Integrate Wallarm

k get svc -n wallarm-ingress

NAME                                           TYPE           CLUSTER-IP       EXTERNAL-IP                                                                       PORT(S)                      AGE
wallarm-ingress-controller                     LoadBalancer   10.100.121.105   ac1e56aba465b4e40977ac9814095940-4023961676.elb.ap-northeast-1.samsungspc.cloud   80:32559/TCP,443:32207/TCP   4d21h
wallarm-ingress-controller-admission           ClusterIP      10.100.183.137   <none>                                                                            443/TCP                      4d21h
wallarm-ingress-controller-wallarm-tarantool   ClusterIP      10.100.129.20    <none>                                                                            3313/TCP                     4d21h

• Primary security functionality is carried out by an external load-balancer service (i.e. - the wallarm-ingress-controller service) integrated with the Wallarm cloud API

• Two additional services are created:

  • wallarm-ingress-controller-admission
  • wallarm-ingress-controller-wallarm-tarantool

Ensure the external IP of the wallarm-ingress-controller service is reachable on its listener ports:

nc -vz ac1e56aba465b4e40977ac9814095940-4023961676.elb.ap-northeast-1.samsungspc.cloud 443

Connection to ac1e56aba465b4e40977ac9814095940-4023961676.elb.ap-northeast-1.samsungspc.cloud port 443 [tcp/https] succeeded!

Deployments, replicasets, and pods #

k get deployments,replicasets,pods -n wallarm-ingress

NAME                                                           READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/wallarm-ingress-controller                     1/1     1            1           4d22h
deployment.apps/wallarm-ingress-controller-wallarm-tarantool   1/1     1            1           4d22h
NAME                                                                      DESIRED   CURRENT   READY   AGE
replicaset.apps/wallarm-ingress-controller-7bcfb684d7                     1         1         1       4d22h
replicaset.apps/wallarm-ingress-controller-wallarm-tarantool-76777844d8   1         1         1       4d22h
NAME                                                                READY   STATUS    RESTARTS   AGE
pod/wallarm-ingress-controller-7bcfb684d7-qvxmd                     4/4     Running   0          4d22h
pod/wallarm-ingress-controller-wallarm-tarantool-76777844d8-f6clk   3/3     Running   0          4d22h

• Deployments control replicasets, which in turn control pods.
• Once ingress is set up and associated with a backend service, web traffic will appear in the wallarm-ingress-controller pod logs.
• Configuration errors also show up in these logs.

IngressClass #

k get ingressclass

NAME              CONTROLLER               PARAMETERS   AGE
wallarm-ingress   k8s.io/wallarm-ingress   <none>       5d

The wallarm-ingress ingress class is installed at the cluster level. If other ingress classes are installed, ingress objects must explicitly reference this name.

Secrets #

k get secrets -n wallarm-ingress

NAME                                    TYPE                 DATA   AGE
controller-secret                       Opaque               1      5d
sh.helm.release.v1.wallarm-ingress.v1   helm.sh/release.v1   1      5d
wallarm-ingress-admission               Opaque               3      5d

• The Wallarm API token (added via UI install) is stored as a base64-encoded string in the controller-secret.
• An invalid or empty token prevents the controller pod from reaching the cloud API.

Example error log:

2025/03/29 16:38:38 [error] 167#167: *11770 WALLARM:ACL: unable to open database file. Folder paths: acl "/opt/wallarm/var/lib/wallarm-acl", mmdb "/opt/wallarm/var/lib/wallarm-acl"

Valid secret contents:

apiVersion: v1
data:
  token: <base-64-encoded-token-string>
kind: Secret
metadata:
  name: controller-secret
  namespace: wallarm-ingress
type: Opaque

Configmaps #

k get configmaps -n wallarm-ingress

NAME                         DATA   AGE
kube-root-ca.crt             1      147m
wallarm-ingress-controller   8      147m

