Image: mikirisec/mikiri-waf-mlc. Claim mount: /mikiri-waf-mlc. The image does not listen on a port.
Deploy the API and the Filter first. MLC reads the API address and the RabbitMQ address from mlc.conf. The parameters are described in MLC. The namespace and the first-start rule are in Kubernetes.
first-launch. This start copies mlc.conf into the claim and the container exits.kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mikiri-waf-mlc
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 25Gi
---
apiVersion: v1
kind: Pod
metadata:
name: mikiri-waf-mlc-first
spec:
restartPolicy: Never
initContainers:
- name: first-launch
image: mikirisec/mikiri-waf-mlc:latest
command: ["touch", "/mikiri-waf-mlc/first-launch"]
volumeMounts:
- name: data
mountPath: /mikiri-waf-mlc
containers:
- name: mlc
image: mikirisec/mikiri-waf-mlc:latest
volumeMounts:
- name: data
mountPath: /mikiri-waf-mlc
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-mlc
EOF
kubectl wait -n mikiri-waf --for='jsonpath={.status.phase}=Succeeded' pod/mikiri-waf-mlc-first --timeout=180s
kubectl delete pod mikiri-waf-mlc-first -n mikiri-waf --wait=true
mlc.conf. USER and RABBITMQ_PASSWORD are the login and password values in rabbitmq_password.kubectl exec -n mikiri-waf deploy/mikiri-waf-filter-nginx -- cat /mikiri-waf-filter-nginx/rabbitmq_password
kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
name: mikiri-waf-mlc-edit
spec:
restartPolicy: Never
containers:
- name: edit
image: mikirisec/mikiri-waf-mlc:latest
command: ["sleep", "3600"]
volumeMounts:
- name: data
mountPath: /mikiri-waf-mlc
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-mlc
EOF
kubectl wait -n mikiri-waf --for=condition=ready pod/mikiri-waf-mlc-edit --timeout=180s
kubectl exec -n mikiri-waf mikiri-waf-mlc-edit -- sed -i \
-e 's|^waf_product_key *=.*|waf_product_key = YOUR_KEY|' \
-e 's|^waf_api_url *=.*|waf_api_url = http://mikiri-waf-api:8080|' \
-e 's|^waf_rabbitmq *=.*|waf_rabbitmq = USER:RABBITMQ_PASSWORD@mikiri-waf-filter-nginx:5672/|' \
/mikiri-waf-mlc/mlc.conf
kubectl delete pod mikiri-waf-mlc-edit -n mikiri-waf --wait=true
Replace YOUR_KEY, USER and RABBITMQ_PASSWORD before running sed. A proxy in front of API is the waf_api_proxy line in integration with API. The sed above leaves waf_sys_proxy empty. The command that sets it is in Editing a file in the container.
kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
name: mikiri-waf-mlc
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: mikiri-waf-mlc
template:
metadata:
labels:
app: mikiri-waf-mlc
spec:
containers:
- name: mlc
image: mikirisec/mikiri-waf-mlc:latest
volumeMounts:
- name: data
mountPath: /mikiri-waf-mlc
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-mlc
EOF
kubectl rollout status deployment/mikiri-waf-mlc -n mikiri-waf
Logs are written to /mikiri-waf-mlc/log/mikiri-waf/.
| On the claim | In the container | Contents |
|---|---|---|
mlc.conf |
/etc/mikiri-waf-mlc/mlc.conf |
Main configuration |
mtp/ |
/etc/mikiri-waf-mlc/mtp/ |
MTP |
lib/mikiri-waf-mlc/ |
/var/lib/mikiri-waf-mlc/ |
Models and training-sample backups |
log/mikiri-waf/ |
/var/log/mikiri-waf/ |
MLC logs |
kubectl rollout restart deployment/mikiri-waf-mlc -n mikiri-waf
kubectl rollout status deployment/mikiri-waf-mlc -n mikiri-waf
Do not create first-launch again. If the package version changed, the previous claim contents are copied to old/. The working files stay in place.