Add support for App Protect DoS

api/v1alpha1/nginxingresscontroller_types.go

@@ -154,6 +154,12 @@ type NginxIngressControllerSpec struct {
 	// +nullable
 	// +operator-sdk:csv:customresourcedefinitions:type=spec
 	AppProtect *AppProtect `json:"appProtect"`
+	// App Protect Dos support configuration.
+	// Requires enableCRDs set to true.
+	// +kubebuilder:validation:Optional
+	// +nullable
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	AppProtectDos *AppProtectDos `json:"appProtectDos"`
 	// Timeout in milliseconds which the Ingress Controller will wait for a successful NGINX reload after a change or at the initial start.
 	// +kubebuilder:validation:Optional
 	// +operator-sdk:csv:customresourcedefinitions:type=spec
@@ -268,8 +274,22 @@ type Prometheus struct {
 
 // AppProtect support configuration.
 type AppProtect struct {
-	// Enable App Protect.
+	// Enable App Protect WAF.
+	Enable bool `json:"enable"`
+}
+
+// AppProtectDos support configuration.
+type AppProtectDos struct {
+	// Enable App Protect Dos.
 	Enable bool `json:"enable"`
+	// Enable debug mode.
+	Debug bool `json:"debug"`
+	// Max number of ADMD instances.
+	MaxDaemons int `json:"maxDaemons"`
+	// Max number of nginx processes to support.
+	MaxWorkers int `json:"maxWorkers"`
+	// RAM memory size in MB.
+	Memory int `json:"memory"`
 }
 
 // Service defines the Service for the Ingress Controller.

config/crd/bases/k8s.nginx.org_nginxingresscontrollers.yaml

@@ -43,11 +43,38 @@ spec:
                 nullable: true
                 properties:
                   enable:
-                    description: Enable App Protect.
+                    description: Enable App Protect WAF.
                     type: boolean
                 required:
                 - enable
                 type: object
+              appProtectDos:
+                description: App Protect Dos support configuration. Requires enableCRDs
+                  set to true.
+                nullable: true
+                properties:
+                  debug:
+                    description: Enable debug mode.
+                    type: boolean
+                  enable:
+                    description: Enable App Protect Dos.
+                    type: boolean
+                  maxDaemons:
+                    description: Max number of ADMD instances.
+                    type: integer
+                  maxWorkers:
+                    description: Max number of nginx processes to support.
+                    type: integer
+                  memory:
+                    description: RAM memory size in MB.
+                    type: integer
+                required:
+                - debug
+                - enable
+                - maxDaemons
+                - maxWorkers
+                - memory
+                type: object
               configMapData:
                 additionalProperties:
                   type: string

config/rbac/role.yaml

@@ -38,6 +38,7 @@ rules:
   - update
 - apiGroups:
   - appprotect.f5.com
+  - appprotectdos.f5.com
   - k8s.nginx.org
   resources:
   - '*'

controllers/nginxingresscontroller_controller.go

@@ -55,7 +55,7 @@ type NginxIngressControllerReconciler struct {
 //+kubebuilder:rbac:groups=k8s.nginx.org,resources=nginxingresscontrollers,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=k8s.nginx.org,resources=nginxingresscontrollers/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=k8s.nginx.org,resources=nginxingresscontrollers/finalizers,verbs=update
-//+kubebuilder:rbac:groups=k8s.nginx.org;appprotect.f5.com,resources=*,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=k8s.nginx.org;appprotect.f5.com;appprotectdos.f5.com,resources=*,verbs=get;list;watch;create;update;patch;delete
 
 //+kubebuilder:rbac:groups=apps,resources=deployments;daemonsets;replicasets;statefulsets,verbs=get;list;watch;create;update;patch;delete
 

controllers/rbac.go

@@ -62,6 +62,11 @@ func clusterRoleForNginxIngressController(name string) *rbacv1.ClusterRole {
 			APIGroups: []string{"appprotect.f5.com"},
 			Resources: []string{"aplogconfs", "appolicies", "apusersigs"},
 		},
+		{
+			Verbs:     []string{"get", "list", "watch"},
+			APIGroups: []string{"appprotectdos.f5.com"},
+			Resources: []string{"apdoslogconfs", "apdospolicies", "dosprotectedresources"},
+		},
 	}
 	rbac := &rbacv1.ClusterRole{
 		ObjectMeta: v1.ObjectMeta{

controllers/rbac_test.go

@@ -70,6 +70,11 @@ func TestClusterRoleForNginxIngressController(t *testing.T) {
 				APIGroups: []string{"appprotect.f5.com"},
 				Resources: []string{"aplogconfs", "appolicies", "apusersigs"},
 			},
+			{
+				Verbs:     []string{"get", "list", "watch"},
+				APIGroups: []string{"appprotectdos.f5.com"},
+				Resources: []string{"apdoslogconfs", "apdospolicies", "dosprotectedresources"},
+			},
 		},
 	}
 

