This chart bootstraps wallarm-ingress deployment on a Kubernetes cluster using the Helm package manager.

Wallarm WAF Ingress controller (wallarm-ingress) is the distribution of the Wallarm WAF node based on the community supported NGINX Ingress controller version 0.26.2. Wallarm Ingress Controller allows you to use Wallarm WAF node to protect web services that are running in the Kubernetes cluster.

• Kubernetes platform version 1.20 and lower
• Helm package manager

To deploy the Wallarm WAF Ingress controller with default values.yaml:

1. Create the WAF node with the Cloud type in the Wallarm Console.

2. Clone this repository by using the command:

   git clone https://github.com/wallarm/ingress-chart --branch stable/3.4 --single-branch
   

3. Install the Wallarm WAF Ingress controller chart by using the command:

   helm install --set controller.wallarm.enabled=true,controller.wallarm.token=<YOUR_CLOUD_NODE_TOKEN>,controller.wallarm.apiHost=api.wallarm.com <INGRESS_CONTROLLER_NAME> ingress-chart/wallarm-ingress -n <KUBERNETES_NAMESPACE>
   

   • <YOUR_CLOUD_NODE_TOKEN> is the cloud WAF node token
   • <INGRESS_CONTROLLER_NAME> is the name for the Wallarm Ingress controller
   • <KUBERNETES_NAMESPACE> is the namespace of your Ingress
   • controller.wallarm.apiHost can be api.wallarm.com for the EU Wallarm Cloud or us1.api.wallarm.com for the US Wallarm Cloud

4. Enable traffic analysis by using the command:

   kubectl annotate ingress <YOUR_INGRESS_NAME> nginx.ingress.kubernetes.io/wallarm-mode=monitoring
   

Alternatively, you can provide a values.yaml file that specifies the values for the parameters while installing the chart. The set of values.yaml paramaters is described in the next section. For example:

helm install my-release wallarm/wallarm-ingress -f values.yaml

You will find more details on the Wallarm WAF Ingress controller deployment in our official documentation.

The following table lists the configurable parameters of the wallarm-ingress chart and their default values.

A useful trick to debug issues with ingress is to increase the logLevel as described here

helm install wallarm/wallarm-ingress --set controller.extraArgs.v=2

Note that the PodDisruptionBudget resource will only be defined if the replicaCount is greater than one, else it would make it impossible to evacuate a node. See gh issue #7127 for more info.

The Nginx ingress controller can export Prometheus metrics.

Helm v2

$ helm install wallarm/wallarm-ingress --name my-release \
    --set controller.stats.enabled=true \
    --set controller.metrics.enabled=true \
    --set controller.wallarm.metrics.enabled=true

Helm v3

$ helm install wallarm/wallarm-ingress my-release \
    --set controller.stats.enabled=true \
    --set controller.metrics.enabled=true \
    --set controller.wallarm.metrics.enabled=true

You can add Prometheus annotations to the metrics service using controller.metrics.service.annotations. Alternatively, if you use the Prometheus Operator, you can enable ServiceMonitor creation using controller.metrics.serviceMonitor.enabled.

Previous versions of this chart had a controller.stats.* configuration block, which is now obsolete due to the following changes in nginx ingress controller:

• in 0.16.1, the vts (virtual host traffic status) dashboard was removed
• in 0.23.0, the status page at port 18080 is now a unix socket webserver only available at localhost. You can use curl --unix-socket /tmp/nginx-status-server.sock http://localhost/nginx_status inside the controller container to access it locally, or use the snippet from nginx-ingress changelog to re-enable the http server

Add an ExternalDNS annotation to the LoadBalancer service:

controller:
  service:
    annotations:
      external-dns.alpha.kubernetes.io/hostname: kubernetes-example.com.

Annotate the controller as shown in the nginx-ingress l7 patch:

controller:
  service:
    targetPorts:
      http: http
      https: http
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:XX-XXXX-X:XXXXXXXXX:certificate/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
      service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600'

To configure the LoadBalancer service with the route53-mapper addon, add the domainName annotation and dns label:

controller:
  service:
    labels:
      dns: "route53"
    annotations:
      domainName: "kubernetes-example.com"

With nginx-ingress-controller version 0.25+, the nginx ingress controller pod exposes an endpoint that will integrate with the validatingwebhookconfiguration Kubernetes feature to prevent bad ingress from being added to the cluster.

With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fix this issue

If you are upgrading this chart from a version between 0.31.0 and 1.2.2 then you may get an error like this:

Error: UPGRADE FAILED: Service "?????-controller" is invalid: spec.clusterIP: Invalid value: "": field is immutable

Detail of how and why are in this issue but to resolve this you can set xxxx.service.omitClusterIP to true where xxxx is the service referenced in the error.

As of version 1.26.0 of this chart, by simply not providing any clusterIP value, invalid: spec.clusterIP: Invalid value: "": field is immutable will no longer occur since clusterIP: "" will not be rendered.