Update local_policy.yaml

Update apisix-standalone.yaml
2025-11-15 17:02:15 +03:00 · 2024-10-01 13:05:23 +03:00 · 2024-10-01 13:03:59 +03:00 · 2024-10-01 12:49:25 +03:00 · 2024-09-30 14:53:51 +03:00 · 2024-09-30 14:10:35 +03:00
420 changed files with 148365 additions and 87674 deletions
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,7 +1,7 @@
 cmake_minimum_required (VERSION 2.8.4)
 project (ngen)

-set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fPIC -Wall -Wno-terminate")
+set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -O2 -fPIC -Wall -Wno-terminate")

 execute_process(COMMAND grep -c "Alpine Linux" /etc/os-release OUTPUT_VARIABLE IS_ALPINE)
 if(NOT IS_ALPINE EQUAL "0")
--- a/attachments/nginx/nginx_attachment_util/nginx_attachment_util.cc
+++ b/attachments/nginx/nginx_attachment_util/nginx_attachment_util.cc
@@ -155,6 +155,24 @@ getWaitingForVerdictThreadTimeout()
    return conf_data.getNumericalValue("waiting_for_verdict_thread_timeout_msec");
 }

+unsigned int
+getMinRetriesForVerdict()
+{
+    return conf_data.getNumericalValue("min_retries_for_verdict");
+}
+
+unsigned int
+getMaxRetriesForVerdict()
+{
+    return conf_data.getNumericalValue("max_retries_for_verdict");
+}
+
+unsigned int
+getReqBodySizeTrigger()
+{
+    return conf_data.getNumericalValue("body_size_trigger");
+}
+
 int
 isIPAddress(c_str ip_str)
 {
--- a/attachments/nginx/nginx_attachment_util/nginx_attachment_util_ut/nginx_attachment_util_ut.cc
+++ b/attachments/nginx/nginx_attachment_util/nginx_attachment_util_ut/nginx_attachment_util_ut.cc
@@ -63,31 +63,37 @@ TEST_F(HttpAttachmentUtilTest, GetValidAttachmentConfiguration)
            "\"waiting_for_verdict_thread_timeout_msec\": 75,\n"
            "\"req_header_thread_timeout_msec\": 10,\n"
            "\"ip_ranges\": " + createIPRangesString(ip_ranges) + ",\n"
-            "\"static_resources_path\": \"" + static_resources_path + "\""
+            "\"static_resources_path\": \"" + static_resources_path + "\",\n"
+            "\"min_retries_for_verdict\": 1,\n"
+            "\"max_retries_for_verdict\": 3,\n"
+            "\"body_size_trigger\": 777\n"
        "}\n";
    ofstream valid_configuration_file(attachment_configuration_file_name);
    valid_configuration_file << valid_configuration;
    valid_configuration_file.close();

    EXPECT_EQ(initAttachmentConfig(attachment_configuration_file_name.c_str()), 1);
-    EXPECT_EQ(getDbgLevel(), 2);
+    EXPECT_EQ(getDbgLevel(), 2u);
    EXPECT_EQ(getStaticResourcesPath(), static_resources_path);
    EXPECT_EQ(isFailOpenMode(), 0);
-    EXPECT_EQ(getFailOpenTimeout(), 1234);
+    EXPECT_EQ(getFailOpenTimeout(), 1234u);
    EXPECT_EQ(isFailOpenHoldMode(), 1);
-    EXPECT_EQ(getFailOpenHoldTimeout(), 4321);
+    EXPECT_EQ(getFailOpenHoldTimeout(), 4321u);
    EXPECT_EQ(isFailOpenOnSessionLimit(), 1);
-    EXPECT_EQ(getMaxSessionsPerMinute(), 0);
-    EXPECT_EQ(getNumOfNginxIpcElements(), 200);
-    EXPECT_EQ(getKeepAliveIntervalMsec(), 10000);
-    EXPECT_EQ(getResProccessingTimeout(), 420);
-    EXPECT_EQ(getReqProccessingTimeout(), 42);
-    EXPECT_EQ(getRegistrationThreadTimeout(), 101);
-    EXPECT_EQ(getReqHeaderThreadTimeout(), 10);
-    EXPECT_EQ(getReqBodyThreadTimeout(), 155);
-    EXPECT_EQ(getResHeaderThreadTimeout(), 1);
-    EXPECT_EQ(getResBodyThreadTimeout(), 0);
-    EXPECT_EQ(getWaitingForVerdictThreadTimeout(), 75);
+    EXPECT_EQ(getMaxSessionsPerMinute(), 0u);
+    EXPECT_EQ(getNumOfNginxIpcElements(), 200u);
+    EXPECT_EQ(getKeepAliveIntervalMsec(), 10000u);
+    EXPECT_EQ(getResProccessingTimeout(), 420u);
+    EXPECT_EQ(getReqProccessingTimeout(), 42u);
+    EXPECT_EQ(getRegistrationThreadTimeout(), 101u);
+    EXPECT_EQ(getReqHeaderThreadTimeout(), 10u);
+    EXPECT_EQ(getReqBodyThreadTimeout(), 155u);
+    EXPECT_EQ(getResHeaderThreadTimeout(), 1u);
+    EXPECT_EQ(getResBodyThreadTimeout(), 0u);
+    EXPECT_EQ(getMinRetriesForVerdict(), 1u);
+    EXPECT_EQ(getMaxRetriesForVerdict(), 3u);
+    EXPECT_EQ(getReqBodySizeTrigger(), 777u);
+    EXPECT_EQ(getWaitingForVerdictThreadTimeout(), 75u);
    EXPECT_EQ(getInspectionMode(), ngx_http_inspection_mode::BLOCKING_THREAD);

    EXPECT_EQ(isDebugContext("1.2.3.4", "5.6.7.8", 80, "GET", "test", "/abc"), 1);
--- a/build_system/apisix/docker-compose.yaml
+++ b/build_system/apisix/docker-compose.yaml
@@ -1,15 +1,15 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+# Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.

-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

 version: "3"

--- a/build_system/charts/open-appsec-k8s-nginx-ingress/Chart.lock
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/Chart.lock
@@ -3,4 +3,4 @@ dependencies:
  repository: https://charts.bitnami.com/bitnami
  version: 12.2.8
 digest: sha256:0d13b8b0c66b8e18781eac510ce58b069518ff14a6a15ad90375e7f0ffad71fe
-generated: "2024-02-18T16:45:15.395307713Z"
+generated: "2024-03-26T14:53:49.928153508Z"
--- a/build_system/charts/open-appsec-k8s-nginx-ingress/Chart.yaml
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/Chart.yaml
@@ -1,7 +1,5 @@
 annotations:
-  artifacthub.io/changes: |-
-    - "update web hook cert gen to latest release v20231226-1a7112e06"
-    - "Update Ingress-Nginx version controller-v1.9.6"
+  artifacthub.io/changes: '- "Update Ingress-Nginx version controller-v1.10.0"'
  artifacthub.io/prerelease: "false"
 apiVersion: v2
 appVersion: latest
@@ -17,4 +15,4 @@ kubeVersion: '>=1.20.0-0'
 name: open-appsec-k8s-nginx-ingress
 sources:
 - https://github.com/kubernetes/ingress-nginx
-version: 4.9.1
+version: 4.10.0
--- a/build_system/charts/open-appsec-k8s-nginx-ingress/README.md
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/README.md
@@ -2,7 +2,7 @@

 [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer

-![Version: 4.9.1](https://img.shields.io/badge/Version-4.9.1-informational?style=flat-square) ![AppVersion: 1.9.6](https://img.shields.io/badge/AppVersion-1.9.6-informational?style=flat-square)
+![Version: 4.10.0](https://img.shields.io/badge/Version-4.10.0-informational?style=flat-square) ![AppVersion: 1.10.0](https://img.shields.io/badge/AppVersion-1.10.0-informational?style=flat-square)

 To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources.

@@ -253,11 +253,11 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
 | controller.admissionWebhooks.namespaceSelector | object | `{}` |  |
 | controller.admissionWebhooks.objectSelector | object | `{}` |  |
 | controller.admissionWebhooks.patch.enabled | bool | `true` |  |
-| controller.admissionWebhooks.patch.image.digest | string | `"sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084"` |  |
+| controller.admissionWebhooks.patch.image.digest | string | `"sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334"` |  |
 | controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` |  |
 | controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` |  |
 | controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` |  |
-| controller.admissionWebhooks.patch.image.tag | string | `"v20231226-1a7112e06"` |  |
+| controller.admissionWebhooks.patch.image.tag | string | `"v1.4.0"` |  |
 | controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources |
 | controller.admissionWebhooks.patch.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
 | controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` |  |
@@ -317,7 +317,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
 | controller.hostname | object | `{}` | Optionally customize the pod hostname. |
 | controller.image.allowPrivilegeEscalation | bool | `false` |  |
 | controller.image.chroot | bool | `false` |  |
-| controller.image.digest | string | `"sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c"` |  |
+| controller.image.digest | string | `"sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c"` |  |
 | controller.image.digestChroot | string | `"sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096"` |  |
 | controller.image.image | string | `"ingress-nginx/controller"` |  |
 | controller.image.pullPolicy | string | `"IfNotPresent"` |  |
@@ -326,7 +326,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
 | controller.image.runAsNonRoot | bool | `true` |  |
 | controller.image.runAsUser | int | `101` |  |
 | controller.image.seccompProfile.type | string | `"RuntimeDefault"` |  |
-| controller.image.tag | string | `"v1.9.6"` |  |
+| controller.image.tag | string | `"v1.10.0"` |  |
 | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
 | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). |
 | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass |
--- a/build_system/charts/open-appsec-k8s-nginx-ingress/changelog/helm-chart-4.10.0.md
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/changelog/helm-chart-4.10.0.md
@@ -0,0 +1,9 @@
+# Changelog
+
+This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
+
+### 4.10.0
+
+* - "Update Ingress-Nginx version controller-v1.10.0"
+
+**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.9.1...helm-chart-4.10.0
--- a/build_system/charts/open-appsec-k8s-nginx-ingress/templates/_params.tpl
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/templates/_params.tpl
@@ -29,7 +29,7 @@
 - --watch-namespace={{ default "$(POD_NAMESPACE)" .Values.controller.scope.namespace }}
 {{- end }}
 {{- if and (not .Values.controller.scope.enabled) .Values.controller.scope.namespaceSelector }}
- --watch-namespace-selector={{ default "" .Values.controller.scope.namespaceSelector }}
+- --watch-namespace-selector={{ .Values.controller.scope.namespaceSelector }}
 {{- end }}
 {{- if and .Values.controller.reportNodeInternalIp .Values.controller.hostNetwork }}
 - --report-node-internal-ip-address={{ .Values.controller.reportNodeInternalIp }}
@@ -54,6 +54,9 @@
 {{- if .Values.controller.watchIngressWithoutClass }}
 - --watch-ingress-without-class=true
 {{- end }}
+{{- if not .Values.controller.metrics.enabled }}
+- --enable-metrics={{ .Values.controller.metrics.enabled }}
+{{- end }}
 {{- if .Values.controller.enableTopologyAwareRouting }}
 - --enable-topology-aware-routing=true
 {{- end }}
--- a/build_system/charts/open-appsec-k8s-nginx-ingress/templates/controller-prometheusrules.yaml
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/templates/controller-prometheusrules.yaml
@@ -1,4 +1,4 @@
-{{- if and ( .Values.controller.metrics.enabled ) ( .Values.controller.metrics.prometheusRule.enabled ) ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) -}}
+{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.prometheusRule.enabled -}}
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
--- a/build_system/charts/open-appsec-k8s-nginx-ingress/templates/default-policy.yaml
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/templates/default-policy.yaml
@@ -34,7 +34,7 @@ spec:
    http-headers: false
    request-body: false
  log-destination:
-    cloud: false
+    cloud: true
    stdout:
      format: json-formatted
 ---
--- a/build_system/charts/open-appsec-k8s-nginx-ingress/tests/controller-daemonset_test.yaml
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/tests/controller-daemonset_test.yaml
@@ -15,3 +15,37 @@ tests:
      - equal:
          path: metadata.name
          value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
+
+  - it: should create a DaemonSet with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
+    set:
+      controller.kind: DaemonSet
+      kind: Vanilla
+      controller.metrics.enabled: false
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --enable-metrics=false
+
+  - it: should create a DaemonSet without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
+    set:
+      controller.kind: DaemonSet
+      kind: Vanilla
+      controller.metrics.enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].args
+          content: --enable-metrics=false
+
+  - it: should create a DaemonSet with resource limits if `controller.resources.limits` is set
+    set:
+      controller.kind: DaemonSet
+      kind: Vanilla
+      controller.resources.limits.cpu: 500m
+      controller.resources.limits.memory: 512Mi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.cpu
+          value: 500m
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.memory
+          value: 512Mi
--- a/build_system/charts/open-appsec-k8s-nginx-ingress/tests/controller-deployment_test.yaml
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/tests/controller-deployment_test.yaml
@@ -4,8 +4,6 @@ templates:

 tests:
  - it: should create a Deployment
-    set:
-      kind: Vanilla
    asserts:
      - hasDocuments:
          count: 1
@@ -24,6 +22,22 @@ tests:
          path: spec.replicas
          value: 3

+  - it: should create a Deployment with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
+    set:
+      controller.metrics.enabled: false
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --enable-metrics=false
+
+  - it: should create a Deployment without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
+    set:
+      controller.metrics.enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].args
+          content: --enable-metrics=false
+
  - it: should create a Deployment with resource limits if `controller.resources.limits` is set
    set:
      controller.resources.limits.cpu: 500m
--- a/build_system/charts/open-appsec-k8s-nginx-ingress/values.yaml
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/values.yaml
@@ -26,8 +26,8 @@ controller:
    ## for backwards compatibility consider setting the full image url via the repository value below
    ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
    ## repository:
-    tag: "v1.9.6"
-    digest: sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c
+    tag: "v1.10.0"
+    digest: sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c
    digestChroot: sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096
    pullPolicy: IfNotPresent
    runAsNonRoot: true
@@ -781,8 +781,8 @@ controller:
        ## for backwards compatibility consider setting the full image url via the repository value below
        ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
        ## repository:
-        tag: v20231226-1a7112e06
-        digest: sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084
+        tag: v1.4.0
+        digest: sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334
        pullPolicy: IfNotPresent
      # -- Provide a priority class name to the webhook patching job
      ##
@@ -1198,7 +1198,7 @@ appsec:
    image:
      registry: ghcr.io/openappsec
      image: smartsync-tuning
-      tag: 1.1.3
+      tag: latest
    enabled: false
    replicaCount: 1
    securityContext:
--- a/build_system/charts/open-appsec-kong/CHANGELOG.md
+++ b/build_system/charts/open-appsec-kong/CHANGELOG.md
@@ -1,5 +1,27 @@
 # Changelog

+## 2.38.0
+
+### Changes
+
+* Added support for setting `SVC.tls.appProtocol` and `SVC.http.appProtocol` values to configure the appProtocol fields
+  for Kubernetes Service HTTP and TLS ports. It might be useful for integration with external load balancers like GCP.
+  [#1018](https://github.com/Kong/charts/pull/1018)
+
+## 2.37.1
+
+* Rename the controller status port. This fixes a collision with the proxy status port in the Prometheus ServiceMonitor.
+  [#1008](https://github.com/Kong/charts/pull/1008)
+
+## 2.37.0
+
+### Changes
+
+* Bumped default `kong/kubernetes-ingress-controller` image tag and updated CRDs to 3.1.
+  [#1011](https://github.com/Kong/charts/pull/1011)
+* Bumped default `kong` image tag to 3.6.
+  [#1011](https://github.com/Kong/charts/pull/1011)
+
 ## 2.36.0

 ### Fixed
--- a/build_system/charts/open-appsec-kong/Chart.yaml
+++ b/build_system/charts/open-appsec-kong/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.1.6
+appVersion: 1.1.8
 dependencies:
 - condition: postgresql.enabled
  name: postgresql
@@ -14,4 +14,4 @@ maintainers:
 name: open-appsec-kong
 sources:
 - https://github.com/Kong/charts/tree/main/charts/kong
-version: 2.36.0
+version: 2.38.0
--- a/build_system/charts/open-appsec-kong/README.md
+++ b/build_system/charts/open-appsec-kong/README.md
@@ -666,40 +666,42 @@ nodes.
 mixed TCP/UDP LoadBalancer Services). It _does not_ support the `http`, `tls`,
 or `ingress` sections, as it is used only for stream listens.

-| Parameter                          | Description                                                                           | Default                  |
-|------------------------------------|---------------------------------------------------------------------------------------|--------------------------|
-| SVC.enabled                        | Create Service resource for SVC (admin, proxy, manager, etc.)                         |                          |
-| SVC.http.enabled                   | Enables http on the service                                                           |                          |
-| SVC.http.servicePort               | Service port to use for http                                                          |                          |
-| SVC.http.containerPort             | Container port to use for http                                                        |                          |
-| SVC.http.nodePort                  | Node port to use for http                                                             |                          |
-| SVC.http.hostPort                  | Host port to use for http                                                             |                          |
-| SVC.http.parameters                | Array of additional listen parameters                                                 | `[]`                     |
-| SVC.tls.enabled                    | Enables TLS on the service                                                            |                          |
-| SVC.tls.containerPort              | Container port to use for TLS                                                         |                          |
-| SVC.tls.servicePort                | Service port to use for TLS                                                           |                          |
-| SVC.tls.nodePort                   | Node port to use for TLS                                                              |                          |
-| SVC.tls.hostPort                   | Host port to use for TLS                                                              |                          |
-| SVC.tls.overrideServiceTargetPort  | Override service port to use for TLS without touching Kong containerPort              |                          |
-| SVC.tls.parameters                 | Array of additional listen parameters                                                 | `["http2"]`              |
-| SVC.type                           | k8s service type. Options: NodePort, ClusterIP, LoadBalancer                          |                          |
-| SVC.clusterIP                      | k8s service clusterIP                                                                 |                          |
-| SVC.loadBalancerClass              | loadBalancerClass to use for LoadBalancer provisionning                               |                          |
-| SVC.loadBalancerSourceRanges       | Limit service access to CIDRs if set and service type is `LoadBalancer`               | `[]`                     |
-| SVC.loadBalancerIP                 | Reuse an existing ingress static IP for the service                                   |                          |
-| SVC.externalIPs                    | IPs for which nodes in the cluster will also accept traffic for the servic            | `[]`                     |
-| SVC.externalTrafficPolicy          | k8s service's externalTrafficPolicy. Options: Cluster, Local                          |                          |
-| SVC.ingress.enabled                | Enable ingress resource creation (works with SVC.type=ClusterIP)                      | `false`                  |
-| SVC.ingress.ingressClassName       | Set the ingressClassName to associate this Ingress with an IngressClass               |                          |
-| SVC.ingress.hostname               | Ingress hostname                                                                      | `""`                     |
-| SVC.ingress.path                   | Ingress path.                                                                         | `/`                      |
-| SVC.ingress.pathType               | Ingress pathType. One of `ImplementationSpecific`, `Exact` or `Prefix`                | `ImplementationSpecific` |
-| SVC.ingress.hosts                  | Slice of hosts configurations, including `hostname`, `path` and `pathType` keys       | `[]`                     |
-| SVC.ingress.tls                    | Name of secret resource or slice of `secretName` and `hosts` keys                     |                          |
-| SVC.ingress.annotations            | Ingress annotations. See documentation for your ingress controller for details        | `{}`                     |
-| SVC.ingress.labels                 | Ingress labels. Additional custom labels to add to the ingress.                       | `{}`                     |
-| SVC.annotations                    | Service annotations                                                                   | `{}`                     |
-| SVC.labels                         | Service labels                                                                        | `{}`                     |
+| Parameter                         | Description                                                                               | Default                  |
+|-----------------------------------|-------------------------------------------------------------------------------------------|--------------------------|
+| SVC.enabled                       | Create Service resource for SVC (admin, proxy, manager, etc.)                             |                          |
+| SVC.http.enabled                  | Enables http on the service                                                               |                          |
+| SVC.http.servicePort              | Service port to use for http                                                              |                          |
+| SVC.http.containerPort            | Container port to use for http                                                            |                          |
+| SVC.http.nodePort                 | Node port to use for http                                                                 |                          |
+| SVC.http.hostPort                 | Host port to use for http                                                                 |                          |
+| SVC.http.parameters               | Array of additional listen parameters                                                     | `[]`                     |
+| SVC.http.appProtocol              | `appProtocol` to be set in a Service's port. If left empty, no `appProtocol` will be set. |                          |
+| SVC.tls.enabled                   | Enables TLS on the service                                                                |                          |
+| SVC.tls.containerPort             | Container port to use for TLS                                                             |                          |
+| SVC.tls.servicePort               | Service port to use for TLS                                                               |                          |
+| SVC.tls.nodePort                  | Node port to use for TLS                                                                  |                          |
+| SVC.tls.hostPort                  | Host port to use for TLS                                                                  |                          |
+| SVC.tls.overrideServiceTargetPort | Override service port to use for TLS without touching Kong containerPort                  |                          |
+| SVC.tls.parameters                | Array of additional listen parameters                                                     | `["http2"]`              |
+| SVC.tls.appProtocol               | `appProtocol` to be set in a Service's port. If left empty, no `appProtocol` will be set. |                          |
+| SVC.type                          | k8s service type. Options: NodePort, ClusterIP, LoadBalancer                              |                          |
+| SVC.clusterIP                     | k8s service clusterIP                                                                     |                          |
+| SVC.loadBalancerClass             | loadBalancerClass to use for LoadBalancer provisionning                                   |                          |
+| SVC.loadBalancerSourceRanges      | Limit service access to CIDRs if set and service type is `LoadBalancer`                   | `[]`                     |
+| SVC.loadBalancerIP                | Reuse an existing ingress static IP for the service                                       |                          |
+| SVC.externalIPs                   | IPs for which nodes in the cluster will also accept traffic for the servic                | `[]`                     |
+| SVC.externalTrafficPolicy         | k8s service's externalTrafficPolicy. Options: Cluster, Local                              |                          |
+| SVC.ingress.enabled               | Enable ingress resource creation (works with SVC.type=ClusterIP)                          | `false`                  |
+| SVC.ingress.ingressClassName      | Set the ingressClassName to associate this Ingress with an IngressClass                   |                          |
+| SVC.ingress.hostname              | Ingress hostname                                                                          | `""`                     |
+| SVC.ingress.path                  | Ingress path.                                                                             | `/`                      |
+| SVC.ingress.pathType              | Ingress pathType. One of `ImplementationSpecific`, `Exact` or `Prefix`                    | `ImplementationSpecific` |
+| SVC.ingress.hosts                 | Slice of hosts configurations, including `hostname`, `path` and `pathType` keys           | `[]`                     |
+| SVC.ingress.tls                   | Name of secret resource or slice of `secretName` and `hosts` keys                         |                          |
+| SVC.ingress.annotations           | Ingress annotations. See documentation for your ingress controller for details            | `{}`                     |
+| SVC.ingress.labels                | Ingress labels. Additional custom labels to add to the ingress.                           | `{}`                     |
+| SVC.annotations                   | Service annotations                                                                       | `{}`                     |
+| SVC.labels                        | Service labels                                                                            | `{}`                     |

