This content originally appeared on DEV Community and was authored by Lulu
As I’ve been learning Kubernetes, I decided to practice by deploying SafeLine Community Edition. Here’s a detailed breakdown of the steps I followed.
Environment Setup
- OS: Ubuntu 22.04
- Specs: 2C8G
- Disk: 40G
- Tools: Minikube v1.31.1
Configuration Files
The configuration files are based on YAML generated by the kompose tool, with some modifications. They consist of two parts: the WAF's core running module configuration and the database configuration. Since there is no persistent data configuration in the default database setup, you can modify the configuration (Steps 1 and 2) if you have your own database cluster.
First, download the configuration files and move them to the appropriate directory:
tar -xzvf safeline-ce-k8s-configs.tar.gz
tar -xzvf safeline-ce-k8s-db.tar.gz
Step 1: Upload Images
You need to upload the offline images to your Docker registry and then load them into your Minikube cluster using the following script:
minikube image load chaitin/safeline-tengine \
chaitin/safeline-mgt-api \
chaitin/safeline-mario \
chaitin/safeline-detector
After running the script, you can check the images using minikube image ls.
Step 2: Modify Database Information
1.Open the management-deployment.yaml file. Replace safeline-ce:${POSTGRES_PASSWORD} with your database username and password. Update the part after @safeline-postgres with the domain name of your PostgreSQL service within the K8s cluster.
2.Open the mario-deployment.yaml file. Similarly, replace safeline-ce:${POSTGRES_PASSWORD} and ${REDIS_PASSWORD} with the correct database information, and replace the domain name accordingly.
3.If you don't have an existing database, you can use the provided test database configuration (for testing purposes only). Generate random passwords using the following script:
echo "POSTGRES_PASSWORD=$(LC_ALL=C tr -dc A-Za-z0-9 </dev/urandom | head -c 32)" >> .env
echo "REDIS_PASSWORD=$(LC_ALL=C tr -dc A-Za-z0-9 </dev/urandom | head -c 32)" >> .env
cat .env
Then, open the postgres-deployment.yaml and redis-deployment.yaml files, and replace the corresponding passwords.
- postgres-deployment:
- redis-deployment:
Step 3: Start Containers
Make sure your database is up and running before starting the WAF. To apply all configurations, run:
# Navigate to the configuration file directory
cd safeline-ce-k8s-configs
bash ./start.sh
To check the status of your pods, run:
kubectl get all
Step 4: Testing
First, you can start a test server by running the following command in the SafeLine configuration directory:
kubectl apply -f test-server.yaml
This server runs a simple Python HTTP server on port 8089. In the configuration, a node port (30007) is opened for external access.
Open the management-deployment.yaml file and check the user-port section under nodePort, which you can modify or leave to be automatically assigned by K8s.
Next, run kubectl get node -o wide to get the IP address of the node. You can then access the WAF management interface at http://<node-ip>:30018.
For direct access to internal ports (e.g., management on port 9443), use port forwarding:
kubectl port-forward service/safeline-management 9440:9443
Now, in a new terminal, you can access the interface at http://localhost:9440.
You can configure the site after opening the administration page：
Final Thoughts
While the proxy was successfully set up, initial attack tests showed that Tengine failed to forward traffic to the detector, meaning attack signatures weren’t intercepted. This likely stems from misconfigurations within Tengine’s internal Nginx setup.
This content originally appeared on DEV Community and was authored by Lulu
Lulu | Sciencx (2024-09-10T06:30:03+00:00) Deploying the Free WAF SafeLine on Kubernetes. Retrieved from https://www.scien.cx/2024/09/10/deploying-the-free-waf-safeline-on-kubernetes/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.