Skip to content

Add custom modsecurity template to ingress-controller

Lucas Charles requested to merge 8558-use-custom-modsecurity-ingress-config into master

What does this MR do?

Adds a custom template for overriding the default modsecurity.conf, that ships with nginx-ingress.

The override is currently quite simple: disabling a few settings: SecRuleEngine (causing it to default to "Off"), SecAuditLogType (defaulting to "Serial"), and SecStatusEngine (disabling anonymous metric reporting).

Since these Directives can only be declared once, this provides flexibility in allowing overriding at a project-level via the auto-deploy chart.

This fixes a small ~bug in the previously merged chart MR (gitlab-org/charts/auto-deploy-app!12 (merged)) and gitlab-org/cluster-integration/auto-deploy-image!28 (merged) where the SecRuleEngine setting was being ignored since it was already set (Why it doesn't throw a duplicate directive error is still unclear to me). The other two are future-proofing.

#8558 (closed)

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Performance and Testing

Edited by Mayra Cabrera

Merge request reports