 #### Admin Service mTLS

--- a/build_system/charts/open-appsec-kong/ci/snapshots/admin-api-service-clusterip-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/admin-api-service-clusterip-values.snap
@@ -9,8 +9,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -33,9 +33,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -90,7 +90,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -205,7 +205,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -274,8 +274,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-custom-dbless-config
        namespace: default
 - object:
@@ -286,8 +286,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-admin
        namespace: default
    spec:
@@ -309,8 +309,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -336,9 +336,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -364,8 +364,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/custom-labels-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/custom-labels-values.snap
@@ -9,8 +9,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -84,8 +84,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -108,9 +108,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -138,7 +138,7 @@ SnapShot = """
                          value: https://localhost:8444
                        - name: CONTROLLER_PUBLISH_SERVICE
                          value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                      imagePullPolicy: IfNotPresent
                      livenessProbe:
                        failureThreshold: 3
@@ -159,7 +159,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -240,7 +240,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -350,7 +350,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -408,8 +408,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -617,6 +617,38 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -657,8 +689,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -677,8 +709,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -742,8 +774,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -766,8 +798,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -783,8 +815,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -797,8 +829,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -825,9 +857,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -854,8 +886,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -870,8 +902,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: ServiceAccount
@@ -881,8 +913,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/default-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/default-values.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -105,9 +105,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -137,7 +137,7 @@ SnapShot = """
                          value: https://localhost:8444
                        - name: CONTROLLER_PUBLISH_SERVICE
                          value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                      imagePullPolicy: IfNotPresent
                      livenessProbe:
                        failureThreshold: 3
@@ -158,7 +158,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -241,7 +241,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -353,7 +353,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -410,8 +410,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -619,6 +619,38 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -658,8 +690,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -677,8 +709,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -741,8 +773,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -764,8 +796,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -780,8 +812,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -793,8 +825,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -820,9 +852,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -848,8 +880,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -863,8 +895,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: ServiceAccount
@@ -873,8 +905,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/kong-ingress-1-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/kong-ingress-1-values.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -105,9 +105,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -135,7 +135,7 @@ SnapShot = """
                          value: https://localhost:8444
                        - name: CONTROLLER_PUBLISH_SERVICE
                          value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                      imagePullPolicy: IfNotPresent
                      livenessProbe:
                        failureThreshold: 3
@@ -156,7 +156,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -237,7 +237,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -347,7 +347,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -404,8 +404,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -430,8 +430,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -639,6 +639,38 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -678,8 +710,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -697,8 +729,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -761,8 +793,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -784,8 +816,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -800,8 +832,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -822,8 +854,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -849,9 +881,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -877,8 +909,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -892,8 +924,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: ServiceAccount
@@ -902,8 +934,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/kong-ingress-2-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/kong-ingress-2-values.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -105,9 +105,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -135,7 +135,7 @@ SnapShot = """
                          value: https://localhost:8444
                        - name: CONTROLLER_PUBLISH_SERVICE
                          value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                      imagePullPolicy: IfNotPresent
                      livenessProbe:
                        failureThreshold: 3
@@ -156,7 +156,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -237,7 +237,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -347,7 +347,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -404,8 +404,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -432,8 +432,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -641,6 +641,38 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -680,8 +712,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -699,8 +731,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -763,8 +795,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -786,8 +818,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -802,8 +834,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -824,8 +856,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -851,9 +883,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -879,8 +911,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -894,8 +926,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: ServiceAccount
@@ -904,8 +936,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/kong-ingress-3-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/kong-ingress-3-values.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -105,9 +105,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -135,7 +135,7 @@ SnapShot = """
                          value: https://localhost:8444
                        - name: CONTROLLER_PUBLISH_SERVICE
                          value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                      imagePullPolicy: IfNotPresent
                      livenessProbe:
                        failureThreshold: 3
@@ -156,7 +156,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -237,7 +237,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -347,7 +347,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -404,8 +404,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -428,8 +428,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -637,6 +637,38 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -676,8 +708,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -695,8 +727,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -759,8 +791,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -782,8 +814,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -798,8 +830,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -811,8 +843,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -838,9 +870,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -866,8 +898,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -881,8 +913,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: ServiceAccount
@@ -891,8 +923,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/kong-ingress-4-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/kong-ingress-4-values.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -105,9 +105,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -135,7 +135,7 @@ SnapShot = """
                          value: https://localhost:8444
                        - name: CONTROLLER_PUBLISH_SERVICE
                          value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                      imagePullPolicy: IfNotPresent
                      livenessProbe:
                        failureThreshold: 3
@@ -156,7 +156,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -237,7 +237,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -347,7 +347,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -404,8 +404,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -463,8 +463,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -672,6 +672,38 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -711,8 +743,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -730,8 +762,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -794,8 +826,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -817,8 +849,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -833,8 +865,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -864,8 +896,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -891,9 +923,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -919,8 +951,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -934,8 +966,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: ServiceAccount
@@ -944,8 +976,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/kong-ingress-5-3.1-rbac-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/kong-ingress-5-3.1-rbac-values.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -105,9 +105,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -158,7 +158,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -241,7 +241,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -353,7 +353,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -410,8 +410,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -690,8 +690,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -709,8 +709,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -773,8 +773,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -796,8 +796,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -812,8 +812,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -825,8 +825,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -852,9 +852,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -880,8 +880,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -895,8 +895,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: ServiceAccount
@@ -905,8 +905,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/proxy-appprotocol-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/proxy-appprotocol-values.snap
@@ -0,0 +1,908 @@
+[proxy-appprotocol-values]
+SnapShot = """
+- object:
+    apiVersion: admissionregistration.k8s.io/v1
+    kind: ValidatingWebhookConfiguration
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-validations
+        namespace: default
+    webhooks:
+        - admissionReviewVersions:
+            - v1beta1
+          clientConfig:
+            caBundle: '###DYNAMIC_FIELD###'
+            service:
+                name: chartsnap-kong-validation-webhook
+                namespace: default
+          failurePolicy: Ignore
+          name: validations.kong.konghq.com
+          objectSelector:
+            matchExpressions:
+                - key: owner
+                  operator: NotIn
+                  values:
+                    - helm
+          rules:
+            - apiGroups:
+                - configuration.konghq.com
+              apiVersions:
+                - '*'
+              operations:
+                - CREATE
+                - UPDATE
+              resources:
+                - kongconsumers
+                - kongplugins
+                - kongclusterplugins
+                - kongingresses
+            - apiGroups:
+                - \"\"
+              apiVersions:
+                - v1
+              operations:
+                - CREATE
+                - UPDATE
+              resources:
+                - secrets
+                - services
+            - apiGroups:
+                - networking.k8s.io
+              apiVersions:
+                - v1
+              operations:
+                - CREATE
+                - UPDATE
+              resources:
+                - ingresses
+            - apiGroups:
+                - gateway.networking.k8s.io
+              apiVersions:
+                - v1alpha2
+                - v1beta1
+                - v1
+              operations:
+                - CREATE
+                - UPDATE
+              resources:
+                - gateways
+                - httproutes
+          sideEffects: None
+- object:
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+        labels:
+            app.kubernetes.io/component: app
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+        namespace: default
+    spec:
+        replicas: 1
+        selector:
+            matchLabels:
+                app.kubernetes.io/component: app
+                app.kubernetes.io/instance: chartsnap
+                app.kubernetes.io/name: kong
+        template:
+            metadata:
+                annotations:
+                    kuma.io/gateway: enabled
+                    kuma.io/service-account-token-volume: chartsnap-kong-token
+                    traffic.sidecar.istio.io/includeInboundPorts: \"\"
+                labels:
+                    app: chartsnap-kong
+                    app.kubernetes.io/component: app
+                    app.kubernetes.io/instance: chartsnap
+                    app.kubernetes.io/managed-by: Helm
+                    app.kubernetes.io/name: kong
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
+            spec:
+                automountServiceAccountToken: false
+                containers:
+                    - args: null
+                      env:
+                        - name: POD_NAME
+                          valueFrom:
+                            fieldRef:
+                                apiVersion: v1
+                                fieldPath: metadata.name
+                        - name: POD_NAMESPACE
+                          valueFrom:
+                            fieldRef:
+                                apiVersion: v1
+                                fieldPath: metadata.namespace
+                        - name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN
+                          value: 0.0.0.0:8080
+                        - name: CONTROLLER_ELECTION_ID
+                          value: kong-ingress-controller-leader-kong
+                        - name: CONTROLLER_INGRESS_CLASS
+                          value: kong
+                        - name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
+                          value: \"true\"
+                        - name: CONTROLLER_KONG_ADMIN_URL
+                          value: https://localhost:8444
+                        - name: CONTROLLER_PUBLISH_SERVICE
+                          value: default/chartsnap-kong-proxy
+                      image: kong/kubernetes-ingress-controller:3.1
+                      imagePullPolicy: IfNotPresent
+                      livenessProbe:
+                        failureThreshold: 3
+                        httpGet:
+                            path: /healthz
+                            port: 10254
+                            scheme: HTTP
+                        initialDelaySeconds: 5
+                        periodSeconds: 10
+                        successThreshold: 1
+                        timeoutSeconds: 5
+                      name: ingress-controller
+                      ports:
+                        - containerPort: 8080
+                          name: webhook
+                          protocol: TCP
+                        - containerPort: 10255
+                          name: cmetrics
+                          protocol: TCP
+                        - containerPort: 10254
+                          name: cstatus
+                          protocol: TCP
+                      readinessProbe:
+                        failureThreshold: 3
+                        httpGet:
+                            path: /readyz
+                            port: 10254
+                            scheme: HTTP
+                        initialDelaySeconds: 5
+                        periodSeconds: 10
+                        successThreshold: 1
+                        timeoutSeconds: 5
+                      resources: {}
+                      securityContext:
+                        allowPrivilegeEscalation: false
+                        capabilities:
+                            drop:
+                                - ALL
+                        readOnlyRootFilesystem: true
+                        runAsNonRoot: true
+                        runAsUser: 1000
+                        seccompProfile:
+                            type: RuntimeDefault
+                      volumeMounts:
+                        - mountPath: /admission-webhook
+                          name: webhook-cert
+                          readOnly: true
+                        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+                          name: chartsnap-kong-token
+                          readOnly: true
+                    - env:
+                        - name: KONG_ADMIN_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_ADMIN_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ADMIN_GUI_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_ADMIN_GUI_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ADMIN_LISTEN
+                          value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
+                        - name: KONG_CLUSTER_LISTEN
+                          value: \"off\"
+                        - name: KONG_DATABASE
+                          value: \"off\"
+                        - name: KONG_KIC
+                          value: \"on\"
+                        - name: KONG_LUA_PACKAGE_PATH
+                          value: /opt/?.lua;/opt/?/init.lua;;
+                        - name: KONG_NGINX_WORKER_PROCESSES
+                          value: \"2\"
+                        - name: KONG_PORTAL_API_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_PORTAL_API_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_PORT_MAPS
+                          value: 80:8000, 443:8443
+                        - name: KONG_PREFIX
+                          value: /kong_prefix/
+                        - name: KONG_PROXY_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_PROXY_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_PROXY_LISTEN
+                          value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
+                        - name: KONG_PROXY_STREAM_ACCESS_LOG
+                          value: /dev/stdout basic
+                        - name: KONG_PROXY_STREAM_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ROUTER_FLAVOR
+                          value: traditional
+                        - name: KONG_STATUS_ACCESS_LOG
+                          value: \"off\"
+                        - name: KONG_STATUS_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_STATUS_LISTEN
+                          value: 0.0.0.0:8100, [::]:8100
+                        - name: KONG_STREAM_LISTEN
+                          value: \"off\"
+                        - name: KONG_NGINX_DAEMON
+                          value: \"off\"
+                      image: kong:3.6
+                      imagePullPolicy: IfNotPresent
+                      lifecycle:
+                        preStop:
+                            exec:
+                                command:
+                                    - kong
+                                    - quit
+                                    - --wait=15
+                      livenessProbe:
+                        failureThreshold: 3
+                        httpGet:
+                            path: /status
+                            port: status
+                            scheme: HTTP
+                        initialDelaySeconds: 5
+                        periodSeconds: 10
+                        successThreshold: 1
+                        timeoutSeconds: 5
+                      name: proxy
+                      ports:
+                        - containerPort: 8000
+                          name: proxy
+                          protocol: TCP
+                        - containerPort: 8443
+                          name: proxy-tls
+                          protocol: TCP
+                        - containerPort: 8100
+                          name: status
+                          protocol: TCP
+                      readinessProbe:
+                        failureThreshold: 3
+                        httpGet:
+                            path: /status/ready
+                            port: status
+                            scheme: HTTP
+                        initialDelaySeconds: 5
+                        periodSeconds: 10
+                        successThreshold: 1
+                        timeoutSeconds: 5
+                      resources: {}
+                      securityContext:
+                        allowPrivilegeEscalation: false
+                        capabilities:
+                            drop:
+                                - ALL
+                        readOnlyRootFilesystem: true
+                        runAsNonRoot: true
+                        runAsUser: 1000
+                        seccompProfile:
+                            type: RuntimeDefault
+                      volumeMounts:
+                        - mountPath: /kong_prefix/
+                          name: chartsnap-kong-prefix-dir
+                        - mountPath: /tmp
+                          name: chartsnap-kong-tmp
+                initContainers:
+                    - command:
+                        - rm
+                        - -vrf
+                        - $KONG_PREFIX/pids
+                      env:
+                        - name: KONG_ADMIN_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_ADMIN_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ADMIN_GUI_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_ADMIN_GUI_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ADMIN_LISTEN
+                          value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
+                        - name: KONG_CLUSTER_LISTEN
+                          value: \"off\"
+                        - name: KONG_DATABASE
+                          value: \"off\"
+                        - name: KONG_KIC
+                          value: \"on\"
+                        - name: KONG_LUA_PACKAGE_PATH
+                          value: /opt/?.lua;/opt/?/init.lua;;
+                        - name: KONG_NGINX_WORKER_PROCESSES
+                          value: \"2\"
+                        - name: KONG_PORTAL_API_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_PORTAL_API_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_PORT_MAPS
+                          value: 80:8000, 443:8443
+                        - name: KONG_PREFIX
+                          value: /kong_prefix/
+                        - name: KONG_PROXY_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_PROXY_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_PROXY_LISTEN
+                          value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
+                        - name: KONG_PROXY_STREAM_ACCESS_LOG
+                          value: /dev/stdout basic
+                        - name: KONG_PROXY_STREAM_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ROUTER_FLAVOR
+                          value: traditional
+                        - name: KONG_STATUS_ACCESS_LOG
+                          value: \"off\"
+                        - name: KONG_STATUS_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_STATUS_LISTEN
+                          value: 0.0.0.0:8100, [::]:8100
+                        - name: KONG_STREAM_LISTEN
+                          value: \"off\"
+                      image: kong:3.6
+                      imagePullPolicy: IfNotPresent
+                      name: clear-stale-pid
+                      resources: {}
+                      securityContext:
+                        allowPrivilegeEscalation: false
+                        capabilities:
+                            drop:
+                                - ALL
+                        readOnlyRootFilesystem: true
+                        runAsNonRoot: true
+                        runAsUser: 1000
+                        seccompProfile:
+                            type: RuntimeDefault
+                      volumeMounts:
+                        - mountPath: /kong_prefix/
+                          name: chartsnap-kong-prefix-dir
+                        - mountPath: /tmp
+                          name: chartsnap-kong-tmp
+                securityContext: {}
+                serviceAccountName: chartsnap-kong
+                terminationGracePeriodSeconds: 30
+                volumes:
+                    - emptyDir:
+                        sizeLimit: 256Mi
+                      name: chartsnap-kong-prefix-dir
+                    - emptyDir:
+                        sizeLimit: 1Gi
+                      name: chartsnap-kong-tmp
+                    - name: chartsnap-kong-token
+                      projected:
+                        sources:
+                            - serviceAccountToken:
+                                expirationSeconds: 3607
+                                path: token
+                            - configMap:
+                                items:
+                                    - key: ca.crt
+                                      path: ca.crt
+                                name: kube-root-ca.crt
+                            - downwardAPI:
+                                items:
+                                    - fieldRef:
+                                        apiVersion: v1
+                                        fieldPath: metadata.namespace
+                                      path: namespace
+                    - name: webhook-cert
+                      secret:
+                        secretName: chartsnap-kong-validation-webhook-keypair
+- object:
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRole
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+    rules:
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongupstreampolicies
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongupstreampolicies/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongconsumergroups
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongconsumergroups/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - \"\"
+          resources:
+            - events
+          verbs:
+            - create
+            - patch
+        - apiGroups:
+            - \"\"
+          resources:
+            - nodes
+          verbs:
+            - list
+            - watch
+        - apiGroups:
+            - \"\"
+          resources:
+            - pods
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - \"\"
+          resources:
+            - secrets
+          verbs:
+            - list
+            - watch
+        - apiGroups:
+            - \"\"
+          resources:
+            - services
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - \"\"
+          resources:
+            - services/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - ingressclassparameterses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongconsumers
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongconsumers/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongingresses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongingresses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongplugins
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongplugins/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - tcpingresses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - tcpingresses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - udpingresses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - udpingresses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - extensions
+          resources:
+            - ingresses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - extensions
+          resources:
+            - ingresses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - networking.k8s.io
+          resources:
+            - ingresses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - networking.k8s.io
+          resources:
+            - ingresses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - discovery.k8s.io
+          resources:
+            - endpointslices
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongclusterplugins
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongclusterplugins/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - apiextensions.k8s.io
+          resources:
+            - customresourcedefinitions
+          verbs:
+            - list
+            - watch
+        - apiGroups:
+            - networking.k8s.io
+          resources:
+            - ingressclasses
+          verbs:
+            - get
+            - list
+            - watch
+- object:
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRoleBinding
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+    roleRef:
+        apiGroup: rbac.authorization.k8s.io
+        kind: ClusterRole
+        name: chartsnap-kong
+    subjects:
+        - kind: ServiceAccount
+          name: chartsnap-kong
+          namespace: default
+- object:
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: Role
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+        namespace: default
+    rules:
+        - apiGroups:
+            - \"\"
+          resources:
+            - configmaps
+            - pods
+            - secrets
+            - namespaces
+          verbs:
+            - get
+        - apiGroups:
+            - \"\"
+          resourceNames:
+            - kong-ingress-controller-leader-kong-kong
+          resources:
+            - configmaps
+          verbs:
+            - get
+            - update
+        - apiGroups:
+            - \"\"
+          resources:
+            - configmaps
+          verbs:
+            - create
+        - apiGroups:
+            - \"\"
+            - coordination.k8s.io
+          resources:
+            - configmaps
+            - leases
+          verbs:
+            - get
+            - list
+            - watch
+            - create
+            - update
+            - patch
+            - delete
+        - apiGroups:
+            - \"\"
+          resources:
+            - events
+          verbs:
+            - create
+            - patch
+        - apiGroups:
+            - \"\"
+          resources:
+            - services
+          verbs:
+            - get
+- object:
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+        namespace: default
+    roleRef:
+        apiGroup: rbac.authorization.k8s.io
+        kind: Role
+        name: chartsnap-kong
+    subjects:
+        - kind: ServiceAccount
+          name: chartsnap-kong
+          namespace: default
+- object:
+    apiVersion: v1
+    data:
+        tls.crt: '###DYNAMIC_FIELD###'
+        tls.key: '###DYNAMIC_FIELD###'
+    kind: Secret
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-validation-webhook-ca-keypair
+        namespace: default
+    type: kubernetes.io/tls
+- object:
+    apiVersion: v1
+    data:
+        tls.crt: '###DYNAMIC_FIELD###'
+        tls.key: '###DYNAMIC_FIELD###'
+    kind: Secret
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-validation-webhook-keypair
+        namespace: default
+    type: kubernetes.io/tls
+- object:
+    apiVersion: v1
+    kind: Service
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-manager
+        namespace: default
+    spec:
+        ports:
+            - name: kong-manager
+              port: 8002
+              protocol: TCP
+              targetPort: 8002
+            - name: kong-manager-tls
+              port: 8445
+              protocol: TCP
+              targetPort: 8445
+        selector:
+            app.kubernetes.io/component: app
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: kong
+        type: NodePort
+- object:
+    apiVersion: v1
+    kind: Service
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            enable-metrics: \"true\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-proxy
+        namespace: default
+    spec:
+        ports:
+            - appProtocol: http
+              name: kong-proxy
+              port: 80
+              protocol: TCP
+              targetPort: 8000
+            - appProtocol: https
+              name: kong-proxy-tls
+              port: 443
+              protocol: TCP
+              targetPort: 8443
+        selector:
+            app.kubernetes.io/component: app
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: kong
+        type: LoadBalancer
+- object:
+    apiVersion: v1
+    kind: Service
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-validation-webhook
+        namespace: default
+    spec:
+        ports:
+            - name: webhook
+              port: 443
+              protocol: TCP
+              targetPort: webhook
+        selector:
+            app.kubernetes.io/component: app
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+- object:
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+        namespace: default
+"""
--- a/build_system/charts/open-appsec-kong/ci/snapshots/service-account.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/service-account.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -105,9 +105,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -135,7 +135,7 @@ SnapShot = """
                          value: https://localhost:8444
                        - name: CONTROLLER_PUBLISH_SERVICE
                          value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                      imagePullPolicy: IfNotPresent
                      livenessProbe:
                        failureThreshold: 3
@@ -156,7 +156,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -237,7 +237,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -347,7 +347,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -404,8 +404,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -613,6 +613,38 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -652,8 +684,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -671,8 +703,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -735,8 +767,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -758,8 +790,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -774,8 +806,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -787,8 +819,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -814,9 +846,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -842,8 +874,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -857,8 +889,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: ServiceAccount
@@ -867,8 +899,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: my-kong-sa
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/single-image-default-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/single-image-default-values.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -105,9 +105,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -158,7 +158,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -410,8 +410,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -619,6 +619,38 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -658,8 +690,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -677,8 +709,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -741,8 +773,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -764,8 +796,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -780,8 +812,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -793,8 +825,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -820,9 +852,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -848,8 +880,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -863,8 +895,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: ServiceAccount
@@ -873,8 +905,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/test-enterprise-version-3.4.0.0-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/test-enterprise-version-3.4.0.0-values.snap
@@ -9,8 +9,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -32,9 +32,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -249,8 +249,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -276,9 +276,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -304,8 +304,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/test1-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/test1-values.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -104,10 +104,10 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
                    environment: test
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -139,7 +139,7 @@ SnapShot = """
                          value: https://localhost:8444
                        - name: CONTROLLER_PUBLISH_SERVICE
                          value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                      imagePullPolicy: IfNotPresent
                      livenessProbe:
                        failureThreshold: 3
@@ -160,7 +160,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -252,7 +252,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -370,7 +370,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -447,8 +447,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -473,8 +473,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -497,8 +497,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -706,6 +706,38 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -745,8 +777,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -764,8 +796,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -828,8 +860,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -851,8 +883,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -867,8 +899,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -880,8 +912,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -907,9 +939,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -935,8 +967,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -950,8 +982,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: ServiceAccount
@@ -960,8 +992,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/test2-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/test2-values.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -83,8 +83,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -111,9 +111,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -150,7 +150,7 @@ SnapShot = """
                      envFrom:
                        - configMapRef:
                            name: env-config
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                      imagePullPolicy: IfNotPresent
                      livenessProbe:
                        failureThreshold: 3
@@ -171,7 +171,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -270,7 +270,7 @@ SnapShot = """
                      envFrom:
                        - configMapRef:
                            name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -404,7 +404,7 @@ SnapShot = """
                      envFrom:
                        - configMapRef:
                            name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -507,7 +507,7 @@ SnapShot = """
                      envFrom:
                        - configMapRef:
                            name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: wait-for-db
                      resources: {}
@@ -724,8 +724,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-init-migrations
        namespace: default
    spec:
@@ -740,8 +740,8 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                name: kong-init-migrations
            spec:
                automountServiceAccountToken: false
@@ -819,7 +819,7 @@ SnapShot = """
                      envFrom:
                        - configMapRef:
                            name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: kong-migrations
                      resources: {}
@@ -924,7 +924,7 @@ SnapShot = """
                      envFrom:
                        - configMapRef:
                            name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: wait-for-postgres
                      resources: {}
@@ -977,8 +977,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-post-upgrade-migrations
        namespace: default
    spec:
@@ -993,8 +993,8 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                name: kong-post-upgrade-migrations
            spec:
                automountServiceAccountToken: false
@@ -1072,7 +1072,7 @@ SnapShot = """
                      envFrom:
                        - configMapRef:
                            name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: kong-post-upgrade-migrations
                      resources: {}
@@ -1177,7 +1177,7 @@ SnapShot = """
                      envFrom:
                        - configMapRef:
                            name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: wait-for-postgres
                      resources: {}
@@ -1232,8 +1232,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-pre-upgrade-migrations
        namespace: default
    spec:
@@ -1248,8 +1248,8 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                name: kong-pre-upgrade-migrations
            spec:
                automountServiceAccountToken: false
@@ -1327,7 +1327,7 @@ SnapShot = """
                      envFrom:
                        - configMapRef:
                            name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: kong-upgrade-migrations
                      resources: {}
@@ -1432,7 +1432,7 @@ SnapShot = """
                      envFrom:
                        - configMapRef:
                            name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: wait-for-postgres
                      resources: {}
@@ -1481,8 +1481,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -1505,10 +1505,26 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -1548,8 +1564,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -1567,8 +1583,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -1631,8 +1647,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-default
        namespace: default
    rules:
@@ -1841,6 +1857,22 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
 - object:
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
@@ -1849,8 +1881,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -1869,8 +1901,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-default
        namespace: default
    roleRef:
@@ -1895,8 +1927,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-bash-wait-for-postgres
        namespace: default
 - object:
@@ -1917,8 +1949,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -1933,8 +1965,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -1961,8 +1993,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -1988,9 +2020,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -2024,8 +2056,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -2039,8 +2071,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: Service
@@ -2099,8 +2131,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/test3-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/test3-values.snap
@@ -9,8 +9,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -33,9 +33,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -92,7 +92,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -208,7 +208,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -295,8 +295,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-custom-dbless-config
        namespace: default
 - object:
@@ -307,8 +307,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -334,9 +334,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -362,8 +362,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/test4-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/test4-values.snap
@@ -9,8 +9,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -33,9 +33,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -92,7 +92,7 @@ SnapShot = """
                          value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -212,7 +212,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -271,8 +271,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -304,8 +304,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-custom-dbless-config
        namespace: default
 - object:
@@ -316,8 +316,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -343,9 +343,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -379,8 +379,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/snapshots/test5-values.snap
+++ b/build_system/charts/open-appsec-kong/ci/snapshots/test5-values.snap
@@ -8,8 +8,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validations
        namespace: default
    webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    spec:
@@ -110,9 +110,9 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
            spec:
                automountServiceAccountToken: false
                containers:
@@ -142,7 +142,7 @@ SnapShot = """
                          value: https://localhost:8444
                        - name: CONTROLLER_PUBLISH_SERVICE
                          value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                      imagePullPolicy: IfNotPresent
                      livenessProbe:
                        failureThreshold: 3
@@ -163,7 +163,7 @@ SnapShot = """
                          name: cmetrics
                          protocol: TCP
                        - containerPort: 10254
-                          name: status
+                          name: cstatus
                          protocol: TCP
                      readinessProbe:
                        failureThreshold: 3
@@ -261,7 +261,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      lifecycle:
                        preStop:
@@ -388,7 +388,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: clear-stale-pid
                      resources: {}
@@ -477,7 +477,7 @@ SnapShot = """
                          value: 0.0.0.0:8100, [::]:8100
                        - name: KONG_STREAM_LISTEN
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: wait-for-db
                      resources: {}
@@ -694,8 +694,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-init-migrations
        namespace: default
    spec:
@@ -710,8 +710,8 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                name: kong-init-migrations
            spec:
                automountServiceAccountToken: false
@@ -788,7 +788,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: kong-migrations
                      resources: {}
@@ -879,7 +879,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: wait-for-postgres
                      resources: {}
@@ -932,8 +932,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-post-upgrade-migrations
        namespace: default
    spec:
@@ -948,8 +948,8 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                name: kong-post-upgrade-migrations
            spec:
                automountServiceAccountToken: false
@@ -1026,7 +1026,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: kong-post-upgrade-migrations
                      resources: {}
@@ -1117,7 +1117,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: wait-for-postgres
                      resources: {}
@@ -1172,8 +1172,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-pre-upgrade-migrations
        namespace: default
    spec:
@@ -1188,8 +1188,8 @@ SnapShot = """
                    app.kubernetes.io/instance: chartsnap
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                name: kong-pre-upgrade-migrations
            spec:
                automountServiceAccountToken: false
@@ -1266,7 +1266,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: kong-upgrade-migrations
                      resources: {}
@@ -1357,7 +1357,7 @@ SnapShot = """
                          value: \"off\"
                        - name: KONG_NGINX_DAEMON
                          value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                      imagePullPolicy: IfNotPresent
                      name: wait-for-postgres
                      resources: {}
@@ -1406,8 +1406,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -1430,8 +1430,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    rules:
        - apiGroups:
@@ -1639,6 +1639,38 @@ SnapShot = """
            - get
            - list
            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
        - apiGroups:
            - configuration.konghq.com
          resources:
@@ -1678,8 +1710,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
    roleRef:
        apiGroup: rbac.authorization.k8s.io
@@ -1697,8 +1729,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    rules:
@@ -1761,8 +1793,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
    roleRef:
@@ -1787,8 +1819,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-bash-wait-for-postgres
        namespace: default
 - object:
@@ -1802,8 +1834,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-ca-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -1818,8 +1850,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook-keypair
        namespace: default
    type: kubernetes.io/tls
@@ -1846,8 +1878,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-manager
        namespace: default
    spec:
@@ -1873,9 +1905,9 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-proxy
        namespace: default
    spec:
@@ -1901,8 +1933,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong-validation-webhook
        namespace: default
    spec:
@@ -1916,8 +1948,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
    apiVersion: v1
    kind: Service
@@ -1976,8 +2008,8 @@ SnapShot = """
            app.kubernetes.io/instance: chartsnap
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
        name: chartsnap-kong
        namespace: default
 """
--- a/build_system/charts/open-appsec-kong/ci/proxy-appprotocol-values.yaml
+++ b/build_system/charts/open-appsec-kong/ci/proxy-appprotocol-values.yaml
@@ -0,0 +1,7 @@
+# This values test that the `proxy.*.appProtocol` can be set to a custom value.
+
+proxy:
+  http:
+    appProtocol: "http"
+  tls:
+    appProtocol: "https"
--- a/build_system/charts/open-appsec-kong/crds/custom-resource-definitions.yaml
+++ b/build_system/charts/open-appsec-kong/crds/custom-resource-definitions.yaml
--- a/build_system/charts/open-appsec-kong/templates/_helpers.tpl
+++ b/build_system/charts/open-appsec-kong/templates/_helpers.tpl
@@ -213,6 +213,9 @@ spec:
  - name: kong-{{ .serviceName }}
    port: {{ .http.servicePort }}
    targetPort: {{ .http.containerPort }}
+  {{- if .http.appProtocol }}
+    appProtocol: {{ .http.appProtocol }}
+  {{- end }}
  {{- if (and (or (eq .type "LoadBalancer") (eq .type "NodePort")) (not (empty .http.nodePort))) }}
    nodePort: {{ .http.nodePort }}
  {{- end }}
@@ -223,6 +226,9 @@ spec:
  - name: kong-{{ .serviceName }}-tls
    port: {{ .tls.servicePort }}
    targetPort: {{ .tls.overrideServiceTargetPort | default .tls.containerPort }}
+  {{- if .tls.appProtocol }}
+    appProtocol: {{ .tls.appProtocol }}
+  {{- end }}
  {{- if (and (or (eq .type "LoadBalancer") (eq .type "NodePort")) (not (empty .tls.nodePort))) }}
    nodePort: {{ .tls.nodePort }}
  {{- end }}
@@ -890,7 +896,7 @@ The name of the Service which will be used by the controller to update the Ingre
    containerPort: 10255
    protocol: TCP
  {{- end }}
-  - name: status
+  - name: cstatus
    containerPort: 10254
    protocol: TCP
  env:
--- a/build_system/charts/open-appsec-kong/templates/default-policy.yaml
+++ b/build_system/charts/open-appsec-kong/templates/default-policy.yaml
@@ -34,7 +34,7 @@ spec:
    http-headers: false
    request-body: false
  log-destination:
-    cloud: false
+    cloud: true
    stdout:
      format: json-formatted
 ---
--- a/build_system/charts/open-appsec-kong/values.yaml
+++ b/build_system/charts/open-appsec-kong/values.yaml
@@ -130,7 +130,7 @@ extraLabels: {}
 # Specify Kong's Docker image and repository details here
 image:
  repository: kong
-  tag: "3.5"
+  tag: "3.6"
  # Kong Enterprise
  # repository: kong/kong-gateway
  # tag: "3.5"
@@ -317,6 +317,10 @@ proxy:
    parameters:
    - http2

