Skip to content

Commit b02d9d9

Browse files
author
Rafal Wegrzycki
committed
support for App Protect UDS
1 parent c222e3a commit b02d9d9

29 files changed

+3093
-171
lines changed

‎build/appprotect/DockerfileWithAppProtectForPlus

+16-15
Original file line numberDiff line numberDiff line change
@@ -75,21 +75,23 @@ RUN ln -sf /proc/1/fd/1 /var/log/nginx/access.log \
7575
&& ln -sf /proc/1/fd/2 /var/log/nginx/error.log
7676

7777
RUN mkdir -p /var/lib/nginx \
78-
/etc/nginx/stream-conf.d \
79-
/etc/nginx/secrets \
80-
/etc/nginx/waf \
81-
/etc/nginx/waf/nac-policies \
82-
/etc/nginx/waf/nac-logconfs \
83-
/var/log/app_protect \
84-
/opt/app_protect \
78+
/etc/nginx/stream-conf.d \
79+
/etc/nginx/secrets \
80+
/etc/nginx/waf \
81+
/etc/nginx/waf/nac-policies \
82+
/etc/nginx/waf/nac-logconfs \
83+
/etc/nginx/waf/nac-usersigs \
84+
/var/log/app_protect \
85+
/opt/app_protect \
86+
&& touch /etc/nginx/waf/nac-usersigs/index.conf \
8587
&& chown -R nginx:0 /etc/app_protect \
86-
/usr/share/ts \
87-
/etc/nginx \
88-
/var/cache/nginx \
89-
/var/lib/nginx/ \
90-
/var/log/app_protect/ \
91-
/opt/app_protect/ \
92-
/var/log/nginx/ \
88+
/usr/share/ts \
89+
/etc/nginx \
90+
/var/cache/nginx \
91+
/var/lib/nginx/ \
92+
/var/log/app_protect/ \
93+
/opt/app_protect/ \
94+
/var/log/nginx/ \
9395
&& apt-get remove --purge -y libcap2-bin \
9496
&& rm /etc/nginx/conf.d/*
9597

@@ -128,7 +130,6 @@ ENTRYPOINT ["/nginx-ingress"]
128130
FROM base AS local
129131
COPY nginx-ingress /
130132

131-
132133
FROM $GOLANG_CONTAINER AS builder
133134
ARG VERSION
134135
ARG GIT_COMMIT

‎build/appprotect/DockerfileWithAppProtectForPlusForOpenShift

+16-14
Original file line numberDiff line numberDiff line change
@@ -75,21 +75,23 @@ RUN ln -sf /proc/1/fd/1 /var/log/nginx/access.log \
7575
&& ln -sf /proc/1/fd/2 /var/log/nginx/error.log
7676

7777
RUN mkdir -p /var/lib/nginx \
78-
/etc/nginx/stream-conf.d \
79-
/etc/nginx/secrets \
80-
/etc/nginx/waf \
81-
/etc/nginx/waf/nac-policies \
82-
/etc/nginx/waf/nac-logconfs \
83-
/var/log/app_protect \
84-
/opt/app_protect \
78+
/etc/nginx/stream-conf.d \
79+
/etc/nginx/secrets \
80+
/etc/nginx/waf \
81+
/etc/nginx/waf/nac-policies \
82+
/etc/nginx/waf/nac-logconfs \
83+
/etc/nginx/waf/nac-usersigs \
84+
/var/log/app_protect \
85+
/opt/app_protect \
86+
&& touch /etc/nginx/waf/nac-usersigs/index.conf \
8587
&& chown -R nginx:0 /etc/app_protect \
86-
/usr/share/ts \
87-
/etc/nginx \
88-
/var/cache/nginx \
89-
/var/lib/nginx/ \
90-
/var/log/app_protect/ \
91-
/opt/app_protect/ \
92-
/var/log/nginx/ \
88+
/usr/share/ts \
89+
/etc/nginx \
90+
/var/cache/nginx \
91+
/var/lib/nginx/ \
92+
/var/log/app_protect/ \
93+
/opt/app_protect/ \
94+
/var/log/nginx/ \
9395
&& rm /etc/nginx/conf.d/*
9496

9597
RUN printf "MODULE = ALL;\nLOG_LEVEL = TS_CRIT;\nFILE = 2;\n" > /etc/app_protect/bd/logger.cfg \

‎deployments/common/crds-v1beta1/appprotect.f5.com_apusersigs.yaml

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
apiVersion: apiextensions.k8s.io/v1beta1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
controller-gen.kubebuilder.io/version: v0.4.0
6+
creationTimestamp: null
7+
name: apusersigs.appprotect.f5.com
8+
spec:
9+
group: appprotect.f5.com
10+
names:
11+
kind: APUserSig
12+
listKind: APUserSigList
13+
plural: apusersigs
14+
singular: apusersig
15+
preserveUnknownFields: false
16+
scope: Namespaced
17+
validation:
18+
openAPIV3Schema:
19+
description: APUserSig is the Schema for the apusersigs API
20+
properties:
21+
apiVersion:
22+
description: 'APIVersion defines the versioned schema of this representation
23+
of an object. Servers should convert recognized schemas to the latest
24+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
25+
type: string
26+
kind:
27+
description: 'Kind is a string value representing the REST resource this
28+
object represents. Servers may infer this from the endpoint the client
29+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
30+
type: string
31+
metadata:
32+
type: object
33+
spec:
34+
description: APUserSigSpec defines the desired state of APUserSig
35+
properties:
36+
properties:
37+
type: string
38+
revisionDatetime:
39+
format: date-time
40+
type: string
41+
signatures:
42+
items:
43+
properties:
44+
accuracy:
45+
enum:
46+
- high
47+
- medium
48+
- low
49+
type: string
50+
attackType:
51+
properties:
52+
name:
53+
type: string
54+
type: object
55+
description:
56+
type: string
57+
name:
58+
type: string
59+
references:
60+
properties:
61+
type:
62+
enum:
63+
- bugtraq
64+
- cve
65+
- nessus
66+
- url
67+
type: string
68+
value:
69+
type: string
70+
type: object
71+
risk:
72+
enum:
73+
- high
74+
- medium
75+
- low
76+
type: string
77+
rule:
78+
type: string
79+
signatureType:
80+
enum:
81+
- request
82+
- response
83+
type: string
84+
systems:
85+
items:
86+
properties:
87+
name:
88+
type: string
89+
type: object
90+
type: array
91+
type: object
92+
type: array
93+
tag:
94+
type: string
95+
type: object
96+
type: object
97+
version: v1beta1
98+
versions:
99+
- name: v1beta1
100+
served: true
101+
storage: true

