haproxy-ingress + modsecurity的实践

本周实践了带WAF功能的haproxy-ingress，

首先部署一个dvwa的应用，

vim dvwa-deployment.yaml，

apiVersion: apps/v1
kind: Deployment
metadata:
  name: dvwa
  labels:
    app: dvwa
  namespace: httpd
spec:
  selector:
    matchLabels:
      app: dvwa
  template:
    metadata:
      labels:
        app: dvwa
    spec:
      containers:
      - name: dvwa
        image: vulnerables/web-dvwa
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80

kubectl apply -f dvwa-deployment.yaml，

部署dvwa服务，

vim dvwa-service.yaml，

apiVersion: v1
kind: Service
metadata:
  name: dvwa
  namespace: httpd
spec:
  type: NodePort
  selector:
    app: dvwa
  ports:
  - protocol: TCP
    nodePort: 31677
    port: 80
    targetPort: 80

kubectl apply -f dvwa-service.yaml，

使用helm全新部署haproxy-ingress，

helm repo add haproxy-ingress https://haproxy-ingress.github.io/charts，
helm repo update，helm repo list，

helm search repo haproxy-ingress，

values.yaml的内容使用https://github.com/haproxy-ingress/charts/blob/release-0.13/haproxy-ingress/values.yaml，

修改参数，hostNetwork: true，replicaCount: 2，

部署，helm install haproxy-ingress haproxy-ingress/haproxy-ingress --create-namespace --namespace ingress-controller --version 0.13.6 -f values.yaml，

接着部署modsecurity的应用，

下载模板，wget https://haproxy-ingress.github.io/resources/modsecurity-deployment.yaml，

部署，kubectl apply -f modsecurity-deployment.yaml，

发布modsecurity服务，kubectl -n ingress-controller expose deployment modsecurity-spoa --port=12345 --type=ClusterIP，

查询服务，kubectl -n ingress-controller get service modsecurity-spoa，

修改haproxy-ingress的configmap，kubectl -n ingress-controller edit configmap haproxy-ingress，

modsecurity-endpoints: 10.108.10.135:12345，

查询修改结果，kubectl -n ingress-controller get configmap haproxy-ingress -o yaml，

给dvw创建ingress，vim dvwa-ingress.yaml，
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-dvwa
  annotations:
    kubernetes.io/ingress.class: haproxy
    haproxy-ingress.github.io/waf: "modsecurity"
  namespace: httpd
spec:
  rules:
  - host: dvwa.test.com
    http:
      paths:
      - path:
        backend:
          serviceName: dvwa
          servicePort: 80
kubectl apply -f dvwa-ingress.yaml，

从外网访问dvwa，做SQL注入的时候被阻断，

能查看到日志，

原文始发于微信公众号（云计算和网络安全技术实践）：haproxy-ingress + modsecurity的实践