbs: ["get", "list", "watch", "create", "delete", "patch"]
32+
- apiGroups: ["citrix.com"]
33+
resources: ["rewritepolicies/status", "continuousdeployments/status", "authpolicies/status", "ratelimits/status", "listeners/status", "httproutes/status", "wafs/status", "apigatewaypolicies/status", "bots/status", "wildcarddnsentries/status"]
34+
verbs: ["patch"]
35+
- apiGroups: ["citrix.com"]
36+
resources: ["vips"]
37+
verbs: ["get", "list", "watch", "create", "delete"]
38+
- apiGroups: ["route.openshift.io"]
39+
resources: ["routes"]
40+
verbs: ["get", "list", "watch"]
41+
- apiGroups: ["config.openshift.io"]
42+
resources: ["networks"]
43+
verbs: ["get", "list"]
44+
- apiGroups: ["network.openshift.io"]
45+
resources: ["hostsubnets"]
46+
verbs: ["get", "list", "watch"]
47+
- apiGroups: ["crd.projectcalico.org"]
48+
resources: ["ipamblocks"]
49+
verbs: ["get", "list", "watch"]
50+
51+
---
52+
53+
kind: ClusterRoleBinding
54+
apiVersion: rbac.authorization.k8s.io/v1
55+
metadata:
56+
name: cpx-ingress-k8s-role
57+
roleRef:
58+
apiGroup: rbac.authorization.k8s.io
59+
kind: ClusterRole
60+
name: cpx-ingress-k8s-role
61+
subjects:
62+
- kind: ServiceAccount
63+
name: cpx-ingress-k8s-role
64+
namespace: default
65+
apiVersion: rbac.authorization.k8s.io/v1
66+
67+
---
68+
69+
apiVersion: v1
70+
kind: ServiceAccount
71+
metadata:
72+
name: cpx-ingress-k8s-role
73+
namespace: default
74+
75+
---
76+
77+
apiVersion: apps/v1
78+
kind: Deployment
79+
metadata:
80+
name: cpx-ingress
81+
labels:
82+
name: cpx-ingress
83+
app: cpx-ingress
84+
spec:
85+
selector:
86+
matchLabels:
87+
app: cpx-ingress
88+
replicas: 1
89+
template:
90+
metadata:
91+
name: cpx-ingress
92+
labels:
93+
app: cpx-ingress
94+
annotations: null
95+
spec:
96+
serviceAccountName: cpx-ingress-k8s-role
97+
containers:
98+
- name: cpx-ingress
99+
image: quay.io/netscaler/netscaler-cpx:14.1-38.53
100+
tty: true
101+
securityContext:
102+
privileged: true
103+
env:
104+
- name: "EULA"
105+
value: "yes"
106+
- name: "KUBERNETES_TASK_ID"
107+
value: ""
108+
imagePullPolicy: Always
109+
volumeMounts:
110+
- mountPath: /var/deviceinfo
111+
name: shared-data
112+
- mountPath: /cpx/
113+
name: cpx-volume
114+
- mountPath: /cpx/conf
115+
name: cpx-volume-conf
116+
# Add cic as a sidecar
117+
- name: cic
118+
image: quay.io/netscaler/netscaler-k8s-ingress-controller:3.1.34
119+
volumeMounts:
120+
- mountPath: /var/deviceinfo
121+
name: shared-data
122+
args:
123+
- --ingress-classes
124+
citrix
125+
env:
126+
- name: "EULA"
127+
value: "yes"
128+
- name: "NS_IP"
129+
value: "127.0.0.1"
130+
- name: "NS_PROTOCOL"
131+
value: "HTTP"
132+
- name: "NS_PORT"
133+
value: "80"
134+
- name: "NS_DEPLOYMENT_MODE"
135+
value: "SIDECAR"
136+
- name: "NS_ENABLE_MONITORING"
137+
value: "YES"
138+
- name: "LOGLEVEL"
139+
value: "INFO"
140+
- name: POD_NAME
141+
valueFrom:
142+
fieldRef:
143+
apiVersion: v1
144+
fieldPath: metadata.name
145+
- name: POD_NAMESPACE
146+
valueFrom:
147+
fieldRef:
148+
apiVersion: v1
149+
fieldPath: metadata.namespace
150+
imagePullPolicy: Always
151+
volumes:
152+
- name: shared-data
153+
emptyDir: {}
154+
- name: cpx-volume
155+
emptyDir: {}
156+
- name: cpx-volume-conf
157+
emptyDir: {}
158+
---
159+
160+
apiVersion: v1
161+
kind: Service
162+
metadata:
163+
name: cpx-service
164+
labels:
165+
app: cpx-service
166+
spec:
167+
type: NodePort
168+
ports:
169+
- port: 80
170+
protocol: TCP
171+
name: http
172+
- port: 443
173+
protocol: TCP
174+
name: https
175+
selector:
176+
app: cpx-ingress

