Merge pull request #91 from SmartColumbusOS/waf

waf arn annotation added to ingress

Jenkinsfile

@@ -78,6 +78,7 @@ def deployUiTo(params = [:]) {
         def ingressScheme = internal ? 'internal' : 'internet-facing'
         def dnsZone = terraformOutputs.internal_dns_zone_name.value
         def rootDnsZone = terraformOutputs.root_dns_zone_name.value
+        def wafARN = terraformOutputs.eks_cluster_waf_acl_arn.value
 
         sh("""#!/bin/bash
             set -e
@@ -93,6 +94,7 @@ def deployUiTo(params = [:]) {
                 --set ingress.dnsZone="${dnsZone}" \
                 --set ingress.rootDnsZone="${rootDnsZone}" \
                 --set ingress.certificateARN="${certificateARNs}" \
+                --set ingress.wafARN="${wafARN}" \
                 --set image.tag="${env.GIT_COMMIT_HASH}"
         """.trim())
     }

chart/templates/ingress.yaml

@@ -13,6 +13,7 @@ metadata:
     alb.ingress.kubernetes.io/actions.redirect: '{"Type": "redirect", "RedirectConfig":{"Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
     alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
     alb.ingress.kubernetes.io/ssl-policy: "ELBSecurityPolicy-TLS-1-2-2017-01"
+    alb.ingress.kubernetes.io/wafv2-acl-arn: {{ .Values.ingress.wafARN }}
 spec:
   backend:
     serviceName: {{ .Chart.Name }}

chart/values.yaml

@@ -10,6 +10,7 @@ ingress:
   subnets: ""
   securityGroups: ""
   certificateARN: ""
+  wafARN: ""
   dnsZone: "localhost"
   rootDnsZone: "localhost"
 service: