Add k8s-nginx-ingress deployment with NGWAF module for colima/kind

[Copilot]

Implements NGINX Ingress Controller integration with Fastly NGWAF module for local Kubernetes development using colima and kind.

Implementation

Directory: on-prem-ngwaf-integrations/k8s-nginx-ingress/

• Dockerfile: Extends registry.k8s.io/ingress-nginx/controller:v1.11.2 with Fastly NGWAF module from Signal Sciences APK repository. Dynamically matches NGINX version for compatibility.

• deployment.yaml: Complete manifests including:

  • NGINX Ingress Controller with sigsci-agent sidecar (Unix socket communication via shared emptyDir volume)
  • Full RBAC (ServiceAccount, ClusterRole, Role, bindings)
  • NodePort service (30080/30443) for local access
  • Demo backend (hashicorp/http-echo) with ingress resource

• Makefile: Automation for colima/kind lifecycle, build/deploy, logging, and testing. Includes setup target for first-time users and test target with attack pattern examples.

• README.md: Architecture overview, prerequisites, setup instructions for colima/kind, deployment steps, troubleshooting.

Architecture

Client → NodePort (30080) → NGINX Ingress Controller (with NGWAF module) ↔ sigsci-agent sidecar → Backend
                                    ↓
                              unix:/sigsci/tmp/sigsci.sock

Module loaded via ConfigMap main-snippet, agent credentials from Secret. Follows sidecar pattern established in k8s-nginx-module-agent.

Usage

make setup  # colima + kind cluster
export NGWAFACCESSKEYID="..." NGWAFACCESSKEYSECRET="..."
make build
make demo   # port-forward to localhost:8080
curl http://127.0.0.1:8080 -H "Host: demo.example.com"

Original prompt

You are using colima and kind for your k8s setup. You need to create a deployment similar to the other deployments in the directory on-prem-ngwaf-integrations based on the nginx-ingress NGWAF integration outlined in the following documentation. Create a seperate directory named k8s-nginx-ingress for this deployment.

https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/kubernetes/kubernetes-agent-ingress-controller-module/

Provide instructions that assume colima and kind are used.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.