Image: mikirisec/mikiri-waf-wmc. Claim mount: /mikiri-waf-wmc. Nginx listens on port 8080.
The database is external PostgreSQL, configured in .env. Create it with Deploying PostgreSQL in Kubernetes before the second start. On every start that finds .env, the entrypoint runs alembic upgrade head. The namespace and the first-start rule are in Kubernetes.
first-launch. This start copies .env from .env.example, writes a random JWT_SECRET and the container exits.kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mikiri-waf-wmc
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 16Gi
---
apiVersion: v1
kind: Pod
metadata:
name: mikiri-waf-wmc-first
spec:
restartPolicy: Never
initContainers:
- name: first-launch
image: mikirisec/mikiri-waf-wmc:latest
command: ["touch", "/mikiri-waf-wmc/first-launch"]
volumeMounts:
- name: data
mountPath: /mikiri-waf-wmc
containers:
- name: wmc
image: mikirisec/mikiri-waf-wmc:latest
volumeMounts:
- name: data
mountPath: /mikiri-waf-wmc
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-wmc
EOF
kubectl wait -n mikiri-waf --for='jsonpath={.status.phase}=Succeeded' pod/mikiri-waf-wmc-first --timeout=180s
kubectl delete pod mikiri-waf-wmc-first -n mikiri-waf --wait=true
.env. Set the API address and the WMC database. Leave HOST and PORT as they are in the example (127.0.0.1 and 8000): Nginx in the image proxies to the backend on that port. Keep the generated JWT_SECRET.kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
name: mikiri-waf-wmc-edit
spec:
restartPolicy: Never
containers:
- name: edit
image: mikirisec/mikiri-waf-wmc:latest
command: ["sleep", "3600"]
volumeMounts:
- name: data
mountPath: /mikiri-waf-wmc
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-wmc
EOF
kubectl wait -n mikiri-waf --for=condition=ready pod/mikiri-waf-wmc-edit --timeout=180s
kubectl exec -n mikiri-waf mikiri-waf-wmc-edit -- sed -i \
-e 's|^API_URL=.*|API_URL="http://mikiri-waf-api:8080"|' \
-e 's|^DB_HOST=.*|DB_HOST=mikiri-waf-db|' \
-e 's|^DB_PORT=.*|DB_PORT=5432|' \
-e 's|^DB_NAME=.*|DB_NAME=wmc|' \
-e 's|^DB_USER=.*|DB_USER=wmc|' \
-e 's|^DB_PASS=.*|DB_PASS=YOUR_PASSWORD|' \
/mikiri-waf-wmc/.env
kubectl delete pod mikiri-waf-wmc-edit -n mikiri-waf --wait=true
YOUR_PASSWORD is the password of the wmc role. The command replaces the image entrypoint, so this Pod does not treat the claim as a new install. This sed does not change a commented line. SYS_PROXY is one of those lines. The command that sets it is in Editing a file in the container.
hostPort publishes container port 8080 on the node. 8081 is an example, the same host port as the Docker page. Replace it before applying the manifest. With hostIP set to 0.0.0.0, that port is open on the node that runs the Pod and stays open while the Pod runs. The node must have the port free.kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
name: mikiri-waf-wmc
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: mikiri-waf-wmc
template:
metadata:
labels:
app: mikiri-waf-wmc
spec:
containers:
- name: wmc
image: mikirisec/mikiri-waf-wmc:latest
ports:
- containerPort: 8080
hostPort: 8081
hostIP: "0.0.0.0"
readinessProbe:
exec:
command: ["/bin/sh", "-c", "test -f /tmp/on"]
periodSeconds: 5
timeoutSeconds: 2
failureThreshold: 60
volumeMounts:
- name: data
mountPath: /mikiri-waf-wmc
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-wmc
---
apiVersion: v1
kind: Service
metadata:
name: mikiri-waf-wmc
spec:
selector:
app: mikiri-waf-wmc
ports:
- port: 8080
targetPort: 8080
EOF
kubectl rollout status deployment/mikiri-waf-wmc -n mikiri-waf
kubectl exec -n mikiri-waf deploy/mikiri-waf-wmc -- \
/var/www/mikiri-waf-wmc/venv/bin/python3 -m backend createadmin 'EMAIL' 'PASSWORD'
Replace EMAIL and PASSWORD before running the command.
kubectl rollout status waits until the file /tmp/on exists. The entrypoint writes it after linking .env, running alembic upgrade head and starting the services. createadmin before that file exists does not create the administrator: the database schema is not there yet, or .env is not linked. The same command succeeds once the probe is ready, without a restart of the Pod. The working directory is /var/www/mikiri-waf-wmc. Open WMC at http://<node>:8081. <node> is an address of the node that runs the Pod, and 8081 is the hostPort from the manifest. Inside the namespace the Service is still mikiri-waf-wmc:8080.
Logs are written to /mikiri-waf-wmc/log/mikiri-waf/ (wmc.log, aux.log).
| On the claim | In the container | Contents |
|---|---|---|
.env |
/var/www/mikiri-waf-wmc/.env |
Database, JWT and API URL |
conf.d/ |
/etc/nginx/conf.d/ |
Server and upstream configuration |
snippets/ |
/etc/nginx/snippets/ |
Custom includes |
log/mikiri-waf/ |
/var/log/mikiri-waf/ |
WMC logs |
kubectl rollout restart deployment/mikiri-waf-wmc -n mikiri-waf
kubectl rollout status deployment/mikiri-waf-wmc -n mikiri-waf
Do not create first-launch again. If the package version changed, the previous claim contents are copied to old/. The working files stay in place.