ingress nginx ModSecurity is an open source cross platform web application firewall WAF engine for Apache IIS and Nginx that is developed by Trustwave s SpiderLabs It has a robust event based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring logging and real time analysis The connector is the connection point between NGINX and libmodsecurity ModSecurity v3 To enable the ModSecurity feature we need to specify in the configuration configmap The default ModSecurity configuration file is located in This is the only file located in this directory and contains the default recommended configuration Using a volume we can replace this file with the desired configuration ModSecurity Web Application Firewall Note the default configuration use detection only because that minimizes the chances of post installation disruption

Answer:
# ModSecurity Web Application Firewall

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis - [https://www.modsecurity.org](https://www.modsecurity.org)

The [ModSecurity-nginx](https://github.com/SpiderLabs/ModSecurity-nginx) connector is the connection point between NGINX and libmodsecurity (ModSecurity v3).

The default ModSecurity configuration file is located in `/etc/nginx/modsecurity/modsecurity.conf`. This is the only file located in this directory and contains the default recommended configuration. Using a volume we can replace this file with the desired configuration.
To enable the ModSecurity feature we need to specify `enable-modsecurity: "true"` in the configuration configmap.

>__Note:__ the default configuration use detection only, because that minimizes the chances of post-installation disruption.
Due to the value of the setting [SecAuditLogType=Concurrent](https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#secauditlogtype) the ModSecurity log is stored in multiple files inside the directory `/var/log/audit`.
The default `Serial` value in SecAuditLogType can impact performance.

The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.
The directory `/etc/nginx/owasp-modsecurity-crs` contains the [OWASP ModSecurity Core Rule Set repository](https://github.com/coreruleset/coreruleset).
Using `enable-owasp-modsecurity-crs: "true"` we enable the use of the rules.

## Supported annotations

For more info on supported annotations, please see [annotations/#modsecurity](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#modsecurity)

## Example of using ModSecurity with plugins via the helm chart

Suppose you have a ConfigMap that contains the contents of the [nextcloud-rule-exclusions plugin](https://github.com/coreruleset/nextcloud-rule-exclusions-plugin/blob/main/plugins/nextcloud-rule-exclusions-before.conf) like this:

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: modsecurity-plugins
data:
  empty-after.conf: |
    # no data
  empty-before.conf: |
    # no data
  empty-config.conf: |
    # no data
  nextcloud-rule-exclusions-before.conf:
    # this is just a snippet
    # find the full file at https://github.com/coreruleset/nextcloud-rule-exclusions-plugin
    #
    # [ File Manager ]
    # The web interface uploads files, and interacts with the user.
    SecRule REQUEST_FILENAME "@contains /remote.php/webdav" \
        "id:9508102,\
        phase:1,\
        pass,\
        t:none,\
        nolog,\
        ver:'nextcloud-rule-exclusions-plugin/1.2.0',\
        ctl:ruleRemoveById=920420,\
        ctl:ruleRemoveById=920440,\
        ctl:ruleRemoveById=941000-942999,\
        ctl:ruleRemoveById=951000-951999,\
        ctl:ruleRemoveById=953100-953130,\
        ctl:ruleRemoveByTag=attack-injection-php"
```

If you're using the helm chart, you can pass in the following parameters in your `values.yaml`:

```yaml
controller:
  config:
    # Enables Modsecurity
    enable-modsecurity: "true"

    # Update ModSecurity config and rules
    modsecurity-snippet: |
      # this enables the mod security nextcloud plugin
      Include /etc/nginx/owasp-modsecurity-crs/plugins/nextcloud-rule-exclusions-before.conf

      # this enables the default OWASP Core Rule Set
      Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf

      # Enable prevention mode. Options: DetectionOnly,On,Off (default is DetectionOnly)
      SecRuleEngine On

      # Enable scanning of the request body
      SecRequestBodyAccess On

      # Enable XML and JSON parsing
      SecRule REQUEST_HEADERS:Content-Type "(?:text|application(?:/soap\+|/)|application/xml)/" \
        "id:200000,phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"

      SecRule REQUEST_HEADERS:Content-Type "application/json" \
        "id:200001,phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"

      # Reject if larger (we could also let it pass with ProcessPartial)
      SecRequestBodyLimitAction Reject

      # Send ModSecurity audit logs to the stdout (only for rejected requests)
      SecAuditLog /dev/stdout

      # format the logs in JSON
      SecAuditLogFormat JSON

      # could be On/Off/RelevantOnly
      SecAuditEngine RelevantOnly

  # Add a volume for the plugins directory
  extraVolumes:
    - name: plugins
      configMap:
        name: modsecurity-plugins

