非常感谢长亭科技发布的优秀产品--长亭雷池社区版，产品很好用，但是目前仅支持单机 Docker 部署方式，本文将介绍如何通过手动 DIY 改造，使雷池社区版支持在 K8s 中进行部署。
系统: CentOS Linux release 7.9.2009
内核: 3.10.0-1160.92.1.el7.x86_64
Kubernetes 版本: v1.24.15
safeline-ce 版本: 2.1.2
首先非常感谢长亭科技开源的优秀产品--长亭雷池 WAF
根据官方提供的 compose.yaml 文件，自己做了一份 K8s pod 运行所需要的各个服务配置（详见附件 safeline-ce-k8s-yaml.zip），直接加载并启动相关 pod 即可。
1[root@master safeline-ce]# kubectl get pods,svc,pvc -n waf -o wide 2NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES 3pod/safeline-detector-54bfb6f99c-gtlmt 1/1 Running 0 12m 100.100.246.231 master.k8s.local 4pod/safeline-mario-779b744447-zq5tc 1/1 Running 0 12m 100.109.175.106 worker01.k8s.local 5pod/safeline-mgt-api-5d65b8b49-txv4f 1/1 Running 0 6m33s 192.168.5.6 master.k8s.local 6pod/safeline-tengine-684cff57fb-rtb6m 1/1 Running 0 12m 192.168.5.8 worker02.k8s.local 7 8NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR 9service/safeline-detector ClusterIP 10.96.0.142 8000/TCP,8001/TCP 12m app=safeline-detector,component=secure 10service/safeline-mario ClusterIP 10.96.3.131 3335/TCP 12m app=safeline-mario,component=secure 11service/safeline-mgt-api ClusterIP 10.96.2.16 1443/TCP,9002/TCP 15m app=safeline-mgt-api,component=secure 12service/safeline-tengine ClusterIP 10.96.3.135 65443/TCP 12m app=safeline-tengine,component=secure 13 14NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE VOLUMEMODE 15persistentvolumeclaim/mgr-api-certs Bound pvc-0af5dcfb-a3ee-4124-93fa-a437f7addc48 5Mi RWX nfs-based-cstor-storage 15m Filesystem 16persistentvolumeclaim/mgr-api-logs Bound pvc-70b5e5d7-b1b1-4b14-ab00-c311a638cf07 500Mi RWO nfs-based-cstor-storage 15m Filesystem 17persistentvolumeclaim/mgr-api-nginx-conf Bound pvc-f6a3bfc7-5354-4897-8719-a03fec03f301 5Mi RWX nfs-based-cstor-storage 15m Filesystem 18persistentvolumeclaim/safeline-detector-data Bound pvc-1747736b-efb3-4c32-938a-c3992c76a041 1Gi RWX nfs-based-cstor-storage 12m Filesystem 19persistentvolumeclaim/safeline-detector-logs Bound pvc-0f11ca46-9602-431b-89c7-c2bb3c080f8a 500Mi RWO nfs-based-cstor-storage 12m Filesystem 20persistentvolumeclaim/safeline-mario-data Bound pvc-92eb78d6-4088-490e-9506-6f4dc0fc6871 10Mi RWO nfs-based-cstor-storage 12m Filesystem 21persistentvolumeclaim/safeline-mario-logs Bound pvc-5c6d3f20-032d-4966-b706-d97b537de1ad 500Mi RWO nfs-based-cstor-storage 12m Filesystem 22persistentvolumeclaim/safeline-tengine-cache Bound pvc-429ba174-8c7d-4441-a15a-3d9ab4e744ec 100Mi RWO nfs-based-cstor-storage 12m Filesystem 23persistentvolumeclaim/safeline-tengine-logs Bound pvc-68cb31d2-54d0-4274-9365-e9b3aeff3193 500Mi RWO nfs-based-cstor-storage 12m Filesystem
进入 safeline-mgt-api 容器的 /app/nginx 目录下，修改 nginx.conf 中 postgres 的外部服务地址（大概在67行）
1upstream postgres { 2 #server safeline-postgres:5432; 3 # 注意替换成自己 K8s 集群的 postgres 地址 4 server postgresql-hl.middleware:5432; 5}
修改完成 postgresql 地址后，supervisorctl restart nginx 重启 nginx 服务，并通过 supervisorctl status 确认 nginx 服务的运行状态
1root@worker01:/app/nginx# supervisorctl status 2nginx RUNNING pid 391, uptime 0:11:20 3webserver RUNNING pid 49, uptime 0:17:02
进入 safeline-mario 容器的 /mario 目录下，修改 config.yml 中的 pg 连接地址，基于运行的容器 docker commit 一个新的镜像，然后修改 deployment 镜像地址后重启服务.
