Update OWASP CRS to 4.4.0 about ingress-nginx HOT 3 CLOSED

oh, this plugin thing is not 100% info. As in the impact on controller and managing expectations related to it.

cc @tao12345666333 seek comments because there is a PR now to bump OWASP which introduces previsously non0-existing feature of plugins for rulesets

from ingress-nginx.

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

from ingress-nginx.

It may also be worth noting that 4.x introduces the concept of plugins to the CRS:

Plugins are not part of the CRS 3.3.x release line. They are released officially with CRS 4.0.

• https://coreruleset.org/docs/concepts/plugins/

Perhaps in a future PR, it makes sense to take the plugin configs as ConfigMaps or Secrets to be templated out as volumeMounts that are present in /etc/nginx/owasp-modsecurity-crs/crs/plugins/. This is mostly useful when a user is running something with a large (or small but very serious) attack vector such as Nextcloud, which OWASP provides this plugin for: https://github.com/coreruleset/nextcloud-rule-exclusions-plugin

Getting the CRS updated to 4.4.0 is my first priority though.

from ingress-nginx.