Endpoints and endpoint slices #

k get endpoints -n wallarm-ingress

NAME                                           ENDPOINTS                                AGE
wallarm-ingress-controller                     172.18.105.208:443,172.18.105.208:8080   148m
wallarm-ingress-controller-admission           172.18.105.208:8443                      148m
wallarm-ingress-controller-wallarm-tarantool   172.18.151.117:3313                      148m

k get endpointslices -n wallarm-ingress

NAME                                                 ADDRESSTYPE   PORTS      ENDPOINTS        AGE
wallarm-ingress-controller-admission-6g7lz           IPv4          8443       172.18.105.208   149m
wallarm-ingress-controller-cljx9                     IPv4          443,8080   172.18.105.208   149m
wallarm-ingress-controller-wallarm-tarantool-74j7k   IPv4          3313       172.18.151.117   149m

Service accounts #

k get serviceaccounts -n wallarm-ingress

NAME              SECRETS   AGE
default           0         150m
wallarm-ingress   0         150m

Leases #

k get leases -n wallarm-ingress

NAME                     HOLDER                                        AGE
wallarm-ingress-leader   wallarm-ingress-controller-59c94584c7-nm955   150m

Roles and role bindings #

k get roles -n wallarm-ingress

NAME              CREATED AT
wallarm-ingress   2025-04-16T16:53:41Z

k get rolebindings -n wallarm-ingress

NAME              ROLE                   AGE
wallarm-ingress   Role/wallarm-ingress   151m

controller:
  config:
    use-forwarded-headers: "true"
    enable-real-ip: "true"
    forwarded-for-header: "X-Forwarded-For"
  ingressClass: wallarm-ingress
  ingressClassResource:
    controllerValue: k8s.io/wallarm-ingress
    name: wallarm-ingress
  service:
    enableHttp: false
  wallarm:
    apiHost: us1.api.wallarm.com
    enabled: true
    token: <wallarm-api-token>

# Seed vars; copy values.yaml contents into a file
export wallarm_ns="wallarm-ingress"
export release_name="wallarm-ingress"
export chart_version="5.3.10"

# Create namespace
kubectl create namespace ${wallarm_ns}

# Add Wallarm Helm repo
helm repo add wallarm https://charts.wallarm.com
helm repo update wallarm

# Install the Helm chart
helm install --version ${chart_version} ${release_name} wallarm/wallarm-ingress -n ${wallarm_ns}

NAME            NAMESPACE       REVISION        UPDATED                                 STATUS          CHART                   APP VERSION
wallarm-ingress wallarm-ingress 1               2025-08-15 12:03:39.970757067 -0700 PDT deployed        wallarm-ingress-5.3.10  5.3.10

NAME                                                            READY   STATUS    RESTARTS   AGE
wallarm-ingress-controller-5ffd7f9c47-zzmpx                     4/4     Running   0          3h2m
wallarm-ingress-controller-wallarm-tarantool-697d8759b6-6m954   3/3     Running   0          3h2m

Defaulted container "controller" out of: controller, cron, collectd, api-firewall, addnode (init)
-------------------------------------------------------------------------------
NGINX Ingress controller
  Release:       5.3.10
  Build:         git-2eae146
  Repository:    https://gitlab-ci-token:glcbt-64_tqU3JvjcR6hwNYkyp4TN@gl.wallarm.com/wallarm-node/ingress.git
  nginx version: nginx/1.25.5