‎docs/configure/cpx-bgp-router/citrix-k8s-cpx-ingress.yml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
annotations:
5+
name: cpx-ingress
6+
namespace: default
7+
spec:
8+
selector:
9+
matchLabels:
10+
app: cpx-ingress
11+
template:
12+
metadata:
13+
labels:
14+
app: cpx-ingress
15+
name: cpx-ingress
16+
spec:
17+
containers:
18+
- env:
19+
- name: EULA
20+
value: "yes"
21+
- name: NS_NETMODE
22+
value: HOST
23+
- name: KUBERNETES_TASK_ID
24+
valueFrom:
25+
fieldRef:
26+
apiVersion: v1
27+
fieldPath: metadata.name
28+
image: quay.io/netscaler/netscaler-cpx:14.1-38.53
29+
imagePullPolicy: Always
30+
name: cpx-ingress
31+
resources: {}
32+
securityContext:
33+
allowPrivilegeEscalation: true
34+
capabilities:
35+
add:
36+
- NET_ADMIN
37+
privileged: true
38+
terminationMessagePath: /dev/termination-log
39+
terminationMessagePolicy: File
40+
volumeMounts:
41+
- mountPath: /cpx/conf/
42+
name: cpx-volume1
43+
- mountPath: /cpx/crash/
44+
name: cpx-volume2
45+
- mountPath: /var/deviceinfo
46+
name: shared-data
47+
# add Netscaler ingress controller as sidecar to CPX
48+
- name: cic
49+
args:
50+
#- --configmap default/config
51+
#- --ipam citrix-ipam-controller
52+
- --deployment-type kube-bgp-router
53+
securityContext:
54+
runAsUser: 0
55+
capabilities:
56+
add:
57+
- NET_ADMIN
58+
env:
59+
- name: EULA
60+
value: "yes"
61+
- name: NS_IP
62+
value: 192.168.1.2
63+
- name: NS_PROTOCOL
64+
value: HTTPS
65+
- name: NS_PORT
66+
value: "9443"
67+
- name: NS_DEPLOYMENT_MODE
68+
value: SIDECAR
69+
- name: NS_ENABLE_MONITORING
70+
value: "YES"
71+
# This is IP used for ingress resources
72+
# - name: NS_VIP
73+
# value: x.x.x.x
74+
- name: LOGLEVEL
75+
value: "INFO"
76+
- name: NODE_NAME
77+
valueFrom:
78+
fieldRef:
79+
apiVersion: v1
80+
fieldPath: spec.nodeName
81+
- name: POD_NAME
82+
valueFrom:
83+
fieldRef:
84+
apiVersion: v1
85+
fieldPath: metadata.name
86+
- name: POD_NAMESPACE
87+
valueFrom:
88+
fieldRef:
89+
apiVersion: v1
90+
fieldPath: metadata.namespace
91+
image: "quay.io/netscaler/netscaler-k8s-ingress-controller:3.1.34"
92+
imagePullPolicy: Always
93+
terminationMessagePath: /dev/termination-log
94+
terminationMessagePolicy: File
95+
volumeMounts:
96+
- mountPath: /var/deviceinfo
97+
name: shared-data
98+
hostNetwork: true
99+
nodeSelector:
100+
beta.kubernetes.io/os: linux
101+
restartPolicy: Always
102+
securityContext: {}
103+
serviceAccount: cpx-ingress-k8s-role
104+
serviceAccountName: cpx-ingress-k8s-role
105+
terminationGracePeriodSeconds: 30
106+
volumes:
107+
- emptyDir: {}
108+
name: cpx-volume1
109+
- emptyDir: {}
110+
name: cpx-volume2
111+
- emptyDir: {}
112+
name: shared-data

0 commit comments

Comments
 (0)