Jeffrey
dcb127e9e8
Detection is CAPI community blocklists plus AppSec inline WAF, not Envoy
access-log parsing. Enforcement is gRPC ext_authz from Envoy Gateway.
Changes from the draft that was held:
Agent disabled rather than given an empty acquisition list. Chart 0.24.0
refuses to render the DaemonSet with acquisition: [] ("No acquisition or
additionalAcquisition configured"), and with no log tailing the agent has
nothing to do. The WAF collections moved to appsec.env, where they belong,
and base-http-scenarios was dropped since it only feeds log parsing. AppSec
registers with LAPI on its own, so it works without the agent.
Bouncer values updated for chart 0.8.0 (the app already pinned 0.8.0 while the
values were written against 0.6.3). Added waf.failOpen: true, whose chart
default is false and would deny every request if AppSec were unreachable.
SecurityPolicy now targets the whole gateway-public rather than the it-tools
listener. EG v1.3.2 rejects targetRefs.sectionName on SecurityPolicy, and
targeting the HTTPRoute instead would gate LAN traffic too since public routes
also parent gateway-internal. Blanket coverage of the public gateway is what we
want anyway, and failOpen keeps a bouncer outage from taking public apps down.
envoyproxy-public.yaml is kept as documentation but not applied. EG v1.3.2
already defaults envoyService.externalTrafficPolicy to Local, verified live on
all three gateway LB services, so the real client IP already reaches Envoy.
Not wired into the envoy-gateway kustomization yet. That lands once the
bouncer is up and healthy.
17 lines
479 B
YAML
17 lines
479 B
YAML
# Allows the SecurityPolicy (in the envoy-gateway namespace) to reference the
|
|
# bouncer Service in this (crowdsec) namespace as its ext_authz backend.
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: crowdsec-ext-auth-from-envoy-gateway
|
|
namespace: crowdsec
|
|
spec:
|
|
from:
|
|
- group: gateway.envoyproxy.io
|
|
kind: SecurityPolicy
|
|
namespace: envoy-gateway
|
|
to:
|
|
- group: ""
|
|
kind: Service
|
|
name: crowdsec-envoy-bouncer
|