Coraza Kubernetes Operator

Web Application Firewall (WAF) support for Kubernetes Gateways.

About

The Coraza Kubernetes Operator (CKO) enables declarative management of Web Application Firewalls (WAF) on Kubernetes clusters. Users can deploy firewall engines which are attached to Gateways, and rules which those engines enforce.

Coraza is used as the firewall engine.

Key Features

• Engine API - declaratively manage WAF instances
• RuleSet API - declaratively manage firewall rules
• ModSecurity Seclang compatibility

Supported Platforms

The operator is designed to run on:

• Kubernetes: v1.32+
• OpenShift Container Platform (OCP): v4.20+

Supported Integrations

The operator integrates with other tools to attach WAF instances to their gateways/proxies:

• istio - Istio integration ✅ Currently Supported (ingress Gateway only)
• wasm - WebAssembly deployment ✅ Currently Supported

Note: Only Istio+WASM is supported currently.

Architecture

RuleSet resources aggregate rules (e.g. list of ConfigMap resources containing the Seclang rules) which when then get emitted to the RuleSet cache server.

Note: Currently, only Seclang rules are supported.

The RuleSet cache contains the compiled and validated set of rules, which is pulled by Engines.

Engine resources pick a RuleSet to enforce, and attach the Coraza WAF to a Gateway, which will then enforce the configured RuleSet.

Warning: Hosting or providing any packaged rules is an explicit non-goal of this project. Users must supply their own rules.

The keys for the cache are the namespace/name of the RuleSet, allowing the compiled set of rules to be polled from a cache server hosting the cache.

Note: All RuleSets and rules are restricted to same-namespace currently.

The engine controller responds to Engine resources by deploying the Coraza engine according to the type and mode provided, and attaching it to a Gateway.

Note: For example: if the type is istio and the mode is wasm, it will attach Coraza to an Istio Gateway, loading it via a WASM module.

Engine resources target a RuleSet to indicate the firewall rules that will be applied to all Gateway traffic. Poll intervals for RuleSets can be set to enable automatic and live rule updates on running Engines.

Documentation

Documentation is available at the project documentation site.

Development

See DEVELOPMENT.md for build instructions, test suites, and the source-of-truth / generation pipeline reference.

Contributing

Contributions are welcome!

Please see the CONTRIBUTING.md guide before you get started.

License

Apache License 2.0 - see LICENSE.