+    # Specify the Service's TLS port's appProtocol. This can be useful when integrating with
+    # external load balancers that require the `appProtocol` field to be set (e.g. GCP).
+    appProtocol: ""
+
  # Define stream (TCP) listen
  # To enable, remove "[]", uncomment the section below, and select your desired
  # ports and parameters. Listens are dynamically named after their containerPort,
@@ -525,7 +529,7 @@ ingressController:
  enabled: true
  image:
    repository: kong/kubernetes-ingress-controller
-    tag: "3.0"
+    tag: "3.1"
    # Optionally set a semantic version for version-gated features. This can normally
    # be left unset. You only need to set this if your tag is not a semver string,
    # such as when you are using a "next" tag. Set this to the effective semantic
@@ -1255,7 +1259,7 @@ appsec:
    #registry:
    repository: ghcr.io/openappsec
    image: "agent"
-    tag: "1.1.6"
+    tag: "1.1.8"
    pullPolicy: Always

    securityContext:
@@ -1269,7 +1273,7 @@ appsec:
  kong:
    image:
      repository: "ghcr.io/openappsec/kong-attachment"
-      tag: "1.1.6"
+      tag: "1.1.8"
  configMapName: appsec-settings-configmap
  configMapContent:
    crowdsec:
--- a/build_system/docker/entry.sh
+++ b/build_system/docker/entry.sh
@@ -11,6 +11,7 @@ var_fog_address=
 var_proxy=
 var_mode=
 var_token=
+var_ignore=
 init=

 if [ ! -f /nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT ]; then
@@ -18,6 +19,10 @@ if [ ! -f /nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT ]; then
    exit 1
 fi

+if [ -z $1 ]; then
+    var_mode="--hybrid_mode"
+fi
+
 while true; do
    if [ -z "$1" ]; then
        break
@@ -27,24 +32,30 @@ while true; do
    elif [ "$1" == "--proxy" ]; then
        shift
        var_proxy="$1"
-    elif [ "$1" == "--hybrid-mode" ]; then
+    elif [ "$1" == "--hybrid-mode" ] || [ "$1" == "--standalone" ]; then
        var_mode="--hybrid_mode"
+    elif [ "$1" == "--no-upgrade" ]; then
+        var_ignore="--ignore all"
    elif [ "$1" == "--token" ]; then
        shift
        var_token="$1"
-    elif [ "$1" == "--standalone" ]; then
-        var_mode="--hybrid_mode"
-        var_token="cp-3fb5c718-5e39-47e6-8d5e-99b4bc5660b74b4b7fc8-5312-451d-a763-aaf7872703c0"
    fi
    shift
 done

-if [ -z $var_token ]; then
-    echo "Error: Token was not provided as input argument."
-    exit 1
+if [ -z $var_token ] && [ $var_mode != "--hybrid_mode" ]; then
+    var_token=$(env | grep 'AGENT_TOKEN=' | cut -d'=' -f2-)
+    if  [ -z $var_token ]; then
+        echo "Error: Token was not provided as input argument."
+        exit 1
+    fi
 fi

-orchestration_service_installation_flags="--token $var_token --container_mode --skip_registration"
+orchestration_service_installation_flags="--container_mode --skip_registration"
+if [ ! -z $var_token ]; then
+    export AGENT_TOKEN="$var_token"
+    orchestration_service_installation_flags="$orchestration_service_installation_flags --token $var_token"
+fi
 if [ ! -z $var_fog_address ]; then
    orchestration_service_installation_flags="$orchestration_service_installation_flags --fog $var_fog_address"
 fi
@@ -55,6 +66,9 @@ fi
 if [ ! -z $var_mode ]; then
    orchestration_service_installation_flags="$orchestration_service_installation_flags $var_mode"
 fi
+if [ ! -z "$var_ignore" ]; then
+    orchestration_service_installation_flags="$orchestration_service_installation_flags $var_ignore"
+fi


 /nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT --install $orchestration_service_installation_flags
--- a/build_system/docker/install-cp-agent-intelligence-service.sh
+++ b/build_system/docker/install-cp-agent-intelligence-service.sh
--- a/build_system/docker/install-cp-crowdsec-aux.sh
+++ b/build_system/docker/install-cp-crowdsec-aux.sh
--- a/components/CMakeLists.txt
+++ b/components/CMakeLists.txt
@@ -1,10 +1,8 @@
-add_subdirectory(report_messaging)
 add_subdirectory(http_manager)
 add_subdirectory(signal_handler)
 add_subdirectory(gradual_deployment)
 add_subdirectory(packet)
 add_subdirectory(pending_key)
-add_subdirectory(health_check_manager)

 add_subdirectory(utils)
 add_subdirectory(attachment-intakers)
--- a/components/attachment-intakers/attachment_registrator/attachment_registrator.cc
+++ b/components/attachment-intakers/attachment_registrator/attachment_registrator.cc
@@ -39,6 +39,8 @@ USE_DEBUG_FLAG(D_ATTACHMENT_REGISTRATION);

 using namespace std;

+static const AlertInfo alert(AlertTeam::CORE, "attachment registrator");
+
 class AttachmentRegistrator::Impl
 {
 public:
@@ -163,7 +165,7 @@ private:
                break;
            }
            default:
-                dbgAssert(false) << "Unsupported Attachment " << static_cast<int>(type);
+                dbgAssert(false) << alert << "Unsupported Attachment " << static_cast<int>(type);
        }

        if (!family_id.empty()) handler_path << family_id << "_";
@@ -175,7 +177,9 @@ private:
    string
    genRegCommand(const string &family_id, const uint num_of_members, const AttachmentType type) const
    {
-        dbgAssert(num_of_members > 0) << "Failed to generate a registration command for an empty group of attachments";
+        dbgAssert(num_of_members > 0)
+            << alert
+            << "Failed to generate a registration command for an empty group of attachments";

        static const string registration_format = "/etc/cp/watchdog/cp-nano-watchdog --register ";
        stringstream registration_command;
@@ -187,7 +191,7 @@ private:
                break;
            }
            default:
-                dbgAssert(false) << "Unsupported Attachment " << static_cast<int>(type);
+                dbgAssert(false) << alert << "Unsupported Attachment " << static_cast<int>(type);
        }

        if (!family_id.empty()) registration_command << " --family " << family_id;
@@ -265,7 +269,7 @@ private:
            return -1;
        }

-        dbgAssert(new_socket.unpack() > 0) << "Generated socket is OK yet negative";
+        dbgAssert(new_socket.unpack() > 0) << alert << "Generated socket is OK yet negative";
        return new_socket.unpack();
    }

@@ -281,7 +285,7 @@ private:
        }

        I_Socket::socketFd client_socket = accepted_socket.unpack();
-        dbgAssert(client_socket > 0) << "Generated client socket is OK yet negative";
+        dbgAssert(client_socket > 0) << alert << "Generated client socket is OK yet negative";
        auto close_socket_on_exit = make_scope_exit([&]() { i_socket->closeSocket(client_socket); });

        Maybe<uint8_t> attachment_id = readNumericParam(client_socket);
@@ -375,7 +379,7 @@ private:
        }

        I_Socket::socketFd client_socket = accepted_socket.unpack();
-        dbgAssert(client_socket > 0) << "Generated client socket is OK yet negative";
+        dbgAssert(client_socket > 0) << alert << "Generated client socket is OK yet negative";
        auto close_socket_on_exit = make_scope_exit([&]() { i_socket->closeSocket(client_socket); });

        Maybe<AttachmentType> attachment_type = readAttachmentType(client_socket);
--- a/components/attachment-intakers/nginx_attachment/nginx_attachment.cc
+++ b/components/attachment-intakers/nginx_attachment/nginx_attachment.cc
@@ -76,6 +76,7 @@ using namespace std;
 using ChunkType = ngx_http_chunk_type_e;

 static const uint32_t corrupted_session_id = CORRUPTED_SESSION_ID;
+static const AlertInfo alert(AlertTeam::CORE, "nginx attachment");

 class FailopenModeListener : public Listener<FailopenModeEvent>
 {
@@ -410,7 +411,10 @@ private:
    bool
    registerAttachmentProcess(uint32_t nginx_user_id, uint32_t nginx_group_id, I_Socket::socketFd new_socket)
    {
-        dbgAssert(server_sock > 0) << "Registration attempt occurred while registration socket is uninitialized";
+        dbgAssert(server_sock > 0)
+        << alert
+        << "Registration attempt occurred while registration socket is uninitialized";
+
 #ifdef FAILURE_TEST
        bool did_fail_on_purpose = false;
 #endif
@@ -802,10 +806,10 @@ private:
        case ChunkType::HOLD_DATA:
            return "HOLD_DATA";
        case ChunkType::COUNT:
-            dbgAssert(false) << "Invalid 'COUNT' ChunkType";
+            dbgAssert(false) << alert << "Invalid 'COUNT' ChunkType";
            return "";
        }
-        dbgAssert(false) << "ChunkType was not handled by the switch case";
+        dbgAssert(false) << alert << "ChunkType was not handled by the switch case";
        return "";
    }

@@ -1582,7 +1586,7 @@ private:
            case WAIT:
                return "WAIT";
        }
-        dbgAssert(false) << "Invalid EventVerdict enum: " << static_cast<int>(verdict.getVerdict());
+        dbgAssert(false) << alert << "Invalid EventVerdict enum: " << static_cast<int>(verdict.getVerdict());
        return string();
    }

@@ -1633,13 +1637,14 @@ private:
            return false;
        }

-        dbgAssert(sock.unpack() > 0) << "The generated server socket is OK, yet negative";
+        dbgAssert(sock.unpack() > 0) << alert << "The generated server socket is OK, yet negative";
        server_sock = sock.unpack();

        I_MainLoop::Routine accept_attachment_routine =
            [this] ()
            {
                dbgAssert(inst_awareness->getUniqueID().ok())
+                    << alert
                    << "NGINX attachment Initialized without Instance Awareness";

                bool did_fail_on_purpose = false;
@@ -1652,7 +1657,7 @@ private:
                    << (did_fail_on_purpose ? "Intentional Failure" : new_sock.getErr());
                    return;
                }
-                dbgAssert(new_sock.unpack() > 0) << "The generated client socket is OK, yet negative";
+                dbgAssert(new_sock.unpack() > 0) << alert << "The generated client socket is OK, yet negative";
                I_Socket::socketFd new_attachment_socket = new_sock.unpack();

                Maybe<string> uid = getUidFromSocket(new_attachment_socket);
@@ -1698,7 +1703,7 @@ private:
                }
            };
        mainloop->addFileRoutine(
-            I_MainLoop::RoutineType::RealTime,
+            I_MainLoop::RoutineType::System,
            server_sock,
            accept_attachment_routine,
            "Nginx Attachment registration listener",
@@ -1711,7 +1716,9 @@ private:
    Maybe<string>
    getUidFromSocket(I_Socket::socketFd new_attachment_socket)
    {
-        dbgAssert(server_sock > 0) << "Registration attempt occurred while registration socket is uninitialized";
+        dbgAssert(server_sock > 0)
+            << alert
+            << "Registration attempt occurred while registration socket is uninitialized";

        bool did_fail_on_purpose = false;
        DELAY_IF_NEEDED(IntentionalFailureHandler::FailureType::ReceiveDataFromSocket);
--- a/components/attachment-intakers/nginx_attachment/nginx_attachment_config.cc
+++ b/components/attachment-intakers/nginx_attachment/nginx_attachment_config.cc
@@ -42,6 +42,7 @@ HttpAttachmentConfig::init()
    setNumOfNginxIpcElements();
    setDebugByContextValues();
    setKeepAliveIntervalMsec();
+    setRetriesForVerdict();
 }

 bool
@@ -215,6 +216,31 @@ HttpAttachmentConfig::setFailOpenTimeout()
    conf_data.setNumericalValue("nginx_inspection_mode", inspection_mode);
 }

+void
+HttpAttachmentConfig::setRetriesForVerdict()
+{
+    conf_data.setNumericalValue("min_retries_for_verdict", getAttachmentConf<uint>(
+        3,
+        "agent.minRetriesForVerdict.nginxModule",
+        "HTTP manager",
+        "Min retries for verdict"
+    ));
+
+    conf_data.setNumericalValue("max_retries_for_verdict", getAttachmentConf<uint>(
+        15,
+        "agent.maxRetriesForVerdict.nginxModule",
+        "HTTP manager",
+        "Max retries for verdict"
+    ));
+
+    conf_data.setNumericalValue("body_size_trigger", getAttachmentConf<uint>(
+        200000,
+        "agent.reqBodySizeTrigger.nginxModule",
+        "HTTP manager",
+        "Request body size trigger"
+    ));
+}
+
 void
 HttpAttachmentConfig::setFailOpenWaitMode()
 {
--- a/components/attachment-intakers/nginx_attachment/nginx_attachment_config.h
+++ b/components/attachment-intakers/nginx_attachment/nginx_attachment_config.h
@@ -70,6 +70,8 @@ private:

    void setDebugByContextValues();

