[WAF] AWS resources disassociated issue of ALB ingress.

[heungh]

Hello.

I'm using EKS's cluster by uploading three. Each cluster exposes a front web page using an Application Load Balancer. We decided to introduce AWS WAF according to the company's security policy, and we plan to use it with ALB.
I configured the AWS reference with the link below.
How do I create an ALB Ingress in Amazon EKS and associate the ALB Ingress with AWS WAF?

• https://aws.amazon.com/premiumsupport/knowledge-center/eks-alb-ingress-aws-waf/

Q1. AWS WAF WebACL was created, and three ALBs corresponding to Associated AWS resources were selected. It seemed to go well in the initial setup, but I don't know the exact time, but in about 30 minutes, the corresponding ALB disappeared from the Associated AWS resources item. Why? It can be seen that the corresponding waf-id is also entered in the EKS Ingress.

Q2. Looking through the guide documentation, I found these phrases. How do you interpret it correctly? Can you please tell me whether one ALB per WebACL or 3 ALBs per WebACL is allowed?
https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.html
As stated in the documentation: 'You can associate each AWS resource with only one web ACL. The relationship between web ACL and AWS resources is one-to-many.'

Q3. Is there any part to add waf-id other than annotation in EKS Ingress?

Q4. From an architecture point of view, is it good to use WAF with EKS ALB or is it better to use WAF after connecting EKS ALB to CloudFront? I would like to give you opinions from various aspects such as security issues, network speed, etc.

[kishorj]

@heungh, can you confirm you use WAF v2? If so, do you mind sharing your controller logs?

For WAFv2 you need to specify the acl arn via the following ingress annotation

alb.ingress.kubernetes.io/wafv2-acl-arn

Q2: You should be able share single ACL with multiple ALBs.

Q3: Ingress annotation is the only way for ALB

Q4: It depends whether you need cloudfront functionality. You could check from the following link https://aws.amazon.com/cloudfront/features/?whats-new-cloudfront.sort-by=item.additionalFields.postDateTime&whats-new-cloudfront.sort-order=desc. We are not able to provide further details without a clear understanding of the requirements.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.