topic Question about CG-WAF support to private-cloud kubernetes like openshift and DIY-K8s in WAF

Question about CG-WAF support to private-cloud kubernetes like openshift and DIY-K8s

iamraylau — Mon, 20 Jan 2025 09:23:16 GMT

Hi all,

I am building my own lab for CG WAF with an on-premise DIY-K8s environment. I used the NFS as the StorageClass and the PVC are good. Modifying the values.yaml from the helm package file to claim the on premise NFS share from SC during installation. All the installation process seems good but the nano agent never showing online... even the pvc status are claimed successfully.

Questions:

1. Will Check Point have a roadmap to provide the Nginx ingress with nano agent for on-premise K8s?

2. Do we have any install procedure for on-premise K8s at this moment?

thank you.

Ray Lau

Re: Question about CG-WAF support to private-cloud kubernetes like openshift and DIY-K8s

Nir_Shamir — Mon, 20 Jan 2025 09:28:24 GMT

have you checked the admin guide ?

https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/kubernetes-ingress

Re: Question about CG-WAF support to private-cloud kubernetes like openshift and DIY-K8s

iamraylau — Mon, 20 Jan 2025 09:34:12 GMT

of cause i did....

as i know, currently support AWS Elastic Kubernetes Service (EKS) or Azure Kubernetes Service (AKS)

and i am trying an on-premise K8s deployment.

Re: Question about CG-WAF support to private-cloud kubernetes like openshift and DIY-K8s

yuvalmamka — Mon, 20 Jan 2025 11:20:40 GMT

Hi,

As you mentioned - CloudGuard WAF for Kubernetes Ingress is supported for AWS Elastic Kubernetes Service (EKS) or Azure Kubernetes Service (AKS) only.

You can try use our open-source addition that supports on-premise K8s - open-appsec.
You can find additional information here: open-appsec | Automatic Open Source WAF & API Security

Re: Question about CG-WAF support to private-cloud kubernetes like openshift and DIY-K8s

iamraylau — Tue, 21 Jan 2025 04:09:54 GMT

open appsec is not my ultimate goal... do the CloudGuard WAF have roadmap to support the on-premise K8s cluster? It should not have differences to AKS or EKS...because it should be a portable container.