Install ToutWAF on Kubernetes
Deploy the data plane with the Helm chart (or plain manifests, or as a sidecar), with a control plane in the cluster if you want one: install, check, upgrade and uninstall.
Which version you install
The public version is a development version, named 0.3.0-dev. Its name stays the same: each publication replaces the previous one, and a build identifier tells two builds apart. No stable version exists yet: it will only be published once every system and package has been tested end to end. The commands on this page therefore install from the dev channel. A development version can contain bugs: try it on a test site before relying on it.
At a glance
- Kubernetes 1.25 or later. The data plane is deployed as a Deployment or a DaemonSet, stateless; the policy comes from Helm values (a hot-reloaded ConfigMap) or from a control plane.
- Pods run unprivileged (user 65532), with a read-only root filesystem, all capabilities dropped and the RuntimeDefault seccomp profile.
- The chart, the manifests and the sidecar example are in the deploy folder of your ToutWAF distribution, not in the public repository.
- The in-cluster control plane is a single instance with SQLite (PostgreSQL is not implemented).
The commands, step by step
Install with Helm
Deploys the data plane as an ingress, with a control plane in the cluster if you want one. The chart and the manifests (sidecar mode included) are in the deploy folder of your ToutWAF distribution, not in the public repository, which holds binaries and installers only. The operator is CRDs and a skeleton.
helm install toutwaf ./deploy/helm/toutwaf --namespace toutwaf --create-namespace -f my-values.yamlCheck the pods and open the console
kubectl -n toutwaf get pods
kubectl -n toutwaf port-forward svc/toutwaf-cp 9443:9443Upgrade (containers)
Take a backup first. The Update button of the console cannot work in a container: replace the binaries in the bin folder (or the image, once one is published) and rebuild; the volumes, so your data, are kept.
helm upgrade toutwaf ./deploy/helm/toutwaf --namespace toutwaf -f my-values.yamlUninstall
The first block removes the services, the binaries and the firewall rules added by ToutWAF, and keeps your data. The second one also deletes configuration, data and logs.
helm uninstall toutwaf --namespace toutwafkubectl delete namespace toutwafWhat is not verified
We prefer to say it plainly.
- The Kubernetes operator is a skeleton: the resource definitions (CRDs), the RBAC and a translation library exist, but no controller binary or operator image is published. Use the Helm “standalone” policy source or a control plane.
- The resource sizes in the sidecar example are example values, not a sizing guarantee.