Use WAF-enabled ALB instances to protect applications-Container Service for Kubernetes(ACK)-阿里云帮助中心

Web applications exposed to the Internet face threats such as DDoS attacks, SQL injection, cross-site scripting, malicious HTTP requests, and SSH brute-force attacks. Enabling Web Application Firewall (WAF) on an Application Load Balancer (ALB) instance adds deep, protocol-aware inspection across multiple HTTP protocols and encoding formats.

For the benefits of WAF-enabled ALB instances, see Benefits of WAF-enabled ALB instances. For an introduction to WAF, see What is WAF?

Important

Enabling WAF changes your ALB billing. For pricing details, see ALB billing rules.

Prerequisites

Before you begin, ensure that you have:

The ALB Ingress controller installed in your cluster. For more information, see Manage the ALB Ingress controller.
Cluster permissions granted to the ALB Ingress controller, if you use an ACK dedicated cluster. For more information, see Authorize an ACK dedicated cluster to access the ALB Ingress controller.
A kubectl client connected to your ACK cluster. For more information, see Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.

Enable or disable WAF protection

Set the edition field in your AlbConfig to control WAF protection. You can apply this change when creating a new ALB instance or when updating an existing one.

`edition` value	WAF protection
`StandardWithWaf`	Enabled
`Standard`	Disabled

Important

You cannot change the edition field of a reused ALB instance.

Console

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Custom Resources.
In the search box on the Resource Objects tab, search for AlbConfig, then click AlbConfig in the search results.
On the AlbConfig panel, find the AlbConfig resource you want to modify (alb by default), then click Edit YAML in the Actions column.

Add the edition field as follows, then click OK.

spec:
  config:
    addressAllocatedMode: Fixed
    addressType: Internet
    edition: StandardWithWaf # Set to Standard to downgrade to the Standard edition.
    zoneMappings:
      - vSwitchId: <YOUR_VSWITCHID>
      - vSwitchId: <YOUR_VSWITCHID>

kubectl

Open the AlbConfig for editing:
```
kubectl edit albconfig <Albconfig_Name>
```

Set the edition field as follows, then save the file.

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb
spec:
  config:
    addressType: Internet
    edition: StandardWithWaf # Enable WAF protection. Set to Standard to disable.
    zoneMappings:
      #...

To stop using WAF entirely, delete the edition field and its related configuration instead of setting it to Standard.

FAQ

Why did my ALB instance roll back from the WAF-enabled edition to the Standard edition?

Cause: If you enable WAF protection for the ALB instance from the WAF console, the ALB Ingress controller detects during a subsequent reconciliation that the actual edition of the instance differs from the edition field declared in the AlbConfig. If the AlbConfig does not explicitly specify edition: StandardWithWaf, the controller restores the instance to the default Standard edition, which rolls back WAF protection.

Solution: Declare WAF protection in the AlbConfig rather than in the WAF console. When you create an ALB instance or modify an existing one, explicitly set the edition field to StandardWithWaf.

What's next

To control access based on source IP addresses, see Use AlbConfigs to add and modify ACL rules.
To authenticate client identities with mutual TLS, see Use HTTPS mutual authentication to enhance security.