+    void setRetriesForVerdict();
+
    WebTriggerConf web_trigger_conf;
    HttpAttachmentConfiguration conf_data;
 };
--- a/components/attachment-intakers/nginx_attachment/user_identifiers_config.cc
+++ b/components/attachment-intakers/nginx_attachment/user_identifiers_config.cc
@@ -306,22 +306,27 @@ UsersAllIdentifiersConfig::parseXForwardedFor(const string &str) const
 void
 UsersAllIdentifiersConfig::setXFFValuesToOpaqueCtx(const HttpHeader &header, ExtractType type) const
 {
+    auto i_transaction_table = Singleton::Consume<I_TableSpecific<SessionID>>::by<NginxAttachment>();
+    if (!i_transaction_table || !i_transaction_table->hasState<NginxAttachmentOpaque>()) {
+        dbgTrace(D_NGINX_ATTACHMENT_PARSER) << "Can't get the transaction table";
+        return;
+    }
+    NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
    auto value = parseXForwardedFor(header.getValue());
    if (!value.ok()) {
        dbgTrace(D_NGINX_ATTACHMENT_PARSER) << "Could not extract source identifier from X-Forwarded-For header";
        return;
    };
-    auto i_transaction_table = Singleton::Consume<I_TableSpecific<SessionID>>::by<NginxAttachment>();
-    if (!i_transaction_table || !i_transaction_table->hasState<NginxAttachmentOpaque>()) {
-        dbgDebug(D_NGINX_ATTACHMENT_PARSER) << "Can't get the transaction table";
-        return;
-    }
-    NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
+
    if (type == ExtractType::SOURCEIDENTIFIER) {
        opaque.setSourceIdentifier(header.getKey(), value.unpack());
        dbgDebug(D_NGINX_ATTACHMENT_PARSER)
            << "Added source identifir to XFF "
            <<  value.unpack();
+        opaque.setSavedData(HttpTransactionData::xff_vals_ctx, header.getValue());
+        dbgTrace(D_NGINX_ATTACHMENT_PARSER)
+        << "XFF found, set ctx with value from header: "
+        << static_cast<string>(header.getValue());
    } else {
        opaque.setSavedData(HttpTransactionData::proxy_ip_ctx, value.unpack());
    }
--- a/components/generic_rulebase/assets_config.cc
+++ b/components/generic_rulebase/assets_config.cc
@@ -1,137 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/assets_config.h"
-
-#include <string>
-#include <algorithm>
-#include <unordered_map>
-
-#include "generic_rulebase/generic_rulebase_utils.h"
-#include "config.h"
-#include "debug.h"
-#include "ip_utilities.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-void
-RuleAsset::load(cereal::JSONInputArchive &archive_in)
-{
-    archive_in(cereal::make_nvp("assetId", asset_id));
-    archive_in(cereal::make_nvp("assetName", asset_name));
-    archive_in(cereal::make_nvp("assetUrls", asset_urls));
-
-    dbgWarning(D_RULEBASE_CONFIG) << "Adding asset with UID: " << asset_id;
-}
-
-void
-RuleAsset::AssetUrl::load(cereal::JSONInputArchive &archive_in)
-{
-    archive_in(cereal::make_nvp("protocol", protocol));
-    transform(protocol.begin(), protocol.end(), protocol.begin(), [](unsigned char c) { return tolower(c); });
-
-    archive_in(cereal::make_nvp("ip", ip));
-    archive_in(cereal::make_nvp("port", port));
-
-    int value;
-    if (protocol == "*") {
-        is_any_proto = true;
-    } else {
-        is_any_proto = false;
-        try {
-            value = 0;
-            if(protocol == "udp") value = IPPROTO_UDP;
-            if(protocol == "tcp") value = IPPROTO_TCP;
-            if(protocol == "dccp") value = IPPROTO_DCCP;
-            if(protocol == "sctp") value = IPPROTO_SCTP;
-            if(protocol == "icmp") value = IPPROTO_ICMP;
-            if(protocol == "icmpv6") value = IPPROTO_ICMP;
-
-            if (value > static_cast<int>(UINT8_MAX) || value < 0) {
-                dbgWarning(D_RULEBASE_CONFIG)
-                    << "provided value is not a legal IP protocol number. Value: "
-                    << protocol;
-            } else {
-                parsed_proto = value;
-            }
-        } catch (...) {
-            dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal IP protocol. Value: " << protocol;
-        }
-    }
-
-    if (port == "*") {
-        is_any_port = true;
-    } else {
-        is_any_port = false;
-        try {
-            value = stoi(port);
-            if (value > static_cast<int>(UINT16_MAX) || value < 0) {
-                dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal port number. Value: " << port;
-            } else {
-                parsed_port = value;
-            }
-        } catch (...) {
-            dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal port. Value: " << port;
-        }
-    }
-
-    if (ip == "*") {
-        is_any_ip = true;
-    } else {
-        is_any_ip = false;
-        auto ip_addr = IPAddr::createIPAddr(ip);
-        if (!ip_addr.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Could not create IP address. Error: " << ip_addr.getErr();
-        } else {
-            parsed_ip = ConvertToIpAddress(ip_addr.unpackMove());
-        }
-    }
-}
-
-IpAddress
-RuleAsset::AssetUrl::ConvertToIpAddress(const IPAddr &addr)
-{
-    IpAddress address;
-    switch (addr.getType()) {
-        case IPType::UNINITIALIZED: {
-            address.addr4_t = {0};
-            address.ip_type = IP_VERSION_ANY;
-            break;
-        }
-        case IPType::V4: {
-            address.addr4_t = addr.getIPv4();
-            address.ip_type = IP_VERSION_4;
-            break;
-        }
-        case IPType::V6: {
-            address.addr6_t = addr.getIPv6();
-            address.ip_type = IP_VERSION_6;
-            break;
-        }
-        default:
-            address.addr4_t = {0};
-            address.ip_type = IP_VERSION_ANY;
-            dbgWarning(D_RULEBASE_CONFIG) << "Unsupported IP type: " << static_cast<int>(addr.getType());
-    }
-    return address;
-}
-
-const Assets Assets::empty_assets_config = Assets();
-
-void
-Assets::preload()
-{
-    registerExpectedSetting<Assets>("rulebase", "usedAssets");
-}
--- a/components/generic_rulebase/evaluators/asset_eval.cc
+++ b/components/generic_rulebase/evaluators/asset_eval.cc
@@ -1,52 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/asset_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/assets_config.h"
-#include "config.h"
-#include "debug.h"
-
-using namespace std;
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-string AssetMatcher::ctx_key = "asset_id";
-
-AssetMatcher::AssetMatcher(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams(AssetMatcher::getName(), params.size(), 1, 1);
-    asset_id = params[0];
-}
-
-Maybe<bool, Context::Error>
-AssetMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<AssetMatcher>();
-    auto bc_asset_id_ctx = env->get<GenericConfigId>(AssetMatcher::ctx_key);
-
-    if (bc_asset_id_ctx.ok()) {
-        dbgTrace(D_RULEBASE_CONFIG)
-            << "Asset ID: "
-            << asset_id
-            << "; Current set assetId context: "
-            << *bc_asset_id_ctx;
-    } else {
-        dbgTrace(D_RULEBASE_CONFIG) << "Asset ID: " << asset_id << ". Empty context";
-    }
-
-    return bc_asset_id_ctx.ok() && *bc_asset_id_ctx == asset_id;
-}
--- a/components/generic_rulebase/evaluators/connection_eval.cc
+++ b/components/generic_rulebase/evaluators/connection_eval.cc
@@ -1,299 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/connection_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/rulebase_config.h"
-#include "config.h"
-#include "debug.h"
-#include "ip_utilities.h"
-
-using namespace std;
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-string IpAddressMatcher::ctx_key = "ipAddress";
-string SourceIpMatcher::ctx_key = "sourceIP";
-string DestinationIpMatcher::ctx_key = "destinationIP";
-string SourcePortMatcher::ctx_key = "sourcePort";
-string ListeningPortMatcher::ctx_key = "listeningPort";
-string IpProtocolMatcher::ctx_key = "ipProtocol";
-string UrlMatcher::ctx_key = "url";
-
-Maybe<IPAddr>
-getIpAddrFromEnviroment(I_Environment *env, Context::MetaDataType enum_data_type, const string &str_data_type)
-{
-    auto ip_str = env->get<string>(enum_data_type);
-    if (!ip_str.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get " << str_data_type << " from the enviroment.";
-        return genError("Failed to get " + str_data_type + " from the enviroment.");
-    }
-    return IPAddr::createIPAddr(ip_str.unpack());
-}
-
-bool
-checkIfIpInRangesVec(const vector<CustomRange<IPAddr>> &values, const IPAddr &ip_to_check)
-{
-    if (values.size() == 0) {
-        dbgTrace(D_RULEBASE_CONFIG) << "Ip addersses vector empty. Match is true.";
-        return true;
-    }
-    for (const CustomRange<IPAddr> &range : values) {
-        if (range.contains(ip_to_check)) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss matched: " << ip_to_check;
-            return true;
-        }
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss not match: " << ip_to_check;
-    return false;
-}
-
-
-IpAddressMatcher::IpAddressMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
-        if (!ip_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create ip. Error: " + ip_range.getErr();
-            continue;
-        }
-        values.push_back(ip_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-IpAddressMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<IpAddressMatcher>();
-    Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
-        env,
-        Context::MetaDataType::SubjectIpAddr,
-        "subject ip address"
-    );
-    if (subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack())) return true;
-
-    Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
-        env,
-        Context::MetaDataType::OtherIpAddr,
-        "other ip address"
-    );
-    if (other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack())) return true;
-    if (!subject_ip.ok() && !other_ip.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Error in getting subject ip and other ip from the enviroment";
-        return false;
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss didn't match";
-    return false;
-}
-
-SourceIpMatcher::SourceIpMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
-        if (!ip_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create source ip. Error: " + ip_range.getErr();
-            continue;
-        }
-        values.push_back(ip_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-SourceIpMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<SourceIpMatcher>();
-    auto direction_maybe = env->get<string>(Context::MetaDataType::Direction);
-    if (!direction_maybe.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get direction from the enviroment.";
-        return false;
-    }
-    string direction = direction_maybe.unpack();
-    if (direction == "incoming") {
-        Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
-            env,
-            Context::MetaDataType::OtherIpAddr,
-            "other ip address"
-        );
-        return other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack());
-    } else if (direction == "outgoing") {
-        Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
-            env,
-            Context::MetaDataType::SubjectIpAddr,
-            "subject ip address"
-        );
-        return subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack());
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Source ip adderss didn't match";
-    return false;
-}
-
-DestinationIpMatcher::DestinationIpMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
-        if (!ip_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create destination ip. Error: " + ip_range.getErr();
-            continue;
-        }
-        values.push_back(ip_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-DestinationIpMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<DestinationIpMatcher>();
-    auto direction_maybe = env->get<string>(Context::MetaDataType::Direction);
-    if (!direction_maybe.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get direction.";
-        return false;
-    }
-    string direction = direction_maybe.unpack();
-    if (direction == "outgoing") {
-        Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
-            env,
-            Context::MetaDataType::OtherIpAddr,
-            "other ip address"
-        );
-        return other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack());
-    } else if (direction == "incoming") {
-        Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
-            env,
-            Context::MetaDataType::SubjectIpAddr,
-            "subject ip address"
-        );
-        return subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack());
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Destination ip adderss didn't match";
-    return false;
-}
-
-SourcePortMatcher::SourcePortMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<PortNumber>> port_range = CustomRange<PortNumber>::createRange(param);
-        if (!port_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create source port.";
-            continue;
-        }
-        values.push_back(port_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-SourcePortMatcher::evalVariable() const
-{
-    dbgTrace(D_RULEBASE_CONFIG) << "Source is not a match";
-    return false;
-}
-
-
-ListeningPortMatcher::ListeningPortMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<PortNumber>> port_range = CustomRange<PortNumber>::createRange(param);
-        if (!port_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create listening port range.";
-            continue;
-        }
-        values.push_back(port_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-ListeningPortMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<ListeningPortMatcher>();
-    auto port_str = env->get<string>(Context::MetaDataType::Port);
-    if (!port_str.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get port from the enviroment.";
-        return false;
-    }
-    PortNumber port;
-    if (ConnKeyUtil::fromString(port_str.unpack(), port)) {
-        if (values.size() == 0) return true;
-        for (const CustomRange<PortNumber> &port_range : values) {
-            if (port_range.contains(port)) {
-                dbgTrace(D_RULEBASE_CONFIG) << "Listening port is a match. Value: " << port_str.unpack();
-                return true;
-            }
-        }
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Listening port is not a match. Value: " << port_str.unpack();
-    return false;
-}
-
-IpProtocolMatcher::IpProtocolMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<IPProto>> proto_range = CustomRange<IPProto>::createRange(param);
-        if (!proto_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create ip protocol.";
-            continue;
-        }
-        values.push_back(proto_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-IpProtocolMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<IpProtocolMatcher>();
-    auto proto_str = env->get<string>(Context::MetaDataType::Protocol);
-    if (!proto_str.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get ip protocol from the enviroment.";
-        return false;
-    }
-    IPProto protocol;
-    if (ConnKeyUtil::fromString(proto_str.unpack(), protocol)) {
-        if (values.size() == 0) return true;
-        for (const CustomRange<IPProto> &proto_range : values) {
-            if (proto_range.contains(protocol)) {
-                dbgTrace(D_RULEBASE_CONFIG) << "Ip protocol is a match. Value: " << proto_str.unpack();
-                return true;
-            }
-        }
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Source port is not a match. Value: " << proto_str.unpack();
-    return false;
-}
-
-UrlMatcher::UrlMatcher(const vector<string> &params) : values(params) {}
-
-Maybe<bool, Context::Error>
-UrlMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<UrlMatcher>();
-    auto curr_url_ctx = env->get<string>(Context::MetaDataType::Url);
-    if (!curr_url_ctx.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get URL from the enviroment.";
-        return false;
-    }
-    
-    if (values.size() == 0) {
-        dbgTrace(D_RULEBASE_CONFIG) << "Matched URL on \"any\". Url: " << *curr_url_ctx;
-        return true;
-    }
-
-    for (const string &url : values) {
-        if (*curr_url_ctx == url) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Matched URL. Value: " << *curr_url_ctx;
-            return true;
-        }
-    }
-
-    dbgTrace(D_RULEBASE_CONFIG) << "URL is not a match. Value: " << *curr_url_ctx;
-    return false;
-}
--- a/components/generic_rulebase/evaluators/http_transaction_data_eval.cc
+++ b/components/generic_rulebase/evaluators/http_transaction_data_eval.cc
@@ -1,168 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/http_transaction_data_eval.h"
-
-#include <boost/lexical_cast.hpp>
-#include <algorithm>
-
-#include "http_transaction_data.h"
-#include "environment/evaluator_templates.h"
-#include "i_environment.h"
-#include "singleton.h"
-#include "debug.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-using namespace EnvironmentHelper;
-
-EqualHost::EqualHost(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("EqualHost", params.size(), 1, 1);
-    host = params[0];
-}
-
-Maybe<bool, Context::Error>
-EqualHost::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualHost>();
-    auto host_ctx = env->get<string>(HttpTransactionData::host_name_ctx);
-
-    if (!host_ctx.ok())
-    {
-        return false;
-    }
-
-    std::string lower_host_ctx = host_ctx.unpack();
-    std::transform(lower_host_ctx.begin(), lower_host_ctx.end(), lower_host_ctx.begin(), ::tolower);
-
-    std::string lower_host = host;
-    std::transform(lower_host.begin(), lower_host.end(), lower_host.begin(), ::tolower);
-
-
-    if (lower_host_ctx == lower_host) return true;
-    size_t pos = lower_host_ctx.find_last_of(':');
-    if (pos == string::npos) return false;
-    lower_host_ctx = string(lower_host_ctx.data(), pos);
-    return lower_host_ctx == lower_host;
-}
-
-WildcardHost::WildcardHost(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("WildcardHost", params.size(), 1, 1);
-    host = params[0];
-}
-
-Maybe<bool, Context::Error>
-WildcardHost::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<WildcardHost>();
-    auto host_ctx = env->get<string>(HttpTransactionData::host_name_ctx);
-
-    if (!host_ctx.ok())
-    {
-        return false;
-    }
-
-    string lower_host_ctx = host_ctx.unpack();
-    transform(lower_host_ctx.begin(), lower_host_ctx.end(), lower_host_ctx.begin(), ::tolower);
-
-    dbgTrace(D_RULEBASE_CONFIG) << "found host in current context: " << lower_host_ctx;
-
-    size_t pos = lower_host_ctx.find_first_of(".");
-    if (pos == string::npos) {
-        return false;
-    }
-
-    lower_host_ctx = "*" + lower_host_ctx.substr(pos, lower_host_ctx.length());
-
-    string lower_host = host;
-    transform(lower_host.begin(), lower_host.end(), lower_host.begin(), ::tolower);
-
-    dbgTrace(D_RULEBASE_CONFIG)
-        << "trying to match host context with its corresponding wildcard address: "
-        << lower_host_ctx
-        << ". Matcher host: "
-        << lower_host;
-
-    if (lower_host_ctx == lower_host) return true;
-    pos = lower_host_ctx.find_last_of(':');
-    if (pos == string::npos) return false;
-    lower_host_ctx = string(lower_host_ctx.data(), pos);
-    return lower_host_ctx == lower_host;
-}
-
-EqualListeningIP::EqualListeningIP(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("EqualListeningIP", params.size(), 1, 1);
-
-    auto maybe_ip = IPAddr::createIPAddr(params[0]);
-    if (!maybe_ip.ok()) reportWrongParamType(getName(), params[0], "Not a valid IP Address");
-
-    listening_ip = maybe_ip.unpack();
-}
-
-Maybe<bool, Context::Error>
-EqualListeningIP::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualListeningIP>();
-    auto listening_ip_ctx = env->get<IPAddr>(HttpTransactionData::listening_ip_ctx);
-    return listening_ip_ctx.ok() &&  listening_ip_ctx.unpack() == listening_ip;
-}
-
-EqualListeningPort::EqualListeningPort(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("EqualListeningPort", params.size(), 1, 1);
-
-    try {
-        listening_port = boost::lexical_cast<PortNumber>(params[0]);
-    } catch (boost::bad_lexical_cast const&) {
-        reportWrongParamType(getName(), params[0], "Not a valid port number");
-    }
-}
-
-Maybe<bool, Context::Error>
-EqualListeningPort::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualListeningPort>();
-    auto port_ctx = env->get<PortNumber>(HttpTransactionData::listening_port_ctx);
-
-    return port_ctx.ok() && port_ctx.unpack() == listening_port;
-}
-
-BeginWithUri::BeginWithUri(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("BeginWithUri", params.size(), 1, 1);
-    uri_prefix = params[0];
-}
-
-Maybe<bool, Context::Error>
-BeginWithUri::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<BeginWithUri>();
-    auto uri_ctx = env->get<string>(HttpTransactionData::uri_ctx);
-
-    if (!uri_ctx.ok())
-    {
-        return false;
-    }
-
-    std::string lower_uri_ctx = uri_ctx.unpack();
-    std::transform(lower_uri_ctx.begin(), lower_uri_ctx.end(), lower_uri_ctx.begin(), ::tolower);
-
-    std::string lower_uri_prefix = uri_prefix;
-    std::transform(lower_uri_prefix.begin(), lower_uri_prefix.end(), lower_uri_prefix.begin(), ::tolower);
-
-    return lower_uri_ctx.find(lower_uri_prefix) == 0;
-}
--- a/components/generic_rulebase/evaluators/parameter_eval.cc
+++ b/components/generic_rulebase/evaluators/parameter_eval.cc
@@ -1,38 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/parameter_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/rulebase_config.h"
-#include "config.h"
-#include "debug.h"
-
-using namespace std;
-
-string ParameterMatcher::ctx_key = "parameters";
-
-ParameterMatcher::ParameterMatcher(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams(ParameterMatcher::getName(), params.size(), 1, 1);
-    parameter_id = params[0];
-}
-
-Maybe<bool, Context::Error>
-ParameterMatcher::evalVariable() const
-{
-    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
-    return rule.ok() && rule.unpack().isParameterActive(parameter_id);
-}
--- a/components/generic_rulebase/evaluators/practice_eval.cc
+++ b/components/generic_rulebase/evaluators/practice_eval.cc
@@ -1,50 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/practice_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/rulebase_config.h"
-#include "config.h"
-#include "debug.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-string PracticeMatcher::ctx_key = "practices";
-
-PracticeMatcher::PracticeMatcher(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams(PracticeMatcher::getName(), params.size(), 1, 1);
-    practice_id = params[0];
-}
-
-Maybe<bool, Context::Error>
-PracticeMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<PracticeMatcher>();
-    auto bc_practice_id_ctx = env->get<set<GenericConfigId>>(PracticeMatcher::ctx_key);
-    dbgTrace(D_RULEBASE_CONFIG)
-        << "Trying to match practice. ID: "
-        << practice_id << ", Current set IDs: "
-        << makeSeparatedStr(bc_practice_id_ctx.ok() ? *bc_practice_id_ctx : set<GenericConfigId>(), ", ");
-    if (bc_practice_id_ctx.ok()) {
-        return bc_practice_id_ctx.unpack().count(practice_id) > 0;
-    }
-
-    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
-    return rule.ok() && rule.unpack().isPracticeActive(practice_id);
-}
--- a/components/generic_rulebase/evaluators/query_eval.cc
+++ b/components/generic_rulebase/evaluators/query_eval.cc
@@ -1,136 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/query_eval.h"
-
-#include <vector>
-#include <string>
-#include <map>
-
-#include "generic_rulebase/rulebase_config.h"
-#include "generic_rulebase/zones_config.h"
-#include "i_environment.h"
-#include "singleton.h"
-#include "config.h"
-#include "debug.h"
-#include "enum_range.h"
-
-using namespace std;
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-QueryMatcher::QueryMatcher(const vector<string> &params)
-{
-    if (params.size() < 1) reportWrongNumberOfParams(QueryMatcher::getName(), params.size(), 1);
-
-    key = params.front();
-    if (key == "any") {
-        is_any = true;
-    } else {
-        values.reserve(params.size() - 1);
-        for (uint i = 1; i < params.size() ; i++) {
-            if (params[i] == "any") {
-                values.clear();
-                break;
-            }
-            values.insert(params[i]);
-        }
-    }
-}
-
-const string
-QueryMatcher::contextKeyToString(Context::MetaDataType type)
-{
-    if (type == Context::MetaDataType::SubjectIpAddr || type == Context::MetaDataType::OtherIpAddr) return "ip";
-    return Context::convertToString(type);
-}
-
-class QueryMatchSerializer
-{
-public:
-    static const string req_attr_ctx_key;
-
-    template <typename Archive>
-    void
-    serialize(Archive &ar)
-    {
-        I_Environment *env = Singleton::Consume<I_Environment>::by<QueryMatcher>();
-        auto req_attr = env->get<string>(req_attr_ctx_key);
-        if (!req_attr.ok()) return;
-
-        try {
-            ar(cereal::make_nvp(*req_attr, value));
-            dbgDebug(D_RULEBASE_CONFIG)
-                << "Found value for requested attribute. Tag: "
-                << *req_attr
-                << ", Value: "
-                << value;
-        } catch (exception &e) {
-            dbgDebug(D_RULEBASE_CONFIG) << "Could not find values for requested attribute. Tag: " << *req_attr;
-            ar.finishNode();
-        }
-    }
-
-    template <typename Values>
-    bool
-    matchValues(const Values &requested_vals) const
-    {
-        return value != "" && (requested_vals.empty() || requested_vals.count(value) > 0);
-    }
-
-private:
-    string value;
-};
-
-const string QueryMatchSerializer::req_attr_ctx_key = "requested attribute key";
-
-Maybe<bool, Context::Error>
-QueryMatcher::evalVariable() const
-{
-    if (is_any) return true;
-
-    I_Environment *env = Singleton::Consume<I_Environment>::by<QueryMatcher>();
-    auto local_asset_ctx = env->get<bool>("is local asset");
-    bool is_remote_asset = local_asset_ctx.ok() && !(*local_asset_ctx);
-
-    QueryRequest request;
-    for (Context::MetaDataType name : makeRange<Context::MetaDataType>()) {
-        auto val = env->get<string>(name);
-        if (val.ok()) {
-            if ((name == Context::MetaDataType::SubjectIpAddr && is_remote_asset) ||
-                (name == Context::MetaDataType::OtherIpAddr && !is_remote_asset)) {
-                continue;
-            }
-
-            request.addCondition(Condition::EQUALS, contextKeyToString(name), *val);
-        }
-    }
-    if (request.empty()) return false;
-
-    request.setRequestedAttr(key);
-    ScopedContext req_attr_key;
-    req_attr_key.registerValue<string>(QueryMatchSerializer::req_attr_ctx_key, key);
-
-    I_Intelligence_IS_V2 *intelligence = Singleton::Consume<I_Intelligence_IS_V2>::by<Zone>();
-    auto query_res = intelligence->queryIntelligence<QueryMatchSerializer>(request);
-    if (!query_res.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to perform intelligence query. Error: " << query_res.getErr();
-        return false;
-    }
-
-    for (const AssetReply<QueryMatchSerializer> &asset : query_res.unpack()) {
-        if (asset.matchValues<unordered_set<string>>(values)) return true;
-    }
-
-    return false;
-}
--- a/components/generic_rulebase/evaluators/trigger_eval.cc
+++ b/components/generic_rulebase/evaluators/trigger_eval.cc
@@ -1,57 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/trigger_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/rulebase_config.h"
-#include "config.h"
-#include "debug.h"
-
-using namespace std;
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-string TriggerMatcher::ctx_key = "triggers";
-
-TriggerMatcher::TriggerMatcher(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams(TriggerMatcher::getName(), params.size(), 1, 1);
-    trigger_id = params[0];
-}
-
-Maybe<bool, Context::Error>
-TriggerMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<TriggerMatcher>();
-    auto ac_bc_trigger_id_ctx = env->get<set<GenericConfigId>>("ac_trigger_id");
-    dbgTrace(D_RULEBASE_CONFIG)
-        << "Trying to match trigger for access control rule. ID: "
-        << trigger_id << ", Current set IDs: "
-        << makeSeparatedStr(ac_bc_trigger_id_ctx.ok() ? *ac_bc_trigger_id_ctx : set<GenericConfigId>(), ", ");
-    if (ac_bc_trigger_id_ctx.ok()) {
-        return ac_bc_trigger_id_ctx.unpack().count(trigger_id) > 0;
-    }
-
-    auto bc_trigger_id_ctx = env->get<set<GenericConfigId>>(TriggerMatcher::ctx_key);
-    dbgTrace(D_RULEBASE_CONFIG)
-        << "Trying to match trigger. ID: "
-        << trigger_id << ", Current set IDs: "
-        << makeSeparatedStr(bc_trigger_id_ctx.ok() ? *bc_trigger_id_ctx : set<GenericConfigId>(), ", ");
-    if (bc_trigger_id_ctx.ok() && bc_trigger_id_ctx.unpack().count(trigger_id) > 0 ) return true;
-
-    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
-    return rule.ok() && rule.unpack().isTriggerActive(trigger_id);
-}
--- a/components/generic_rulebase/evaluators/zone_eval.cc
+++ b/components/generic_rulebase/evaluators/zone_eval.cc
@@ -1,44 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/zone_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/zone.h"
-#include "generic_rulebase/rulebase_config.h"
-#include "config.h"
-
-using namespace std;
-
-string ZoneMatcher::ctx_key = "zone_id";
-
-ZoneMatcher::ZoneMatcher(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams(ZoneMatcher::getName(), params.size(), 1, 1);
-    zone_id = params[0];
-}
-
-Maybe<bool, Context::Error>
-ZoneMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<ZoneMatcher>();
-    auto bc_zone_id_ctx = env->get<GenericConfigId>(ZoneMatcher::ctx_key);
-    if (bc_zone_id_ctx.ok() && *bc_zone_id_ctx == zone_id) return true;
-
-    if (!getProfileAgentSettingWithDefault<bool>(false, "rulebase.enableQueryBasedMatch")) return false;
-
-    auto zone = getConfiguration<Zone>("rulebase", "zones");
-    return zone.ok() && zone.unpack().getId() == zone_id;
-}
--- a/components/generic_rulebase/generic_rulebase.cc
+++ b/components/generic_rulebase/generic_rulebase.cc
@@ -1,126 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/generic_rulebase.h"
-
-#include <unordered_set>
-
-#include "generic_rulebase/evaluators/trigger_eval.h"
-#include "generic_rulebase/evaluators/practice_eval.h"
-#include "generic_rulebase/evaluators/parameter_eval.h"
-#include "generic_rulebase/evaluators/zone_eval.h"
-#include "generic_rulebase/evaluators/asset_eval.h"
-#include "generic_rulebase/evaluators/query_eval.h"
-#include "generic_rulebase/evaluators/connection_eval.h"
-#include "generic_rulebase/evaluators/http_transaction_data_eval.h"
-#include "generic_rulebase/zone.h"
-#include "generic_rulebase/triggers_config.h"
-#include "singleton.h"
-#include "common.h"
-#include "debug.h"
-#include "cache.h"
-#include "config.h"
-
-using namespace std;
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-class GenericRulebase::Impl : Singleton::Provide<I_GenericRulebase>::From<GenericRulebase>
-{
-public:
-    void init() {}
-    void fini() {}
-
-    void preload();
-
-    Maybe<Zone, Config::Errors> getLocalZone() const override { return getZoneConfig(true); }
-    Maybe<Zone, Config::Errors> getOtherZone() const override { return getZoneConfig(false); }
-
-    set<ParameterBehavior> getBehavior(const ParameterKeyValues &key_value_pairs) const override;
-
-private:
-    Maybe<Zone, Config::Errors>
-    getZoneConfig(bool is_local_zone) const
-    {
-        ScopedContext asset_location_ctx;
-        asset_location_ctx.registerValue<bool>("is local asset", is_local_zone);
-        return getConfiguration<Zone>("rulebase", "zones");
-    }
-};
-
-void
-GenericRulebase::Impl::preload()
-{
-    addMatcher<TriggerMatcher>();
-    addMatcher<PracticeMatcher>();
-    addMatcher<ParameterMatcher>();
-    addMatcher<ZoneMatcher>();
-    addMatcher<AssetMatcher>();
-    addMatcher<QueryMatcher>();
-    addMatcher<IpAddressMatcher>();
-    addMatcher<SourceIpMatcher>();
-    addMatcher<DestinationIpMatcher>();
-    addMatcher<SourcePortMatcher>();
-    addMatcher<ListeningPortMatcher>();
-    addMatcher<IpProtocolMatcher>();
-    addMatcher<UrlMatcher>();
-    addMatcher<EqualHost>();
-    addMatcher<WildcardHost>();
-    addMatcher<EqualListeningIP>();
-    addMatcher<EqualListeningPort>();
-    addMatcher<BeginWithUri>();
-    BasicRuleConfig::preload();
-    LogTriggerConf::preload();
-    ParameterException::preload();
-    registerExpectedConfiguration<Zone>("rulebase", "zones");
-    registerExpectedConfigFile("zones", Config::ConfigFileType::Policy);
-    registerExpectedConfigFile("triggers", Config::ConfigFileType::Policy);
-    registerExpectedConfigFile("rules", Config::ConfigFileType::Policy);
-    registerExpectedConfigFile("parameters", Config::ConfigFileType::Policy);
-    registerExpectedConfigFile("exceptions", Config::ConfigFileType::Policy);
-
-}
-
-set<ParameterBehavior>
-GenericRulebase::Impl::getBehavior(const ParameterKeyValues &key_value_pairs) const
-{
-    auto &exceptions = getConfiguration<ParameterException>("rulebase", "exception");
-
-    if (!exceptions.ok()) {
-        dbgTrace(D_RULEBASE_CONFIG) << "Could not find any exception with the current rule's context";
-        return {};
-    }
-    return (*exceptions).getBehavior(key_value_pairs);
-}
-
-GenericRulebase::GenericRulebase() : Component("GenericRulebase"), pimpl(make_unique<Impl>()) {}
-
-GenericRulebase::~GenericRulebase() {}
-
-void
-GenericRulebase::init()
-{
-    pimpl->init();
-}
-
-void
-GenericRulebase::fini()
-{
-    pimpl->fini();
-}
-
-void
-GenericRulebase::preload()
-{
-    pimpl->preload();
-}
--- a/components/generic_rulebase/generic_rulebase_context.cc
+++ b/components/generic_rulebase/generic_rulebase_context.cc
@@ -1,109 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/generic_rulebase_context.h"
-
-#include <vector>
-
-#include "context.h"
-#include "config.h"
-#include "generic_rulebase/evaluators/trigger_eval.h"
-#include "generic_rulebase/evaluators/parameter_eval.h"
-#include "generic_rulebase/evaluators/practice_eval.h"
-#include "generic_rulebase/evaluators/zone_eval.h"
-#include "generic_rulebase/evaluators/asset_eval.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-template<typename Configs>
-set<GenericConfigId>
-extractIds(const vector<Configs> &configurations)
-{
-    set<GenericConfigId> ids;
-    for (const Configs &conf : configurations) {
-        ids.insert(conf.getId());
-    }
-    return ids;
-}
-
-void
-GenericRulebaseContext::activate(const BasicRuleConfig &rule)
-{
-    switch(registration_state) {
-        case RuleRegistrationState::UNINITIALIZED: {
-            registration_state = RuleRegistrationState::REGISTERED;
-            ctx.registerValue<set<GenericConfigId>>(
-                TriggerMatcher::ctx_key,
-                extractIds<RuleTrigger>(rule.getTriggers())
-            );
-            ctx.registerValue<set<GenericConfigId>>(
-                PracticeMatcher::ctx_key,
-                extractIds<RulePractice>(rule.getPractices())
-            );
-            dbgTrace(D_RULEBASE_CONFIG)
-                << "Activating current practices. Current practice IDs: "
-                << makeSeparatedStr(extractIds<RulePractice>(rule.getPractices()), ", ");
-
-            ctx.registerValue<set<GenericConfigId>>(
-                ParameterMatcher::ctx_key,
-                extractIds<RuleParameter>(rule.getParameters())
-            );
-            ctx.registerValue<GenericConfigId>(
-                ZoneMatcher::ctx_key,
-                rule.getZoneId()
-            );
-            ctx.registerValue<GenericConfigId>(
-                AssetMatcher::ctx_key,
-                rule.getAssetId()
-            );
-            ctx.activate();
-            break;
-        }
-        case RuleRegistrationState::REGISTERED: {
-            dbgTrace(D_RULEBASE_CONFIG) << "Activating registered rule values";
-            ctx.activate();
-            break;
-        }
-        case RuleRegistrationState::UNREGISTERED: {
-            dbgTrace(D_RULEBASE_CONFIG) << "Failed to register rule values";
-        }
-    }
-}
-
-void
-GenericRulebaseContext::activate()
-{
-    switch(registration_state) {
-        case RuleRegistrationState::UNINITIALIZED: {
-            auto maybe_rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
-            if (!maybe_rule.ok()) {
-                registration_state = RuleRegistrationState::UNREGISTERED;
-                return;
-            }
-            dbgTrace(D_RULEBASE_CONFIG) << "Registering new rule values";
-            activate(maybe_rule.unpack());
-            registration_state = RuleRegistrationState::REGISTERED;
-            break;
-        }
-        case RuleRegistrationState::REGISTERED: {
-            dbgTrace(D_RULEBASE_CONFIG) << "Activating registered rule values";
-            ctx.activate();
-            break;
-        }
-        case RuleRegistrationState::UNREGISTERED: {
-            dbgTrace(D_RULEBASE_CONFIG) << "Failed to register rule values";
-        }
-    }
-}
--- a/components/generic_rulebase/match_query.cc
+++ b/components/generic_rulebase/match_query.cc
@@ -1,347 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/match_query.h"
-
-#include "cereal/types/set.hpp"
-
-#include "generic_rulebase/generic_rulebase_utils.h"
-#include "config.h"
-#include "ip_utilities.h"
-#include "agent_core_utilities.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-static const unordered_map<string, MatchQuery::MatchType> string_to_match_type = {
-    { "condition", MatchQuery::MatchType::Condition },
-    { "operator", MatchQuery::MatchType::Operator }
-};
-
-static const unordered_map<string, MatchQuery::Operators> string_to_operator = {
-    { "and", MatchQuery::Operators::And },
-    { "or", MatchQuery::Operators::Or }
-};
-
-static const unordered_map<string, MatchQuery::Conditions> string_to_condition = {
-    { "equals", MatchQuery::Conditions::Equals },
-    { "not-equals", MatchQuery::Conditions::NotEquals },
-    { "not equals", MatchQuery::Conditions::NotEquals },
-    { "in", MatchQuery::Conditions::In },
-    { "not-in", MatchQuery::Conditions::NotIn },
-    { "not in", MatchQuery::Conditions::NotIn },
