Images are published as mikirisec/<name>. The tag latest is the current build. To install a fixed build, replace latest with the image tag.
Deploy PostgreSQL first, then API, then the agents that call the API. Every Pod is in the namespace mikiri-waf. A Service name is the same as the Docker container name, so a configuration written for Docker images keeps the same host name.
The commands on this page and the agent pages use kubectl. Install kubectl before creating the namespace.
Where a running Filter sits behind the public Ingress is a separate page: Kubernetes Ingress.
kubectl create namespace mikiri-waf
The pages below apply every object in that namespace. The cluster needs a default StorageClass. The claim sizes are the disk sizes in Introduction. CAPTCHA is not in that table. Its claim is 1Gi. Challenge sessions stay in memory.
Each Mikiri WAF image keeps its configuration and logs on one volume, mounted at /<name> in the container. The first start needs an empty file first-launch on that volume. The entrypoint copies the initial configuration, writes the package version to version and deletes first-launch.
On API, that start leaves Nginx running and does not start the API. On WMC, Filter, MLC, Scanner and CAPTCHA, the container exits. A Deployment would start the container again before the configuration is filled in. The first start is a Pod with restartPolicy: Never.
Delete that Pod before the Deployment. A completed Pod still holds a ReadWriteOnce volume, and the Deployment cannot mount it. The files stay on the claim.
Do not create first-launch again. The Deployment uses the files already on the claim.
What each claim stores is listed on the agent page. The claim does not store the application code, the Python virtual environment, Nginx modules (*.so), or *.example files. Those stay in the image and are replaced when the image is updated.
When the package version in the new image differs from version, the entrypoint copies the current claim to old/ and leaves the working files in place. Check the working files after an update. The copy in old/ is a snapshot of the previous configuration.
The sed commands on the agent pages replace a line that already starts with the parameter name. A generated line that begins with # is left as it is. That includes the system proxy.
Run the command in the edit Pod, before that Pod is deleted. POD below is that Pod name. After the Deployment is running, the same command works with deploy/<name> instead of POD. The path is the file on the claim.
The pattern #\{0,1\} matches the line with or without the comment mark. The generated file already contains the line, so the command replaces it and does not append a second one.
WMC. The generated line in .env is # SYS_PROXY="http://10.10.10.10:3128".
kubectl exec -n mikiri-waf POD -- sed -i \
-e 's|^#\{0,1\}[[:space:]]*SYS_PROXY=.*|SYS_PROXY="http://proxy.example.com:3128"|' \
/mikiri-waf-wmc/.env
Filter. The generated line in waf.conf is # waf_sys_proxy http://proxy.example.com:3128;.
kubectl exec -n mikiri-waf POD -- sed -i \
-e 's|^#\{0,1\}[[:space:]]*waf_sys_proxy .*|waf_sys_proxy http://proxy.example.com:3128;|' \
/mikiri-waf-filter-nginx/mikiri-waf/filter/global/waf.conf
Scanner and MLC. The line is already present and empty: waf_sys_proxy =.
kubectl exec -n mikiri-waf POD -- sed -i \
-e 's|^#\{0,1\}[[:space:]]*waf_sys_proxy *=.*|waf_sys_proxy = http://proxy.example.com:3128|' \
/mikiri-waf-scanner/scanner.conf
For MLC the file is /mikiri-waf-mlc/mlc.conf. Leave the value empty when the agent reaches s.mikiri.ai and auth.s.mikiri.ai directly. The parameter is described in Scanner and MLC.
The same form changes any other line. Put the parameter name in place of SYS_PROXY or waf_sys_proxy, and the claim path in place of the path above. API keeps its settings in /mikiri-waf-api/settings.py. Run that command with -c api, as on the API page.
API and WMC store their data in an external PostgreSQL database. The database is not part of the Mikiri WAF images.
API connects the agents, receives incidents and vulnerabilities and writes them to the database. The image runs Nginx, Memcached, mikiri-waf-api and mikiri-waf-api-aux. The Service port is 8080.
WMC shows attacks and vulnerabilities and manages Mikiri WAF and Nginx settings. The image runs Nginx, Memcached, mikiri-waf-wmc and mikiri-waf-wmc-aux. Nginx listens on port 8080 and proxies requests to the backend on port 8000.
Filter analyzes requests and responses. The image mikirisec/mikiri-waf-filter-nginx also includes Nginx, Memcached, RabbitMQ, MLA and the API Firewall. The Service ports are 80, 443 and 5672.
MLC builds behavioral models and detects brute-force, flood and DDoS attacks. The image runs Memcached and mikiri-waf-mlc. It has no Service. It connects to API and to RabbitMQ in the Filter Pod.
Scanner rechecks blocked attacks and runs scheduled scans. The image runs the Scanner process from the image. It has no Service. It receives its settings from API.
Mikiri WAF CAPTCHA asks a blocked visitor to solve a challenge. The image runs Memcached and mikiri-waf-captcha. The Service port is 8080, reachable only inside the namespace.
On the agent page, the update command creates the Pod again from the same Deployment and the same claim, without first-launch. The tag latest is pulled when the Pod is created. Do not delete the claim.