1handler:
2 plumber: {}
3 persistence:
4 postgres:
5 # 注意替换成自己 K8s 集群的 postgres 地址和密码
6 url: postgres://safeline-ce:@postgresql-hl.middleware:5432/safeline-ce
由于 safeline-ce 是部署在 k8s 上的，每个 pod 位于不同的网络命名空间下，所以 safeline-detector 和 safeline-tengine 之间无法通过 domain unix sock 进行通信，只能通过网络 socket 通信（即以 IP + 端口的方式通信）。
进入 safeline-detector 容器的 /resources/detector 目录，将修改 snserver.yml 中的配置，如下所示:
1fusion_sofile: ./config/libfusion2.so
2ip_location_db: ./GeoLite2-City.mmdb
3bind_addr: unix:///resources/detector/snserver.sock
4# bind_addr: 0.0.0.0
5# listen_port: 8000
6health_check_addr: 0.0.0.0
7health_check_port: 8001
8mgt_server_addr: ""
9log: file:///logs/detector/snserver.log
10log_level: warning
11# worker: 4
12daemon: false
13heartbeat_interval: 5000
14max_queue_size: 16384
15rlimit_nofile: 65536
16web_log_interval: 400
17web_log: http://safeline-mario:3335/log/envelop
1fusion_sofile: ./config/libfusion2.so
2ip_location_db: ./GeoLite2-City.mmdb
3#bind_addr: unix:///resources/detector/snserver.sock
4bind_addr: 0.0.0.0
5listen_port: 8000
6health_check_addr: 0.0.0.0
7health_check_port: 8001
8mgt_server_addr: safeline-mgt-api:9002
9log: file:///logs/detector/snserver.log
10log_level: warning
11# worker: 4
12daemon: false
13heartbeat_interval: 5000
14max_queue_size: 16384
15rlimit_nofile: 65536
16web_log_interval: 400
17web_log: http://safeline-mario:3335/log/envelop
重新加载配置
1kill -1 1
查看服务端口信息
1root@safeline-detector-5975fd46f-ksggn:/resources/detector# netstat -nplt 2Active Internet connections (only servers) 3Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name 4tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN - 5tcp 0 0 0.0.0.0:8001 0.0.0.0:* LISTEN -
进入 safeline-tengine 容器下的 /root/nginx 目录，修改 nginx.conf
修改前：
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/generated;
include /etc/nginx/sites-enabled/IF_*;
include /etc/nginx/safeline_unix.conf; # 修改前使用 domain unix sock 模式
修改后：
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/generated;
include /etc/nginx/sites-enabled/IF_*;
#include /etc/nginx/safeline_unix.conf;
include /etc/nginx/safeline.conf; # 修改后使用网络 socket 模式
进入 /root/tcontrollerd 目录下修改 config.yml
修改前：
1log:
2 output: /var/log/nginx/tcd.log # "stdout", "stderr" or file path
3 level: info # "debug", "info", "warn" or "error"
4mgt_addr: 169.254.0.2:9002
修改后：
1log:
2 output: /var/log/nginx/tcd.log # "stdout", "stderr" or file path
3 level: info # "debug", "info", "warn" or "error"
4mgt_addr: safeline-mgt-api:9002
访问 safeline-mgt-api 所在的主机节点 IP + 1443，使用 google authenticator 扫码绑定后输入动态密码登录
添加防护站点
访问添加的站点后查看大屏数据展示
拦截功能测试
优点:
缺点: