Image: mikirisec/mikiri-waf-scanner. Claim mount: /mikiri-waf-scanner. The image does not listen on a port.
The process is recheck.pyc from the image. It rechecks attacks and runs the scheduled scan through main.pyc. Settings are loaded from API. Deploy the API first. The namespace and the first-start rule are in Kubernetes.
first-launch. This start copies scanner.conf into the claim, deletes first-launch and the container exits.kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mikiri-waf-scanner
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 16Gi
---
apiVersion: v1
kind: Pod
metadata:
name: mikiri-waf-scanner-first
spec:
restartPolicy: Never
initContainers:
- name: first-launch
image: mikirisec/mikiri-waf-scanner:latest
command: ["touch", "/mikiri-waf-scanner/first-launch"]
volumeMounts:
- name: data
mountPath: /mikiri-waf-scanner
containers:
- name: scanner
image: mikirisec/mikiri-waf-scanner:latest
volumeMounts:
- name: data
mountPath: /mikiri-waf-scanner
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-scanner
EOF
kubectl wait -n mikiri-waf --for='jsonpath={.status.phase}=Succeeded' pod/mikiri-waf-scanner-first --timeout=180s
kubectl delete pod mikiri-waf-scanner-first -n mikiri-waf --wait=true
sed below leaves waf_sys_proxy empty. The command that sets it is in Editing a file in the container.kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
name: mikiri-waf-scanner-edit
spec:
restartPolicy: Never
containers:
- name: edit
image: mikirisec/mikiri-waf-scanner:latest
command: ["sleep", "3600"]
volumeMounts:
- name: data
mountPath: /mikiri-waf-scanner
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-scanner
EOF
kubectl wait -n mikiri-waf --for=condition=ready pod/mikiri-waf-scanner-edit --timeout=180s
kubectl exec -n mikiri-waf mikiri-waf-scanner-edit -- sed -i \
-e 's|^waf_product_key *=.*|waf_product_key = YOUR_KEY|' \
-e 's|^waf_api_url *=.*|waf_api_url = http://mikiri-waf-api:8080|' \
/mikiri-waf-scanner/scanner.conf
kubectl delete pod mikiri-waf-scanner-edit -n mikiri-waf --wait=true
Replace YOUR_KEY with the license key before running sed.
kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
name: mikiri-waf-scanner
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: mikiri-waf-scanner
template:
metadata:
labels:
app: mikiri-waf-scanner
spec:
containers:
- name: scanner
image: mikirisec/mikiri-waf-scanner:latest
volumeMounts:
- name: data
mountPath: /mikiri-waf-scanner
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-scanner
EOF
kubectl rollout status deployment/mikiri-waf-scanner -n mikiri-waf
Logs are written to /mikiri-waf-scanner/log/mikiri-waf/. The files scanner.pid and recheck.pid in tmp/ are removed on every start. The classic scan schedule is kept in memory and is not stored on the claim.
| On the claim | In the container | Contents |
|---|---|---|
scanner.conf |
/etc/mikiri-waf-scanner/scanner.conf |
Main configuration |
db/ |
/etc/mikiri-waf-scanner/db/ |
Scanner settings cached from the API |
tmp/ |
/etc/mikiri-waf-scanner/tmp/ |
Process identifiers scanner.pid and recheck.pid |
log/mikiri-waf/ |
/var/log/mikiri-waf/ |
Scanner logs |
version |
— | Package version recorded from the image |
kubectl rollout restart deployment/mikiri-waf-scanner -n mikiri-waf
kubectl rollout status deployment/mikiri-waf-scanner -n mikiri-waf
Do not create first-launch again. If the package version changed, the previous claim contents are copied to old/. The working files stay in place.