  # override the /etc/nginx/enable-owasp-modsecurity-crs/plugins with your ConfigMap
  extraVolumeMounts:
    - name: plugins
      mountPath: /etc/nginx/owasp-modsecurity-crs/plugins
```

ModSecurity Web Application Firewall  ModSecurity is an open source  cross platform web application firewall  WAF  engine for Apache  IIS and Nginx that is developed by Trustwave s SpiderLabs  It has a robust event based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring  logging and real time analysis    https   www modsecurity org  https   www modsecurity org   The  ModSecurity nginx  https   github com SpiderLabs ModSecurity nginx  connector is the connection point between NGINX and libmodsecurity  ModSecurity v3    The default ModSecurity configuration file is located in   etc nginx modsecurity modsecurity conf   This is the only file located in this directory and contains the default recommended configuration  Using a volume we can replace this file with the desired configuration  To enable the ModSecurity feature we need to specify  enable modsecurity   true   in the configuration configmap      Note    the default configuration use detection only  because that minimizes the chances of post installation disruption  Due to the value of the setting  SecAuditLogType Concurrent  https   github com SpiderLabs ModSecurity wiki Reference Manual  v2 x  secauditlogtype  the ModSecurity log is stored in multiple files inside the directory   var log audit   The default  Serial  value in SecAuditLogType can impact performance   The OWASP ModSecurity Core Rule Set  CRS  is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls  The CRS aims to protect web applications from a wide range of attacks  including the OWASP Top Ten  with a minimum of false alerts  The directory   etc nginx owasp modsecurity crs  contains the  OWASP ModSecurity Core Rule Set repository  https   github com coreruleset coreruleset   Using  enable owasp modsecurity crs   true   we enable the use of the rules      Supported annotations  For more info on supported annotations  please see  annotations  modsecurity  https   kubernetes github io ingress nginx user guide nginx configuration annotations  modsecurity      Example of using ModSecurity with plugins via the helm chart  Suppose you have a ConfigMap that contains the contents of the  nextcloud rule exclusions plugin  https   github com coreruleset nextcloud rule exclusions plugin blob main plugins nextcloud rule exclusions before conf  like this      yaml apiVersion  v1 kind  ConfigMap metadata    name  modsecurity plugins data    empty after conf          no data   empty before conf          no data   empty config conf          no data   nextcloud rule exclusions before conf        this is just a snippet       find the full file at https   github com coreruleset nextcloud rule exclusions plugin               File Manager         The web interface uploads files  and interacts with the user      SecRule REQUEST FILENAME   contains  remote php webdav             id 9508102           phase 1           pass           t none           nolog           ver  nextcloud rule exclusions plugin 1 2 0            ctl ruleRemoveById 920420           ctl ruleRemoveById 920440           ctl ruleRemoveById 941000 942999           ctl ruleRemoveById 951000 951999           ctl ruleRemoveById 953100 953130           ctl ruleRemoveByTag attack injection php       If you re using the helm chart  you can pass in the following parameters in your  values yaml       yaml controller    config        Enables Modsecurity     enable modsecurity   true         Update ModSecurity config and rules     modsecurity snippet            this enables the mod security nextcloud plugin       Include  etc nginx owasp modsecurity crs plugins nextcloud rule exclusions before conf          this enables the default OWASP Core Rule Set       Include  etc nginx owasp modsecurity crs nginx modsecurity conf          Enable prevention mode  Options  DetectionOnly On Off  default is DetectionOnly        SecRuleEngine On          Enable scanning of the request body       SecRequestBodyAccess On          Enable XML and JSON parsing       SecRule REQUEST HEADERS Content Type     text application    soap      application xml               id 200000 phase 1 t none t lowercase pass nolog ctl requestBodyProcessor XML         SecRule REQUEST HEADERS Content Type  application json             id 200001 phase 1 t none t lowercase pass nolog ctl requestBodyProcessor JSON           Reject if larger  we could also let it pass with ProcessPartial        SecRequestBodyLimitAction Reject          Send ModSecurity audit logs to the stdout  only for rejected requests        SecAuditLog  dev stdout          format the logs in JSON       SecAuditLogFormat JSON          could be On Off RelevantOnly       SecAuditEngine RelevantOnly      Add a volume for the plugins directory   extraVolumes        name  plugins       configMap          name  modsecurity plugins      override the  etc nginx enable owasp modsecurity crs plugins with your ConfigMap   extraVolumeMounts        name  plugins       mountPath   etc nginx owasp modsecurity crs plugins


ingress nginx Using the third party module the Ingress Nginx Controller can configure NGINX to enable instrumentation and monitoring purposes OpenTelemetry practical demonstration of how OpenTelemetry can be utilized in Ingress NGINX for observability By default this feature is disabled Check out this demo showcasing OpenTelemetry in Ingress NGINX The video provides an overview and Enables requests served by NGINX for distributed telemetry via The OpenTelemetry Project

Answer:
# OpenTelemetry

Enables requests served by NGINX for distributed telemetry via The OpenTelemetry Project.

Using the third party module [opentelemetry-cpp-contrib/nginx](https://github.com/open-telemetry/opentelemetry-cpp-contrib/tree/main/instrumentation/nginx) the Ingress-Nginx Controller can configure NGINX to enable [OpenTelemetry](http://opentelemetry.io) instrumentation.
By default this feature is disabled.

Check out this demo showcasing OpenTelemetry in Ingress NGINX. The video provides an overview and
practical demonstration of how OpenTelemetry can be utilized in Ingress NGINX for observability
and monitoring purposes.

Demo: OpenTelemetry in Ingress NGINX.

## Usage

To enable the instrumentation we must enable OpenTelemetry in the configuration ConfigMap:
```yaml
data:
  enable-opentelemetry: "true"
```

To enable or disable instrumentation for a single Ingress, use
the `enable-opentelemetry` annotation:
```yaml
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/enable-opentelemetry: "true"
```

We must also set the host to use when uploading traces:

```yaml
otlp-collector-host: "otel-coll-collector.otel.svc"
```
NOTE: While the option is called `otlp-collector-host`, you will need to point this to any backend that receives otlp-grpc.

Next you will need to deploy a distributed telemetry system which uses OpenTelemetry.
[opentelemetry-collector](https://github.com/open-telemetry/opentelemetry-collector), [Jaeger](https://www.jaegertracing.io/)
[Tempo](https://github.com/grafana/tempo), and [zipkin](https://zipkin.io/)
have been tested.

Other optional configuration options:
```yaml
# specifies the name to use for the server span
opentelemetry-operation-name

# sets whether or not to trust incoming telemetry spans
opentelemetry-trust-incoming-span

# specifies the port to use when uploading traces, Default: 4317
otlp-collector-port

# specifies the service name to use for any traces created, Default: nginx
otel-service-name

# The maximum queue size. After the size is reached data are dropped.
otel-max-queuesize

# The delay interval in milliseconds between two consecutive exports.
otel-schedule-delay-millis

# How long the export can run before it is cancelled.
otel-schedule-delay-millis

# The maximum batch size of every export. It must be smaller or equal to maxQueueSize.
otel-max-export-batch-size

# specifies sample rate for any traces created, Default: 0.01
otel-sampler-ratio

# specifies the sampler to be used when sampling traces.
# The available samplers are: AlwaysOn,  AlwaysOff, TraceIdRatioBased, Default: AlwaysOff
otel-sampler

# Uses sampler implementation which by default will take a sample if parent Activity is sampled, Default: false
otel-sampler-parent-based
```

Note that you can also set whether to trust incoming spans (global default is true) per-location using annotations like the following:
```yaml
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/opentelemetry-trust-incoming-span: "true"
```

## Examples

The following examples show how to deploy and test different distributed telemetry systems. These example can be performed using Docker Desktop.

In the [esigo/nginx-example](https://github.com/esigo/nginx-example)
GitHub repository is an example of a simple hello service:

