checkpoint/infinity-next-nginx-ingress repository overview

To Install an NGINX with Check Point Nano-Agent for Kuberenetes (k8s) environments:

1. Replace the docker image used be the NGINX ingress controller with the check point’s NGINX ingress:

• To get the image use this registry to pull the following NGINX Ingress image for this deployment.
• The image is based on the official NGINX inc. alpine based ingress controller nginx/nginx-ingress:<version>-alpine
• If you have a main template for the NGINX configurations make sure you add to the top of it the following line, to load the check point NGINX plugin (which will send the http traffic to the agent for inspection):
  main-template: |
  load_module /usr/lib/nginx/modules/ngx_cp_attachment_module.so;
• Currently the agent can protect k8s environment only if it uses an official nginx inc. image (nginx-ingress / regular nginx)
• Currently the agent cannot protect k8s environment with non NGINX ingress controller. In addition the agent does not support Kubernetes’s version of nginx-ingress.

1. Obtain an agent token from the <a href=https://portal.checkpoint.com>Infinity⁠ Next Management Portal - Enforcement/Profile page.

2. Add the Nano-Agent container image to the deployment yaml file of the NGINX ingress:

• Use the following registry to pull the Nano-Agent image:
  <a href=https://hub.docker.com/r/checkpoint/infinity-next-nano-agent>checkpoint/infinity-next-nano-agent⁠
• The image is based on the official alpine docker.
• Both the agent and above NGINX containers must be of the same version (tag)
• Add the following argument to the nano agent container’s arg’s array : [ “--token”, “<token>” ]
• Optional:If your environment's internet connection goes through a proxy server, add the proxy address to the nano agent container’s arg’s array as well : [ “--token”, “<token>”, “--proxy" , “<proxy address in the format http://[user:password@]url:port>” ]
• Prepare in advanced a volume to be claimed by the agent container (we are creating a stateful set and the agent container requires persistency of some data in cases of restarts / upgrades
• Add the following two mount paths + associated volume claim templates : “/etc/cp/conf/”, “/etc/cp/data/”

1. The deployment yaml with both NGINX and the agent will look like the following example:
   containers:
   ‐ image: checkpoint/infinity-next-nginx-ingress
   name: nginx-ingress-container
   ports:
   ‐ ... <relevant ports if needed>
   env:
   ‐ ... <relevant env if needed>
   args:
   ‐ ... <relevant args if needed>
   
   ‐ image: checkpoint/infinity-next-nano-agent
   name: nano-agent-container
   command: ["/cp-nano-agent"]
   args: ["--token", "<token>"]
   volumeMounts:
   ‐ name: cp-nano-agent-conf-volume-claim-template
   mountPath: /etc/cp/conf/
   ‐ name: cp-nano-agent-data-volume-claim-template
   mountPath: /etc/cp/data/