Commit 393bc3a5 authored by Lucas Charles's avatar Lucas Charles Committed by Thong Kuah
Browse files

feat: Add support for modsecurity secruleengine configuration 

In support of https://gitlab.com/gitlab-org/gitlab/issues/8558, this
MR adds support for passing `MODSECURITY_SEC_RULE_ENGINE` to the
underlying chart to customize execution of modsecurity within the
ingress nginx configuration.

This configuration is enabled as "DetectionOnly" by default within the
nginx-controller ConfigMap but overridable per ingress resource. This
allows customization of the specific handling of the ruleset, in this
case enabling the engine to be toggled to "Off" or "On" to either
disable rulechecks entirely or enable blocking mode.

This MR is paired with
https://gitlab.com/gitlab-org/charts/auto-deploy-app/merge_requests/12
which adds the necessary fields to the chart
parent 50b31564

src/bin/auto-deploy

+8 −0
Original line number Diff line number Diff line
@@ -118,6 +118,10 @@ function deploy() { 
    secret_name=''

  fi



  if [[ -n "$AUTO_DEVOPS_MODSECURITY_SEC_RULE_ENGINE" ]]; then

    modsecurity_enabled="true"

  fi



  create_application_secret "$track"



  # shellcheck disable=SC2086 # double quote variables to prevent globbing
@@ -161,6 +165,8 @@ function deploy() { 
      --set postgresql.postgresDatabase="$POSTGRES_DB" \

      --set postgresql.imageTag="$POSTGRES_VERSION" \

      --set application.initializeCommand="$DB_INITIALIZE" \

      --set ingress.modSecurity.enabled="$modsecurity_enabled" \

      --set ingress.modSecurity.secRuleEngine="$AUTO_DEVOPS_MODSECURITY_SEC_RULE_ENGINE" \

      $HELM_UPGRADE_EXTRA_ARGS \

      --namespace="$KUBE_NAMESPACE" \

      "$name" \
@@ -204,6 +210,8 @@ function deploy() { 
      --set postgresql.postgresDatabase="$POSTGRES_DB" \

      --set postgresql.imageTag="$POSTGRES_VERSION" \

      --set application.migrateCommand="$DB_MIGRATE" \

      --set ingress.modSecurity.enabled="$modsecurity_enabled" \

      --set ingress.modSecurity.secRuleEngine="$AUTO_DEVOPS_MODSECURITY_SEC_RULE_ENGINE" \

      $HELM_UPGRADE_EXTRA_ARGS \

      --namespace="$KUBE_NAMESPACE" \

      "$name" \