Customizing Kong Ingress Controller with Integrated Wallarm Services¶

This article instructs you on the safe and effective customization of the Kong Ingress Controller with integrated Wallarm services.

Configuration area¶

Kong Ingress Controller with integrated Wallarm services is based on the standard Kubernetes components, thus the solution configuration is largely similar to the Kubernetes stack configuration.

You can configure the solution as follows:

• Globally via values.yaml - it allows setting up the general deployment configuration, the Kong API Gateway and some basic Wallarm settings. These settings apply to all Ingress resources the solution proxies traffic to.

• Via the Ingress annotations - it allows fine-tuning the Wallarm settings on a per-Ingress basis.

  Annotation support

  Ingress annotation is supported only by the solution based on the Open-Source Kong Ingress controller. The list of supported annotations is limited.

• Via the Wallarm Console UI - it allows fine-tuning the Wallarm settings.

Configuration of Kong API Gateway¶

Configuration of Kong Ingress Controller for Kong API Gateway is set by the default Helm chart values. This configuration can be overridden by the values.yaml file provided by the user during helm install or helm upgrade.

To customize the default Helm chart values, learn the official instructions on the Kong and Ingress Controller configuration.

Configuration of the Wallarm layer¶

You can configure the Wallarm layer of the solution as follows:

• Set basic configuration via values.yaml: connection to the Wallarm Cloud, resource allocation, fallbacks.

• Fine-tune traffic analysis on a per-Ingress basis via annotations (only for the Open-Source edition): traffic filtration mode, application management, multitenancy configuration, etc.

• Fine-tune traffic analysis via the Wallarm Console UI: traffic filtration mode, notifications about security events, request source management, mask sensitive data, allow certain attack types, etc.

Basic configuration via values.yaml¶

The default values.yaml file provides the following Wallarm configuration:

wallarm:
  image:
    tag: "<WALLARM_NODE_IMAGE_TAG>"
  enabled: true
  apiHost: api.wallarm.com
  apiPort: 443
  apiSSL: true
  token: ""
  fallback: "on"
  tarantool:
    kind: Deployment
    service:
      annotations: {}
    replicaCount: 1
    arena: "0.2"
    livenessProbe:
      failureThreshold: 3
      initialDelaySeconds: 10
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    resources: {}
    podAnnotations:
      sidecar.istio.io/inject: false
  heartbeat:
    resources: {}
  wallarm-appstructure:
    resources: {}
  wallarm-antibot:
    resources: {}
  metrics:
    port: 18080
    enabled: false

    service:
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/path: /wallarm-metrics
        prometheus.io/port: "18080"

      # clusterIP: ""

      ## -- List of IP addresses at which the stats-exporter service is available
      ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
      ##
      externalIPs: []

      # loadBalancerIP: ""
      loadBalancerSourceRanges: []
      servicePort: 18080
      type: ClusterIP
      # externalTrafficPolicy: ""
      # nodePort: ""
  addnode:
    resources: {}
  cron:
    jobs:
      exportEnvironment:
        schedule: "0 */1 * * *"
        timeout: 10m
      exportAttacks:
        schedule: "* * * * *"
        timeout: 3h
      exportCounters:
        schedule: "* * * * *"
        timeout: 11m
      bruteDetect:
        schedule: "* * * * *"
        timeout: 6m
      syncIpLists:
        schedule: "* * * * *"
        timeout: 3h
      exportMetrics:
        schedule: "* * * * *"
        timeout: 3h
      syncIpListsSource:
        schedule: "*/5 * * * *"
        timeout: 3h
      syncMarkers:
        schedule: "* * * * *"
        timeout: 1h
    resources: {}
  exportenv:
    resources: {}
  synccloud:
    wallarm_syncnode_interval_sec: 120
    resources: {}
  collectd:
    resources: {}

The main parameters you may need to change are:

Other parameters come with default values and rarely need to be changed.

Fine-tuning of traffic analysis via Ingress annotations (only for the Open-Source edition)¶

Below is the list of annotations supported in the Open-Source Kong Ingress controller with integrated Wallarm services.

Fine-tuning of traffic analysis via the Wallarm Console UI¶

The Wallarm Console UI enables you to fine-tune the traffic analysis performed by the Wallarm layer as follows:

• Configure the traffic filtration mode

  Once the solution is deployed, it starts filtering all incoming requests in the monitoring mode.

  The Wallarm Console UI enables you to change the mode:

  • Globally for all incoming requests
  • On a per-Ingress basis using the rule

  Priorities of per-Ingress' settings and the ones specified in the Wallarm Console UI

  If the mode for the Kong Open-Source based solution is specified via the wallarm-mode annotation and the Wallarm Console UI, the last will take precedence over the annotation.

• Set up notifications on security events

• Manage access to APIs by the request sources

• Customize traffic filtration rules

Was this page helpful?

How can we improve this article? (Optional)

Information is unclear or confusing

Insufficient information

Outdated or incorrect information

0/240

Send