How to apply WAF to Application Gateway for Containers frontend

Hi Andreas,

thanks for posting this ))

first, make sure u've got the latest azure cli or powershell modules. sometimes the ui lags behind like my ex's text replies ) https://docs.microsoft.com/en-us/cli/azure/install-azure-cli try this az cli command

az network application-gateway waf-policy create --name YourPolicy --resource-group YourRG --type OWASP

then attach it with

az network application-gateway update --name YourAG --resource-group YourRG --set webApplicationFirewallConfiguration=YourPolicy

check this the kubernetes managed way needs proper annotations in ur ingress yaml. add something like

annotations:  
  appgw.ingress.kubernetes.io/waf-policy: "/subscriptions/your-sub/resourceGroups/your-rg/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/your-policy"

the full kubernetes integration guide https://docs.microsoft.com/en-us/azure/application-gateway/ingress-controller-annotations

this might help in other tools too always verify ur service principal has network contributor role. that red icon sometimes means permission issues )) the role assignment steps https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

worth looking into the activity logs in azure portal if it still acts up. the logs often spill the tea before the ui does :))) https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log

aha, and dont forget containers gateway is still kinda new, so some features might play hide and seek. microsoft's been killing it with updates tho )) latest release notes https://docs.microsoft.com/en-us/azure/application-gateway/overview#whats-new

if u hit more snags, the azure monitor diagnostic settings can be ur best friend here. setup logs for application gateway and waf to see what's really going on https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-diagnostics

ps: that red icon? yeah it loves being mysterious. try refreshing after 10 mins or check the resource health blade azure's way of saying 'just wait bro' ))) resource health https://docs.microsoft.com/en-us/azure/service-health/resource-health-overview

let me know if the commands work

rgds,

Alex

Thanks for the quick reply.
I'm suspecting that this feature flag should be toggled for the helm deployment (default was false):

helm upgrade alb-controller oci://mcr.microsoft.com/application-lb/charts/alb-controller 
--set securityPolicyFeatureFlag=true

It seems to indicate that the feature exists, but does not solve the problem.
Although this page seems to indicate that WAF is not supported yet:
https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/migrate-from-agic-to-agc

I can try your commands but will be good to verify that it's actually possible first.