Skip to content

Commit e82d9e9

Browse files
akananthakananth
authored
Merge pull request #4 from akananth/main
merger
2 parents 6ecc87e + a043b56 commit e82d9e9

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

74 files changed

+1167
-2645
lines changed

‎.DS_Store

-6 KB
Binary file not shown.

‎README.md

Lines changed: 83 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,104 @@
1-
## Overview
1+
# Deploying NGINX Ingress Controller with NGINX WAFv5 in AWS
2+
---------------------------------------------------------------
23

3-
This is a consolidated automation repo for different verified designs customer use case examples using `F5 Nginx`. Users can use this to test a specific use case end to end by using the automation code available in this repo. </br>
4-
</br>
5-
**NOTE: To learn about each use case check the devcentral article link provided in each scenario folder README** </br>
6-
</br>
4+
Introduction :
5+
---------------
6+
This demo guide offers a step-by-step walkthrough for configuring the NGINX Ingress Controller with NGINX App Protect v5 on AWS Cloud, using Terraform scripts to automate the deployment. For more information, refer to the devcentral article: <Coming Soon>
77

88

9+
## Getting Started
10+
911
## Prerequisites
1012

11-
* [AWS Account](https://aws.amazon.com) - Due to the assets being created, free tier will not work.
12-
* The F5 NGINX App Protect AMI being used from the [AWS Marketplace](https://aws.amazon.com/marketplace) should be subsribed to your account
13-
* Please make sure resources like VPC and Elastic IP's are below the threshold limit in that aws region
13+
* [NGINX Plus with App Protect and NGINX Ingress Controller license](https://www.nginx.com/free-trial-request/)
14+
* [AWS Account](https://aws.amazon.com) - Due to the assets being created, the free tier will not work.
1415
* [GitHub Account](https://github.com)
1516

16-
## Steps to execute
17+
## Assets
18+
19+
* **nap:** NGINX Ingress Controller for Kubernetes with NGINX App Protect (WAF and API Protection)
20+
* **infra:** AWS Infrastructure (VPC, IGW, etc.)
21+
* **eks:** AWS Elastic Kubernetes Service
22+
* **arcadia:** Arcadia Finance test web application and API
23+
* **policy:** NGINX WAF Compiler Docker and Policy
24+
* **S3:** Amazon S3 bucket and IAM role and policy for storage.
25+
26+
## Tools
27+
28+
* **Cloud Provider:** AWS
29+
* **IAC:** Terraform
30+
* **IAC State:** Amazon S3
31+
* **CI/CD:** GitHub Actions
32+
33+
34+
## GitHub Secrets Configuration
35+
36+
This workflow requires the following secrets to be configured in your GitHub repository:
37+
38+
### Required Secrets
39+
40+
| Secret Name | Type | Description | Example Value/Format |
41+
|------------------------|---------|-----------------------------------------------------------------------------|----------------------------|
42+
| `AWS_ACCESS_KEY_ID` | Secret | AWS IAM user access key ID with sufficient permissions | `AKIAXXXXXXXXXXXXXXXX` |
43+
| `AWS_SECRET_ACCESS_KEY` | Secret | Corresponding secret access key for the AWS IAM user | (40-character mixed case string) |
44+
| `AWS_SESSION_TOKEN` | Secret | Session token for temporary AWS credentials (if using MFA) | (Base64-encoded string) |
45+
| `NGINX_JWT` | Secret | JSON Web Token for NGINX license authentication | `eyJhbGciOi...` (JWT format) |
46+
| `NGINX_CRT` | Secret | NGINX Certificate in PKCS#12 format | `api.p12` file contents |
47+
| `NGINX_KEY` | Secret | Private key for securing HTTPS and verifying SSL/TLS certificates | YourCertificatePasrivatekey|
48+
49+
### How to Add Secrets
50+
51+
1. Navigate to your GitHub repository
52+
2. Go to **Settings** → **Secrets and variables** → **Actions**
53+
3. Click **New repository secret**
54+
4. Enter the secret name exactly as shown above
55+
5. Paste the secret value
56+
6. Click **Add secret**
57+
58+
59+
## Workflow Runs
60+
61+
**STEP 1:** Check out a branch for the workflow you wish to run using the following naming convention.
62+
63+
**DEPLOY**
64+
65+
| Workflow | Branch Name |
66+
| ------------ | ---------------- |
67+
| NGINX V5-NIC/NAP Apply| apply-NIC/NAP |
1768