```mermaid
graph TB
    subgraph Browser
    start["http://esigo.dev/hello/nginx"]
    end

    subgraph app
        sa[service-a]
        sb[service-b]
        sa --> |name: nginx| sb
        sb --> |hello nginx!| sa
    end

    subgraph otel
        otc["Otel Collector"]
    end

    subgraph observability
        tempo["Tempo"]
        grafana["Grafana"]
        backend["Jaeger"]
        zipkin["Zipkin"]
    end

    subgraph ingress-nginx
        ngx[nginx]
    end

    subgraph ngx[nginx]
        ng[nginx]
        om[OpenTelemetry module]
    end

    subgraph Node
        app
        otel
        observability
        ingress-nginx
        om --> |otlp-gRPC| otc --> |jaeger| backend
        otc --> |zipkin| zipkin
        otc --> |otlp-gRPC| tempo --> grafana
        sa --> |otlp-gRPC| otc
        sb --> |otlp-gRPC| otc
        start --> ng --> sa
    end
```

To install the example and collectors run:

1. Enable OpenTelemetry and set the otlp-collector-host:

    ```yaml
    $ echo '
      apiVersion: v1
      kind: ConfigMap
      data:
        enable-opentelemetry: "true"
        opentelemetry-config: "/etc/nginx/opentelemetry.toml"
        opentelemetry-operation-name: "HTTP $request_method $service_name $uri"
        opentelemetry-trust-incoming-span: "true"
        otlp-collector-host: "otel-coll-collector.otel.svc"
        otlp-collector-port: "4317"
        otel-max-queuesize: "2048"
        otel-schedule-delay-millis: "5000"
        otel-max-export-batch-size: "512"
        otel-service-name: "nginx-proxy" # Opentelemetry resource name
        otel-sampler: "AlwaysOn" # Also: AlwaysOff, TraceIdRatioBased
        otel-sampler-ratio: "1.0"
        otel-sampler-parent-based: "false"
      metadata:
        name: ingress-nginx-controller
        namespace: ingress-nginx
      ' | kubectl replace -f -
    ```

2. Deploy otel-collector, grafana and Jaeger backend:

    ```bash
    # add helm charts needed for grafana and OpenTelemetry collector
    helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
    helm repo add grafana https://grafana.github.io/helm-charts
    helm repo update
    # deploy cert-manager needed for OpenTelemetry collector operator
    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.3/cert-manager.yaml
    # create observability namespace
    kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/namespace.yaml
    # install OpenTelemetry collector operator
    helm upgrade --install otel-collector-operator -n otel --create-namespace open-telemetry/opentelemetry-operator
    # deploy OpenTelemetry collector
    kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/collector.yaml
    # deploy Jaeger all-in-one
    kubectl apply -f https://github.com/jaegertracing/jaeger-operator/releases/download/v1.37.0/jaeger-operator.yaml -n observability
    kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/jaeger.yaml -n observability
    # deploy zipkin
    kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/zipkin.yaml -n observability
    # deploy tempo and grafana
	helm upgrade --install tempo grafana/tempo --create-namespace -n observability
	helm upgrade -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/grafana/grafana-values.yaml --install grafana grafana/grafana --create-namespace -n observability
    ```

3. Build and deploy demo app:

    ```bash
    # build images
    make images

    # deploy demo app:
    make deploy-app
    ```

4. Make a few requests to the Service:

    ```bash
    kubectl port-forward --namespace=ingress-nginx service/ingress-nginx-controller 8090:80
    curl http://esigo.dev:8090/hello/nginx

    StatusCode        : 200
    StatusDescription : OK
    Content           : {"v":"hello nginx!"}

    RawContent        : HTTP/1.1 200 OK
                        Connection: keep-alive
                        Content-Length: 21
                        Content-Type: text/plain; charset=utf-8
                        Date: Mon, 10 Oct 2022 17:43:33 GMT

                        {"v":"hello nginx!"}

    Forms             : {}
    Headers           : {[Connection, keep-alive], [Content-Length, 21], [Content-Type, text/plain; charset=utf-8], [Date,
                        Mon, 10 Oct 2022 17:43:33 GMT]}
    Images            : {}
    InputFields       : {}
    Links             : {}
    ParsedHtml        : System.__ComObject
    RawContentLength  : 21
    ```

5. View the Grafana UI:

    ```bash
    kubectl port-forward --namespace=observability service/grafana 3000:80
    ```
    In the Grafana interface we can see the details:
    ![grafana screenshot](../../images/otel-grafana-demo.png "grafana screenshot")

6. View the Jaeger UI:

    ```bash
    kubectl port-forward --namespace=observability service/jaeger-all-in-one-query 16686:16686
    ```
    In the Jaeger interface we can see the details:
    ![Jaeger screenshot](../../images/otel-jaeger-demo.png "Jaeger screenshot")

7. View the Zipkin UI:

    ```bash
    kubectl port-forward --namespace=observability service/zipkin 9411:9411
    ```
    In the Zipkin interface we can see the details:
    ![zipkin screenshot](../../images/otel-zipkin-demo.png "zipkin screenshot")

## Migration from OpenTracing, Jaeger, Zipkin and Datadog

If you are migrating from OpenTracing, Jaeger, Zipkin, or Datadog to OpenTelemetry,
you may need to update various annotations and configurations. Here are the mappings
for common annotations and configurations:

### Annotations

| Legacy                                                        | OpenTelemetry                                                   |
|---------------------------------------------------------------|-----------------------------------------------------------------|
| `nginx.ingress.kubernetes.io/enable-opentracing`              | `nginx.ingress.kubernetes.io/enable-opentelemetry`              |
| `nginx.ingress.kubernetes.io/opentracing-trust-incoming-span` | `nginx.ingress.kubernetes.io/opentelemetry-trust-incoming-span` |

### Configs

| Legacy                                | OpenTelemetry                                |
|---------------------------------------|----------------------------------------------|
| `opentracing-operation-name`          | `opentelemetry-operation-name`               |
| `opentracing-location-operation-name` | `opentelemetry-operation-name`               |
| `opentracing-trust-incoming-span`     | `opentelemetry-trust-incoming-span`          |
| `zipkin-collector-port`               | `otlp-collector-port`                        |
| `zipkin-service-name`                 | `otel-service-name`                          |
| `zipkin-sample-rate`                  | `otel-sampler-ratio`                         |
| `jaeger-collector-port`               | `otlp-collector-port`                        |
| `jaeger-endpoint`                     | `otlp-collector-port`, `otlp-collector-host` |
| `jaeger-service-name`                 | `otel-service-name`                          |
| `jaeger-propagation-format`           | `N/A`                                        |
| `jaeger-sampler-type`                 | `otel-sampler`                               |
| `jaeger-sampler-param`                | `otel-sampler`                               |
| `jaeger-sampler-host`                 | `N/A`                                        |
| `jaeger-sampler-port`                 | `N/A`                                        |
| `jaeger-trace-context-header-name`    | `N/A`                                        |
| `jaeger-debug-header`                 | `N/A`                                        |
| `jaeger-baggage-header`               | `N/A`                                        |
| `jaeger-tracer-baggage-header-prefix` | `N/A`                                        |
| `datadog-collector-port`              | `otlp-collector-port`                        |
