Ingress-nginx: Add annotation enable-modsecurity = [true|false]

Created on 8 Feb 2018 · 2Comments · Source: kubernetes/ingress-nginx

Is this a BUG REPORT or FEATURE REQUEST? (choose one):
FEATURE REQUEST

NGINX Ingress controller version: 10.0.2

Add annotation enable-modsecurity with possible values of either true or false

Source

kolima

Most helpful comment

Hmm, i'm not sure about this as there is much more to modsecurity that "true" or "false".
For example;

Should on just mean SecAuditLog?
Should on mean SecAuditLog AND SecRuleEngine?
Where should modsec write its logs?

Theres far too many configuration options for modsecurity to start putting in individual annotations, when all of them can be controller with a simple configuration snippet on the ingress in question:

    nginx.ingress.kubernetes.io/configuration-snippet: |
      modsecurity_rules '
        SecRuleEngine DetectionOnly
        SecAuditEngine RelevantOnly
      ';

For a full list of the wide range of configuration options check this page

Stono on 10 Feb 2018

👍2

All 2 comments

Hmm, i'm not sure about this as there is much more to modsecurity that "true" or "false".
For example;

Should on just mean SecAuditLog?
Should on mean SecAuditLog AND SecRuleEngine?
Where should modsec write its logs?

    nginx.ingress.kubernetes.io/configuration-snippet: |
      modsecurity_rules '
        SecRuleEngine DetectionOnly
        SecAuditEngine RelevantOnly
      ';

For a full list of the wide range of configuration options check this page

Stono on 10 Feb 2018

👍2

Closing. As @Stono mentioned you can do this kind of customizations using the configuration-snippet annotation.
Please keep in mind we cannot add annotations for all the possible configuration options