Kubernetes
Deploy the data plane with the Helm chart (or plain manifests, or as a sidecar), with a control plane in the cluster if you want one: install, check, upgrade and uninstall.
您安装的是哪个版本
目前公开的是名为 0.3.0-dev 的开发版。名称保持不变：每次发布都会替换上一次，并用构建编号区分两个构建。尚无稳定版：只有在每个系统和每个软件包都完成端到端测试之后，才会发布稳定版。因此本页的命令从 dev 通道安装。开发版可能存在缺陷：在依赖它之前，请先在测试站点上试用。
At a glance
- Kubernetes 1.25 or later. The data plane is deployed as a Deployment or a DaemonSet, stateless; the policy comes from Helm values (a hot-reloaded ConfigMap) or from a control plane.
- Pods run unprivileged (user 65532), with a read-only root filesystem, all capabilities dropped and the RuntimeDefault seccomp profile.
- The chart, the manifests and the sidecar example are in the deploy folder of your ToutWAF distribution, not in the public repository.
- The in-cluster control plane is a single instance with SQLite (PostgreSQL is not implemented).
The commands, step by step
使用 Helm 安装
把数据平面部署为 ingress，需要时可在集群内部署控制平面。Chart 和清单文件（含 sidecar 模式）位于您的 ToutWAF 发行包的 deploy 文件夹中，而不在公开仓库里，公开仓库只有程序文件和安装程序。运算符目前只有 CRD 和骨架。
bash
helm install toutwaf ./deploy/helm/toutwaf --namespace toutwaf --create-namespace -f my-values.yaml检查 Pod 并打开控制台
bash
kubectl -n toutwaf get pods
kubectl -n toutwaf port-forward svc/toutwaf-cp 9443:9443升级（容器）
请先做备份。控制台里的更新按钮在容器中无法工作：请替换 bin 文件夹中的二进制文件（待发布镜像后则替换镜像）并重新构建；数据卷即您的数据会被保留。
bash
helm upgrade toutwaf ./deploy/helm/toutwaf --namespace toutwaf -f my-values.yaml卸载
第一段命令移除服务、二进制文件以及 ToutWAF 添加的防火墙规则，并保留您的数据。第二段还会删除配置、数据和日志。
bash
helm uninstall toutwaf --namespace toutwafpurge
kubectl delete namespace toutwafWhat is not verified
We prefer to say it plainly.
- The Kubernetes operator is a skeleton: the resource definitions (CRDs), the RBAC and a translation library exist, but no controller binary or operator image is published. Use the Helm “standalone” policy source or a control plane.
- The resource sizes in the sidecar example are example values, not a sizing guarantee.