| `datadog-service-name`                | `otel-service-name`                          |
| `datadog-environment`                 | `N/A`                                        |
| `datadog-operation-name-override`     | `N/A`                                        |
| `datadog-priority-sampling`           | `otel-sampler`                               |
| `datadog-sample-rate`                 | `otel-sampler-ratio`                         |

OpenTelemetry  Enables requests served by NGINX for distributed telemetry via The OpenTelemetry Project   Using the third party module  opentelemetry cpp contrib nginx  https   github com open telemetry opentelemetry cpp contrib tree main instrumentation nginx  the Ingress Nginx Controller can configure NGINX to enable  OpenTelemetry  http   opentelemetry io  instrumentation  By default this feature is disabled   Check out this demo showcasing OpenTelemetry in Ingress NGINX  The video provides an overview and practical demonstration of how OpenTelemetry can be utilized in Ingress NGINX for observability and monitoring purposes    p align  center      a href  https   www youtube com watch v jpBfgJpTcfw t 129  target   blank  rel  noopener noreferrer        img src  https   img youtube com vi jpBfgJpTcfw 0 jpg  alt  Video Thumbnail         a    p    p align  center  Demo  OpenTelemetry in Ingress NGINX   p      Usage  To enable the instrumentation we must enable OpenTelemetry in the configuration ConfigMap     yaml data    enable opentelemetry   true       To enable or disable instrumentation for a single Ingress  use the  enable opentelemetry  annotation     yaml kind  Ingress metadata    annotations      nginx ingress kubernetes io enable opentelemetry   true       We must also set the host to use when uploading traces      yaml otlp collector host   otel coll collector otel svc      NOTE  While the option is called  otlp collector host   you will need to point this to any backend that receives otlp grpc   Next you will need to deploy a distributed telemetry system which uses OpenTelemetry   opentelemetry collector  https   github com open telemetry opentelemetry collector    Jaeger  https   www jaegertracing io    Tempo  https   github com grafana tempo   and  zipkin  https   zipkin io   have been tested   Other optional configuration options     yaml   specifies the name to use for the server span opentelemetry operation name    sets whether or not to trust incoming telemetry spans opentelemetry trust incoming span    specifies the port to use when uploading traces  Default  4317 otlp collector port    specifies the service name to use for any traces created  Default  nginx otel service name    The maximum queue size  After the size is reached data are dropped  otel max queuesize    The delay interval in milliseconds between two consecutive exports  otel schedule delay millis    How long the export can run before it is cancelled  otel schedule delay millis    The maximum batch size of every export  It must be smaller or equal to maxQueueSize  otel max export batch size    specifies sample rate for any traces created  Default  0 01 otel sampler ratio    specifies the sampler to be used when sampling traces    The available samplers are  AlwaysOn   AlwaysOff  TraceIdRatioBased  Default  AlwaysOff otel sampler    Uses sampler implementation which by default will take a sample if parent Activity is sampled  Default  false otel sampler parent based      Note that you can also set whether to trust incoming spans  global default is true  per location using annotations like the following     yaml kind  Ingress metadata    annotations      nginx ingress kubernetes io opentelemetry trust incoming span   true          Examples  The following examples show how to deploy and test different distributed telemetry systems  These example can be performed using Docker Desktop   In the  esigo nginx example  https   github com esigo nginx example  GitHub repository is an example of a simple hello service      mermaid graph TB     subgraph Browser     start  http   esigo dev hello nginx       end      subgraph app         sa service a          sb service b          sa      name  nginx  sb         sb      hello nginx   sa     end      subgraph otel         otc  Otel Collector       end      subgraph observability         tempo  Tempo           grafana  Grafana           backend  Jaeger           zipkin  Zipkin       end      subgraph ingress nginx         ngx nginx      end      subgraph ngx nginx          ng nginx          om OpenTelemetry module      end      subgraph Node         app         otel         observability         ingress nginx         om      otlp gRPC  otc      jaeger  backend         otc      zipkin  zipkin         otc      otlp gRPC  tempo     grafana         sa      otlp gRPC  otc         sb      otlp gRPC  otc         start     ng     sa     end      To install the example and collectors run   1  Enable OpenTelemetry and set the otlp collector host          yaml       echo         apiVersion  v1       kind  ConfigMap       data          enable opentelemetry   true          opentelemetry config    etc nginx opentelemetry toml          opentelemetry operation name   HTTP  request method  service name  uri          opentelemetry trust incoming span   true          otlp collector host   otel coll collector otel svc          otlp collector port   4317          otel max queuesize   2048          otel schedule delay millis   5000          otel max export batch size   512          otel service name   nginx proxy    Opentelemetry resource name         otel sampler   AlwaysOn    Also  AlwaysOff  TraceIdRatioBased         otel sampler ratio   1 0          otel sampler parent based   false        metadata          name  ingress nginx controller         namespace  ingress nginx           kubectl replace  f            2  Deploy otel collector  grafana and Jaeger backend          bash       add helm charts needed for grafana and OpenTelemetry collector     helm repo add open telemetry https   open telemetry github io opentelemetry helm charts     helm repo add grafana https   grafana github io helm charts     helm repo update       deploy cert manager needed for OpenTelemetry collector operator     kubectl apply  f https   github com cert manager cert manager releases download v1 15 3 cert manager yaml       create observability namespace     kubectl apply  f https   raw githubusercontent com esigo nginx example main observability namespace yaml       install OpenTelemetry collector operator     helm upgrade   install otel collector operator  n otel   create namespace open telemetry opentelemetry operator       deploy OpenTelemetry collector     kubectl apply  f https   raw githubusercontent com esigo nginx example main observability collector yaml       deploy Jaeger all in one     kubectl apply  f https   github com jaegertracing jaeger operator releases download v1 37 0 jaeger operator yaml  n observability     kubectl apply  f https   raw githubusercontent com esigo nginx example main observability jaeger yaml  n observability       deploy zipkin     kubectl apply  f https   raw githubusercontent com esigo nginx example main observability zipkin yaml  n observability       deploy tempo and grafana  helm upgrade   install tempo grafana tempo   create namespace  n observability  helm upgrade  f https   raw githubusercontent com esigo nginx example main observability grafana grafana values yaml   install grafana grafana grafana   create namespace  n observability          3  Build and deploy demo app          bash       build images     make images        deploy demo app      make deploy app          4  Make a few requests to the Service          bash     kubectl port forward   namespace ingress nginx service ingress nginx