18-
1. Clone the repo locally and update AWS credentials like `access keys`, `secret key` and `session token` be in `settings` --> `Secrets` --> `Actions` section <br />
19-
![image](https://user-images.githubusercontent.com/6093830/209962425-1c3452ec-9b32-4509-adb5-cc85d4a67a10.png)
20-
> Note: Above values typically expire in every 12 hours. If you are not using session token please remove this field accordingly in workflow file step name-`configure aws credentials` in all jobs
69+
70+
**DESTROY**
71+
72+
| Workflow | Branch Name |
73+
| ------------ | ----------------- |
74+
| NGINX V5-NIC/NAP Destroy| destroy-NIC/NAP |
2175

22-
2. EC2 keys should be updated properly in `settings` --> `Secrets` --> `Actions` section <br />
23-
> Note: Make sure passwords follow company security standards like alpha numeric, etc. <br />
2476

25-
3. EC2 key related pem and pub file should be copied to terraform folder in your use case<br />
2677

27-
4. Make sure you have subscribed to the `NGINX App Protect AMI` in AWS account <br />
78+
**STEP 2:** Rename `infra/terraform.tfvars.examples` to `infra/terraform.tfvars` and add the following data:
79+
* project_prefix = "Your project identifier name in **lower case** letters only - this will be applied as a prefix to all assets"
80+
* resource_owner = "Your-name"
81+
* aws_region = "AWS Region" ex. us-east-1
82+
* azs = ["us-east-1a", "us-east1b"] - Change to Correct Availability Zones based on selected Region
83+
* Also update assets boolean value as per your work-flows
2884

29-
5. Update your `ENV` variables in `/data/testbed-data.json` file in your use case folder <br />
85+
**STEP 3:** In the `S3 directory`, inside the `variable.tf` file modify the following data
86+
* description = "S3 bucket for Terraform remote state storage"
87+
* default = "your-unique-bucket-name" # Replace with your actual bucket name
88+
3089

31-
6. Install self hosted runner and add it to this repo <br />
90+
**STEP 4:** Commit and push your build branch to your forked repo
91+
* Build will run and can be monitored in the GitHub Actions tab and TF Cloud console
3292

33-
7. Make sure `awscli`, `kubectl`, `ansible-playbook`, `pytest`, `git` and other required tools are installed in this private custom runner. Refer `requirements.txt` file for more details <br />
3493

35-
> Note: Please install and make sure python packages like `pytest-html`, `awscli==1.18.105` and `botocore==1.17.28` are available with their correct versions in runner to avoid failures <br />
94+
**STEP 5:** Once the pipeline is complete, verify that your assets were deployed or destroyed based on your workflow.
3695

37-
8. Go to `Actions` tab and select your article work-flow <br />
96+
**NOTE:** The autocert process takes time. It may be 5 to 10 minutes before Let's Encrypt has provided the cert.
3897

39-
9. Click on `Run Workflow` option and execute it <br />
4098

41-
10. Check the CI/CD jobs execution and check the artifacts for more details <br />
42-
<br />
99+
## Development
43100

101+
Outline any requirements to setup a development environment if someone would like to contribute. You may also link to another file for this information.
44102

45103
## Support
46104

@@ -56,7 +114,7 @@ Please refer to the [F5 DevCentral Community Code of Conduct](code_of_conduct.md
56114

57115
## Copyright
58116

59-
Copyright 2014-2023 F5 Networks Inc.
117+
Copyright 2014-2020 F5 Networks Inc.
60118

61119
### F5 Networks Contributor License Agreement
62120

0 commit comments

Comments
 (0)