@@ -35,12 +35,13 @@ Store these files locally:
35
35
└── nginx-repo.jwt
36
36
```
37
37
38
+
38
39
## Step 2: Pull the NGINX App Protect WAF Compiler image
39
40
40
41
Log into the nginx private registry using your jwt file and the password ` none ` which you will have to type in when
41
42
asked:
42
43
43
- ``` bash
44
+ ``` shell
44
45
$ docker login private-registry.nginx.com --username=$( cat nginx-repo.jwt)
45
46
46
47
i Info → A Personal Access Token (PAT) can be used instead.
@@ -53,7 +54,7 @@ Login Succeeded
53
54
54
55
Once that's done, pull the ` waf-compiler ` image with:
55
56
56
- ``` bash
57
+ ``` shell
57
58
$ docker pull private-registry.nginx.com/nap/waf-compiler:5.6.0
58
59
```
59
60
@@ -63,13 +64,13 @@ $ docker pull private-registry.nginx.com/nap/waf-compiler:5.6.0
63
64
64
65
Download the [ provided WAF Policy JSON] ( https://raw.githubusercontent.com/nginx/kubernetes-ingress/main/tests/data/ap-waf-v5/wafv5.json ) :
65
66
66
- ``` bash
67
+ ``` shell
67
68
curl -LO https://raw.githubusercontent.com/nginx/kubernetes-ingress/main/tests/data/ap-waf-v5/wafv5.json
68
69
```
69
70
70
71
Use your pulled NAP Docker image (` private-registry.nginx.com/nap/waf-compiler:5.6.0 ` ) to compile the policy bundle:
71
72
72
- ``` bash
73
+ ``` shell
73
74
# Using your newly created image
74
75
docker run --rm \
75
76
-v $( pwd) :$( pwd) \
@@ -127,13 +128,13 @@ spec:
127
128
This sets up a 1Gi disk and attaches a claim to it that you will reference in the NIC deployment chart.
128
129
129
130
Create these with:
130
- ` ` ` bash
131
+ ` ` ` shell
131
132
kubectl apply -f pvc.yaml
132
133
```
133
134
134
135
Verify that the persistent volume and claim are created:
135
136
136
- ``` bash
137
+ ``` shell
137
138
# For the persistent volume
138
139
kubectl get pv
139
140
@@ -144,13 +145,13 @@ kubectl get pvc
144
145
## Step 5: Deploy NGINX Plus NIC Controller with NAP Enabled using Helm
145
146
146
147
Add the official NGINX Helm repository:
147
- ``` bash
148
+ ``` shell
148
149
helm repo add nginx-stable https://helm.nginx.com/stable
149
150
helm repo update
150
151
```
151
152
152
153
Create Kubernetes Docker and licensing secrets:
153
- ``` bash
154
+ ``` shell
154
155
kubectl create secret \
155
156
docker-registry regcred \
156
157
--docker-server=private-registry.nginx.com \
@@ -165,13 +166,13 @@ kubectl create secret \
165
166
166
167
Install the required CRDs for NGINX Ingress Controller:
167
168
168
- ``` bash
169
+ ``` shell
169
170
kubectl apply -f https://raw.githubusercontent.com/nginx/kubernetes-ingress/v5.0.0/deploy/crds.yaml
170
171
```
171
172
172
173
Using helm, install NGINX Ingress Controller
173
174
174
- ``` bash
175
+ ``` shell
175
176
helm upgrade nic nginx-stable/nginx-ingress \
176
177
--set controller.image.repository=" private-registry.nginx.com/nginx-ic-nap-v5/nginx-plus-ingress" \
177
178
--set controller.image.tag=" 5.0.0-alpine-fips" \
@@ -186,7 +187,7 @@ helm upgrade nic nginx-stable/nginx-ingress \
186
187
```
187
188
188
189
Verify deployment success:
189
- ``` bash
190
+ ``` shell
190
191
kubectl get pods
191
192
```
192
193
@@ -198,23 +199,23 @@ Get the name of the pod from the `kubectl get pods` command above.
198
199
199
200
Copy the file into the ` nginx-ingress ` container within the pod:
200
201
201
- ``` bash
202
+ ``` shell
202
203
kubectl cp ./compiled_policy.tgz \
203
204
< pod name> :/etc/app_protect/bundles/compiled_policy.tgz \
204
205
-c nginx-ingress
205
206
```
206
207
207
208
Replace ` <pod name> ` with the actual name of the pod, for example:
208
209
209
- ``` bash
210
+ ``` shell
210
211
kubectl cp ./compiled_policy.tgz \
211
212
nic-nginx-ingress-controller-9bd89589d-j925h:/etc/app_protect/bundles/compiled_policy.tgz \
212
213
-c nginx-ingress
213
214
```
214
215
215
216
Confirm that the policy file is in the pod. The following command should list ` compiled_policy.tgz ` .
216
217
217
- ``` bash
218
+ ``` shell
218
219
kubectl exec --stdin --tty \
219
220
-c nginx-ingress \
220
221
< pod name> \
@@ -290,13 +291,13 @@ spec:
290
291
291
292
Find out what they are with this:
292
293
293
- ` ` ` bash
294
+ ` ` ` shell
294
295
kubectl get svc
295
296
```
296
297
Take note of the external IP of the ` nic-nginx-ingress-controller ` service and the port. Save them in the following
297
298
environment variables:
298
299
299
- ``` bash
300
+ ``` shell
300
301
IC_IP=XXX.YYY.ZZZ.III
301
302
IC_HTTP_PORT=< port number>
302
303
```
@@ -305,7 +306,7 @@ IC_HTTP_PORT=<port number>
305
306
306
307
Send a valid request to the deployed application:
307
308
308
- ``` bash
309
+ ``` shell
309
310
curl --resolve webapp.example.com:$IC_HTTP_PORT :$IC_IP http://webapp.example.com:$IC_HTTP_PORT /
310
311
```
311
312
@@ -319,7 +320,7 @@ Request ID: 4f378a01fb8a36ae27e2c3059d264527
319
320
320
321
And send one that should be rejected
321
322
322
- ``` bash
323
+ ``` shell
323
324
curl --resolve webapp.example.com:$IC_HTTP_PORT :$IC_IP " http://webapp.example.com:$IC_HTTP_PORT /<script>"
324
325
```
325
326
0 commit comments