-------------------------------------------------------------------------------

W0815 19:05:00.550209       8 client_config.go:659] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
I0815 19:05:00.550456       8 main.go:205] "Creating API client" host="https://172.20.0.1:443"
I0815 19:05:00.559729       8 main.go:248] "Running in Kubernetes cluster" major="1" minor="31" git="v1.31.7" state="clean" commit="da53587841b4960dc3bd2af1ec6101b57c79aff4" platform="linux/amd64"
I0815 19:05:00.659503       8 main.go:101] "SSL fake certificate created" file="/etc/ingress-controller/ssl/default-fake-certificate.pem"
I0815 19:05:00.677518       8 ssl.go:535] "loading tls certificate" path="/usr/local/certificates/cert" key="/usr/local/certificates/key"
I0815 19:05:00.687116       8 nginx.go:271] "Starting NGINX Ingress controller"
I0815 19:05:00.694669       8 event.go:377] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"wallarm-ingress", Name:"wallarm-ingress-controller", UID:"91fbfe7c-f1b4-4ff1-b656-062436bb8883", APIVersion:"v1", ResourceVersion:"313131", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap wallarm-ingress/wallarm-ingress-controller
I0815 19:05:01.887952       8 nginx.go:317] "Starting NGINX process"
I0815 19:05:01.888153       8 leaderelection.go:254] attempting to acquire leader lease wallarm-ingress/wallarm-ingress-leader...
I0815 19:05:01.888427       8 nginx.go:337] "Starting validation webhook" address=":8443" certPath="/usr/local/certificates/cert" keyPath="/usr/local/certificates/key"
I0815 19:05:01.888658       8 controller.go:194] "Configuration changes detected, backend reload required"
I0815 19:05:01.900746       8 leaderelection.go:268] successfully acquired lease wallarm-ingress/wallarm-ingress-leader
I0815 19:05:01.901056       8 status.go:85] "New leader elected" identity="wallarm-ingress-controller-5ffd7f9c47-zzmpx"
I0815 19:05:01.930403       8 controller.go:214] "Backend successfully reloaded"
I0815 19:05:01.930446       8 controller.go:225] "Initial sync, sleeping for 1 second"
I0815 19:05:01.930526       8 event.go:377] Event(v1.ObjectReference{Kind:"Pod", Namespace:"wallarm-ingress", Name:"wallarm-ingress-controller-5ffd7f9c47-zzmpx", UID:"fe2f20e7-199c-4e02-a4f3-7cc06046875b", APIVersion:"v1", ResourceVersion:"313364", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration

2025/08/15 18:43:51 [error] 26#26: *1294 WALLARM:ACL: unable to open database file. Folder paths: acl "/opt/wallarm/var/lib/wallarm-acl", mmdb "/opt/wallarm/var/lib/wallarm-acl", client: 127.0.0.1, server: , request: "GET /is-dynamic-lb-initialized HTTP/1.1", host: "127.0.0.1:10246"
2025/08/15 18:44:00 [error] 26#26: *1351 WALLARM:ACL: unable to open database file. Folder paths: acl "/opt/wallarm/var/lib/wallarm-acl", mmdb "/opt/wallarm/var/lib/wallarm-acl", client: 127.0.0.1, server: , request: "GET /is-dynamic-lb-initialized HTTP/1.1", host: "127.0.0.1:10246"
2025/08/15 18:44:01 [error] 26#26: *1358 WALLARM:ACL: unable to open database file. Folder paths: acl "/opt/wallarm/var/lib/wallarm-acl", mmdb "/opt/wallarm/var/lib/wallarm-acl", client: 127.0.0.1, server: , request: "GET /is-dynamic-lb-initialized HTTP/1.1", host: "127.0.0.1:10246"
2025/08/15 18:44:10 [error] 26#26: *1415 WALLARM:ACL: unable to open database file. Folder paths: acl "/opt/wallarm/var/lib/wallarm-acl",

#! /bin/bash

# reference: https://devopscube.com/create-self-signed-certificates-openssl/

if [ "$#" -ne 3 ]
then
  echo "Error: No domain name argument provided"
  echo "Usage: Provide a domain name, org, and org unit as arguments"
  exit 1
fi

DOMAIN=$1
ORG=$2
ORG_UNIT=$3

# Create root CA & Private key

openssl req -x509 \
            -sha256 -days 356 \
            -nodes \
            -newkey rsa:2048 \
            -subj "/CN=${DOMAIN}/C=US/L=San Fransisco" \
            -keyout rootCA.key -out rootCA.crt

