Image: mikirisec/mikiri-waf-captcha. Claim mount: /mikiri-waf-captcha. Service port: 8080.
The image runs Memcached and Gunicorn from mikiri-waf-captcha. Challenge sessions stay in Memcached inside the container. Deploy the Filter in the same namespace. The exchange is described in Integrating with CAPTCHA. The namespace and the first-start rule are in Kubernetes.
first-launch. This start copies init.py into the claim, changes bind from 127.0.0.1:8080 to 0.0.0.0:8080 and the container exits.kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mikiri-waf-captcha
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
---
apiVersion: v1
kind: Pod
metadata:
name: mikiri-waf-captcha-first
spec:
restartPolicy: Never
initContainers:
- name: first-launch
image: mikirisec/mikiri-waf-captcha:latest
command: ["touch", "/mikiri-waf-captcha/first-launch"]
volumeMounts:
- name: data
mountPath: /mikiri-waf-captcha
containers:
- name: captcha
image: mikirisec/mikiri-waf-captcha:latest
volumeMounts:
- name: data
mountPath: /mikiri-waf-captcha
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-captcha
EOF
kubectl wait -n mikiri-waf --for='jsonpath={.status.phase}=Succeeded' pod/mikiri-waf-captcha-first --timeout=180s
kubectl delete pod mikiri-waf-captcha-first -n mikiri-waf --wait=true
mikiri-waf-captcha. The Service is reachable in the namespace as mikiri-waf-captcha:8080.kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
name: mikiri-waf-captcha
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: mikiri-waf-captcha
template:
metadata:
labels:
app: mikiri-waf-captcha
spec:
containers:
- name: captcha
image: mikirisec/mikiri-waf-captcha:latest
ports:
- containerPort: 8080
volumeMounts:
- name: data
mountPath: /mikiri-waf-captcha
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-captcha
---
apiVersion: v1
kind: Service
metadata:
name: mikiri-waf-captcha
spec:
selector:
app: mikiri-waf-captcha
ports:
- port: 8080
targetPort: 8080
EOF
kubectl rollout status deployment/mikiri-waf-captcha -n mikiri-waf
waf_ban_captcha_url to http://mikiri-waf-captcha:8080. The other options are described in Connecting the filter. A later change to init.py on the claim uses the command in Editing a file in the container.Logs are in log/mikiri-waf/captcha/.
| On the claim | In the container | Contents |
|---|---|---|
init.py |
/var/www/mikiri-waf-captcha/init.py |
Listen address and worker count |
log/mikiri-waf/ |
/var/log/mikiri-waf/ |
api.log and error.log |
version |
— | Git revision built into the image |
The Python virtual environment and the application code stay in the image. Memcached data is not stored: a challenge lives for 60 seconds.
kubectl rollout restart deployment/mikiri-waf-captcha -n mikiri-waf
kubectl rollout status deployment/mikiri-waf-captcha -n mikiri-waf
Do not create first-launch again. If the git revision changed, the previous claim contents are copied to old/. The working files stay in place.