controller 8090 80     curl http   esigo dev 8090 hello nginx       StatusCode          200     StatusDescription   OK     Content               v   hello nginx         RawContent          HTTP 1 1 200 OK                         Connection  keep alive                         Content Length  21                         Content Type  text plain  charset utf 8                         Date  Mon  10 Oct 2022 17 43 33 GMT                            v   hello nginx         Forms                      Headers               Connection  keep alive    Content Length  21    Content Type  text plain  charset utf 8    Date                          Mon  10 Oct 2022 17 43 33 GMT       Images                     InputFields                Links                      ParsedHtml          System   ComObject     RawContentLength    21          5  View the Grafana UI          bash     kubectl port forward   namespace observability service grafana 3000 80             In the Grafana interface we can see the details        grafana screenshot        images otel grafana demo png  grafana screenshot    6  View the Jaeger UI          bash     kubectl port forward   namespace observability service jaeger all in one query 16686 16686             In the Jaeger interface we can see the details        Jaeger screenshot        images otel jaeger demo png  Jaeger screenshot    7  View the Zipkin UI          bash     kubectl port forward   namespace observability service zipkin 9411 9411             In the Zipkin interface we can see the details        zipkin screenshot        images otel zipkin demo png  zipkin screenshot       Migration from OpenTracing  Jaeger  Zipkin and Datadog  If you are migrating from OpenTracing  Jaeger  Zipkin  or Datadog to OpenTelemetry  you may need to update various annotations and configurations  Here are the mappings for common annotations and configurations       Annotations    Legacy                                                          OpenTelemetry                                                                                nginx ingress kubernetes io enable opentracing                  nginx ingress kubernetes io enable opentelemetry                    nginx ingress kubernetes io opentracing trust incoming span     nginx ingress kubernetes io opentelemetry trust incoming span         Configs    Legacy                                  OpenTelemetry                                                                                opentracing operation name              opentelemetry operation name                     opentracing location operation name     opentelemetry operation name                     opentracing trust incoming span         opentelemetry trust incoming span                zipkin collector port                   otlp collector port                              zipkin service name                     otel service name                                zipkin sample rate                      otel sampler ratio                               jaeger collector port                   otlp collector port                              jaeger endpoint                         otlp collector port    otlp collector host       jaeger service name                     otel service name                                jaeger propagation format               N A                                              jaeger sampler type                     otel sampler                                     jaeger sampler param                    otel sampler                                     jaeger sampler host                     N A                                              jaeger sampler port                     N A                                              jaeger trace context header name        N A                                              jaeger debug header                     N A                                              jaeger baggage header                   N A                                              jaeger tracer baggage header prefix     N A                                              datadog collector port                  otlp collector port                              datadog service name                    otel service name                                datadog environment                     N A                                              datadog operation name override         N A                                              datadog priority sampling               otel sampler                                     datadog sample rate                     otel sampler ratio


ingress nginx overlapping in some points Hardening Guide Overview Do not use in multi tenant Kubernetes production installations This project assumes that users that can create Ingress objects are administrators of the cluster There are several ways to do hardening and securing of nginx In this documentation two guides are used the guides are

Answer:
# Hardening Guide

Do not use in multi-tenant Kubernetes production installations. This project assumes that users that can create Ingress objects are administrators of the cluster.

## Overview
There are several ways to do hardening and securing of nginx. In this documentation two guides are used, the guides are
overlapping in some points:

- [nginx CIS Benchmark](https://www.cisecurity.org/benchmark/nginx/)
- [cipherlist.eu](https://cipherlist.eu/) (one of many forks of the now dead project cipherli.st)

This guide describes, what of the different configurations described in those guides is already implemented as default
in the nginx implementation of kubernetes ingress, what needs to be configured, what is obsolete due to the fact that
the nginx is running as container (the CIS benchmark relates to a non-containerized installation) and what is difficult
or not possible.

Be aware that this is only a guide and you are responsible for your own implementation. Some of the configurations may
lead to have specific clients unable to reach your site or similar consequences.

This guide refers to chapters in the CIS Benchmark. For full explanation you should refer to the benchmark document itself

## Configuration Guide

| Chapter in CIS benchmark | Status | Default | Action to do if not default|
|:-------------------------|:-------|:--------|:---------------------------|
| __1 Initial Setup__ ||| |
| ||| |
| __1.1 Installation__||| |
| 1.1.1 Ensure NGINX is installed (Scored)| OK | done through helm charts / following documentation to deploy nginx ingress | |
| 1.1.2 Ensure NGINX is installed from source (Not Scored)| OK | done through helm charts / following documentation to deploy nginx ingress | |
| ||| |
| __1.2 Configure Software Updates__||| |
| 1.2.1 Ensure package manager repositories are properly configured (Not Scored) | OK | done via helm, nginx version could be overwritten, however compatibility is not ensured then| |
| 1.2.2 Ensure the latest software package is installed (Not Scored)| ACTION NEEDED | done via helm, nginx version could be overwritten, however compatibility is not ensured then| Plan for periodic updates |
| ||| |
| __2 Basic Configuration__ ||| |
| ||| |
| __2.1 Minimize NGINX Modules__||| |
| 2.1.1 Ensure only required modules are installed (Not Scored) | OK | Already only needed modules are installed, however proposals for further reduction are welcome | |
| 2.1.2 Ensure HTTP WebDAV module is not installed (Scored) | OK | | |
| 2.1.3 Ensure modules with gzip functionality are disabled (Scored)| OK | | |
| 2.1.4 Ensure the autoindex module is disabled (Scored)| OK | No autoindex configs so far in ingress defaults| |
| ||| |
| __2.2 Account Security__||| |