# Generate Private key

openssl genrsa -out ${DOMAIN}.key 2048

# Create csf conf

cat > csr.conf <<EOF
[ req ]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C = US
ST = California
L = San Fransisco
O = ${ORG}
OU = ${ORG_UNIT}
CN = ${DOMAIN}

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = ${DOMAIN}
DNS.2 = www.${DOMAIN}
IP.1 = 192.168.1.5
IP.2 = 192.168.1.6

EOF

# create CSR request using private key

openssl req -new -key ${DOMAIN}.key -out ${DOMAIN}.csr -config csr.conf

# Create a external config file for the certificate

cat > cert.conf <<EOF

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = ${DOMAIN}

EOF

# Create SSl with self signed CA

openssl x509 -req \
    -in ${DOMAIN}.csr \
    -CA rootCA.crt -CAkey rootCA.key \
    -CAcreateserial -out ${DOMAIN}.crt \
    -days 365 \
    -sha256 -extfile cert.conf

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-configmap
  namespace: ingress-testing
data:
  index.html: |
    <!DOCTYPE html>
    <html>
    <head>
      <title>vCluster 'mksdp-waf-vcluster' Index Page</title>
    </head>
    <body style="background-color:powderblue">
      <h1>Hello! I am an index page from within a pod running on vCluster => "mksdp-waf-vcluster"!</h1>
    </body>
    </html>
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-defaultconf-configmap
  namespace: ingress-testing
data:
  default.conf: |
    server {
        listen       80;
        listen  [::]:80;
        server_name  localhost;

        #access_log  /var/log/nginx/host.access.log  main;

        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }

        location /vcluster/ {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }

    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  namespace: ingress-testing
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx
      namespace: ingress-testing
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        imagePullPolicy: IfNotPresent
        volumeMounts:
          - mountPath: /usr/share/nginx/html
            name: nginx-config-volume
          - mountPath: /etc/nginx/conf.d
            name: nginx-default-volume
      restartPolicy: Always
      volumes:
        - name: nginx-config-volume
          configMap:
            name: nginx-configmap
        - name: nginx-default-volume
          configMap:
            name: nginx-defaultconf-configmap
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    #cert-manager.io/cluster-issuer: kubeissuer
    kubernetes.io/ingress.class: wallarm-ingress
    nginx.ingress.kubernetes.io/rewrite-target: /
  name: ingress-demo
  namespace: ingress-testing
spec:
  ingressClassName: wallarm-ingress
  tls:
    - hosts:
        - ingress.testing.joyentqe.com
      secretName: ingress-testing-joyentqe
  rules:
    - host: ingress.testing.joyentqe.com
      http:
        paths:
          - backend:
              service:
                name: nginx-svc
                port:
                  number: 80
            path: /
            pathType: Prefix

Name:             ingress-demo
Labels:           <none>
Namespace:        ingress-testing
Address:          ac1e56aba465b4e40977ac9814095940-4023961676.elb.ap-northeast-1.samsungspc.cloud
Ingress Class:    wallarm-ingress
Default backend:  <default>
TLS:
  ingress-testing-joyentqe terminates ingress.testing.joyentqe.com
Rules:
  Host                          Path  Backends
  ----                          ----  --------
  ingress.testing.joyentqe.com
                                /   nginx-svc:80
Annotations:                    kubernetes.io/ingress.class: wallarm-ingress
                                nginx.ingress.kubernetes.io/rewrite-target: /
Events:                         <none>

Test connectivity:

curl -kiX GET "https://ingress.testing.joyentqe.com/"

<!DOCTYPE html>
<html>
<head>
  <title>vCluster 'mksdp-waf-vcluster' Index Page</title>
</head>
<body style="background-color:powderblue">
  <h1>Hello! I am an index page from within a pod running on vCluster => "mksdp-waf-vcluster"!</h1>
</body>
</html>