workload.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: workload
data:
  nginx.conf: |
    user nginx;
    worker_processes  3;
    error_log  /var/log/nginx/error.log;
    events {
      worker_connections 10240;
    }
    http {
      log_format main '$remote_addr - $remote_user [$time_local] '
                      '"$request" $status $bytes_sent '
                      '"$http_referer" "$http_user_agent" "$gzip_ratio"';
      access_log /var/log/nginx/access.log main;
      server {
        listen 80;
        server_name  _;
    
        location / {
          return 200;
        }
    
        # Location for API discovery test
        location /api-discovery-test {
            add_header Api-Discovery-Header "Hello, I am header!";
            return 200 '{"json_response": "Hello, I am json"}';
            default_type application/json;
        }
        # Location for Blocking Tor Source Type
        location /blocking-by-tor-test {
              add_header Block-by-Tor "Hello, I am header!";
              return 200 '{"json_response": "Hello, I am json"}';
              default_type application/json;
        }
        # Some mocks for test_api_abuse_prevention.py
        location /.git {
            if ($http_custom_id) {
                return 400;
            }
            return 200;
        }
        location /wallarm-application/admin {
            return 401;
        }
        location /api/v2 {
            if ($http_custom_id) {
                return 502;
            }
            return 200;
        }
        location /smoke-auto-forced-browsing/ {
            return 404;
        }
      }
    }
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: sidecar-config
data:
  sidecar-include.conf : |
    location /wallarm-mode/monitoring {
        wallarm_mode monitoring;
        proxy_pass http://127.0.0.1:80;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    
            # Endpoint for `test_api_abuse_prevention.py` (and any other test, that uses non-default APP_ID)
    location /wallarm-application/ {
            wallarm_application $http_custom_id;
            proxy_pass http://127.0.0.1:80;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            
    }
    
    location /api-discovery-test {
        wallarm_application $http_custom_id;
        proxy_pass http://127.0.0.1:80;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /blocking-by-tor-test {
        wallarm_application $http_custom_id;
        proxy_pass http://127.0.0.1:80;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: workload
spec:
  selector:
    matchLabels:
      app: workload
  replicas: 1
  template:
    metadata:
      labels:
        app: workload
        wallarm-sidecar: enabled
        app.kubernetes.io/component: workload
      annotations:
        sidecar.wallarm.io/wallarm-mode: "block"
        sidecar.wallarm.io/proxy-extra-volumes: '[{"name": "nginx-http-extra-config", "configMap": {"name": "sidecar-config"}}]'
        sidecar.wallarm.io/proxy-extra-volume-mounts: '[{"name": "nginx-http-extra-config", "mountPath": "/nginx_include/sidecar-config.conf", "subPath": "sidecar-include.conf"}]'
        sidecar.wallarm.io/nginx-server-include: "['/nginx_include/sidecar-config.conf']"
    spec:
      imagePullSecrets:
        - name: dockerhub-secret
      containers:
        - name: nginx
          image: nginx:stable-alpine
          ports:
            - containerPort: 80
          volumeMounts:
            - name: config
              mountPath: /etc/nginx
              readOnly: true
      volumes:
        - name: config
          configMap:
            name: workload
            items:
              - key: nginx.conf
                path: nginx.conf
---
apiVersion: v1
kind: Service
metadata:
  name: workload
spec:
  type: NodePort
  ports:
    - port: 80
      targetPort: 80
      nodePort: 30000
  selector:
    app: workload