modsecurity-crs-proxy/values.yaml at main · PHOENIX-MEDIA/modsecurity-crs-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
# Default values for modsecurity-crs-proxy.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1

image:
  repository: owasp/modsecurity-crs
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

# IMPORTANT: set your backend service where the traffic should be forwarded to
backend: "http://my-app.svc.cluster.local:80"

# see https://github.com/coreruleset/modsecurity-crs-docker?tab=readme-ov-file#modsecurity-env-variables
env:
  - name: PORT
    value: "8080"
  - name: SERVER_TOKENS
    value: ProductOnly
  # set to "DetectionOnly" or "Off" to disable blocking
  - name: MODSEC_RULE_ENGINE
    value: "On"
  - name: PARANOIA
    value: "3"
  - name: BLOCKING_PARANOIA
    value: "3"
#  - name: MODSEC_DEBUG_LOG
#    value: "/dev/stdout"
#  - name: MODSEC_DEBUG_LOGLEVEL
#    value: "9"

securityRules:
  modsecurity-override.conf: |-
    # Use this file if you need to override specific parts that are not in environment variables

  REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf: |-
    # The purpose of this file is to hold LOCAL exceptions for your site.  The
    # types of rules that would go into this file are one where you want to
    # short-circuit inspection and allow certain transactions to pass through
    # inspection or if you want to alter rules that are applied.

    # skip health check
    SecRule REQUEST_URI "@streq /healthz" "id:10001,phase:1,pass,nolog,ctl:ruleEngine=Off"

  RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf: |-
    # The purpose of this file is to hold LOCAL exceptions for your site.
    # The types of rules that would go into this file are one where you want
    # to unconditionally disable rules or modify their actions during startup.

annotations: {}
podAnnotations: {}
podLabels: {}

podSecurityContext: {}
  # fsGroup: 2000

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

podDisruptionBudget:
  enabled: false
  minAvailable: 0
  maxUnavailable: 1

service:
  type: ClusterIP
  port: 8080

ingress:
  enabled: false
  className: ""
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  hosts:
    - host: chart-example.local
      paths:
        - path: /
          pathType: ImplementationSpecific
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

resources:
  # limits:
  #   cpu: 2000m
  #   memory: 1024Mi
  requests:
    cpu: 250m
    memory: 256Mi

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 3
  targetCPUUtilizationPercentage: 70
  # targetMemoryUtilizationPercentage: 75

geoip:
  enabled: false
  downloadUrl: ""
  downloadToken: ""
  downloadCommand: ""

  persistence:
    enabled: true
    name: geoip-database
    existingClaim: ""
    annotations: {}
    labels: {}
    size: 1Gi
    storageClassName: "files"
    accessModes:
      - ReadWriteMany

# Additional volumes on the output Deployment definition.
volumes:
  - name: security-rules
    configMap:
      name: security-rules

# Additional volumeMounts on the output Deployment definition.
volumeMounts:
  - name: security-rules
    mountPath: /etc/modsecurity.d/modsecurity-override.conf
    subPath: modsecurity-override.conf
  - name: security-rules
    mountPath: /etc/modsecurity.d/owasp-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
    subPath: REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
  - name: security-rules
    mountPath: /etc/modsecurity.d/owasp-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
    subPath: RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf

nodeSelector: {}

tolerations: []

affinity: {}

# extra K8s manifests to deploy
extraObjects: []