controllers/utils.go

@@ -38,6 +38,21 @@ func generatePodArgs(instance *k8sv1alpha1.NginxIngressController) []string {
 		if instance.Spec.AppProtect != nil && instance.Spec.AppProtect.Enable {
 			args = append(args, "-enable-app-protect")
 		}
+		if instance.Spec.AppProtectDos != nil && instance.Spec.AppProtectDos.Enable {
+			args = append(args, "-enable-app-protect-dos")
+			if instance.Spec.AppProtectDos.Debug {
+				args = append(args, "-app-protect-dos-debug")
+			}
+			if instance.Spec.AppProtectDos.MaxDaemons != 0 {
+				args = append(args, fmt.Sprintf("-app-protect-dos-max-daemons=%v", instance.Spec.AppProtectDos.MaxDaemons))
+			}
+			if instance.Spec.AppProtectDos.MaxWorkers != 0 {
+				args = append(args, fmt.Sprintf("-app-protect-dos-max-workers=%v", instance.Spec.AppProtectDos.MaxWorkers))
+			}
+			if instance.Spec.AppProtectDos.Memory != 0 {
+				args = append(args, fmt.Sprintf("-app-protect-dos-memory=%v", instance.Spec.AppProtectDos.Memory))
+			}
+		}
 	}
 
 	if instance.Spec.IngressClass != "" {

controllers/utils_test.go

@@ -232,6 +232,13 @@ func TestGeneratePodArgs(t *testing.T) {
 					AppProtect: &k8sv1alpha1.AppProtect{
 						Enable: true,
 					},
+					AppProtectDos: &k8sv1alpha1.AppProtectDos{
+						Enable:     true,
+						Debug:      true,
+						MaxDaemons: 12,
+						MaxWorkers: 3,
+						Memory:     512,
+					},
 					NginxReloadTimeout:    5000,
 					EnableCRDs:            &disable,
 					EnableSnippets:        true,
@@ -243,6 +250,11 @@ func TestGeneratePodArgs(t *testing.T) {
 				"-default-server-tls-secret=my-nginx-ingress/my-secret",
 				"-nginx-plus",
 				"-enable-app-protect",
+				"-enable-app-protect-dos",
+				"-app-protect-dos-debug",
+				"-app-protect-dos-max-daemons=12",
+				"-app-protect-dos-max-workers=3",
+				"-app-protect-dos-memory=512",
 				"-ingress-class=ingressClass",
 				"-watch-namespace=default",
 				"-health-status",

docs/nginx-ingress-controller.md

@@ -1,7 +1,7 @@
 # NginxIngressController Custom Resource
 
-The `NginxIngressController` Custom Resource is the definition of a deployment of the Ingress Controller. 
-With this Custom Resource, the NGINX Ingress Operator will be able to deploy and configure instances of the Ingress Controller in your cluster.  
+The `NginxIngressController` Custom Resource is the definition of a deployment of the Ingress Controller.
+With this Custom Resource, the NGINX Ingress Operator will be able to deploy and configure instances of the Ingress Controller in your cluster.
 
 ## Configuration
 
@@ -25,7 +25,7 @@ spec:
 ```
 
  The following example shows the usage of all fields (required and optional):
- 
+
 ```yaml
  apiVersion: k8s.nginx.org/v1alpha1
  kind: NginxIngressController
@@ -73,8 +73,8 @@ spec:
    nginxReloadTimeout: 5000
    appProtect:
      enable: false
- ``` 
- 
+ ```
+
 | Field | Type | Description | Required |
 | --- | --- | --- | --- |
 | `type` | `string` | The type of the Ingress Controller installation - `deployment` or `daemonset`. | Yes |
@@ -100,7 +100,8 @@ spec:
 | `configMapData` | `map[string]string` | Initial values of the Ingress Controller ConfigMap. Check the [ConfigMap docs](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) for more information about possible values. | No |
 | `globalConfiguration` | `string` | The GlobalConfiguration resource for global configuration of the Ingress Controller. Format is namespace/name. Requires `enableCRDs` set to `true`. | No |
 | `enableTLSPassthrough` | `boolean` | Enable TLS Passthrough on port 443. Requires `enableCRDs` set to `true`. | No |
-| `appprotect` | [appprotect](#nginxingresscontrollerappprotect) | App Protect support configuration. Requires `nginxPlus` set to `true`. | No |
+| `appProtect` | [appProtect](#nginxingresscontrollerappprotect) | App Protect WAF support configuration. Requires `nginxPlus` set to `true`. | No |
+| `appProtectDos` | [appProtectDos](#nginxingresscontrollerappprotectdos) | App Protect DoS support configuration. Requires `nginxPlus` set to `true`. | No |
 | `nginxReloadTimeout` | `int`| Timeout in milliseconds which the Ingress Controller will wait for a successful NGINX reload after a change or at the initial start. (default is 4000. Default is 20000 instead if `enable-app-protect` is true) | No |
 
 ## NginxIngressController.Image
@@ -153,4 +154,14 @@ spec:
 
 | Field | Type | Description | Required |
 | --- | --- | --- | --- |
-| `enable` | `boolean` | Enable App Protect. | Yes |
+| `enable` | `boolean` | Enable App Protect WAF. | Yes |
+
+## NginxIngressController.AppProtectDos
+
+| Field | Type | Description | Required |
+| --- | --- | --- | --- |
+| `enable` | `boolean` | Enable App Protect DoS. | Yes |
+| `debug` | `boolean` | Enable debug mode. | No |
+| `maxDaemons` | `int` | Maximum number of ADMD instances. | No |
+| `maxWorkers` | `int` | Max number of nginx processes to support. | No |
+| `memory` | `int` | RAM memory size to consume in MB. | No |