Repository navigation
[DOCS#EV-7238]: Add optional Kibana WAF step to web console gateway access - #3156
Open
electricjesus wants to merge 2 commits into
Open
electricjesus wants to merge 2 commits into
electricjesus wants to merge 2 commits into
Conversation
Kibana Discover returns 403 when a Gateway WAF policy with the Core Rule Set covers the web console gateway. Add one optional step with the smallest GlobalWAFPlugin that fixes it, and point the WAF troubleshooting 403 section at it. EV-7238
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
5 tasks
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved documentation clarifications are needed for rule scope, ID ranges, and tab navigation.
1 open issue
What changed in this PR
This pull request adds optional Gateway WAF guidance to prevent Kibana Discover 403 responses when the web console is protected by the OWASP Core Rule Set.
Changes:
- Adds a host- and path-scoped
GlobalWAFPluginexample for Kibana requests. - Documents attaching the plugin to the default
GlobalWAFPolicy. - Links Kibana-specific troubleshooting to the web console access procedure.
| File | Description |
|---|---|
calico-enterprise/threat/gateway-waf/troubleshooting.mdx |
Links Kibana Discover 403 troubleshooting to the web console access instructions. |
calico-enterprise/operations/cnx/access-the-manager.mdx |
Adds the optional Kibana WAF exception step to the Calico Ingress Gateway setup. |
Review effort: Lite
electricjesus
commented
Oct 22, 2026
ctauchen
reviewed
Oct 22, 2026
ctauchen
left a comment
ctauchen
left a comment
Collaborator
There was a problem hiding this comment.
Thanks @electricjesus, a few suggestions here
…e Kibana WAF step Per review: name the hostname placeholder and define it after the YAML, show only the spec.plugins entry to add to the existing default GlobalWAFPolicy, and say that the url argument exception covers every Kibana request, not just search. EV-7238
ctauchen
reviewed
Oct 23, 2026
|
|
||
| 1. Point your hostname at that address in DNS. | ||
|
|
||
| 1. Optional: if you protect the web console with a [Gateway WAF](../../threat/gateway-waf/overview.mdx) policy that uses the Core Rule Set, Kibana Discover fails with HTTP `403`. The Core Rule Set reads Kibana's search requests as attacks. To allow them, create this `GlobalWAFPlugin`: |
Collaborator
There was a problem hiding this comment.
Suggested change
| 1. Optional: if you protect the web console with a [Gateway WAF](../../threat/gateway-waf/overview.mdx) policy that uses the Core Rule Set, Kibana Discover fails with HTTP `403`. The Core Rule Set reads Kibana's search requests as attacks. To allow them, create this `GlobalWAFPlugin`: | |
| 1. Optional: If you also use [Gateway WAF](../../threat/gateway-waf/overview.mdx), you need to add a WAF exception to prevent traffic to the web console from being blocked. Create a `GlobalWAFPlugin` resource like the following: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Product Version(s):
Calico Enterprise, next (
calico-enterprise/only, like #3110).Issue:
https://tigera.atlassian.net/browse/EV-7238
Link to docs preview:
SME review:
DOCS review:
Additional information:
When a WAF policy with the Core Rule Set covers the web console, Kibana Discover gets a 403. This PR adds one optional step to the gateway tab of the web console access page. The step shows the smallest
GlobalWAFPluginthat fixes it. The WAF troubleshooting page now links to it.This supersedes #3110. It keeps the same reviewed fix. It is 20 lines, not 94. And it sits where users set up the gateway.
Test plan: I compiled both pages with MDX 3. I checked that each relative link resolves. I did not run a full site build. The Netlify preview covers that.
AI assistance: This PR was written in part with the assistance of generative AI.
Merge checklist: