Internet, then Ingress, then Filter, then the Services. Installing those agents in a cluster is Kubernetes. The other scenarios are listed in Deployment scenarios.
The visitor opens the site name. DNS points that name at Ingress. Ingress is the public hop and forwards the request to Filter. Filter proxies a permitted request to Service A or Service B. The Service is selected by the Host and the path on the Filter. A blocked request is answered by the Filter and does not reach a Service.
Mikiri WAF is not an Ingress controller. The cluster keeps its Ingress. Ingress no longer selects the Service. Its backend for the public name is the Filter.
403. Send that check to the Filter, not to the public Ingress.example.com. After cutover, that rule forwards to the Filter and keeps Host unchanged.On the existing Ingress, set the backend of the public name to the Filter. Leave Host unchanged. Ingress sends the visitor address in X-Forwarded-For and the visitor scheme in X-Forwarded-Proto. How Ingress writes those headers is a setting of that Ingress, not of Mikiri WAF.
In WMC, open Web server for the CID of this Filter. Under Global settings → Header settings, set real_ip_header to X-Forwarded-For. Add the addresses of the Ingress controller to set_real_ip_from. Filter uses that header only when the connection comes from one of those addresses. The fields are described in Configuring Filter as a reverse proxy.
Add a virtual host for the public name. Each path that Ingress used to route becomes a location. proxy_pass points at the Service ClusterIP, not at Ingress. Pass Host unchanged. Pass X-Real-IP and X-Forwarded-For set to $remote_addr, which is the visitor address after real_ip_header is applied. Pass X-Forwarded-Proto from the header Ingress sent.
Do not add an HTTP redirect on this host. Ingress already accepted HTTPS and speaks HTTP to the Filter.
WebSocket and gRPC locations are in Configuring Filter as a reverse proxy.
10.0.20.10 port 80 is the Filter address Ingress connects to. 10.0.10.0/24 is the range of that Ingress controller. 10.20.1.1 is the ClusterIP of Service A, which previously received /. 10.20.2.2 is the ClusterIP of Service B, which previously received /api/. Both Services listen on port 80.
Global settings → Header settings:
| Field | Value |
|---|---|
| real_ip_header | X-Forwarded-For |
| set_real_ip_from | 10.0.10.0/24 |
Save.
Virtual hosts → Add a virtual host named example.com:
| Field | Value |
|---|---|
| server_name | example.com |
| listen | 80 |
| Active | on |
Add location /:
| Field | Value |
|---|---|
| pass_type | proxy_pass |
| proxy_pass | http://10.20.1.1 |
proxy_set_header:
| Header | Value |
|---|---|
| Host | $http_host |
| X-Real-IP | $remote_addr |
| X-Forwarded-For | $remote_addr |
| X-Forwarded-Proto | $http_x_forwarded_proto |
Add location /api/:
| Field | Value |
|---|---|
| pass_type | proxy_pass |
| proxy_pass | http://10.20.2.2 |
Use the same proxy_set_header values. Save.
curl -i https://example.com/mikiri-waf-test
While example.com is in waf_host_dm, the Filter does not answer 403. The event is on the attacks page in WMC /var/log/mikiri-waf/filter/filter.log records signature ID 1. The request still reaches Service A, because /mikiri-waf-test matches location /.
After the host is removed from waf_host_dm, the Filter answers 403. The request does not appear in the Service A log. Ingress still records it, because Ingress forwarded it to the Filter.
Open / and /api/ without the test signature. Service A answers /. Service B answers /api/.
waf_host_dm on until real traffic shows no mass false blocks, then remove the host. Otherwise the Filter only monitors.set_real_ip_from lists the Ingress controller addresses. A wider range trusts addresses that are not Ingress.server_name list. Each path is a location on that host./ also matches every path that does not match a longer location.403. The host is still in waf_host_dm.502. proxy_pass points at a Pod IP, or at a ClusterIP the Filter cannot reach.real_ip_header is not X-Forwarded-For, set_real_ip_from does not include the Ingress controller, or X-Real-IP is not passed to the Service.https://example.com. The Filter host returns a redirect to HTTPS. Leave that redirect on Ingress.