-    { "exist", MatchQuery::Conditions::Exist }
-};
-
-static const string ip_addr_type_name = "IP address";
-static const string port_type_name = "port";
-static const string ip_proto_type_name = "IP protocol";
-
-static const unordered_map<string, MatchQuery::StaticKeys> string_to_key = {
-    { "sourceIP", MatchQuery::StaticKeys::SrcIpAddress },
-    { "sourceIpAddr", MatchQuery::StaticKeys::SrcIpAddress },
-    { "destinationIP", MatchQuery::StaticKeys::DstIpAddress },
-    { "destinationIpAddr", MatchQuery::StaticKeys::DstIpAddress },
-    { "ipAddress", MatchQuery::StaticKeys::IpAddress },
-    { "sourcePort", MatchQuery::StaticKeys::SrcPort },
-    { "listeningPort", MatchQuery::StaticKeys::ListeningPort },
-    { "ipProtocol", MatchQuery::StaticKeys::IpProtocol },
-    { "domain", MatchQuery::StaticKeys::Domain }
-};
-
-MatchQuery::MatchQuery(const string &match) : is_specific_label(false), is_ignore_keyword(false)
-{
-    try {
-        stringstream ss;
-        ss.str(match);
-        cereal::JSONInputArchive archive_in(ss);
-        load(archive_in);
-    } catch (const exception &e) {
-        dbgWarning(D_RULEBASE_CONFIG)
-            << "Unable to load match query JSON. JSON content: "
-            << match
-            << ", Error: "
-            << e.what();
-    }
-}
-
-void
-MatchQuery::load(cereal::JSONInputArchive &archive_in)
-{
-    string type_as_string;
-    archive_in(cereal::make_nvp("type", type_as_string));
-
-    string op_as_string;
-    archive_in(cereal::make_nvp("op", op_as_string));
-
-    auto maybe_type = string_to_match_type.find(type_as_string);
-    if (maybe_type == string_to_match_type.end()) {
-        reportConfigurationError("Illegal Zone match query type. Provided type in configuration: " + type_as_string);
-    }
-
-    type = maybe_type->second;
-    switch (type) {
-        case (MatchType::Condition): {
-            auto maybe_condition = string_to_condition.find(op_as_string);
-            if (maybe_condition == string_to_condition.end()) {
-                reportConfigurationError(
-                    "Illegal op provided for condition. Provided op in configuration: " +
-                    op_as_string
-                );
-            }
-            condition_type = maybe_condition->second;
-            operator_type = Operators::None;
-            archive_in(cereal::make_nvp("key", key));
-            key_type = getKeyByName(key);
-            if (key_type == StaticKeys::NotStatic) {
-                if (key.rfind("containerLabels.", 0) == 0)  {
-                    is_specific_label = true;
-                } else {
-                    is_specific_label = false;
-                }
-            }
-            is_ignore_keyword = (key == "indicator");
-
-            if (condition_type != Conditions::Exist) {
-                archive_in(cereal::make_nvp("value", value));
-                for(const auto &val: value) {
-                    if (isKeyTypeIp()) {
-                        auto ip_range = IPUtilities::createRangeFromString<IPRange, IpAddress>(val, ip_addr_type_name);
-                        if (ip_range.ok()) {
-                            ip_addr_value.push_back(ip_range.unpack());
-                        } else {
-                            dbgWarning(D_RULEBASE_CONFIG)
-                                << "Failed to parse IP address range. Error: "
-                                << ip_range.getErr();
-                        }
-                    } else if (isKeyTypePort()) {
-                        auto port_range = IPUtilities::createRangeFromString<PortsRange, uint16_t>(
-                            val,
-                            port_type_name
-                        );
-                        if (port_range.ok()) {
-                            port_value.push_back(port_range.unpack());
-                        } else {
-                            dbgWarning(D_RULEBASE_CONFIG)
-                                << "Failed to parse port range. Error: "
-                                << port_range.getErr();
-                        }
-                    } else if (isKeyTypeProtocol()) {
-                        auto proto_range = IPUtilities::createRangeFromString<IpProtoRange, uint8_t>(
-                            val,
-                            ip_proto_type_name
-                        );
-                        if (proto_range.ok()) {
-                            ip_proto_value.push_back(proto_range.unpack());
-                        } else {
-                            dbgWarning(D_RULEBASE_CONFIG)
-                                << "Failed to parse IP protocol range. Error: "
-                                << proto_range.getErr();
-                        }
-                    }
-
-                    try {
-                        regex_values.insert(boost::regex(val));
-                    } catch (const exception &e) {
-                        dbgDebug(D_RULEBASE_CONFIG) << "Failed to compile regex. Error: " << e.what();
-                    }
-                }
-                first_value = *(value.begin());
-            }
-            break;
-        }
-        case (MatchType::Operator): {
-            auto maybe_operator = string_to_operator.find(op_as_string);
-            if (maybe_operator == string_to_operator.end()) {
-                reportConfigurationError(
-                    "Illegal op provided for operator. Provided op in configuration: " +
-                    op_as_string
-                );
-            }
-            operator_type = maybe_operator->second;
-            condition_type = Conditions::None;
-            archive_in(cereal::make_nvp("items", items));
-            break;
-        }
-    }
-}
-
-MatchQuery::StaticKeys
-MatchQuery::getKeyByName(const string &key_type_name)
-{
-    auto key = string_to_key.find(key_type_name);
-    if (key == string_to_key.end()) return StaticKeys::NotStatic;
-    return key->second;
-}
-
-bool
-MatchQuery::isKeyTypeIp() const
-{
-    return (key_type >= StaticKeys::IpAddress && key_type <= StaticKeys::DstIpAddress);
-}
-
-bool
-MatchQuery::isKeyTypePort() const
-{
-    return (key_type == StaticKeys::SrcPort || key_type == StaticKeys::ListeningPort);
-}
-
-bool
-MatchQuery::isKeyTypeProtocol() const
-{
-    return (key_type == StaticKeys::IpProtocol);
-}
-
-bool
-MatchQuery::isKeyTypeDomain() const
-{
-    return (key_type == StaticKeys::Domain);
-}
-
-bool
-MatchQuery::isKeyTypeSpecificLabel() const
-{
-    return is_specific_label;
-}
-
-bool
-MatchQuery::isKeyTypeStatic() const
-{
-    return (key_type != StaticKeys::NotStatic);
-}
-
-set<string>
-MatchQuery::getAllKeys() const
-{
-    set<string> keys;
-    if (type == MatchType::Condition) {
-        if (!key.empty()) keys.insert(key);
-        return keys;
-    }
-
-    for (const MatchQuery &inner_match: items) {
-        set<string> iner_keys = inner_match.getAllKeys();
-        keys.insert(iner_keys.begin(), iner_keys.end());
-    }
-
-    return keys;
-}
-
-bool
-MatchQuery::matchAttributes(
-        const unordered_map<string, set<string>> &key_value_pairs,
-        set<string> &matched_override_keywords ) const
-{
-
-    if (type == MatchType::Condition) {
-        auto key_value_pair = key_value_pairs.find(key);
-        if (key_value_pair == key_value_pairs.end()) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Ignoring irrelevant key: " << key;
-            return false;
-        }
-        return matchAttributes(key_value_pair->second, matched_override_keywords);
-    } else if (type == MatchType::Operator && operator_type == Operators::And) {
-        for (const MatchQuery &inner_match: items) {
-            if (!inner_match.matchAttributes(key_value_pairs, matched_override_keywords)) {
-                return false;
-            }
-        }
-        return true;
-    } else if (type == MatchType::Operator && operator_type == Operators::Or) {
-        // With 'or' condition, evaluate matched override keywords first and add the ones that were fully matched
-        set<string> inner_override_keywords;
-        bool res = false;
-        for (const MatchQuery &inner_match: items) {
-            inner_override_keywords.clear();
-            if (inner_match.matchAttributes(key_value_pairs, inner_override_keywords)) {
-                matched_override_keywords.insert(inner_override_keywords.begin(), inner_override_keywords.end());
-                res = true;
-            }
-        }
-        return res;
-    } else {
-        dbgWarning(D_RULEBASE_CONFIG) << "Unsupported match query type";
-    }
-    return false;
-}
-
-MatchQuery::MatchResult
-MatchQuery::getMatch( const unordered_map<string, set<string>> &key_value_pairs) const
-{
-    MatchQuery::MatchResult matches;
-    matches.matched_keywords = make_shared<set<string>>();
-    matches.is_match = matchAttributes(key_value_pairs, *matches.matched_keywords);
-    return matches;
-}
-
-bool
-MatchQuery::matchAttributes(
-        const unordered_map<string, set<string>> &key_value_pairs) const
-{
-    return getMatch(key_value_pairs).is_match;
-}
-
-bool
-MatchQuery::matchAttributes(
-        const set<string> &values,
-        set<string> &matched_override_keywords) const
-{
-    auto &type = condition_type;
-    bool negate = type == MatchQuery::Conditions::NotEquals || type == MatchQuery::Conditions::NotIn;
-    bool match = isRegEx() ? matchAttributesRegEx(values, matched_override_keywords) : matchAttributesString(values);
-    return negate ? !match : match;
-}
-
-bool
-MatchQuery::matchAttributesRegEx(
-        const set<string> &values,
-        set<string> &matched_override_keywords) const
-{
-    bool res = false;
-    boost::cmatch value_matcher;
-    for (const boost::regex &val_regex : regex_values) {
-        for (const string &requested_match_value : values) {
-            if (NGEN::Regex::regexMatch(
-                __FILE__,
-                __LINE__,
-                requested_match_value.c_str(),
-                value_matcher,
-                val_regex))
-            {
-                res = true;
-                if (is_ignore_keyword) {
-                    matched_override_keywords.insert(requested_match_value);
-                } else {
-                    return res;
-                }
-            }
-        }
-    }
-    return res;
-}
-
-bool
-MatchQuery::matchAttributesString(const set<string> &values) const
-{
-    for (const string &requested_value : values) {
-        if (value.find(requested_value) != value.end()) return true;
-    }
-    return false;
-}
-
-bool
-MatchQuery::isRegEx() const
-{
-    return key != "protectionName";
-}
--- a/components/generic_rulebase/parameters_config.cc
+++ b/components/generic_rulebase/parameters_config.cc
@@ -1,157 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/parameters_config.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-bool ParameterException::is_geo_location_exception_exists(false);
-bool ParameterException::is_geo_location_exception_being_loaded(false);
-
-void
-ParameterOverrides::load(cereal::JSONInputArchive &archive_in)
-{
-    parseJSONKey<vector<ParsedBehavior>>("parsedBehavior", parsed_behaviors, archive_in);
-}
-
-void
-ParameterTrustedSources::load(cereal::JSONInputArchive &archive_in)
-{
-    parseJSONKey<uint>("numOfSources", num_of_sources, archive_in);
-    parseJSONKey<vector<SourcesIdentifier>>("sourcesIdentifiers", sources_identidiers, archive_in);
-}
-
-void
-ParameterBehavior::load(cereal::JSONInputArchive &archive_in)
-{
-    string key_string;
-    string val_string;
-    parseJSONKey<string>("id", id, archive_in);
-    parseJSONKey<string>("key", key_string, archive_in);
-    parseJSONKey<string>("value", val_string, archive_in);
-    if (string_to_behavior_key.find(key_string) == string_to_behavior_key.end()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Unsupported behavior key: " << key_string;
-        return;
-    }
-    key = string_to_behavior_key.at(key_string);
-
-    if (string_to_behavior_val.find(val_string) == string_to_behavior_val.end()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Unsupported behavior value: " << val_string;
-        return;
-    }
-    value = string_to_behavior_val.at(val_string);
-}
-
-void
-ParameterAntiBot::load(cereal::JSONInputArchive &archive_in)
-{
-    parseJSONKey<vector<string>>("injected", injected, archive_in);
-    parseJSONKey<vector<string>>("validated", validated, archive_in);
-}
-
-void
-ParameterOAS::load(cereal::JSONInputArchive &archive_in)
-{
-    parseJSONKey<string>("value", value, archive_in);
-}
-
-void
-ParameterException::MatchBehaviorPair::load(cereal::JSONInputArchive &archive_in)
-{
-    parseJSONKey<MatchQuery>("match", match, archive_in);
-    parseJSONKey<ParameterBehavior>("behavior", behavior, archive_in);
-}
-
-void
-ParameterException::load(cereal::JSONInputArchive &archive_in)
-{
-    try {
-        archive_in(
-            cereal::make_nvp("match", match),
-            cereal::make_nvp("behavior", behavior)
-        );
-    } catch (...) {
-        parseJSONKey<vector<MatchBehaviorPair>>("exceptions", match_queries, archive_in);
-    }
-
-    function<bool(const MatchQuery &)> isGeoLocationExists =
-        [&](const MatchQuery &query)
-        {
-            if (query.getKey() == "countryCode" || query.getKey() == "countryName") {
-                is_geo_location_exception_being_loaded = true;
-                return true;
-            }
-
-            for (const MatchQuery &query_item : query.getItems()) {
-                if (isGeoLocationExists(query_item)) return true;
-            }
-
-            return false;
-        };
-
-    if (isGeoLocationExists(match)) return;
-    for (const MatchBehaviorPair &match_query : match_queries) {
-        if (isGeoLocationExists(match_query.match)) return;
-    }
-}
-
-set<ParameterBehavior>
-ParameterException::getBehavior(
-        const unordered_map<string, set<string>> &key_value_pairs,
-        set<string> &matched_override_keywords) const
-{
-    set<ParameterBehavior> matched_behaviors;
-
-    matched_override_keywords.clear();
-    dbgTrace(D_RULEBASE_CONFIG) << "Matching exception";
-    for (const MatchBehaviorPair &match_behavior_pair: match_queries) {
-        MatchQuery::MatchResult match_res = match_behavior_pair.match.getMatch(key_value_pairs);
-        if (match_res.is_match) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Successfully matched an exception from a list of matches.";
-            // When matching indicators with action=ignore, we expect no behavior override.
-            // Instead, a matched keywords list should be returned which will be later removed from score calculation
-            if (match_res.matched_keywords->size() > 0 && match_behavior_pair.behavior == action_ignore) {
-                matched_override_keywords.insert(match_res.matched_keywords->begin(),
-                        match_res.matched_keywords->end());
-            } else {
-                matched_behaviors.insert(match_behavior_pair.behavior);
-            }
-        }
-    }
-
-    if (match_queries.empty()) {
-        MatchQuery::MatchResult match_res = match.getMatch(key_value_pairs);
-        if (match_res.is_match) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Successfully matched an exception.";
-            // When matching indicators with action=ignore, we expect no behavior override.
-            // Instead, a matched keywords list should be returned which will be later removed from score calculation
-            if (match_res.matched_keywords->size() > 0 && behavior == action_ignore) {
-                matched_override_keywords.insert(match_res.matched_keywords->begin(),
-                        match_res.matched_keywords->end());
-            } else {
-                matched_behaviors.insert(behavior);
-            }
-        }
-    }
-
-    return matched_behaviors;
-}
-
-set<ParameterBehavior>
-ParameterException::getBehavior(const unordered_map<string, set<string>> &key_value_pairs) const
-{
-    set<string> keywords;
-    return getBehavior(key_value_pairs, keywords);
-}
--- a/components/generic_rulebase/rulebase_config.cc
+++ b/components/generic_rulebase/rulebase_config.cc
@@ -1,79 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/rulebase_config.h"
-
-#include "telemetry.h"
-#include "config.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-set<string> BasicRuleConfig::assets_ids{};
-set<string> BasicRuleConfig::assets_ids_aggregation{};
-
-void
-BasicRuleConfig::load(cereal::JSONInputArchive &ar)
-{
-    parseJSONKey<vector<RulePractice>>("practices", practices, ar);
-    parseJSONKey<vector<RuleTrigger>>("triggers", triggers, ar);
-    parseJSONKey<vector<RuleParameter>>("parameters", parameters, ar);
-    parseJSONKey<uint8_t>("priority", priority, ar);
-    parseJSONKey<string>("ruleId", rule_id, ar);
-    parseJSONKey<string>("ruleName", rule_name, ar);
-    parseJSONKey<string>("assetId", asset_id, ar);
-    parseJSONKey<string>("assetName", asset_name, ar);
-    parseJSONKey<string>("zoneId", zone_id, ar);
-    parseJSONKey<string>("zoneName", zone_name, ar);
-
-    assets_ids_aggregation.insert(asset_id);
-}
-
-void
-BasicRuleConfig::updateCountMetric()
-{
-    BasicRuleConfig::assets_ids = BasicRuleConfig::assets_ids_aggregation;
-    AssetCountEvent(AssetType::ALL, BasicRuleConfig::assets_ids.size()).notify();
-}
-
-bool
-BasicRuleConfig::isPracticeActive(const string &practice_id) const
-{
-    for (auto practice: practices) {
-        if (practice.getId() == practice_id) return true;
-    }
-    return false;
-}
-
-bool
-BasicRuleConfig::isTriggerActive(const string &trigger_id) const
-{
-    for (auto trigger: triggers) {
-        if (trigger.getId() == trigger_id) {
-            return true;
-        }
-    }
-    return false;
-}
-
-bool
-BasicRuleConfig::isParameterActive(const string &parameter_id) const
-{
-    for (auto param: parameters) {
-        if (param.getId() == parameter_id) {
-            return true;
-        }
-    }
-    return false;
-}
--- a/components/generic_rulebase/triggers_config.cc
+++ b/components/generic_rulebase/triggers_config.cc
@@ -1,243 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include <string>
-#include <map>
-
-#include "generic_rulebase/triggers_config.h"
-#include "generic_rulebase/generic_rulebase_utils.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-WebTriggerConf::WebTriggerConf() :  response_title(""), response_body(""), response_code(0) {}
-WebTriggerConf::WebTriggerConf(const string &title, const string &body, uint code)
-        :
-    response_title(title),
-    response_body(body),
-    response_code(code)
-{}
-
-WebTriggerConf WebTriggerConf::default_trigger_conf = WebTriggerConf(
-    "Attack blocked by web application protection",                                     // title
-    "Check Point's <b>Application Security</b> has detected an attack and blocked it.", // body
-    403
-);
-
-void
-WebTriggerConf::load(cereal::JSONInputArchive &archive_in)
-{
-    try {
-        parseJSONKey<string>("details level", details_level, archive_in);
-        if (details_level == "Redirect") {
-            parseJSONKey<string>("redirect URL", redirect_url, archive_in);
-            parseJSONKey<bool>("xEventId", add_event_id_to_header, archive_in);
-            parseJSONKey<bool>("eventIdInHeader", add_event_id_to_header, archive_in);
-            return;
-        }
-        parseJSONKey<uint>("response code", response_code, archive_in);
-        if (response_code < 100 || response_code > 599) {
-            throw cereal::Exception(
-                "illegal web trigger response code: " +
-                to_string(response_code) +
-                " is out of range (100-599)"
-            );
-        }
-
-        if (details_level == "Response Code") return;
-
-        parseJSONKey<string>("response body", response_body, archive_in);
-        parseJSONKey<string>("response title", response_title, archive_in);
-    } catch (const exception &e) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to parse the web trigger configuration: '" << e.what() << "'";
-        archive_in.setNextName(nullptr);
-    }
-}
-
-bool
-WebTriggerConf::operator==(const WebTriggerConf &other) const
-{
-    return
-        response_code == other.response_code &&
-        response_title == other.response_title &&
-        response_body == other.response_body;
-}
-
-LogTriggerConf::LogTriggerConf(string trigger_name, bool log_detect, bool log_prevent) : name(trigger_name)
-{
-    if (log_detect) should_log_on_detect.setAll();
-    if (log_prevent) should_log_on_prevent.setAll();
-    active_streams.setFlag(ReportIS::StreamType::JSON_FOG);
-    active_streams.setFlag(ReportIS::StreamType::JSON_LOG_FILE);
-}
-
-ReportIS::Severity
-LogTriggerConf::getSeverity(bool is_action_drop_or_prevent) const
-{
-    return is_action_drop_or_prevent ? ReportIS::Severity::MEDIUM : ReportIS::Severity::LOW;
-}
-
-ReportIS::Priority
-LogTriggerConf::getPriority(bool is_action_drop_or_prevent) const
-{
-    return is_action_drop_or_prevent ? ReportIS::Priority::HIGH : ReportIS::Priority::MEDIUM;
-}
-
-Flags<ReportIS::StreamType>
-LogTriggerConf::getStreams(SecurityType security_type, bool is_action_drop_or_prevent) const
-{
-    if (is_action_drop_or_prevent && should_log_on_prevent.isSet(security_type)) return active_streams;
-    if (!is_action_drop_or_prevent && should_log_on_detect.isSet(security_type)) return active_streams;
-
-    return Flags<ReportIS::StreamType>();
-}
-
-Flags<ReportIS::Enreachments>
-LogTriggerConf::getEnrechments(SecurityType security_type) const
-{
-    Flags<ReportIS::Enreachments> enreachments;
-
-    if (log_geo_location.isSet(security_type)) enreachments.setFlag(ReportIS::Enreachments::GEOLOCATION);
-    if (should_format_output) enreachments.setFlag(ReportIS::Enreachments::BEAUTIFY_OUTPUT);
-
-    return enreachments;
-}
-
-template <typename EnumClass>
-static void
-setTriggersFlag(const string &key, cereal::JSONInputArchive &ar, EnumClass flag, Flags<EnumClass> &flags)
-{
-    bool value = false;
-    parseJSONKey<bool>(key, value, ar);
-    if (value) flags.setFlag(flag);
-}
-
-static void
-setLogConfiguration(
-    const ReportIS::StreamType &log_type,
-    const string &log_server_url = "",
-    const string &protocol = ""
-)
-{
-    dbgTrace(D_RULEBASE_CONFIG) << "log server url:" << log_server_url;
-    if (log_server_url != "" && protocol != "") {
-        Singleton::Consume<I_Logging>::by<LogTriggerConf>()->addStream(log_type, log_server_url, protocol);
-    } else {
-        Singleton::Consume<I_Logging>::by<LogTriggerConf>()->addStream(log_type);
-    }
-}
-
-static string
-parseProtocolWithDefault(
-    const std::string &default_value,
-    const std::string &key_name,
-    cereal::JSONInputArchive &archive_in
-)
-{
-    string value;
-    try {
-        archive_in(cereal::make_nvp(key_name, value));
-    } catch (const cereal::Exception &e) {
-        return default_value;
-    }
-    return value;
-}
-
-void
-LogTriggerConf::load(cereal::JSONInputArchive& archive_in)
-{
-    try {
-        parseJSONKey<string>("triggerName", name, archive_in);
-        parseJSONKey<string>("verbosity", verbosity, archive_in);
-        parseJSONKey<string>("urlForSyslog", url_for_syslog, archive_in);
-        parseJSONKey<string>("urlForCef", url_for_cef, archive_in);
-        parseJSONKey<string>("syslogProtocol", syslog_protocol, archive_in);
-        syslog_protocol = parseProtocolWithDefault("UDP", "syslogProtocol", archive_in);
-        cef_protocol = parseProtocolWithDefault("UDP", "cefProtocol", archive_in);
-
-        setTriggersFlag("webBody",  archive_in, WebLogFields::webBody, log_web_fields);
-        setTriggersFlag("webHeaders", archive_in, WebLogFields::webHeaders, log_web_fields);
-        setTriggersFlag("webRequests", archive_in, WebLogFields::webRequests, log_web_fields);
-        setTriggersFlag("webUrlPath", archive_in, WebLogFields::webUrlPath, log_web_fields);
-        setTriggersFlag("webUrlQuery", archive_in, WebLogFields::webUrlQuery, log_web_fields);
-        setTriggersFlag("logToAgent", archive_in, ReportIS::StreamType::JSON_LOG_FILE, active_streams);
-        setTriggersFlag("logToCloud", archive_in, ReportIS::StreamType::JSON_FOG, active_streams);
-        setTriggersFlag("logToK8sService", archive_in, ReportIS::StreamType::JSON_K8S_SVC, active_streams);
-        setTriggersFlag("logToSyslog", archive_in, ReportIS::StreamType::SYSLOG, active_streams);
-        setTriggersFlag("logToCef", archive_in, ReportIS::StreamType::CEF, active_streams);
-        setTriggersFlag("acAllow", archive_in, SecurityType::AccessControl, should_log_on_detect);
-        setTriggersFlag("acDrop", archive_in, SecurityType::AccessControl, should_log_on_prevent);
-        setTriggersFlag("tpDetect", archive_in, SecurityType::ThreatPrevention, should_log_on_detect);
-        setTriggersFlag("tpPrevent", archive_in, SecurityType::ThreatPrevention, should_log_on_prevent);
-        setTriggersFlag("complianceWarnings", archive_in, SecurityType::Compliance, should_log_on_detect);
-        setTriggersFlag("complianceViolations", archive_in, SecurityType::Compliance, should_log_on_prevent);
-        setTriggersFlag("acLogGeoLocation", archive_in, SecurityType::AccessControl, log_geo_location);
-        setTriggersFlag("tpLogGeoLocation", archive_in, SecurityType::ThreatPrevention, log_geo_location);
-        setTriggersFlag("complianceLogGeoLocation", archive_in, SecurityType::Compliance, log_geo_location);
-
-        bool extend_logging = false;
-        parseJSONKey<bool>("extendLogging", extend_logging, archive_in);
-        if (extend_logging) {
-            setTriggersFlag("responseCode", archive_in, WebLogFields::responseCode, log_web_fields);
-            setTriggersFlag("responseBody", archive_in, WebLogFields::responseBody, log_web_fields);
-
-            string severity;
-            static const map<string, extendLoggingSeverity> extend_logging_severity_strings = {
-                {"High", extendLoggingSeverity::High},
-                {"Critical", extendLoggingSeverity::Critical}
-            };
-            parseJSONKey<string>("extendLoggingMinSeverity", severity, archive_in);
-            auto extended_severity = extend_logging_severity_strings.find(severity);
-            if (extended_severity != extend_logging_severity_strings.end()) {
-                extend_logging_severity = extended_severity->second;
-            } else {
-                dbgWarning(D_RULEBASE_CONFIG)
-                    << "Failed to parse the extendLoggingMinSeverityfield: '"
-                    << severity
-                    << "'";
-            }
-        }
-
-        for (ReportIS::StreamType log_stream : makeRange<ReportIS::StreamType>()) {
-            if (!active_streams.isSet(log_stream)) continue;
-            switch (log_stream) {
-                case ReportIS::StreamType::JSON_DEBUG:
-                    setLogConfiguration(ReportIS::StreamType::JSON_DEBUG);
-                    break;
-                case ReportIS::StreamType::JSON_FOG:
-                    setLogConfiguration(ReportIS::StreamType::JSON_FOG);
-                    break;
-                case ReportIS::StreamType::JSON_LOG_FILE:
-                    setLogConfiguration(ReportIS::StreamType::JSON_LOG_FILE);
-                    break;
-                case ReportIS::StreamType::JSON_K8S_SVC:
-                    setLogConfiguration(ReportIS::StreamType::JSON_K8S_SVC);
-                    break;
-                case ReportIS::StreamType::SYSLOG:
-                    setLogConfiguration(ReportIS::StreamType::SYSLOG, getUrlForSyslog(), syslog_protocol);
-                    break;
-                case ReportIS::StreamType::CEF:
-                    setLogConfiguration(ReportIS::StreamType::CEF, getUrlForCef(), cef_protocol);
-                    break;
-                case ReportIS::StreamType::NONE: break;
-                case ReportIS::StreamType::COUNT: break;
-            }
-        }
-
-        parseJSONKey<bool>("formatLoggingOutput", should_format_output, archive_in);
-    } catch (const exception &e) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to parse the log trigger configuration: '" << e.what() << "'";
-        archive_in.setNextName(nullptr);
-    }
-}
--- a/components/generic_rulebase/zone.cc
+++ b/components/generic_rulebase/zone.cc
@@ -1,179 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/zone.h"
-
-#include <set>
-#include <vector>
-#include <string>
-
-using namespace std;
-
-static const unordered_map<string, Zone::Direction> string_to_direction = {
-    { "to", Zone::Direction::To },
-    { "from", Zone::Direction::From },
-    { "bidirectional", Zone::Direction::Bidirectional }
-};
-
-class AdjacentZone
-{
-public:
-    void
-    load(cereal::JSONInputArchive &archive_in)
-    {
-        string direction_as_string;
-        archive_in(cereal::make_nvp("direction", direction_as_string));
-        archive_in(cereal::make_nvp("zoneId", id));
-        auto maybe_direction = string_to_direction.find(direction_as_string);
-        if (maybe_direction == string_to_direction.end()) {
-            reportConfigurationError(
-                "Illegal direction provided for adjacency. Provided direction in configuration: " +
-                direction_as_string
-            );
-        }
-        dir = maybe_direction->second;
-    }
-
-    pair<Zone::Direction, GenericConfigId> getValue() const { return make_pair(dir, id); }
-
-private:
-    Zone::Direction dir;
-    GenericConfigId id;
-};
-
-class TagsValues
-{
-public:
-    static const string req_attrs_ctx_key;
-
-    TagsValues() {}
-
-    template <typename Archive>
-    void
-    serialize(Archive &ar)
-    {
-        I_Environment *env = Singleton::Consume<I_Environment>::by<Zone>();
-        auto req_attrs = env->get<set<string>>(req_attrs_ctx_key);
-        if (!req_attrs.ok()) return;
-
-        for (const string &req_attr : *req_attrs) {
-            try {
-                string data;
-                ar(cereal::make_nvp(req_attr, data));
-                dbgDebug(D_RULEBASE_CONFIG)
-                    << "Found value for requested attribute. Tag: "
-                    << req_attr
-                    << ", Value: "
-                    << data;
-
-                tags_set[req_attr].insert(data);
-            } catch (const exception &e) {
-                dbgDebug(D_RULEBASE_CONFIG) << "Could not find values for requested attribute. Tag: " << req_attr;
-                ar.setNextName(nullptr);
-            }
-        }
-    }
-
-    bool
-    matchValueByKey(const string &requested_key, const unordered_set<string> &possible_values) const
-    {
-        auto values = tags_set.find(requested_key);
-        if (values == tags_set.end()) return false;
-
-        for (const string &val : possible_values) {
-            if (values->second.count(val)) return true;
-        }
-        return false;
-    }
-
-    void
-    insert(const TagsValues &other)
-    {
-        for (auto &single_tags_value : other.getData()) {
-            tags_set[single_tags_value.first].insert(single_tags_value.second.begin(), single_tags_value.second.end());
-        }
-    }
-
-    const unordered_map<string, set<string>> & getData() const { return tags_set; }
-
-private:
-    unordered_map<string, set<string>> tags_set;
-};
-
-const string TagsValues::req_attrs_ctx_key = "requested attributes key";
-
-void
-Zone::load(cereal::JSONInputArchive &archive_in)
-{
-    archive_in(cereal::make_nvp("id", zone_id));
-    archive_in(cereal::make_nvp("name", zone_name));
-    vector<AdjacentZone> adjacency;
-    try {
-        archive_in(cereal::make_nvp("adjacentZones", adjacency));
-    } catch (const cereal::Exception &) {
-        dbgTrace(D_RULEBASE_CONFIG)
-            << "List of adjacentZones does not exist for current object. Zone id: "
-            << zone_id
-            << ", Zone name: "
-            << zone_name;
-
-        archive_in.setNextName(nullptr);
-    }
-
-    for (const AdjacentZone &zone : adjacency) {
-        adjacent_zones.push_back(zone.getValue());
-    }
-
-    archive_in(cereal::make_nvp("match", match_query));
-
-    is_any =
-        match_query.getType() == MatchQuery::MatchType::Condition &&
-        match_query.getKey() == "any" &&
-        match_query.getValue().count("any") > 0;
-
-    set<string> keys = match_query.getAllKeys();
-}
-
-const string
-contextKeyToString(Context::MetaDataType type)
-{
-    if (type == Context::MetaDataType::SubjectIpAddr || type == Context::MetaDataType::OtherIpAddr) return "ip";
-    return Context::convertToString(type);
-}
-
-bool
-Zone::contains(const Asset &asset)
-{
-    QueryRequest request;
-
-    for (const auto &main_attr : asset.getAttrs()) {
-        request.addCondition(Condition::EQUALS, contextKeyToString(main_attr.first), main_attr.second);
-    }
-
-    ScopedContext req_attrs_key;
-    req_attrs_key.registerValue<set<string>>(TagsValues::req_attrs_ctx_key, match_query.getAllKeys());
-
-    I_Intelligence_IS_V2 *intelligence = Singleton::Consume<I_Intelligence_IS_V2>::by<Zone>();
-    auto query_res = intelligence->queryIntelligence<TagsValues>(request);
-    if (!query_res.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to perform intelligence query. Error: " << query_res.getErr();
-        return false;
-    }
-
-    for (const AssetReply<TagsValues> &asset : query_res.unpack()) {
-        TagsValues tag_values = asset.mergeReplyData();
-
-        if (match_query.matchAttributes(tag_values.getData())) return true;
-    }
-    return false;
-}
--- a/components/generic_rulebase/zones_config.cc
+++ b/components/generic_rulebase/zones_config.cc
@@ -1,114 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/zones_config.h"
-
-#include <string>
-#include <unordered_map>
-
-#include "generic_rulebase/generic_rulebase_utils.h"
-#include "config.h"
-#include "ip_utilities.h"
-#include "connkey.h"
-#include "i_generic_rulebase.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-void
-ZonesConfig::load(cereal::JSONInputArchive &archive_in)
-{
-    dbgFlow(D_RULEBASE_CONFIG) << "Saving active zones";
-    set<string> used_zones;
-    cereal::load(archive_in, used_zones);
-
-    dbgTrace(D_RULEBASE_CONFIG) << "Loading all zones";
-    auto all_zones_maybe = getSetting<Zones>("rulebase", "zones");
-    if (!all_zones_maybe.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to load zones";
-        return;
-    }
-
-    dbgTrace(D_RULEBASE_CONFIG) << "Creating cache of all zones by ID";
-    map<GenericConfigId, Zone> all_zones;
-    for (const auto &single_zone : all_zones_maybe.unpack().zones) {
-        if (used_zones.count(single_zone.getId()) > 0 && single_zone.isAnyZone()) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Found used zone of type \"Any\": saving all zones as active zones";
-            zones = all_zones_maybe.unpack().zones;
-            return;
-        }
-
-        dbgDebug(D_RULEBASE_CONFIG)
-            << "Adding specific zone to cache. Zone ID: "
-            << single_zone.getId()
-            << ", name: "
-            << single_zone.getName();
-        all_zones.emplace(single_zone.getId(), single_zone);
-    }
-
-    dbgTrace(D_RULEBASE_CONFIG) << "Creating list of active zones";
-    map<GenericConfigId, Zone> active_zones_set;
-    for (const auto &single_used_zone_id : used_zones) {
-        const auto &found_zone = all_zones[single_used_zone_id];
-        dbgTrace(D_RULEBASE_CONFIG)
-            << "Adding zone to list of active zones. Zone ID: "
-            << single_used_zone_id
-            << ", zone name: "
-            << found_zone.getName();
-        active_zones_set.emplace(found_zone.getId(), found_zone);
-
-        for (const auto &adjacent_zone : found_zone.getAdjacentZones()) {
-            const auto &adjacent_zone_obj = all_zones[adjacent_zone.second];
-            dbgTrace(D_RULEBASE_CONFIG)
-                << "Adding adjacent zone to list of active zones. Zone ID: "
-                << adjacent_zone_obj.getId()
-                << ", zone name: "
-                << adjacent_zone_obj.getName();
-            active_zones_set.emplace(adjacent_zone_obj.getId(), adjacent_zone_obj);
-        }
-    }
-
-    vector<GenericConfigId> implied_zones = {
-        "impliedAzure",
-        "impliedDNS",
-        "impliedSSH",
-        "impliedProxy",
-        "impliedFog"
-    };
-
-    GenericConfigId any_zone_id = "";
-    for (const auto &single_zone : all_zones_maybe.unpack().zones) {
-        if (single_zone.isAnyZone()) any_zone_id = single_zone.getId();
-    }
-    for (GenericConfigId &implied_id: implied_zones) {
-        if (all_zones.find(implied_id) != all_zones.end()) {
-            dbgDebug(D_RULEBASE_CONFIG) << "Adding implied zone to cache. Zone ID: " << implied_id;
-            active_zones_set.emplace(implied_id, all_zones[implied_id]);
-            if (any_zone_id != "" && active_zones_set.count(any_zone_id) == 0) {
-                active_zones_set.emplace(any_zone_id, all_zones[any_zone_id]);
-            }
-        }
-    }
-
-    for (const auto &single_id_zone_pair : active_zones_set) {
-        zones.push_back(single_id_zone_pair.second);
-    }
-}
-
-void
-ZonesConfig::preload()
-{
-    registerExpectedSetting<Zones>("rulebase", "zones");
-    registerExpectedSetting<ZonesConfig>("rulebase", "usedZones");
-}
--- a/components/gradual_deployment/gradual_deployment.cc
+++ b/components/gradual_deployment/gradual_deployment.cc
@@ -128,7 +128,7 @@ private:
                break;
            }
            default:
-                dbgAssert(false) << "Unsupported IP type";
+                dbgAssert(false) << AlertInfo(AlertTeam::CORE, "gradual deployment") << "Unsupported IP type";
        }
        return address;
    }
--- a/components/health_check_manager/health_check_manager_ut/CMakeLists.txt
+++ b/components/health_check_manager/health_check_manager_ut/CMakeLists.txt
@@ -1,8 +0,0 @@
-include_directories(${CMAKE_SOURCE_DIR}/components/include)
-link_directories(${BOOST_ROOT}/lib)
-
-add_unit_test(
-    health_check_manager_ut
-    "health_check_manager_ut.cc"
-    "singleton;messaging;mainloop;health_check_manager;event_is;metric;-lboost_regex"
-)
--- a/components/http_manager/http_manager.cc
+++ b/components/http_manager/http_manager.cc
@@ -46,7 +46,10 @@ operator<<(ostream &os, const EventVerdict &event)
        case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_WAIT: return os << "Wait";
    }

-    dbgAssert(false) << "Illegal Event Verdict value: " << static_cast<uint>(event.getVerdict());
+    dbgAssert(false)
+        << AlertInfo(AlertTeam::CORE, "http manager")
+        << "Illegal Event Verdict value: "
+        << static_cast<uint>(event.getVerdict());
    return os;
 }

@@ -321,8 +324,11 @@ private:

            state.setApplicationVerdict(respond.first, respond.second.getVerdict());
        }
-
-        return state.getCurrVerdict();
+        FilterVerdict aggregated_verdict = state.getCurrVerdict();
+        if (aggregated_verdict.getVerdict() == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
+            SecurityAppsDropEvent(state.getCurrentDropVerdictCausers()).notify();
+        }
+        return aggregated_verdict;
    }

    static void
--- a/components/http_manager/http_manager_opaque.cc
+++ b/components/http_manager/http_manager_opaque.cc
@@ -69,6 +69,7 @@ HttpManagerOpaque::getCurrVerdict() const
                break;
            default:
                dbgAssert(false)
+                    << AlertInfo(AlertTeam::CORE, "http manager")
                    << "Received unknown verdict "
                    << static_cast<int>(app_verdic_pair.second);
        }
@@ -77,6 +78,25 @@ HttpManagerOpaque::getCurrVerdict() const
    return accepted_apps == applications_verdicts.size() ? ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT : verdict;
 }

+std::set<std::string>
+HttpManagerOpaque::getCurrentDropVerdictCausers() const
+{
+    std::set<std::string> causers;
+    if (manager_verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
+        causers.insert(HTTP_MANAGER_NAME);
+    }
+    for (const auto &app_verdic_pair : applications_verdicts) {
+        bool was_dropped = app_verdic_pair.second == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP;
+        dbgTrace(D_HTTP_MANAGER)
+            << "The verdict from: " << app_verdic_pair.first
+            << (was_dropped ? " is \"drop\"" : " is not \"drop\" ");
+        if (was_dropped) {
+            causers.insert(app_verdic_pair.first);
+        }
+    }
+    return causers;
+}
+
 void
 HttpManagerOpaque::saveCurrentDataToCache(const Buffer &full_data)
 {
--- a/components/http_manager/http_manager_opaque.h
+++ b/components/http_manager/http_manager_opaque.h
@@ -20,6 +20,8 @@
 #include "table_opaque.h"
 #include "nginx_attachment_common.h"

+static const std::string HTTP_MANAGER_NAME = "HTTP Manager";
+
 class HttpManagerOpaque : public TableOpaqueSerialize<HttpManagerOpaque>
 {
 public:
@@ -30,6 +32,7 @@ public:
    void setManagerVerdict(ngx_http_cp_verdict_e verdict) { manager_verdict = verdict; }
    ngx_http_cp_verdict_e getManagerVerdict() const { return manager_verdict; }
    ngx_http_cp_verdict_e getCurrVerdict() const;
+    std::set<std::string> getCurrentDropVerdictCausers() const;
    void saveCurrentDataToCache(const Buffer &full_data);
    void setUserDefinedValue(const std::string &value) { user_defined_value = value; }
    Maybe<std::string> getUserDefinedValue() const { return user_defined_value; }
--- a/components/include/details_resolver.h
+++ b/components/include/details_resolver.h
@@ -34,6 +34,7 @@ public:
    ~DetailsResolver();

    void preload() override;
+    void init() override;

 private:
    class Impl;
--- a/components/include/downloader.h
+++ b/components/include/downloader.h
@@ -21,6 +21,7 @@
 #include "url_parser.h"
 #include "i_agent_details.h"
 #include "i_mainloop.h"
+#include "i_environment.h"
 #include "singleton.h"
 #include "component.h"

@@ -32,6 +33,7 @@ class Downloader
    Singleton::Consume<I_Encryptor>,
    Singleton::Consume<I_MainLoop>,
    Singleton::Consume<I_OrchestrationTools>,
+    Singleton::Consume<I_Environment>,
    Singleton::Consume<I_UpdateCommunication>
 {
 public:
--- a/components/include/external_sdk_server.h
+++ b/components/include/external_sdk_server.h
@@ -24,7 +24,8 @@ class ExternalSdkServer
        :
    public Component,
    Singleton::Provide<I_ExternalSdkServer>,
-    Singleton::Consume<I_RestApi>
+    Singleton::Consume<I_RestApi>,
+    Singleton::Consume<I_Messaging>
 {
 public:
    ExternalSdkServer();
--- a/components/include/generic_rulebase/match_query.h
+++ b/components/include/generic_rulebase/match_query.h
@@ -89,7 +89,9 @@ private:
    bool matchAttributesRegEx(const std::set<std::string> &values,
            std::set<std::string> &matched_override_keywords) const;
    bool matchAttributesString(const std::set<std::string> &values) const;
+    bool matchAttributesIp(const std::set<std::string> &values) const;
    bool isRegEx() const;
+    bool isIP() const;

    MatchType type;
    Operators operator_type;
--- a/components/include/health_checker.h
+++ b/components/include/health_checker.h
@@ -21,6 +21,7 @@
 #include "i_shell_cmd.h"
 #include "i_orchestration_status.h"
 #include "component.h"
+#include "i_service_controller.h"

 class HealthChecker
        :
@@ -29,7 +30,8 @@ class HealthChecker
    Singleton::Consume<I_Socket>,
    Singleton::Consume<I_Health_Check_Manager>,
    Singleton::Consume<I_ShellCmd>,
-    Singleton::Consume<I_OrchestrationStatus>
+    Singleton::Consume<I_OrchestrationStatus>,
+    Singleton::Consume<I_ServiceController>
 {
 public:
    HealthChecker();
--- a/components/include/http_event_impl/i_http_event_impl.h
+++ b/components/include/http_event_impl/i_http_event_impl.h
@@ -50,9 +50,11 @@ public:
        position(mod_position)
    {
        dbgAssert(mod_type != ModificationType::APPEND || position == injection_pos_irrelevant)
+            << AlertInfo(AlertTeam::CORE, "http manager")
            << "Injection position is not applicable to a modification of type \"Append\"";

        dbgAssert(mod_type != ModificationType::INJECT || position >= 0)
+            << AlertInfo(AlertTeam::CORE, "http manager")
            << "Invalid injection position: must be non-negative. Position: "
            << position;
    }
@@ -166,6 +168,7 @@ private:
            }
            default:
                dbgAssert(false)
+                    << AlertInfo(AlertTeam::CORE, "http manager")
                    << "Unknown type of ModificationType: "
                    << static_cast<int>(modification_type);
        }
--- a/components/include/http_geo_filter.h
+++ b/components/include/http_geo_filter.h
@@ -15,7 +15,8 @@ class HttpGeoFilter
    public Component,
    Singleton::Consume<I_MainLoop>,
    Singleton::Consume<I_GeoLocation>,
-    Singleton::Consume<I_GenericRulebase>
+    Singleton::Consume<I_GenericRulebase>,
+    Singleton::Consume<I_Environment>
 {
 public:
    HttpGeoFilter();
--- a/components/include/http_inspection_events.h
+++ b/components/include/http_inspection_events.h
@@ -183,4 +183,16 @@ class WaitTransactionEvent : public Event<WaitTransactionEvent, EventVerdict>
 {
 };

+class SecurityAppsDropEvent : public Event<SecurityAppsDropEvent>
+{
+public:
+    SecurityAppsDropEvent(
+        const std::set<std::string> &apps_names)
+            :
+        apps_names(apps_names) {}
+    const std::set<std::string> & getAppsNames() const { return apps_names; }
+
+private:
+    const std::set<std::string> apps_names;
+};
 #endif // __HTTP_INSPECTION_EVENTS_H__
--- a/components/include/http_transaction_data.h
+++ b/components/include/http_transaction_data.h
@@ -136,6 +136,7 @@ public:
    static const std::string req_body;
    static const std::string source_identifier;
    static const std::string proxy_ip_ctx;
+    static const std::string xff_vals_ctx;

    static const CompressionType default_response_content_encoding;

--- a/components/include/i_details_resolver.h
+++ b/components/include/i_details_resolver.h
@@ -29,7 +29,9 @@ public:
    virtual bool isGwNotVsx() = 0;
    virtual bool isVersionAboveR8110() = 0;
    virtual bool isReverseProxy() = 0;
+    virtual bool isCloudStorageEnabled() = 0;
    virtual Maybe<std::tuple<std::string, std::string, std::string>> parseNginxMetadata() = 0;
+    virtual Maybe<std::tuple<std::string, std::string, std::string, std::string, std::string>> readCloudMetadata() = 0;
    virtual std::map<std::string, std::string> getResolvedDetails() = 0;
 #if defined(gaia) || defined(smb)
    virtual bool compareCheckpointVersion(int cp_version, std::function<bool(int, int)> compare_operator) const = 0;
--- a/components/include/i_downloader.h
+++ b/components/include/i_downloader.h
@@ -22,7 +22,7 @@
 class I_Downloader
 {
 public:
-    virtual Maybe<std::string> downloadFileFromFog(
+    virtual Maybe<std::string> downloadFile(
        const std::string &checksum,
        Package::ChecksumTypes,
        const GetResourceFile &resourse_file
--- a/components/include/i_orchestration_tools.h
+++ b/components/include/i_orchestration_tools.h
@@ -117,7 +117,7 @@ public:
        const std::string &conf_path) const = 0;
    virtual bool copyFile(const std::string &src_path, const std::string &dst_path) const = 0;
    virtual bool doesFileExist(const std::string &file_path) const = 0;
-    virtual void getClusterId() const = 0;
+    virtual void setClusterId() const = 0;
    virtual void fillKeyInJson(
        const std::string &filename,
        const std::string &_key,
--- a/components/include/i_service_controller.h
+++ b/components/include/i_service_controller.h
@@ -64,7 +64,9 @@ public:
        const std::string &service_id
    ) = 0;

-    virtual std::map<std::string, PortNumber> getServiceToPortMap() = 0;
+    virtual std::map<std::string, std::vector<PortNumber>> getServiceToPortMap() = 0;
+
+    virtual bool getServicesPolicyStatus() const = 0;

 protected:
    virtual ~I_ServiceController() {}
--- a/components/include/i_update_communication.h
+++ b/components/include/i_update_communication.h
@@ -32,6 +32,7 @@ public:
        const std::string &policy_versions
    ) const = 0;
    virtual Maybe<void> authenticateAgent() = 0;
+    virtual void registerLocalAgentToFog() = 0;
    virtual Maybe<void> getUpdate(CheckUpdateRequest &request) = 0;
    virtual Maybe<std::string> downloadAttributeFile(
        const GetResourceFile &resourse_file,
--- a/components/include/orchestration_comp.h
+++ b/components/include/orchestration_comp.h
@@ -31,6 +31,7 @@
 #include "i_environment.h"
 #include "i_tenant_manager.h"
 #include "i_package_handler.h"
+#include "i_proxy_configuration.h"
 #include "i_env_details.h"
 #include "component.h"

@@ -54,7 +55,8 @@ class OrchestrationComp
    Singleton::Consume<I_UpdateCommunication>,
    Singleton::Consume<I_Downloader>,
    Singleton::Consume<I_ManifestController>,
-    Singleton::Consume<I_EnvDetails>
+    Singleton::Consume<I_EnvDetails>,
+    Singleton::Consume<I_ProxyConfiguration>
 {
 public:
    OrchestrationComp();
--- a/components/include/orchestration_status.h
+++ b/components/include/orchestration_status.h
@@ -40,7 +40,7 @@ public:
    ~OrchestrationStatus();

    void init() override;
-    
+
 private:
    class Impl;
    std::unique_ptr<Impl> pimpl;
--- a/components/include/orchestrator/rest_api/get_resource_file.h
+++ b/components/include/orchestrator/rest_api/get_resource_file.h
@@ -115,7 +115,7 @@ public:
            case ResourceFileType::VIRTUAL_SETTINGS: return "virtualSettings";
            case ResourceFileType::VIRTUAL_POLICY:   return "virtualPolicy";
            default:
-                dbgAssert(false) << "Unknown file type";
+                dbgAssert(false) << AlertInfo(AlertTeam::CORE, "update process") << "Unknown file type";
        }
        return std::string();
    }
--- a/components/include/package.h
+++ b/components/include/package.h
@@ -56,7 +56,7 @@ private:
            if (mapped_type.second == type) return mapped_type.first;
        }

-        dbgAssert(false) << "Unsupported type " << static_cast<int>(type);
+        dbgAssert(false) << AlertInfo(AlertTeam::CORE, "packaging") << "Unsupported type " << static_cast<int>(type);
        // Just satisfying the compiler, this return never reached
        return std::string();
    }
--- a/components/include/package_handler.h
+++ b/components/include/package_handler.h
@@ -17,6 +17,7 @@
 #include "i_package_handler.h"
 #include "i_orchestration_tools.h"
 #include "i_shell_cmd.h"
+#include "i_environment.h"
 #include "component.h"

 class PackageHandler
@@ -24,7 +25,8 @@ class PackageHandler
    public Component,
    Singleton::Provide<I_PackageHandler>,
    Singleton::Consume<I_ShellCmd>,
-    Singleton::Consume<I_OrchestrationTools>
+    Singleton::Consume<I_OrchestrationTools>,
+    Singleton::Consume<I_Environment>
 {
 public:
    PackageHandler();
--- a/components/include/reverse_proxy_defaults.h
+++ b/components/include/reverse_proxy_defaults.h
@@ -7,24 +7,28 @@ static const std::string product_name = getenv("DOCKER_RPM_ENABLED") ? "CloudGua
 static const std::string default_cp_cert_file = "/etc/cp/cpCert.pem";
 static const std::string default_cp_key_file = "/etc/cp/cpKey.key";
 static const std::string default_rpm_conf_path = "/etc/cp/conf/rpmanager/";
+
 static const std::string default_certificate_path = "/etc/cp/rpmanager/certs";
+static const std::string default_manual_certs_path = "/etc/cp/rpmanager/manualCerts/";
+static const std::string default_config_path = "/etc/cp/conf/rpmanager/servers";
+static const std::string default_rpm_prepare_path = "/etc/cp/conf/rpmanager/prepare/servers";
+
+static const std::string default_nginx_log_files_path = "/var/log/nginx/";
 static const std::string default_additional_files_path = "/etc/cp/conf/rpmanager/include";
 static const std::string default_server_config = "additional_server_config.conf";
 static const std::string default_location_config = "additional_location_config.conf";
 static const std::string default_trusted_ca_suffix = "_user_ca_bundle.crt";
-static const std::string default_nginx_log_files_path = "/var/log/nginx/";
 static const std::string default_log_files_host_path = "/var/log/nano_agent/rpmanager/nginx_log/";
-static const std::string default_config_path = "/etc/cp/conf/rpmanager/servers";
 static const std::string default_template_path = "/etc/cp/conf/rpmanager/nginx-template-clear";
-static const std::string default_manual_certs_path = "/etc/cp/rpmanager/manualCerts/";
 static const std::string default_server_certificate_path = "/etc/cp/rpmanager/certs/sslCertificate_";
 static const std::string default_server_certificate_key_path = "/etc/cp/rpmanager/certs/sslPrivateKey_";
 static const std::string default_container_name = "cp_nginx_gaia";
 static const std::string default_docker_image = "cp_nginx_gaia";
 static const std::string default_nginx_config_file = "/etc/cp/conf/rpmanager/nginx.conf";
+static const std::string default_prepare_nginx_config_file = "/etc/cp/conf/rpmanager/nginx_prepare.conf";
 static const std::string default_global_conf_template = "/etc/cp/conf/rpmanager/nginx-conf-template";
 static const std::string default_nginx_config_include_file =
-    "/etc/cp/conf/rpmanager/servers/nginx_conf_include";
+    "/etc/cp/conf/rpmanager/servers/nginx_conf_include.conf";
 static const std::string default_global_conf_include_template =
    "/etc/cp/conf/rpmanager/nginx-conf-include-template";
 static const std::string default_global_conf_include_template_no_responses =
--- a/components/include/service_health_status.h
+++ b/components/include/service_health_status.h
@@ -0,0 +1,39 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef __SERVICE_HEALTH_STATUS_H__
+#define __SERVICE_HEALTH_STATUS_H__
+
+#include "singleton.h"
+#include "i_rest_api.h"
+#include "i_environment.h"
+#include "component.h"
+
+class ServiceHealthStatus
+        :
+    public Component,
+    Singleton::Consume<I_RestApi>,
+    Singleton::Consume<I_Environment>
+{
+public:
+    ServiceHealthStatus();
+    ~ServiceHealthStatus();
+
+    void init() override;
+
+private:
+    class Impl;
+    std::unique_ptr<Impl> pimpl;
+};
+
+#endif // __SERVICE_HEALTH_STATUS_H__
--- a/components/include/url_parser.h
+++ b/components/include/url_parser.h
@@ -35,8 +35,10 @@ public:
    bool isOverSSL() const { return over_ssl; }
    std::string getPort() const { return port; }
    std::string getQuery() const { return query; }
+    std::string getHost() const;
    URLProtocol getProtocol() const { return protocol; }
    std::string toString() const;
+    void setHost(const std::string &new_host);
    void setQuery(const std::string &new_query);

 private:
@@ -47,6 +49,7 @@ private:
    std::string base_url;
    std::string port;
    std::string query;
+    std::string host;
    URLProtocol protocol;
 };

--- a/components/include/waap.h
+++ b/components/include/waap.h
@@ -34,6 +34,8 @@ class I_Messaging;
 class I_AgentDetails;
 class I_Encryptor;

+const std::string WAAP_APPLICATION_NAME = "waap application";
+
 class WaapComponent
        :
    public Component,
--- a/components/packet/packet.cc
+++ b/components/packet/packet.cc
@@ -563,7 +563,10 @@ Packet::parsePacket(PktType type, IPType proto)
            return parseFromL3v6();
        }
        default: {
-            dbgAssert(false) << "Unknown (neither IPv4, nor IPv6), or uninitialized packet type: " << proto;
+            dbgAssert(false)
+                << AlertInfo(AlertTeam::CORE, "packet")
+                << "Unknown (neither IPv4, nor IPv6), or uninitialized packet type: "
+                << proto;
        }
    }

--- a/components/pending_key/pending_key.cc
+++ b/components/pending_key/pending_key.cc
@@ -43,7 +43,9 @@ PendingKey::print(ostream &os) const
 size_t
 PendingKey::hash() const
 {
-    dbgAssert(src.type != IPType::UNINITIALIZED) << "PendingKey::hash was called on an uninitialized object";
+    dbgAssert(src.type != IPType::UNINITIALIZED)
+        << AlertInfo(AlertTeam::CORE, "pending key")
+        << "PendingKey::hash was called on an uninitialized object";
    size_t seed = 0;
    hashCombine(seed, static_cast<u_char>(src.type));
    hashCombine(seed, src.proto);
--- a/components/report_messaging/report_messaging_ut/CMakeLists.txt
+++ b/components/report_messaging/report_messaging_ut/CMakeLists.txt
@@ -1,3 +0,0 @@
-link_directories(${BOOST_ROOT}/lib)
-
-add_unit_test(report_messaging_ut "report_messaging_ut.cc" "report_messaging;report;messaging;singleton;-lboost_regex")
--- a/components/security_apps/http_geo_filter/CMakeLists.txt
+++ b/components/security_apps/http_geo_filter/CMakeLists.txt
@@ -1 +1,5 @@
+include_directories(../waap/include)
+include_directories(../waap/waap_clib)
+include_directories(../../attachment-intakers/nginx_attachment)
+
 add_library(http_geo_filter http_geo_filter.cc)
--- a/components/security_apps/http_geo_filter/http_geo_filter.cc
+++ b/components/security_apps/http_geo_filter/http_geo_filter.cc
@@ -4,10 +4,16 @@
 #include <unistd.h>
 #include <stddef.h>
 #include <algorithm>
+#include <sstream>
+#include <string>
+#include <vector>
+#include <boost/algorithm/string.hpp>

+#include "cidrs_data.h"
 #include "generic_rulebase/generic_rulebase.h"
 #include "generic_rulebase/parameters_config.h"
 #include "generic_rulebase/triggers_config.h"
+#include "user_identifiers_config.h"
 #include "debug.h"
 #include "config.h"
 #include "rest.h"
@@ -21,9 +27,10 @@ USE_DEBUG_FLAG(D_GEO_FILTER);

 static const LogTriggerConf default_triger;

-class HttpGeoFilter::Impl : public Listener<NewHttpTransactionEvent>
+class HttpGeoFilter::Impl : public Listener<HttpRequestHeaderEvent>
 {
 public:
+
    void
    init()
    {
@@ -55,32 +62,42 @@ public:
    }

    EventVerdict
-    respond(const NewHttpTransactionEvent &event) override
+    respond(const HttpRequestHeaderEvent &event) override
    {
        dbgTrace(D_GEO_FILTER) << getListenerName() << " new transaction event";

-        if (!ParameterException::isGeoLocationExceptionExists() &&
-            !getConfiguration<GeoConfig>("rulebase", "httpGeoFilter").ok()
-        ) {
-            dbgTrace(D_GEO_FILTER) << "No geo location practice nor exception was found. Returning default verdict";
+        if (!event.isLastHeader()) return EventVerdict(ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INSPECT);
+        std::set<std::string> ip_set;
+        auto env = Singleton::Consume<I_Environment>::by<HttpGeoFilter>();
+        auto maybe_xff = env->get<std::string>(HttpTransactionData::xff_vals_ctx);
+        if (!maybe_xff.ok()) {
+            dbgTrace(D_GEO_FILTER) << "failed to get xff vals from env";
+        } else {
+            ip_set = split(maybe_xff.unpack(), ',');
+        }
+        dbgDebug(D_GEO_FILTER) << getListenerName() << " last header, start lookup";
+
+        if (ip_set.size() > 0) {
+            removeTrustedIpsFromXff(ip_set);
+        } else {
+            dbgDebug(D_GEO_FILTER) << "xff not found in headers";
+        }
+
+        auto maybe_source_ip = env->get<IPAddr>(HttpTransactionData::client_ip_ctx);
+        if (!maybe_source_ip.ok()) {
+            dbgWarning(D_GEO_FILTER) << "failed to get source ip from env";
            return EventVerdict(default_action);
        }

-        I_GeoLocation *i_geo_location = Singleton::Consume<I_GeoLocation>::by<HttpGeoFilter>();
-        auto asset_location = i_geo_location->lookupLocation(event.getSourceIP());
-        if (!asset_location.ok()) {
-            dbgTrace(D_GEO_FILTER) << "Lookup location failed, Error: " << asset_location.getErr();
-            return EventVerdict(default_action);
-        }
+        auto source_ip = convertIpAddrToString(maybe_source_ip.unpack());
+        ip_set.insert(source_ip);

-        EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data = asset_location.unpack();
-
-        ngx_http_cp_verdict_e exception_verdict = getExceptionVerdict(event, geo_location_data);
+        ngx_http_cp_verdict_e exception_verdict = getExceptionVerdict(ip_set);
        if (exception_verdict != ngx_http_cp_verdict_e::TRAFFIC_VERDICT_IRRELEVANT) {
            return EventVerdict(exception_verdict);
        }

