kubeWAF is under active development — feedback and stars on GitHub are very welcome!
kubeWAFkubeWAF
kubeWAFmodsecurity-proxy-wasmpow-proxy-wasm

Standalone Envoy

Build and run modsecurity-proxy-wasm without Kubernetes

Build

From kubewaf-io/modsecurity-proxy-wasm:

make image && make extract-wasm
# → dist/modsecurity-proxy-wasm.wasm

Envoy filter

http_filters:
- name: envoy.filters.http.wasm
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
    config:
      vm_config:
        runtime: envoy.wasm.runtime.v8
        code:
          local:
            filename: /etc/modsecurity-proxy-wasm.wasm

Provide plugin JSON as the Wasm configuration (see Configuration).

Smoke test

podman run --rm \
  -v "$(pwd)/dist/modsecurity-proxy-wasm.wasm:/etc/modsecurity-proxy-wasm.wasm:ro" \
  -v "$(pwd)/test/fixtures/envoy.yaml:/etc/envoy.yaml:ro" \
  -p 8080:8080 envoyproxy/envoy:v1.38-latest envoy -c /etc/envoy.yaml

curl http://localhost:8080/                                      # 200
curl 'http://localhost:8080/?q=<script>alert(1)</script>'       # 403

Tests

make test-bats         # Envoy smoke
make test-regression   # CRS go-ftw
make test-unit         # waf_config

OCI artifact

make image
make extract-wasm    # → dist/modsecurity-proxy-wasm.wasm

Configuration

Plugin JSON, embedded CRS includes, metrics, and security logs

On this page

BuildEnvoy filterSmoke testTestsOCI artifactRelated