kubeWAF is under active development — feedback and stars on GitHub are very welcome!
kubeWAFkubeWAF
kubeWAFmodsecurity-proxy-wasmpow-proxy-wasm

Troubleshooting

Filter-level symptoms for pow-proxy-wasm

SymptomCheck
Filter never loads / Envoy logs config failsecret missing or < 32 bytes
Always 403 challenge pageCookies blocked; clock skew; IP context changed between issue and solve
Works then re-challenges after ~30 minClearance expired — expected
Works then re-challenges after ~60s without clearanceClearance not set (response path); check logs for generate errors
Context mismatch in logsClient IP changed (XFF vs direct); normalize hop trust
Too hard / too easy for usersTune base_difficulty / min / max; watch dynamic tick logs

When deployed by kubeWAF, also check: