<p>Until now I'm using Docker for a hand-made hosting solution on single-VPCs, with fail2ban installed on host and watching at Docker logs from Nginx containers (Each server can host multiple websites, served through an Nginx proxy)</p>

<p>I wonder how it would be possible to achieve same feature with Kubernetes, especially blocking POST requests to /wp-admin access after X attempts?</p>

<p>I thought about building a custom Docker image for Nginx proxy (Ingress in K8s), including Fail2ban; but maybe there's a simpler solution: Network Policies ?</p>

<p>That's an old question probably resolved by the author, but for other community members I decided to provide an answer with a few clarifications.</p>
<p>I have tried to find a <code>fail2ban</code> solution that can help with this case. Unfortunately, I did not find anything suitable and easy to use at the same time.<br />
It may be reasonable to create a <a href="https://github.com/fail2ban/fail2ban/issues" rel="nofollow noreferrer">GitHub issue</a> for <code>fail2ban</code> integration with Kubernetes.</p>
<p>Below are some other solutions that may help you:</p>
<h3><a href="https://github.com/SpiderLabs/ModSecurity" rel="nofollow noreferrer">ModSecurity</a></h3>
<p>Using <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Kubernetes Ingress</a> to expose HTTP and HTTPS routes from outside the cluster to services within the cluster may be a good starting point for you.</p>
<p>As we can see in the <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Kubernetes Ingress documentation</a>:</p>
<blockquote>
<p>You must have an Ingress controller to satisfy an Ingress. Only creating an Ingress resource has no effect. You may need to deploy an Ingress controller such as ingress-nginx.</p>
</blockquote>
<p>In the NGINX Ingress Controller you can use <a href="https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/modsecurity/#modsecurity-web-application-firewall" rel="nofollow noreferrer">ModSecurity</a> as a third party addons:</p>
<blockquote>
<p>ModSecurity is an OpenSource Web Application firewall. It can be enabled for a particular set of ingress locations. The ModSecurity module must first be enabled by enabling ModSecurity in the ConfigMap. Note this will enable ModSecurity for all paths, and each path must be disabled manually.</p>
</blockquote>
<p>You can enable the <a href="https://github.com/SpiderLabs/ModSecurity" rel="nofollow noreferrer">OWASP Core Rule Set</a> by setting the following annotation at the ingress level (more information can be found in the <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#modsecurity" rel="nofollow noreferrer">NGINX ModSecurity configuration</a> documentation):</p>
<pre><code>nginx.ingress.kubernetes.io/enable-owasp-core-rules: &quot;true&quot;
</code></pre>
<p>It seems possible to use <code>ModSecurity</code> as a <strong>Brute-Force Authentication Protection</strong> as described in this article:
<a href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/defending-wordpress-logins-from-brute-force-attacks/" rel="nofollow noreferrer">Defending WordPress Logins from Brute Force Attacks</a>.</p>
<p>Additionally, it is worth mentioning that NGINX Ingress Controller has many <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#rate-limiting" rel="nofollow noreferrer">annotations</a> that can be used to mitigate <strong>DDoS Attacks</strong> e.g.:</p>
<blockquote>
<p>nginx.ingress.kubernetes.io/limit-whitelist: client IP source ranges to be excluded from rate-limiting. The value is a comma separated list of CIDRs.</p>
</blockquote>
<blockquote>
<p>nginx.ingress.kubernetes.io/limit-rps: number of requests accepted from a given IP each second. The burst limit is set to this limit multiplied by the burst multiplier, the default multiplier is 5. When clients exceed this limit, limit-req-status-code default: 503 is returned.</p>
</blockquote>
<blockquote>
<p>nginx.ingress.kubernetes.io/limit-connections: number of concurrent connections allowed from a single IP address. A 503 error is returned when exceeding this limit.</p>
</blockquote>
<h3><a href="https://wordpress.org/plugins/" rel="nofollow noreferrer">WordPress Plugins</a></h3>
<p>As you are using WordPress, you can use many WordPress Plugins.
For example the <a href="https://wordpress.org/plugins/web-application-firewall/" rel="nofollow noreferrer">Web Application Firewall</a> plugin offers <code>Real Time IP Blocking</code> feature.</p>
<h3><a href="https://www.cloudflare.com/learning/ddos/glossary/web-application-firewall-waf/" rel="nofollow noreferrer">Web Application Firewall (WAF)</a></h3>
<p>Whether you use an onprem or cloud environment, you can use a specialized firewall (WAF) and DDoS mitigation service such as <a href="https://cloud.google.com/armor/" rel="nofollow noreferrer">Google Cloud Armor</a> (see <a href="https://cloud.google.com/blog/products/identity-security/new-waf-capabilities-in-cloud-armor" rel="nofollow noreferrer">Cloud Armor for on-prem and cloud workloads</a>).</p>
