Using kubernetes appprotect.f5.com with gateway.envoyproxy.io

Question

Pulumi · Accepted Answer

In this scenario, we'll look into how you can configure Kubernetes resources using Pulumi to deploy an application that leverages `appprotect.f5.com` and `gateway.envoyproxy.io`. These resources are typically used for advanced traffic management, security, and observability within a Kubernetes cluster.

- `appprotect.f5.com`: This usually refers to NGINX App Protect which is a web application firewall (WAF) solution that is managed by an NGINX controller and can be configured using Kubernetes CRDs (Custom Resource Definitions). It helps in protecting the app from various threats by enforcing security policies.
  
- `gateway.envoyproxy.io`: Envoy is a high-performance proxy designed for cloud-native applications. It can be deployed as an edge proxy or as a gateway in front of your microservices. The Envoy gateway helps in managing ingress traffic to your Kubernetes cluster.

Below, I will provide you with a Pulumi program in TypeScript which could be used as a base for configuring such an environment. The types of resources you might end up defining include:

- **CustomResourceDefinitions (CRDs)**: For NGINX App Protect
- **EnvoyFilter**: To apply specific configurations to the Envoy proxy
- **Ingress/Gateway**: As API objects that manage external access to services in a cluster, typically HTTP

### Pulumi TypeScript Program

First, we need to ensure that we have installed the Pulumi Kubernetes provider and have the relevant kubeconfig file in place to interact with our Kubernetes cluster. If these requirements are not met, you will need to first set up the Pulumi CLI, the Pulumi Kubernetes provider, and configure your Kubernetes cluster access.

Now, let's set up the TypeScript program.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";

// The following program assumes that you've installed `appprotect.f5.com` and `gateway.envoyproxy.io`
// CRDs in your Kubernetes cluster. This will define a sample policy and an ingress setup
// using NGINX App Protect for WAF capabilities with an Envoy proxy as the gateway.

const namespaceName = "my-namespace";

// Create a namespace for your resources
const ns = new k8s.core.v1.Namespace(namespaceName, {
    metadata: { // Metadata for the namespace
        name: namespaceName,
    },
});

// Define an App Protect policy using the CustomResourceDefinition
const appProtectPolicy = new k8s.apiextensions.CustomResource("ap-app-protect-policy", {
    apiVersion: "appprotect.f5.com/v1beta1",
    kind: "AppProtectPolicy",
    metadata: {
        namespace: ns.metadata.name,
        name: "my-app-protect-policy"
    },
    spec: {
        // Define your policy spec here. The spec will depend on your application requirements.
        // For demonstration purposes, I'll create a simple policy that logs requests.
        policy: {
            name: "MyAppProtectPolicy",
            template: {
                name: "POLICY_TEMPLATE"
            },
            rules: [
                {
                    name: "Log all requests",
                    action: "allow",
                    text: "Logging all requests for inspection"
                }
            ]
        },
    },
}, { dependsOn: [ns] });

// Define an EnvoyFilter resource that could be used to integrate with your WAF policy
const envoyFilter = new k8s.apiextensions.CustomResource("my-envoy-filter", {
    apiVersion: "networking.istio.io/v1alpha3",
    kind: "EnvoyFilter",
    metadata: {
        namespace: ns.metadata.name, // So it's deployed in the created namespace
        name: "my-envoy-filter"
    },
    spec: {
        workloadSelector: {
            labels: {
                app: "my-envoy-gateway" // Replace with the appropriate label for your Envoy Gateway
            }
        },
        configPatches: [
            {
                // This is just a demonstration of making an imaginary WAF integration
                // Actual details will depend on NGINX App Protect & Envoy configurations
                applyTo: "HTTP_FILTER",
                match: {
                    context: "GATEWAY",
                    listener: {
                        portNumber: 80, // HTTP listener
                        filterChain: {
                            filter: {
                                name: "envoy.http_connection_manager",
                            },
                        },
                    },
                },
                patch: {
                    operation: "ADD",
                    value: {
                        name: "envoy.filters.http.waf",
                        typed_config: {
                            // This is where you would configure your WAF integration
                            "@type": "type.googleapis.com/envoy.extensions.filters.http.waf.v3.WAF",
                            config: {
                                app_protect_policy: "my-app-protect-policy",
                            }
                        }
                    }
                }
            }
        ]
    },
}, { dependsOn: [ns] });

// Create an Ingress / Gateway resource as needed to direct traffic to your services.
// Depending on your use-case, you might opt for an Ingress that points to Envoy
// or a custom Gateway resource and VirtualService for fine-grained control.

// The following is an example Ingress that could be used as a starting point.
const ingress = new k8s.networking.v1.Ingress("my-ingress", {
    metadata: {
        namespace: ns.metadata.name,
        annotations: {
            "appprotect.f5.com/app-protect-enable": "true",  // Annotation to enable the App Protect Policy
            "appprotect.f5.com/app-protect-policy": appProtectPolicy.metadata.name // Reference to policy
        },
        name: "my-ingress"
    },
    spec: {
        rules: [
            {
                http: {
                    paths: [
                        {
                            path: "/",
                            pathType: "Prefix",
                            backend: {
                                service: {
                                    // Reference to the service you want to protect with WAF policy
                                    name: "my-service",
                                    port: {
                                        number: 80,
                                    },
                                },
                            },
                        },
                    ],
                },
            },
        ],
    },
}, { dependsOn: [ns, appProtectPolicy] });

// Export the namespace name and ingress URL
export const namespace = ns.metadata.name;
export const ingressUrl = ingress.spec.rules[0].http.paths[0]?.backend.service?.name;
```

This Pulumi program sets up the necessary Kubernetes resources based on custom configurations. You may need to adjust the `spec` for the App Protect policy and the EnvoyFilter to match the actual configuration your application requires.

Remember, working with CRDs and custom configurations like this usually requires a solid understanding of the underlying technologies and their Kubernetes integrations. Make sure to review the official documentation of NGINX App Protect and Envoy to configure them according to your security and traffic management needs.

The EnvoyFilter is quite advanced and truly depends on how your Envoy is deployed in your cluster, you might need to adjust labels and configurations accordingly.

When you have the Pulumi CLI installed and your kubeconfig file set up, running `pulumi up` in your terminal within the same directory as your Pulumi program will deploy these resources to your Kubernetes cluster.