| 2.2.1 Ensure that NGINX is run using a non-privileged, dedicated service account (Not Scored) | OK | Pod configured as user www-data: [See this line in helm chart values](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L10). Compiled with user www-data: [See this line in build script](https://github.com/kubernetes/ingress-nginx/blob/5d67794f4fbf38ec6575476de46201b068eabf87/images/nginx/rootfs/build.sh#L529) | |
| 2.2.2 Ensure the NGINX service account is locked (Scored) | OK | Docker design ensures this | |
| 2.2.3 Ensure the NGINX service account has an invalid shell (Scored)| OK | Shell is nologin: [see this line in build script](https://github.com/kubernetes/ingress-nginx/blob/5d67794f4fbf38ec6575476de46201b068eabf87/images/nginx/rootfs/build.sh#L613)| |
| ||| |
| __2.3 Permissions and Ownership__ ||| |
| 2.3.1 Ensure NGINX directories and files are owned by root (Scored) | OK | Obsolete through docker-design and ingress controller needs to update the configs dynamically| |
| 2.3.2 Ensure access to NGINX directories and files is restricted (Scored) | OK | See previous answer| |
| 2.3.3 Ensure the NGINX process ID (PID) file is secured (Scored)| OK | No PID-File due to docker design | |
| 2.3.4 Ensure the core dump directory is secured (Not Scored)| OK | No working_directory configured by default | |
| ||| |
| __2.4 Network Configuration__ ||| |
| 2.4.1 Ensure NGINX only listens for network connections on authorized ports (Not Scored)| OK | Ensured by automatic nginx.conf configuration| |
| 2.4.2 Ensure requests for unknown host names are rejected (Not Scored)| OK | They are not rejected but send to the "default backend" delivering appropriate errors (mostly 404)| |
| 2.4.3 Ensure keepalive_timeout is 10 seconds or less, but not 0 (Scored)| ACTION NEEDED| Default is 75s | configure keep-alive to 10 seconds [according to this documentation](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/configmap.md#keep-alive) |
| 2.4.4 Ensure send_timeout is set to 10 seconds or less, but not 0 (Scored)| RISK TO BE ACCEPTED| Not configured, however the nginx default is 60s| Not configurable|
| ||| |
| __2.5 Information Disclosure__||| |
| 2.5.1 Ensure server_tokens directive is set to `off` (Scored) | OK | server_tokens is configured to off by default| |
| 2.5.2 Ensure default error and index.html pages do not reference NGINX (Scored) | ACTION NEEDED| 404 shows no version at all, 503 and 403 show "nginx", which is hardcoded [see this line in nginx source code](https://github.com/nginx/nginx/blob/master/src/http/ngx_http_special_response.c#L36) | configure custom error pages at least for 403, 404 and 503 and 500|
| 2.5.3 Ensure hidden file serving is disabled (Not Scored) | ACTION NEEDED | config not set | configure a config.server-snippet Snippet, but beware of .well-known challenges or similar. Refer to the benchmark here please |
| 2.5.4 Ensure the NGINX reverse proxy does not enable information disclosure (Scored)| ACTION NEEDED| hide not configured| configure hide-headers with array of "X-Powered-By" and "Server": [according to this documentation](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/configmap.md#hide-headers) |
| ||| |
| __3 Logging__ ||| |
| ||| |
| 3.1 Ensure detailed logging is enabled (Not Scored) | OK | nginx ingress has a very detailed log format by default | |
| 3.2 Ensure access logging is enabled (Scored) | OK | Access log is enabled by default | |
| 3.3 Ensure error logging is enabled and set to the info logging level (Scored)| OK | Error log is configured by default. The log level does not matter, because it is all sent to STDOUT anyway | |
| 3.4 Ensure log files are rotated (Scored) | OBSOLETE | Log file handling is not part of the nginx ingress and should be handled separately | |
| 3.5 Ensure error logs are sent to a remote syslog server (Not Scored) | OBSOLETE | See previous answer| |
| 3.6 Ensure access logs are sent to a remote syslog server (Not Scored)| OBSOLETE | See previous answer| |
| 3.7 Ensure proxies pass source IP information (Scored)| OK | Headers are set by default | |
| ||| |
| __4 Encryption__ ||| |
| ||| |
| __4.1 TLS / SSL Configuration__ ||| |
| 4.1.1 Ensure HTTP is redirected to HTTPS (Scored) | OK | Redirect to TLS is default | |
| 4.1.2 Ensure a trusted certificate and trust chain is installed (Not Scored)| ACTION NEEDED| For installing certs there are enough manuals in the web. A good way is to use lets encrypt through cert-manager | Install proper certificates or use lets encrypt with cert-manager |
| 4.1.3 Ensure private key permissions are restricted (Scored)| ACTION NEEDED| See previous answer| |
| 4.1.4 Ensure only modern TLS protocols are used (Scored)| OK/ACTION NEEDED | Default is TLS 1.2 + 1.3, while this is okay for CIS Benchmark, cipherlist.eu only recommends 1.3. This may cut off old OS's | Set controller.config.ssl-protocols to "TLSv1.3"|
| 4.1.5 Disable weak ciphers (Scored) | ACTION NEEDED| Default ciphers are already good, but cipherlist.eu recommends even stronger ciphers | Set controller.config.ssl-ciphers to "EECDH+AESGCM:EDH+AESGCM"|
| 4.1.6 Ensure custom Diffie-Hellman parameters are used (Scored) | ACTION NEEDED| No custom DH parameters are generated| Generate dh parameters for each ingress deployment you use - [see here for a how to](https://kubernetes.github.io/ingress-nginx/examples/customization/ssl-dh-param/) |
| 4.1.7 Ensure Online Certificate Status Protocol (OCSP) stapling is enabled (Scored) | ACTION NEEDED | Not enabled | set via [this configuration parameter](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#enable-ocsp) |
| 4.1.8 Ensure HTTP Strict Transport Security (HSTS) is enabled (Scored)| OK | HSTS is enabled by default | |
| 4.1.9 Ensure HTTP Public Key Pinning is enabled (Not Scored)| ACTION NEEDED / RISK TO BE ACCEPTED | HKPK not enabled by default | If lets encrypt is not used, set correct HPKP header. There are several ways to implement this - with the helm charts it works via controller.add-headers. If lets encrypt is used, this is complicated, a solution here is yet unknown |
| 4.1.10 Ensure upstream server traffic is authenticated with a client certificate (Scored) | DEPENDS ON BACKEND | Highly dependent on backends, not every backend allows configuring this, can also be mitigated via a service mesh| If backend allows it, [manual is here](https://kubernetes.github.io/ingress-nginx/examples/auth/client-certs/)|
| 4.1.11 Ensure the upstream traffic server certificate is trusted (Not Scored) | DEPENDS ON BACKEND | Highly dependent on backends, not every backend allows configuring this, can also be mitigated via a service mesh| If backend allows it, [see configuration here](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md#backend-certificate-authentication) |
| 4.1.12 Ensure your domain is preloaded (Not Scored) | ACTION NEEDED| Preload is not active by default | Set controller.config.hsts-preload to true|
| 4.1.13 Ensure session resumption is disabled to enable perfect forward security (Scored)| OK | Session tickets are disabled by default | |
| 4.1.14 Ensure HTTP/2.0 is used (Not Scored) | OK | http2 is set by default| |
| ||| |
| __5 Request Filtering and Restrictions__||| |
| ||| |
| __5.1 Access Control__||| |
| 5.1.1 Ensure allow and deny filters limit access to specific IP addresses (Not Scored)| OK/ACTION NEEDED | Depends on use case, geo ip module is compiled into Ingress-Nginx Controller, there are several ways to use it | If needed set IP restrictions via annotations or work with config snippets (be careful with lets-encrypt-http-challenge!) |
| 5.1.2 Ensure only whitelisted HTTP methods are allowed (Not Scored) | OK/ACTION NEEDED | Depends on use case| If required it can be set via config snippet|
| ||| |
| __5.2 Request Limits__||| |
| 5.2.1 Ensure timeout values for reading the client header and body are set correctly (Scored) | ACTION NEEDED| Default timeout is 60s | Set via [this configuration parameter](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/configmap.md#client-header-timeout) and respective body equivalent|
