summaryrefslogtreecommitdiffstats
path: root/samples/scenarios/modsecurity_all_in_one.yaml
blob: aa92b13bc5070f34f220cbf673c4a0fdc8c090e5 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: modsecurity-crs
  namespace: clover-gateway
spec:
  replicas: 1
  selector:
    matchLabels:
      app: modsecurity-crs
  template:
    metadata:
      labels:
        app: modsecurity-crs
    spec:
      containers:
        - name: modsecurity-crs
          image: clover/clover-ns-modsecurity-crs
          ports:
            - containerPort: 80
          env:
            - name: PARANOIA
              value: '1'
---
apiVersion: v1
kind: Service
metadata:
  name: modsecurity-crs
  namespace: clover-gateway
spec:
  type: NodePort
  ports:
  - port: 80
    name: http-modsecurity-crs
    protocol: TCP
    targetPort: 80
  selector:
    app: modsecurity-crs
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ext-authz
  namespace: clover-gateway
spec:
  workloadLabels:
    app: istio-ingressgateway
  filters:
  - insertPosition:
      index: FIRST
    listenerMatch:
      portNumber: 80
      listenerType: GATEWAY
      listenerProtocol: HTTP
    filterType: HTTP
    filterName: "envoy.ext_authz"
    filterConfig:
      http_service:
        server_uri:
          uri: "http://modsecurity-crs.clover-gateway.svc.cluster.local"
          cluster: "outbound|80||modsecurity-crs.clover-gateway.svc.cluster.local"
          timeout: 0.5s
      failure_mode_allow: false
---