Mikiri WAF does not publish its own PostgreSQL image. Use the official postgres image, or an existing PostgreSQL server. The steps below use PostgreSQL 17 in the namespace mikiri-waf from the Kubernetes page.
YOUR_PASSWORD is the password of the PostgreSQL superuser. Do not use this example password. A new claim is empty, which is what the first start requires. The image runs as user postgres (uid 999). fsGroup makes the claim writable by that user. PGDATA is a subdirectory, so a lost+found directory on the claim does not stop initialization.kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mikiri-waf-db
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 30Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: mikiri-waf-db
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: mikiri-waf-db
template:
metadata:
labels:
app: mikiri-waf-db
spec:
securityContext:
fsGroup: 999
containers:
- name: postgres
image: postgres:17
env:
- name: POSTGRES_PASSWORD
value: YOUR_PASSWORD
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
ports:
- containerPort: 5432
volumeMounts:
- name: data
mountPath: /var/lib/postgresql/data
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-db
---
apiVersion: v1
kind: Service
metadata:
name: mikiri-waf-db
spec:
selector:
app: mikiri-waf-db
ports:
- port: 5432
targetPort: 5432
EOF
kubectl rollout status deployment/mikiri-waf-db -n mikiri-waf
Other Pods in the namespace reach the database as mikiri-waf-db on port 5432. The Service is not published outside the cluster.
kubectl exec without a password.API
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -c "CREATE DATABASE api;"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -c "CREATE ROLE api PASSWORD 'YOUR_PASSWORD';"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -c "GRANT ALL ON DATABASE api TO api;"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -c "ALTER ROLE api WITH LOGIN;"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -d api -c "GRANT ALL ON ALL TABLES IN SCHEMA public TO api;"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -d api -c "GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO api;"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -d api -c "GRANT CREATE ON SCHEMA public TO api;"
WMC
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -c "CREATE DATABASE wmc;"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -c "CREATE ROLE wmc PASSWORD 'YOUR_PASSWORD';"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -c "GRANT ALL ON DATABASE wmc TO wmc;"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -c "ALTER ROLE wmc WITH LOGIN;"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -d wmc -c "GRANT ALL ON ALL TABLES IN SCHEMA public TO wmc;"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -d wmc -c "GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO wmc;"
kubectl exec -n mikiri-waf deploy/mikiri-waf-db -- psql -U postgres -d wmc -c "GRANT CREATE ON SCHEMA public TO wmc;"
Use a different password for each role. In the agent configuration, set the database host to mikiri-waf-db and the port to 5432.
kubectl rollout restart deployment/mikiri-waf-db -n mikiri-waf
kubectl rollout status deployment/mikiri-waf-db -n mikiri-waf
Keep the claim. POSTGRES_PASSWORD is applied only when the data directory is initialized. An existing claim keeps the password that was set on the first start.