coraza-kubernetes-operator

module

v0.3.0 Latest Latest Go to latest Published: Mar 19, 2026 License: Apache-2.0

README ¶

RELEASE

Coraza Kubernetes Operator

Web Application Firewall (WAF) support for Kubernetes Gateways.

About

The Coraza Kubernetes Operator (CKO) enables declarative management of Web Application Firewalls (WAF) on Kubernetes clusters. Users can deploy firewall engines which are attached to Gateways, and rules which those engines enforce.

Coraza is used as the firewall engine.

Key Features

Engine API - declaratively manage WAF instances
RuleSet API - declaratively manage firewall rules
ModSecurity Seclang compatibility

Supported Platforms

The operator is designed to run on:

Kubernetes: v1.33+
OpenShift Container Platform (OCP): v4.20+

Supported Integrations

The operator integrates with other tools to attach WAF instances to their gateways/proxies:

istio - Istio integration ✅ Currently Supported (ingress Gateway only)
wasm - WebAssembly deployment ✅ Currently Supported

Note: Only Istio+WASM is supported currently.

Architecture

The CKO's ruleset controller responds to RuleSet resources by validating and compiling the rules (e.g. list of ConfigMap resources containing the Seclang rules), which gets emitted to the RuleSet cache.

Note: Currently, only Seclang rules are supported.

Warning: Hosting or providing any packaged rules is an explicit non-goal of this project. Users must supply their own rules.

The keys for the cache are the namespace/name of the RuleSet, allowing the compiled set of rules to be polled from a cache server hosting the cache.

Note: All RuleSets and rules are restricted to same-namespace currently.

The engine controller responds to Engine resources by deploying the Coraza engine according to the type and mode provided, and attaching it to a Gateway.

Note: For example: if the type is istio and the mode is wasm, it will attach Coraza to an Istio Gateway, loading it via a WASM module.

Engine resources target a RuleSet to indicate the firewall rules that will be applied to all Gateway traffic. Poll intervals for RuleSets can be set to enable automatic and live rule updates on running Engines.

Documentation

Documentation is available in the wiki.

Development

See DEVELOPMENT.md for build instructions, test suites, and the source-of-truth / generation pipeline reference.

Contributing

Contributions are welcome!

See CONTRIBUTING.md.

License

Apache License 2.0 - see LICENSE.

Directories ¶

Path	Synopsis
api
v1alpha1 Package v1alpha1 contains API Schema definitions for the waf v1alpha1 API group.	Package v1alpha1 contains API Schema definitions for the waf v1alpha1 API group.
cmd
internal
controller Package controller implements Kubernetes controllers for WAF resources.	Package controller implements Kubernetes controllers for WAF resources.
rulesets/cache Package cache provides in-memory caching for WAF rulesets.	Package cache provides in-memory caching for WAF rulesets.
pkg
utils Package utils implements functions shared by multiple parts of the project	Package utils implements functions shared by multiple parts of the project
test
framework Package framework provides integration test utilities for the Coraza Kubernetes Operator.	Package framework provides integration test utilities for the Coraza Kubernetes Operator.
utils Package utils provides testing utilities for integration and unit tests.	Package utils provides testing utilities for integration and unit tests.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL