docs(waf): Firewall events — sampled matches, retention, privacy, API/CLI#67
Draft
acoshift wants to merge 2 commits into
Draft
docs(waf): Firewall events — sampled matches, retention, privacy, API/CLI#67acoshift wants to merge 2 commits into
acoshift wants to merge 2 commits into
Conversation
…privacy note, API/CLI Documents the sampled WAF match events (waf.events): what an event row shows, per-ingress-instance sampling caps (10/min per rule, blocks exempt; 60/min per zone), 3-day retention with an explicit privacy note on client IPs (no query strings, headers, cookies, or bodies), that the metrics charts remain the exact counts, filters + keyset pagination, and the curl/CLI usage. Screenshot is left as an escaped-shortcode placeholder (the shot shortcode fails the build on a missing image); capture it via scripts/screenshots/refresh.sh once the console section ships.
…ntry, clarify screenshot TODO - The console events table has no response-status column (Time, Action, Rule, IP, Country, Method, Host, Path) — remove the parenthetical claiming blocks show their status. - capture.mjs gains the waf-events entry per SPEC-waf-events.md §H, so resolving the screenshot TODO after the console section merges needs no further script change. - The TODO now says to strip the /* */ Hugo-escape markers, not just uncomment — uncommenting alone would render the shortcode literally.
Preview
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the Firewall events feature (spec:
SPEC-waf-events.md, workstream #7) oncontent/networking/waf.md, after the Metrics section:wafevent.go).waf.events(newest first,ruleId/actionfilters, limit default 50 / max 200,next→beforekeyset cursor). CLI:deploys waf events.scripts/screenshots/capture.mjsgains thewaf-eventsentry (spec §H) so the screenshot TODO resolves with a plainrefresh.shrun once the console section is merged.All examples use documentation IPs (
203.0.113.x) — no real event data.Draft — merge gate
Docs deploy on merge, and this page describes the console events table and the
deploys waf eventsCLI command. Per spec §J rollout order (docs depend on console #5 and CLI #6), keep this PR draft until the consolewaf-eventsbranch is merged and deployed and the CLI subcommand has shipped. After console merges, runscripts/screenshots/refresh.shand resolve theTODO(screenshot)inwaf.md(replace the comment with the shot line, dropping the/* */escapes) before marking ready.Expected merge conflicts
Two other open docs branches also touch
content/networking/waf.md:waf-ip-lists(+157 lines on waf.md) — will conflict around the section ordering.waf-test(+103 lines on waf.md, also editsscripts/screenshots/capture.mjs) — will conflict on both files; whichever merges second rebases.Rollout (spec §J — every step inert alone)
waf_eventsDDL migration (apiserver) — apply before the binary.collector.setWAFEvents,waf.events).WAF_EVENTS_TOKENSecret (feat(waf): sampled match-event ring + bearer-authed cursor endpoint moonrhythm/parapet-ingress-controller#182).waf_events_target+waf_events_token(same Secret value); unset = off.Gate: api repo re-pin to main before CLI/mcp branches build against the new
waf.eventstypes.Test evidence
hugo --gc --minifybuilds green (59 pages); rendered/networking/waf/contains the Firewall events section, and the commented screenshot TODO leaves no literal shortcode text orwaf-events.pngreference in the output.node --check scripts/screenshots/capture.mjspasses.waf-eventsbranch (Time, Action, Rule, IP, Country, Method, Host, Path) — the docs no longer claim a response-status column.