{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30088","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30088/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30088/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30088/events","html_url":"https://github.com/kubernetes/kubernetes/issues/30088","id":169443631,"number":30088,"title":"DoS protection for ingress","user":{"login":"bprashanth","id":10927820,"avatar_url":"https://avatars.githubusercontent.com/u/10927820?v=3","gravatar_id":"","url":"https://api.github.com/users/bprashanth","html_url":"https://github.com/bprashanth","followers_url":"https://api.github.com/users/bprashanth/followers","following_url":"https://api.github.com/users/bprashanth/following{/other_user}","gists_url":"https://api.github.com/users/bprashanth/gists{/gist_id}","starred_url":"https://api.github.com/users/bprashanth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bprashanth/subscriptions","organizations_url":"https://api.github.com/users/bprashanth/orgs","repos_url":"https://api.github.com/users/bprashanth/repos","events_url":"https://api.github.com/users/bprashanth/events{/privacy}","received_events_url":"https://api.github.com/users/bprashanth/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/networking","name":"area/networking","color":"006b75"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/help-wanted","name":"help-wanted","color":"006b75"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-08-04T18:36:11Z","updated_at":"2016-08-09T21:48:12Z","closed_at":null,"body":"We should AT LEAST document how to handle it, but ideally give users an easy way to prevent agains some of the most common attacks both at l7 and l4. \r\n\r\nMost obvious options is to accumulate logs from a bank of nginx ingress controllers via fluentd into ES/Cloud logging and setup a reconciliation loop that feeds into a DoS engine, which then sends accept/reject policy back down to nginx, through the Ingress. We'd need to add a DoS section to Ingress for this. \r\n\r\nWe could also do pof at iptables layer (http://www.ioremap.net/projects/osf/), or some iptables firewalling as discussed https://github.com/kubernetes/kubernetes/issues/22679 and https://github.com/kubernetes/kubernetes/issues/13774. Would be nice if the apiserver could use the DoS engine to protect itself, when/if we move it behind an Ingress. "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/238702624","html_url":"https://github.com/kubernetes/kubernetes/issues/30088#issuecomment-238702624","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30088","id":238702624,"user":{"login":"bprashanth","id":10927820,"avatar_url":"https://avatars.githubusercontent.com/u/10927820?v=3","gravatar_id":"","url":"https://api.github.com/users/bprashanth","html_url":"https://github.com/bprashanth","followers_url":"https://api.github.com/users/bprashanth/followers","following_url":"https://api.github.com/users/bprashanth/following{/other_user}","gists_url":"https://api.github.com/users/bprashanth/gists{/gist_id}","starred_url":"https://api.github.com/users/bprashanth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bprashanth/subscriptions","organizations_url":"https://api.github.com/users/bprashanth/orgs","repos_url":"https://api.github.com/users/bprashanth/repos","events_url":"https://api.github.com/users/bprashanth/events{/privacy}","received_events_url":"https://api.github.com/users/bprashanth/received_events","type":"User","site_admin":false},"created_at":"2016-08-09T21:48:12Z","updated_at":"2016-08-09T21:48:12Z","body":"@therc nice list. maybe you have time to collaborate over adding something basic to the nginx ingress controller? we'd start out by piping things through annotations, iterate, then boil it up to the Ingress api. "}}
{"actor":{"display_login":"bprashanth"}}