From 010ec6f15946f5f8d49b7dc8e8e015a855b29a2e Mon Sep 17 00:00:00 2001 From: Sablu Miah Date: Thu, 28 Nov 2019 15:16:09 +0000 Subject: [PATCH] Remove extra annotation when Enabling ModSecurity Since version 0.25, if you try to use both annotations of: nginx.ingress.kubernetes.io/modsecurity-snippet: | Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf Include /etc/nginx/modsecurity/modsecurity.conf and nginx.ingress.kubernetes.io/enable-modsecurity: "true" it breaks nginx config and you will not catch it unless you have nginx admission controller enabled. You do not need the annotation of `Include /etc/nginx/modsecurity/modsecurity.conf` from version 0.25 --- docs/user-guide/nginx-configuration/annotations.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index fbbd89327..134cab0f9 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -782,11 +782,18 @@ Note: If you use both `enable-owasp-core-rules` and `modsecurity-snippet` annota `modsecurity-snippet` will take effect. If you wish to include the [OWASP Core Rule Set](https://www.modsecurity.org/CRS/Documentation/) or [recommended configuration](https://github.com/SpiderLabs/ModSecurity/blob/v3/master/modsecurity.conf-recommended) simply use the include statement: + +nginx 0.24.1 and below ```yaml nginx.ingress.kubernetes.io/modsecurity-snippet: | Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf Include /etc/nginx/modsecurity/modsecurity.conf ``` +nginx 0.25.0 and above +```yaml +nginx.ingress.kubernetes.io/modsecurity-snippet: | +Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf +``` ### InfluxDB