-        ngx_http_cp_verdict_e geo_lookup_verdict = getGeoLookupVerdict(event, geo_location_data);
+        ngx_http_cp_verdict_e geo_lookup_verdict = getGeoLookupVerdict(ip_set);
        if (geo_lookup_verdict != ngx_http_cp_verdict_e::TRAFFIC_VERDICT_IRRELEVANT) {
            return EventVerdict(geo_lookup_verdict);
        }
@@ -88,6 +105,73 @@ public:
    }

 private:
+    std::set<std::string>
+    split(const std::string& s, char delim) {
+        std::set<std::string> elems;
+        std::stringstream ss(s);
+        std::string value;
+        while (std::getline(ss, value, delim)) {
+            elems.insert(trim(value));
+        }
+        return elems;
+    }
+
+    static inline std::string &ltrim(std::string &s) {
+        s.erase(s.begin(), std::find_if(s.begin(), s.end(),
+            [] (char c) { return !std::isspace(c); }));
+        return s;
+    }
+
+    // trim from end
+    static inline std::string &rtrim(std::string &s) {
+        s.erase(std::find_if(s.rbegin(), s.rend(),
+            [] (char c) { return !std::isspace(c); }).base(), s.end());
+        return s;
+    }
+
+    // trim from both ends
+    static inline std::string &trim(std::string &s) {
+        return ltrim(rtrim(s));
+    }
+
+    void
+    removeTrustedIpsFromXff(std::set<std::string> &xff_set)
+    {
+        auto identify_config = getConfiguration<UsersAllIdentifiersConfig>(
+            "rulebase",
+            "usersIdentifiers"
+        );
+        if (!identify_config.ok()) {
+            dbgDebug(D_GEO_FILTER) << "did not find users identifiers definition in policy";
+        } else {
+            auto trusted_ips = (*identify_config).getHeaderValuesFromConfig("x-forwarded-for");
+            for (auto it = xff_set.begin(); it != xff_set.end();) {
+                if (isIpTrusted(*it, trusted_ips)) {
+                    dbgTrace(D_GEO_FILTER) << "xff value is in trusted ips: " << *it;
+                    it = xff_set.erase(it);
+                } else {
+                    dbgTrace(D_GEO_FILTER) << "xff value is not in trusted ips: " << *it;
+                    ++it;
+                }
+            }
+        }
+    }
+
+    bool
+    isIpTrusted(const string &ip, const vector<string> &trusted_ips)
+    {
+        for (const auto &trusted_ip : trusted_ips) {
+            CIDRSData cidr_data(trusted_ip);
+            if (
+                ip == trusted_ip ||
+                (cidr_data.contains(ip))
+            ) {
+                return true;
+            }
+        }
+        return false;
+    }
+
    string
    convertIpAddrToString(const IPAddr &ip_to_convert)
    {
@@ -117,54 +201,75 @@ private:
    }

    ngx_http_cp_verdict_e
-    getGeoLookupVerdict(
-        const NewHttpTransactionEvent &event,
-        const EnumArray<I_GeoLocation::GeoLocationField, std::string> &geo_location_data)
+    getGeoLookupVerdict(const std::set<std::string> &sources)
    {
        auto maybe_geo_config = getConfiguration<GeoConfig>("rulebase", "httpGeoFilter");
        if (!maybe_geo_config.ok()) {
-            dbgWarning(D_GEO_FILTER) << "Failed to load HTTP Geo Filter config. Error:" << maybe_geo_config.getErr();
+            dbgTrace(D_GEO_FILTER) << "Failed to load HTTP Geo Filter config. Error:" << maybe_geo_config.getErr();
            return ngx_http_cp_verdict_e::TRAFFIC_VERDICT_IRRELEVANT;
        }
        GeoConfig geo_config = maybe_geo_config.unpack();
-        string country_code = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_CODE];
+        EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data;
+        I_GeoLocation *i_geo_location = Singleton::Consume<I_GeoLocation>::by<HttpGeoFilter>();

-        if (geo_config.isAllowedCountry(country_code)) {
-            dbgTrace(D_GEO_FILTER)
-                << "geo verdict ACCEPT, practice id: "
-                << geo_config.getId()
-                << ", country code: "
-                << country_code;
-            generateVerdictLog(
-                ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT,
-                event,
-                geo_config.getId(),
-                true,
-                geo_location_data
-            );
-            return ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT;
-        }
-        if (geo_config.isBlockedCountry(country_code)) {
-            dbgTrace(D_GEO_FILTER)
-                << "geo verdict DROP, practice id: "
-                << geo_config.getId()
-                << ", country code: "
-                << country_code;
-            generateVerdictLog(
-                ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP,
-                event,
-                geo_config.getId(),
-                true,
-                geo_location_data
-            );
-            return ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP;
+        for (const std::string& source : sources) {
+            Maybe<IPAddr> maybe_source_ip = IPAddr::createIPAddr(source);
+            if (!maybe_source_ip.ok()){
+                dbgWarning(D_GEO_FILTER) <<
+                "create ip address failed for source: " <<
+                source <<
+                ", Error: " <<
+                maybe_source_ip.getErr();
+                continue;
+            }
+            auto asset_location = i_geo_location->lookupLocation(maybe_source_ip.unpack());
+            if (!asset_location.ok()) {
+                dbgWarning(D_GEO_FILTER) <<
+                "Lookup location failed for source: " <<
+                source <<
+                ", Error: " <<
+                asset_location.getErr();
+                continue;
+            }
+
+            geo_location_data = asset_location.unpack();
+
+            string country_code = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_CODE];
+
+            if (geo_config.isAllowedCountry(country_code)) {
+                dbgTrace(D_GEO_FILTER)
+                    << "geo verdict ACCEPT, practice id: "
+                    << geo_config.getId()
+                    << ", country code: "
+                    << country_code;
+                generateVerdictLog(
+                    ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT,
+                    geo_config.getId(),
+                    true,
+                    geo_location_data
+                );
+                return ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT;
+            }
+            if (geo_config.isBlockedCountry(country_code)) {
+                dbgTrace(D_GEO_FILTER)
+                    << "geo verdict DROP, practice id: "
+                    << geo_config.getId()
+                    << ", country code: "
+                    << country_code;
+                generateVerdictLog(
+                    ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP,
+                    geo_config.getId(),
+                    true,
+                    geo_location_data
+                );
+                return ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP;
+            }
        }
        dbgTrace(D_GEO_FILTER)
            << "No matched practice. Returned default action: "
            << geo_config.getDefaultAction();
        generateVerdictLog(
            convertActionToVerdict(geo_config.getDefaultAction()),
-            event,
            geo_config.getId(),
            true,
            geo_location_data,
@@ -176,7 +281,6 @@ private:
    Maybe<pair<ngx_http_cp_verdict_e, string>>
    getBehaviorsVerdict(
        const unordered_map<string, set<string>> &behaviors_map_to_search,
-        const NewHttpTransactionEvent &event,
        EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data)
    {
        bool is_matched = false;
@@ -193,7 +297,6 @@ private:
                dbgTrace(D_GEO_FILTER) << "behavior verdict: DROP, exception id: " << behavior.getId();
                generateVerdictLog(
                    matched_verdict,
-                    event,
                    behavior.getId(),
                    false,
                    geo_location_data
@@ -218,63 +321,74 @@ private:
    }

    ngx_http_cp_verdict_e
-    getExceptionVerdict(
-        const NewHttpTransactionEvent &event,
-        EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data
-    ){
-        string country_code = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_CODE];
-        string country_name = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_NAME];
-        string source_ip = convertIpAddrToString(event.getSourceIP());
+    getExceptionVerdict(const std::set<std::string> &sources) {

        pair<ngx_http_cp_verdict_e, string> curr_matched_behavior;
        ngx_http_cp_verdict_e verdict = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_IRRELEVANT;
+        I_GeoLocation *i_geo_location = Singleton::Consume<I_GeoLocation>::by<HttpGeoFilter>();
+        EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data;

-        dbgTrace(D_GEO_FILTER)
+        for (const std::string& source : sources) {
+
+            Maybe<IPAddr> maybe_source_ip = IPAddr::createIPAddr(source);
+            if (!maybe_source_ip.ok()){
+                dbgWarning(D_GEO_FILTER) <<
+                "create ip address failed for source: " <<
+                source <<
+                ", Error: " <<
+                maybe_source_ip.getErr();
+                continue;
+            }
+
+
+            auto asset_location = i_geo_location->lookupLocation(maybe_source_ip.unpack());
+            if (!asset_location.ok()) {
+                dbgWarning(D_GEO_FILTER) << "Lookup location failed for source: " <<
+                source <<
+                ", Error: " <<
+                asset_location.getErr();
+                continue;
+            }
+            geo_location_data = asset_location.unpack();
+            string country_code = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_CODE];
+            string country_name = geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_NAME];
+            dbgTrace(D_GEO_FILTER)
            << "Get exception verdict. "
            << "country code: "
            << country_code
            << ", country name: "
            << country_name
            << ", source ip address: "
-            << source_ip;
+            << source;

-        unordered_map<string, set<string>> exception_value_source_ip = {{"sourceIP", {source_ip}}};
-        auto matched_behavior_maybe = getBehaviorsVerdict(exception_value_source_ip, event, geo_location_data);
-        if (matched_behavior_maybe.ok()) {
-            curr_matched_behavior = matched_behavior_maybe.unpack();
-            verdict = curr_matched_behavior.first;
-            if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
-                return verdict;
+            unordered_map<string, set<string>> exception_value_country_code = {
+                {"countryCode", {country_code}}
+            };
+            auto matched_behavior_maybe = getBehaviorsVerdict(exception_value_country_code, geo_location_data);
+            if (matched_behavior_maybe.ok()) {
+                curr_matched_behavior = matched_behavior_maybe.unpack();
+                verdict = curr_matched_behavior.first;
+                if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
+                    return verdict;
+                }
+            }
+
+            unordered_map<string, set<string>> exception_value_country_name = {
+                {"countryName", {country_name}}
+            };
+            matched_behavior_maybe = getBehaviorsVerdict(exception_value_country_name, geo_location_data);
+            if (matched_behavior_maybe.ok()) {
+                curr_matched_behavior = matched_behavior_maybe.unpack();
+                verdict = curr_matched_behavior.first;
+                if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
+                    return verdict;
+                }
            }
        }

-        unordered_map<string, set<string>> exception_value_country_code = {
-            {"countryCode", {country_code}}
-        };
-        matched_behavior_maybe = getBehaviorsVerdict(exception_value_country_code, event, geo_location_data);
-        if (matched_behavior_maybe.ok()) {
-            curr_matched_behavior = matched_behavior_maybe.unpack();
-            verdict = curr_matched_behavior.first;
-            if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
-                return verdict;
-            }
-        }
-
-        unordered_map<string, set<string>> exception_value_country_name = {
-            {"countryName", {country_name}}
-        };
-        matched_behavior_maybe = getBehaviorsVerdict(exception_value_country_name, event, geo_location_data);
-        if (matched_behavior_maybe.ok()) {
-            curr_matched_behavior = matched_behavior_maybe.unpack();
-            verdict = curr_matched_behavior.first;
-            if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
-                return verdict;
-            }
-        }
        if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT) {
            generateVerdictLog(
                verdict,
-                event,
                curr_matched_behavior.second,
                false,
                geo_location_data
@@ -286,7 +400,6 @@ private:
    void
    generateVerdictLog(
        const ngx_http_cp_verdict_e &verdict,
-        const NewHttpTransactionEvent &event,
        const string &matched_id,
        bool is_geo_filter,
        const EnumArray<I_GeoLocation::GeoLocationField, std::string> geo_location_data,
@@ -307,14 +420,27 @@ private:
            LogField(matched_on, matched_id),
            ReportIS::Tags::HTTP_GEO_FILTER
        );
-        log
-            << LogField("sourceIP", convertIpAddrToString(event.getSourceIP()))
-            << LogField("sourcePort", event.getSourcePort())
-            << LogField("hostName", event.getDestinationHost())
-            << LogField("httpMethod", event.getHttpMethod())
-            << LogField("securityAction", is_prevent ? "Prevent" : "Detect");
+        auto env = Singleton::Consume<I_Environment>::by<HttpGeoFilter>();
+        auto source_ip = env->get<IPAddr>(HttpTransactionData::client_ip_ctx);
+        if (source_ip.ok()) log << LogField("sourceIP", convertIpAddrToString(source_ip.unpack()));
+
+        auto source_identifier = env->get<string>(HttpTransactionData::source_identifier);
+        if (source_identifier.ok()) log << LogField("httpSourceId", source_identifier.unpack());
+
+        auto source_port = env->get<string>(HttpTransactionData::client_port_ctx);
+        if (source_port.ok()) log << LogField("sourcePort", source_port.unpack());
+
+        auto host_name = env->get<string>(HttpTransactionData::host_name_ctx);
+        if (host_name.ok()) log << LogField("hostName", host_name.unpack());
+
+        auto method = env->get<string>(HttpTransactionData::method_ctx);
+        if (method.ok()) log << LogField("httpMethod", method.unpack());
+
+        log << LogField("securityAction", is_prevent ? "Prevent" : "Detect");

        if (is_default_action) log << LogField("isDefaultSecurityAction", true);
+        auto xff = env->get<string>(HttpTransactionData::xff_vals_ctx);
+        if (xff.ok()) log << LogField("proxyIP", xff.unpack());

        log
            << LogField("sourceCountryCode", geo_location_data[I_GeoLocation::GeoLocationField::COUNTRY_CODE])
@@ -343,5 +469,6 @@ void
 HttpGeoFilter::preload()
 {
    registerExpectedConfiguration<GeoConfig>("rulebase", "httpGeoFilter");
+    registerExpectedConfiguration<UsersAllIdentifiersConfig>("rulebase", "usersIdentifiers");
    registerConfigLoadCb([this]() { pimpl->loadDefaultAction(); });
 }
--- a/components/security_apps/ips/compound_protection.cc
+++ b/components/security_apps/ips/compound_protection.cc
@@ -43,7 +43,10 @@ CompoundProtection::Impl::getMatch(const set<PMPattern> &matched) const
        case Operation::ORDERED_AND: return getMatchOrderedAnd(matched);
    }

-    dbgAssert(false) << "Unknown compound operation: " << static_cast<uint>(operation);
+    dbgAssert(false)
+        << AlertInfo(AlertTeam::CORE, "ips")
+        << "Unknown compound operation: "
+        << static_cast<uint>(operation);
    return MatchType::NO_MATCH;
 }

--- a/components/security_apps/ips/include/ips_basic_policy.h
+++ b/components/security_apps/ips/include/ips_basic_policy.h
@@ -50,9 +50,13 @@ public:

 private:
    void readRules(cereal::JSONInputArchive &ar);
+    void readTriggerId(cereal::JSONInputArchive &ar);
+    void readExceptionId(cereal::JSONInputArchive &ar);
    void readDefaultAction(cereal::JSONInputArchive &ar);

    std::vector<Rule> rules;
+    std::string trigger_id;
+    std::string exception_id;
 };

 #endif // __IPS_BASIC_POLICY_H__
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
orianelou	b58f7781e6	Update local_policy.yaml	2024-10-01 13:05:23 +03:00
orianelou	7153d222c0	Update local_policy.yaml	2024-10-01 13:03:59 +03:00
orianelou	f1ec8959b7	Update apisix-standalone.yaml	2024-10-01 12:49:25 +03:00
Daniel-Eisenberg	4a7336b276	Merge pull request #190 from openappsec/Sep_17_2024-Dev sync code	2024-09-30 14:53:51 +03:00
orianelou	4d0042e933	Create apisix-standalone.yaml	2024-09-30 14:10:35 +03:00
orianelou	015915497a	Create docker-compose.yaml	2024-09-30 14:09:43 +03:00
Ned Wright	586150fe4f	sync code	2024-09-17 10:53:09 +00:00
orianelou	3fe0b42fcd	Merge pull request #189 from openappsec/Sep_15_2024-Dev sync code	2024-09-15 17:25:26 +03:00
orianelou	84e10c7129	Merge pull request #186 from chkp-omriat2/main Updating crowdsec auxiliary	2024-09-15 17:25:13 +03:00
Ned Wright	eddd250409	sync code	2024-09-15 02:49:26 +00:00
chkp-omriat2	294cb600f8	Updating crowdsec auxiliary	2024-09-10 06:09:54 +00:00
Ned Wright	f4bad4c4d9	Remove non-active files	2024-09-02 14:16:01 +03:00
WrightNed	6e916599d9	Merge pull request #179 from openappsec/Aug_20_2024-Dev Aug 20th update	2024-08-27 12:33:46 +03:00
orianelou	24d53aed53	Update docker-compose.yaml	2024-08-27 10:50:25 +03:00
WrightNed	93fb3da2f8	Merge pull request #177 from wiaam96/patch-1 Update entry.sh	2024-08-22 15:17:49 +03:00
wiaam96	e7378c9a5f	Update entry.sh	2024-08-22 15:15:24 +03:00
Ned Wright	110f0c8bd2	Aug 20th update	2024-08-21 08:42:14 +00:00
WrightNed	ca31aac08a	Merge pull request #174 from openappsec/orianelou-patch-6 Update docker-compose.yaml	2024-08-20 15:17:02 +03:00
orianelou	161b6dd180	Update docker-compose.yaml	2024-08-20 14:50:01 +03:00
WrightNed	84327e0b19	Merge pull request #170 from openappsec/orianelou-patch-4 Create docker-compose.yaml	2024-08-05 13:12:40 +03:00
orianelou	b9723ba6ce	Create docker-compose.yaml added compose for docker SWAG	2024-08-05 12:06:37 +03:00
WrightNed	00e183b8c6	Merge pull request #169 from openappsec/Jul_31_2024-Dev Jul 31st update	2024-08-01 18:10:44 +03:00
WrightNed	e859c167ed	Merge pull request #167 from openappsec/orianelou-crds Orianelou crds	2024-08-01 18:10:11 +03:00
Ned Wright	384b59cc87	Jul 31st update	2024-07-31 17:15:35 +00:00
orianelou	805e958cb9	Create open-appsec-crd-latest.yaml	2024-07-25 12:06:59 +03:00
orianelou	5bcd7cfcf1	Create open-appsec-crd-v1beta2.yaml	2024-07-25 12:05:57 +03:00
orianelou	ae6f2faeec	Create open-appsec-crd-v1beta1.yaml	2024-07-25 12:04:22 +03:00
WrightNed	705a5e6061	Merge pull request #166 from openappsec/Jul_23_2024-Dev Jul 23rd update	2024-07-24 16:01:45 +03:00
WrightNed	c33b74a970	Merge pull request #164 from chkp-omris/main update intelligence	2024-07-24 15:54:58 +03:00
chkp-omris	2da9fbc385	update intelligence	2024-07-23 13:15:33 +00:00
Ned Wright	f58e9a6128	Jul 23rd update	2024-07-23 11:08:24 +00:00
WrightNed	57ea5c72c5	Merge pull request #156 from openappsec/Jul_04_2024-Dev Jul 4th update	2024-07-07 08:47:38 +03:00
Ned Wright	962bd31d46	Jul 4th update	2024-07-04 14:10:34 +00:00
WrightNed	01770475ec	Merge pull request #153 from openappsec/Jun_26_2024-Dev June 27th update	2024-07-01 11:42:11 +03:00
Ned Wright	78b114a274	June 27th update	2024-06-27 12:05:38 +00:00
WrightNed	81b1aec487	Merge pull request #148 from openappsec/orianelou-new-policy-files Orianelou new policy files	2024-06-19 16:18:41 +03:00
orianelou	be6591a670	Update local_policy.yaml	2024-06-17 13:49:48 +03:00
orianelou	663782009c	Update local_policy.yaml	2024-06-17 13:49:18 +03:00
orianelou	9392bbb26c	Update local_policy.yaml	2024-06-17 13:49:01 +03:00
orianelou	46682bcdce	Update local_policy.yaml	2024-06-17 13:48:39 +03:00
orianelou	057bc42375	Update local_policy.yaml	2024-06-17 13:47:24 +03:00
orianelou	88e0ccd308	Rename open-appsec-k8s-default-config-v1beta21.yaml to open-appsec-k8s-default-config-v1beta1.yaml	2024-06-17 13:45:02 +03:00
orianelou	4241b9c574	Create open-appsec-k8s-prevent-config-v1beta2.yaml	2024-06-17 13:44:45 +03:00
orianelou	4af9f18ada	Create open-appsec-k8s-default-config-v1beta2.yaml	2024-06-17 13:44:25 +03:00
orianelou	3b533608b1	Create open-appsec-k8s-prevent-config-v1beta1.yaml	2024-06-17 13:42:13 +03:00
orianelou	74bb3086ec	Create open-appsec-k8s-default-config-v1beta21.yaml	2024-06-17 13:41:29 +03:00
orianelou	504d1415a5	Create local_policy.yaml	2024-06-17 13:39:40 +03:00
orianelou	18b1b63c42	Create local_policy.yaml	2024-06-17 13:38:31 +03:00
orianelou	ded2a5ffc2	Create local_policy.yaml	2024-06-17 13:36:23 +03:00
orianelou	1254bb37b2	Create local_policy.yaml	2024-06-17 13:34:35 +03:00
orianelou	cf16343caa	Create open-appsec-k8s-prevent-config-v1beta2.yaml	2024-06-16 10:56:16 +03:00
orianelou	78c4209406	Rename config/k8s/v1beta2/default/open-appsec-k8s-default-config-v1beta2.yaml to config/k8s/v1beta2/open-appsec-k8s-default-config-v1beta2.yaml	2024-06-16 10:55:23 +03:00
orianelou	3c8672c565	Rename config/k8s/v1beta2/open-appsec-k8s-default-config-v1beta2.yaml to config/k8s/v1beta2/default/open-appsec-k8s-default-config-v1beta2.yaml	2024-06-16 10:54:05 +03:00
orianelou	48d6baed3b	Rename config/linux/v1beta2/local_policy.yaml to config/linux/v1beta2/default/local_policy.yaml	2024-06-16 10:44:39 +03:00
orianelou	8770257a60	Create local_policy.yaml for linux prevent	2024-06-16 10:44:21 +03:00
Ned Wright	fd5d093b24	Add --no-upgrade option to docker	2024-06-03 14:19:41 +00:00
WrightNed	d6debf8d8d	Merge pull request #141 from openappsec/May_27_2024-Dev May 27 2024 dev	2024-06-02 10:15:10 +03:00
Ned Wright	395b754575	Add dammy get-cloud-metadata.sh script	2024-05-29 11:01:17 +00:00
Ned Wright	dc000372c4	Turn on optimization by default	2024-05-27 12:05:16 +00:00
Ned Wright	941c641174	Change cloud default logging	2024-05-27 11:56:05 +00:00
Ned Wright	fdc148aa9b	May 27 update	2024-05-27 09:05:33 +00:00
orianelou	307fd8897d	Rename config/k8s/open-appsec-k8s-default-config-v1beta2.yaml to config/k8s/v1beta2/open-appsec-k8s-default-config-v1beta2.yaml	2024-05-21 15:24:55 +03:00
orianelou	afd2b4930b	Create open-appsec-k8s-default-config-v1beta2.yaml	2024-05-21 15:24:33 +03:00
orianelou	1fb9a29223	Create local_policy.yaml	2024-05-21 15:22:54 +03:00
WrightNed	253ca70de6	Merge pull request #136 from chkp-omris/main Update agent-intelligence-service package	2024-05-19 15:30:22 +03:00
chkp-omris	938f625535	Merge branch 'openappsec:main' into main	2024-05-19 15:21:46 +03:00
chkp-omris	183d14fc55	Update agent-intelligence-service package	2024-05-19 12:21:10 +00:00
WrightNed	1f3d4ed5e1	Merge pull request #135 from openappsec/Apr_21_2024-Dev Apr 21 2024 dev	2024-05-19 11:08:26 +03:00
WrightNed	fdbd6d3786	Merge pull request #115 from openappsec/orianelou-patch-3 Update docker-compose.yaml	2024-05-19 11:07:22 +03:00
Ned Wright	4504138a4a	Change all deployments to embedded	2024-04-22 09:46:50 +00:00
Ned Wright	66ed4a8d81	April 21th 2024 update	2024-04-21 13:57:46 +00:00
WrightNed	189c9209c9	Merge pull request #122 from openappsec/Apr_14_2024-Dev Apr 14 2024 dev	2024-04-17 12:40:41 +03:00
Ned Wright	1a1580081c	Add watchdog changes	2024-04-16 14:06:43 +00:00
Ned Wright	942b2ef8b4	2024 April 14th update	2024-04-14 12:55:54 +00:00
Ned Wright	7a7f65a77a	Detect docker on http transaction installation	2024-04-14 11:28:53 +00:00
Ned Wright	98639d9cb6	configuration loading changes	2024-04-04 17:11:06 +00:00
Ned Wright	b3de81d9d9	Updating orchestration_package.sh	2024-03-31 08:48:55 +00:00
Ned Wright	a77fd9a6d0	Remove old data	2024-03-27 14:30:40 +00:00
Ned Wright	8454b2dd9b	Open Appsec helm chart automation Wed Mar 27 16:27:33 IST 2024 latest	2024-03-27 16:27:33 +02:00
Ned Wright	3913e1e8b3	Update entry.sh	2024-03-26 16:05:23 +00:00
WrightNed	262b2e59ff	Merge pull request #117 from openappsec/Mar_21_2024-Dev Mar 21 2024 dev	2024-03-26 13:53:49 +02:00
orianelou	ecbb34bc17	Update docker-compose.yaml changes comment type	2024-03-21 11:24:12 +02:00