| 5.2.2 Ensure the maximum request body size is set correctly (Scored)| ACTION NEEDED| Default is 1m| set via [this configuration parameter](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/configmap.md#proxy-body-size)|
| 5.2.3 Ensure the maximum buffer size for URIs is defined (Scored) | ACTION NEEDED| Default is 4 8k| Set via [this configuration parameter](https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/configmap.md#large-client-header-buffers)|
| 5.2.4 Ensure the number of connections per IP address is limited (Not Scored) | OK/ACTION NEEDED| No limit set| Depends on use case, limit can be set via [these annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#rate-limiting)|
| 5.2.5 Ensure rate limits by IP address are set (Not Scored) | OK/ACTION NEEDED| No limit set| Depends on use case, limit can be set via [these annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#rate-limiting)|
| ||| |
| __5.3 Browser Security__||| |
| 5.3.1 Ensure X-Frame-Options header is configured and enabled (Scored)| ACTION NEEDED| Header not set by default| Several ways to implement this - with the helm charts it works via controller.add-headers |
| 5.3.2 Ensure X-Content-Type-Options header is configured and enabled (Scored) | ACTION NEEDED| See previous answer| See previous answer |
| 5.3.3 Ensure the X-XSS-Protection Header is enabled and configured properly (Scored)| ACTION NEEDED| See previous answer| See previous answer |
| 5.3.4 Ensure that Content Security Policy (CSP) is enabled and configured properly (Not Scored) | ACTION NEEDED| See previous answer| See previous answer |
| 5.3.5 Ensure the Referrer Policy is enabled and configured properly (Not Scored)| ACTION NEEDED | Depends on application. It should be handled in the applications webserver itself, not in the load balancing ingress | check backend webserver |
| ||| |
| __6 Mandatory Access Control__| n/a| too high level, depends on backends | |

<style type="text/css" rel="stylesheet">
@media only screen and (min-width: 768px) {
	td:nth-child(1){
		white-space:normal !important;
    }

    .md-typeset table:not([class]) td {
        padding: .2rem .3rem;
    }
}
</style>

Hardening Guide  Do not use in multi tenant Kubernetes production installations  This project assumes that users that can create Ingress objects are administrators of the cluster      Overview There are several ways to do hardening and securing of nginx  In this documentation two guides are used  the guides are overlapping in some points      nginx CIS Benchmark  https   www cisecurity org benchmark nginx      cipherlist eu  https   cipherlist eu    one of many forks of the now dead project cipherli st   This guide describes  what of the different configurations described in those guides is already implemented as default in the nginx implementation of kubernetes ingress  what needs to be configured  what is obsolete due to the fact that the nginx is running as container  the CIS benchmark relates to a non containerized installation  and what is difficult or not possible   Be aware that this is only a guide and you are responsible for your own implementation  Some of the configurations may lead to have specific clients unable to reach your site or similar consequences   This guide refers to chapters in the CIS Benchmark  For full explanation you should refer to the benchmark document itself     Configuration Guide    Chapter in CIS benchmark   Status   Default   Action to do if not default                                                                                1 Initial Setup                     1 1 Installation          1 1 1 Ensure NGINX is installed  Scored   OK   done through helm charts   following documentation to deploy nginx ingress       1 1 2 Ensure NGINX is installed from source  Not Scored   OK   done through helm charts   following documentation to deploy nginx ingress                 1 2 Configure Software Updates          1 2 1 Ensure package manager repositories are properly configured  Not Scored    OK   done via helm  nginx version could be overwritten  however compatibility is not ensured then      1 2 2 Ensure the latest software package is installed  Not Scored   ACTION NEEDED   done via helm  nginx version could be overwritten  however compatibility is not ensured then  Plan for periodic updates               2 Basic Configuration                     2 1 Minimize NGINX Modules          2 1 1 Ensure only required modules are installed  Not Scored    OK   Already only needed modules are installed  however proposals for further reduction are welcome       2 1 2 Ensure HTTP WebDAV module is not installed  Scored    OK         2 1 3 Ensure modules with gzip functionality are disabled  Scored   OK         2 1 4 Ensure the autoindex module is disabled  Scored   OK   No autoindex configs so far in ingress defaults                2 2 Account Security          2 2 1 Ensure that NGINX is run using a non privileged  dedicated service account  Not Scored    OK   Pod configured as user www data   See this line in helm chart values  https   github com kubernetes ingress nginx blob 0cbe783f43a9313c9c26136e888324b1ee91a72f charts ingress nginx values yaml L10   Compiled with user www data   See this line in build script  https   github com kubernetes ingress nginx blob 5d67794f4fbf38ec6575476de46201b068eabf87 images nginx rootfs build sh L529        2 2 2 Ensure the NGINX service account is locked  Scored    OK   Docker design ensures this       2 2 3 Ensure the NGINX service account has an invalid shell  Scored   OK   Shell is nologin   see this line in build script  https   github com kubernetes ingress nginx blob 5d67794f4fbf38ec6575476de46201b068eabf87 images nginx rootfs build sh L613                 2 3 Permissions and Ownership           2 3 1 Ensure NGINX directories and files are owned by root  Scored    OK   Obsolete through docker design and ingress controller needs to update the configs dynamically      2 3 2 Ensure access to NGINX directories and files is restricted  Scored    OK   See previous answer      2 3 3 Ensure the NGINX process ID  PID  file is secured  Scored   OK   No PID File due to docker design       2 3 4 Ensure the core dump directory is secured  Not Scored   OK   No working directory configured by default                 2 4 Network Configuration           2 4 1 Ensure NGINX only listens for network connections on authorized ports  Not Scored   OK   Ensured by automatic nginx conf configuration      2 4 2 Ensure requests for unknown host names are rejected  Not Scored   OK   They are not rejected but send to the  default backend  delivering appropriate errors  mostly 404       2 4 3 Ensure keepalive timeout is 10 seconds or less  but not 0  Scored   ACTION NEEDED  Default is 75s   configure keep alive to 10 seconds  according to this documentation  https   github com kubernetes ingress nginx blob main docs user guide nginx configuration configmap md keep alive      2 4 4 Ensure send timeout is set to 10 seconds or less  but not 0  Scored   RISK TO BE ACCEPTED  Not configured  however the nginx default is 60s  Not configurable              2 5 Information Disclosure          2 5 1 Ensure server tokens directive is set to  off   Scored    OK   server tokens is configured to off by default      2 5 2 Ensure default error and index html pages do not reference NGINX  Scored    ACTION NEEDED  404 shows no version at all  503 and 403 show  nginx   which is hardcoded  see this line in nginx source code  https   github com nginx nginx blob master src http ngx http special response c L36    configure custom error pages at least for 403  404 and 503 and 500    2 5 3 Ensure hidden file serving is disabled  Not Scored    ACTION NEEDED   config