= openshift-operator-airlock-waf

== workflow(s)

image::http://www.plantuml.com/plantuml/proxy?src=https://raw.github.com/baloise-incubator/openshift-operator-airlock-waf/master/workflow.puml[workflow]

== metadata

=== ideas

We've discussed two ideas

- defining a https://docs.okd.io/3.11/admin_guide/custom_resource_definitions.html[CustomResourceDefinitions (CRD)] and listend for change events here
- listening for e.g. route - see https://docs.okd.io/3.11/architecture/networking/routes.html[architecture] and https://docs.okd.io/3.11/rest_api/route_openshift_io/route-route-openshift-io-v1.html[API] - change events and https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/[annotation] the e.g. route with required information to create / update / maintain a WAF mapping

For now we go with the second approach.

=== WAF -> OpenShift attribute & annotation mapping

[source,yaml]
----
apiVersion: "stable.baloise.ch/v1beta"
kind: WafMapping
metadata:
  name: demoapp
spec:
  mappingName: <mapping-name>                 #(1)
  mappingEntryPath: <mapping-entry-path>      #(2)
  mappingBackendPath: <mapping-backend-path>  #(3)
  backendGroupName: <backendgroup-name>       #(4)
  backendName: <backend-name>                 #(5)
  backendProtocol: <backend-protocol>         #(6)
  backendPort: <backend-port>                 #(7)
  vhostName: <vhost-name>                     #(8)
----
<1> 
<2> 
<3> 
<4> 
<5> 
<6> 
<7> 
<8>

### example
[source,yaml]
----
apiVersion: "stable.baloise.ch/v1beta"
kind: WafMapping
metadata:
  name: demoapp
spec:
  mappingName: "demoapp"
  mappingEntryPath: "/demoapp"
  mappingBackendPath: "/"
  backendGroupName: "DemoAppBackendGroup"
  backendName: "servername.for.demoapp.ch"
  backendProtocol: "https"
  backendPort: 443
  vhostName: "thevhostname"
----

=== https://docs.airlock.com/gateway/7.4/rest-api/config-rest-api.html[-> WAF Configuration REST API]

== approach 1

=== idea

use and contribute: https://github.com/ergon/airlock-waf-kubernetes-openshift-integration

=== https://en.wikipedia.org/wiki/SWOT_analysis#Overview[SWOT] ergon

[cols="1,1", options="header"] 
|===
| Strengths 
| Weaknesses

| based on Spring

based on manufacturer know-how

modularized

in sync with manufacturer (API) changes

| partially reliant on https://github.com/ergon/airlock-waf-kubernetes-openshift-integration/issues/8[internal / binary resources]

| *Opportunities*
| *Threats*

| (distributed) maintenance (e.g. by manufacturer) in future
| upstream project direction no longer aligned with internal requirements

mitigation: *https://github.com/baloise-incubator/airlock-waf-kubernetes-openshift-integration[fork] and maintain on our own*
|===

== approach 2 

=== idea

champion: build our own (lightweight) solution based on Quarkus and the Fabric8 Java Kubernetes client API.

=== https://en.wikipedia.org/wiki/SWOT_analysis#Overview[SWOT] baloise

[cols="1,1", options="header"] 
|===
| Strengths 
| Weaknesses

| potentially more lightweight

exactly what we need

support waf mappings for applications inside and outside of OpenShift

| offset to manufacturer (API) changes

(new) use cases must be implemented and maintained by our own

| *Opportunities*
| *Threats*

| exemplify new technology within small and well defined scope
| new framework technology without TIP & supporter

mitigation: *find supporter and file TIP*

incompatible (API) changes by manufacturer

mitigation: *make open-source and inform manufacturer about it*

|===