‎deployments/common/crds/appprotect.f5.com_apusersigs.yaml

+100
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
controller-gen.kubebuilder.io/version: v0.4.0
6+
creationTimestamp: null
7+
name: apusersigs.appprotect.f5.com
8+
spec:
9+
group: appprotect.f5.com
10+
names:
11+
kind: APUserSig
12+
listKind: APUserSigList
13+
plural: apusersigs
14+
singular: apusersig
15+
preserveUnknownFields: false
16+
scope: Namespaced
17+
versions:
18+
- name: v1beta1
19+
schema:
20+
openAPIV3Schema:
21+
description: APUserSig is the Schema for the apusersigs API
22+
properties:
23+
apiVersion:
24+
description: 'APIVersion defines the versioned schema of this representation
25+
of an object. Servers should convert recognized schemas to the latest
26+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
27+
type: string
28+
kind:
29+
description: 'Kind is a string value representing the REST resource this
30+
object represents. Servers may infer this from the endpoint the client
31+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
32+
type: string
33+
metadata:
34+
type: object
35+
spec:
36+
description: APUserSigSpec defines the desired state of APUserSig
37+
properties:
38+
properties:
39+
type: string
40+
revisionDatetime:
41+
format: date-time
42+
type: string
43+
signatures:
44+
items:
45+
properties:
46+
accuracy:
47+
enum:
48+
- high
49+
- medium
50+
- low
51+
type: string
52+
attackType:
53+
properties:
54+
name:
55+
type: string
56+
type: object
57+
description:
58+
type: string
59+
name:
60+
type: string
61+
references:
62+
properties:
63+
type:
64+
enum:
65+
- bugtraq
66+
- cve
67+
- nessus
68+
- url
69+
type: string
70+
value:
71+
type: string
72+
type: object
73+
risk:
74+
enum:
75+
- high
76+
- medium
77+
- low
78+
type: string
79+
rule:
80+
type: string
81+
signatureType:
82+
enum:
83+
- request
84+
- response
85+
type: string
86+
systems:
87+
items:
88+
properties:
89+
name:
90+
type: string
91+
type: object
92+
type: array
93+
type: object
94+
type: array
95+
tag:
96+
type: string
97+
type: object
98+
type: object
99+
served: true
100+
storage: true

‎deployments/helm-chart/crds/appprotect.f5.com_apusersigs.yaml

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
apiVersion: apiextensions.k8s.io/v1beta1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
controller-gen.kubebuilder.io/version: v0.4.0
6+
creationTimestamp: null
7+
name: apusersigs.appprotect.f5.com
8+
spec:
9+
group: appprotect.f5.com
10+
names:
11+
kind: APUserSig
12+
listKind: APUserSigList
13+
plural: apusersigs
14+
singular: apusersig
15+
preserveUnknownFields: false
16+
scope: Namespaced
17+
validation:
18+
openAPIV3Schema:
19+
description: APUserSig is the Schema for the apusersigs API
20+
properties:
21+
apiVersion:
22+
description: 'APIVersion defines the versioned schema of this representation
23+
of an object. Servers should convert recognized schemas to the latest
24+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
25+
type: string
26+
kind:
27+
description: 'Kind is a string value representing the REST resource this
28+
object represents. Servers may infer this from the endpoint the client
29+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
30+
type: string
31+
metadata:
32+
type: object
33+
spec:
34+
description: APUserSigSpec defines the desired state of APUserSig
35+
properties:
36+
properties:
37+
type: string
38+
revisionDatetime:
39+
format: date-time
40+
type: string
41+
signatures:
42+
items:
43+
properties:
44+
accuracy:
45+
enum:
46+
- high
47+
- medium
48+
- low
49+
type: string
50+
attackType:
51+
properties:
52+
name:
53+
type: string
54+
type: object
55+
description:
56+
type: string
57+
name:
58+
type: string
59+
references:
60+
properties:
61+
type:
62+
enum:
63+
- bugtraq
64+
- cve
65+
- nessus
66+
- url
67+
type: string
68+
value:
69+
type: string
70+
type: object
71+
risk:
72+
enum:
73+
- high
74+
- medium
75+
- low
76+
type: string
77+
rule:
78+
type: string
79+
signatureType:
80+
enum:
81+
- request
82+
- response
83+
type: string
84+
systems:
85+
items:
86+
properties:
87+
name:
88+
type: string
89+
type: object
90+
type: array
91+
type: object
92+
type: array
93+
tag:
94+
type: string
95+
type: object
96+
type: object
97+
version: v1beta1
98+
versions:
99+
- name: v1beta1
100+
served: true
101+
storage: true

‎deployments/helm-chart/templates/rbac.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ rules:
1212
resources:
1313
- appolicies
1414
- aplogconfs
15+
- apusersigs
1516
verbs:
1617
- get
1718
- watch

0 commit comments

Comments
 (0)