not set   configure a config server snippet Snippet  but beware of  well known challenges or similar  Refer to the benchmark here please     2 5 4 Ensure the NGINX reverse proxy does not enable information disclosure  Scored   ACTION NEEDED  hide not configured  configure hide headers with array of  X Powered By  and  Server    according to this documentation  https   github com kubernetes ingress nginx blob main docs user guide nginx configuration configmap md hide headers                3 Logging                   3 1 Ensure detailed logging is enabled  Not Scored    OK   nginx ingress has a very detailed log format by default       3 2 Ensure access logging is enabled  Scored    OK   Access log is enabled by default       3 3 Ensure error logging is enabled and set to the info logging level  Scored   OK   Error log is configured by default  The log level does not matter  because it is all sent to STDOUT anyway       3 4 Ensure log files are rotated  Scored    OBSOLETE   Log file handling is not part of the nginx ingress and should be handled separately       3 5 Ensure error logs are sent to a remote syslog server  Not Scored    OBSOLETE   See previous answer      3 6 Ensure access logs are sent to a remote syslog server  Not Scored   OBSOLETE   See previous answer      3 7 Ensure proxies pass source IP information  Scored   OK   Headers are set by default                 4 Encryption                     4 1 TLS   SSL Configuration           4 1 1 Ensure HTTP is redirected to HTTPS  Scored    OK   Redirect to TLS is default       4 1 2 Ensure a trusted certificate and trust chain is installed  Not Scored   ACTION NEEDED  For installing certs there are enough manuals in the web  A good way is to use lets encrypt through cert manager   Install proper certificates or use lets encrypt with cert manager     4 1 3 Ensure private key permissions are restricted  Scored   ACTION NEEDED  See previous answer      4 1 4 Ensure only modern TLS protocols are used  Scored   OK ACTION NEEDED   Default is TLS 1 2   1 3  while this is okay for CIS Benchmark  cipherlist eu only recommends 1 3  This may cut off old OS s   Set controller config ssl protocols to  TLSv1 3     4 1 5 Disable weak ciphers  Scored    ACTION NEEDED  Default ciphers are already good  but cipherlist eu recommends even stronger ciphers   Set controller config ssl ciphers to  EECDH AESGCM EDH AESGCM     4 1 6 Ensure custom Diffie Hellman parameters are used  Scored    ACTION NEEDED  No custom DH parameters are generated  Generate dh parameters for each ingress deployment you use    see here for a how to  https   kubernetes github io ingress nginx examples customization ssl dh param       4 1 7 Ensure Online Certificate Status Protocol  OCSP  stapling is enabled  Scored    ACTION NEEDED   Not enabled   set via  this configuration parameter  https   kubernetes github io ingress nginx user guide nginx configuration configmap  enable ocsp      4 1 8 Ensure HTTP Strict Transport Security  HSTS  is enabled  Scored   OK   HSTS is enabled by default       4 1 9 Ensure HTTP Public Key Pinning is enabled  Not Scored   ACTION NEEDED   RISK TO BE ACCEPTED   HKPK not enabled by default   If lets encrypt is not used  set correct HPKP header  There are several ways to implement this   with the helm charts it works via controller add headers  If lets encrypt is used  this is complicated  a solution here is yet unknown     4 1 10 Ensure upstream server traffic is authenticated with a client certificate  Scored    DEPENDS ON BACKEND   Highly dependent on backends  not every backend allows configuring this  can also be mitigated via a service mesh  If backend allows it   manual is here  https   kubernetes github io ingress nginx examples auth client certs      4 1 11 Ensure the upstream traffic server certificate is trusted  Not Scored    DEPENDS ON BACKEND   Highly dependent on backends  not every backend allows configuring this  can also be mitigated via a service mesh  If backend allows it   see configuration here  https   github com kubernetes ingress nginx blob main docs user guide nginx configuration annotations md backend certificate authentication      4 1 12 Ensure your domain is preloaded  Not Scored    ACTION NEEDED  Preload is not active by default   Set controller config hsts preload to true    4 1 13 Ensure session resumption is disabled to enable perfect forward security  Scored   OK   Session tickets are disabled by default       4 1 14 Ensure HTTP 2 0 is used  Not Scored    OK   http2 is set by default                5 Request Filtering and Restrictions                    5 1 Access Control          5 1 1 Ensure allow and deny filters limit access to specific IP addresses  Not Scored   OK ACTION NEEDED   Depends on use case  geo ip module is compiled into Ingress Nginx Controller  there are several ways to use it   If needed set IP restrictions via annotations or work with config snippets  be careful with lets encrypt http challenge       5 1 2 Ensure only whitelisted HTTP methods are allowed  Not Scored    OK ACTION NEEDED   Depends on use case  If required it can be set via config snippet              5 2 Request Limits          5 2 1 Ensure timeout values for reading the client header and body are set correctly  Scored    ACTION NEEDED  Default timeout is 60s   Set via  this configuration parameter  https   github com kubernetes ingress nginx blob main docs user guide nginx configuration configmap md client header timeout  and respective body equivalent    5 2 2 Ensure the maximum request body size is set correctly  Scored   ACTION NEEDED  Default is 1m  set via  this configuration parameter  https   github com kubernetes ingress nginx blob main docs user guide nginx configuration configmap md proxy body size     5 2 3 Ensure the maximum buffer size for URIs is defined  Scored    ACTION NEEDED  Default is 4 8k  Set via  this configuration parameter  https   github com kubernetes ingress nginx blob main docs user guide nginx configuration configmap md large client header buffers     5 2 4 Ensure the number of connections per IP address is limited  Not Scored    OK ACTION NEEDED  No limit set  Depends on use case  limit can be set via  these annotations  https   kubernetes github io ingress nginx user guide nginx configuration annotations  rate limiting     5 2 5 Ensure rate limits by IP address are set  Not Scored    OK ACTION NEEDED  No limit set  Depends on use case  limit can be set via  these annotations  https   kubernetes github io ingress nginx user guide nginx configuration annotations  rate limiting               5 3 Browser Security          5 3 1 Ensure X Frame Options header is configured and enabled  Scored   ACTION NEEDED  Header not set by default  Several ways to implement this   with the helm charts it works via controller add headers     5 3 2 Ensure X Content Type Options header is configured and enabled  Scored    ACTION NEEDED  See previous answer  See previous answer     5 3 3 Ensure the X XSS Protection Header is enabled and configured properly  Scored   ACTION NEEDED  See previous answer  See previous answer     5 3 4 Ensure that Content Security Policy  CSP  is enabled and configured properly  Not Scored    ACTION NEEDED  See previous answer  See previous answer     5 3 5 Ensure the Referrer Policy is enabled and configured properly  Not Scored   ACTION NEEDED   Depends on application  It should be handled in the applications webserver itself  not in the load balancing ingress   check backend webserver               6 Mandatory Access Control    n a  too high level  depends on backends       style type  text css  rel  stylesheet    media only screen and  min width  768px     td nth child 1     white space normal  important              md typeset table not  class   td           padding   2rem  3rem            style