Supercharge K8s Security: SafeLine WAF + Ingress-nginx

cd /data/safeline/resources/detector/

bind_addr: 0.0.0.0
listen_port: 8000

cd /data/safeline

......
detect:
    ......
    ports:
    - 8000:8000
......

docker compose down
docker compose up -d

cat 

kubectl create namespace ingress-nginx
kubectl apply -f safeline.yaml

curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

cat 

helm upgrade --install ingress-nginx ingress-nginx --repo https://kubernetes.github.io/ingress-nginx --namespace ingress-nginx --create-namespace -f ingress-nginx-values.yaml

cat EOF | sudo tee safeline-test.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: safeline-test

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  namespace: safeline-test
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: registry.cn-shanghai.aliyuncs.com/kubesec/nginx:1.14.2
        ports:
        - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
  name: nginx
  namespace: safeline-test
spec:
  selector:
    app: nginx
  type: NodePort
  ports:
    - name: http
      protocol: TCP
      nodePort: 30080
      port: 80
      targetPort: 80

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx
  namespace: safeline-test
spec:
  ingressClassName: nginx
  rules:
  - host: www.safeline-test.org
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF

kubectl create -f safeline-test.yaml

curl http://www.safeline-test.org/ -H "Host: example.com" -H "User-Agent: () { :; }; echo; echo; /bin/bash -c 'echo hello'"

{
  "code": 403,
  "success": false,
  "message": "blocked by Chaitin SafeLine Web Application Firewall",
  "event_id": "009efd8d2bf44a07b5cb7ed4cf18fb84"
}

docker pull registry.cn-shanghai.aliyuncs.com/kubesec/chaitin-blazehttp:v0.2.0
docker run --rm --net=host registry.cn-shanghai.aliyuncs.com/kubesec/chaitin-blazehttp:v0.2.0 /app/blazehttp -t http://www.safeline-test.org/

sending 100% |██████████████████████████████| (33677/33677, 1160 it/s) [29s:0s]
Total samples: 33677    Success: 33677    Errors: 0
Detection rate: 83.87% (Total malicious samples: 558, Correctly blocked: 468, Missed: 90)
False positive rate: 0.07% (Total benign samples: 33119, Correctly allowed: 33096, False positives: 23)
Accuracy: 99.66% (Correctly blocked + Correctly allowed) / Total samples
Average response time: 8.47 ms