Configuration
Plugin JSON, embedded CRS includes, metrics, and security logs
Plugin JSON
The filter is configured with a JSON object (Envoy Wasm configuration or
kubeWAF-generated ECDS payload). Shape overview:
{
"mode": "kubewaf",
"config_id": "kubewaf/shop/shop-waf",
"allow_fallback": false,
"default_directives": "default",
"directives_map": {
"default": [
"Include @kubewaf-defaults",
"SecRuleEngine On",
"SecDebugLogLevel 3",
"Include @crs-setup-conf",
"Include @owasp_crs/*.conf"
]
},
"metric_labels": {
"waf_namespace": "shop",
"waf_name": "shop-waf",
"engine": "modsecurity",
"owner": "modsecurity-proxy-wasm"
},
"metrics": {
"enabled": true,
"per_rule_id": true,
"rule_tags": true
},
"block": {
"message": "blocked by kubeWAF"
}
}| Field | Notes |
|---|---|
mode | kubewaf enables fail-closed behaviour (no silent fallback) |
config_id | Stable identity for logs / metrics |
directives_map / default_directives | Named SecLang profiles |
allow_fallback | When false (kubeWAF default), invalid config aborts startup |
metric_labels | Name-embedded Prometheus labels |
metrics | Per-rule / tag series toggles |
block.message | Body/message for blocked responses |
Schema in the operator repo: waf-plugin-config.json.
Virtual includes (embedded CRS)
CRS and helpers are baked into the wasm; load them with virtual includes (no runtime filesystem):
| Include | Purpose |
|---|---|
@kubewaf-defaults | Production body access / tmp dirs |
@demo-conf | Standalone demo overlay |
@crs-setup-conf | CRS setup |
@owasp_crs/*.conf | Full CRS rules |
Example CRS-only profile:
{
"directives_map": {
"crs": [
"Include @kubewaf-defaults",
"SecRuleEngine On",
"Include @crs-setup-conf",
"Include @owasp_crs/*.conf"
]
},
"default_directives": "crs"
}Metrics
Core series are dual-emitted as modsecurity_proxy_wasm.* and kubewaf_waf.*.
curl -s http://127.0.0.1:9901/stats/prometheus | grep -E 'modsecurity_proxy_wasm|kubewaf_waf'Security logs
Rule matches and blocks emit JSON lines:
[kubewaf][security] {"event":"tx_interrupt","config_id":"kubewaf/shop/shop-waf",...}