Skip to main content

​
Overview

Coraza is an open-source Web Application Firewall (WAF) that integrates the OWASP Core Rule Set (CRS) for comprehensive protection against common web attacks. This template uses the Coraza Caddy image, which runs Coraza as a plugin inside the Caddy web server to handle request inspection and proxying. It sits in front of a target workload, filtering all incoming requests before forwarding them.

​
What Gets Created

  • Workload — A Coraza WAF container running with OWASP CRS, configured as a reverse proxy to your target workload.
  • Secrets — A startup script secret that configures the Caddy reverse proxy, and a custom rules secret (suffixed -coraza-custom-rules) containing an initial example rule, editable after installation to define your own WAF policies.
  • Identity & Policy — An identity bound to the workload with reveal access to the startup and custom rules secrets.
This template does not create a GVC. You must deploy it into an existing GVC alongside your target workload.

​
Prerequisites

The target workload must be reachable from the Coraza WAF workload. Before installing, ensure the target workload’s internal access is configured to allow traffic from the WAF:
  • Set the target workload’s internal_access to same-gvc, same-org, or use workload-list to explicitly allow the Coraza workload.

​
Installation

To install, follow the instructions for your preferred method:

UI

Browse, install, and manage templates visually

CLI

Manage templates from your terminal

Terraform

Declare templates in your Terraform configurations

Pulumi

Declare templates in your Pulumi programs

​
Configuration

The default values.yaml for this template: 
image: ghcr.io/coreruleset/coraza-crs@sha256:eed7280e0de4820507b500b1ee10de820c175165d5cce329609bf34f32977af8

# MUST BE CHANGED
targetWorkload: my-workload.my-gvc.cpln.local # Internal name of the workload to proxy traffic to

targetPort: 8080 # Port of the target workload

WAFPort: 80 # Port on the WAF workload exposed to the internet

resources:
  cpu: 50m
  memory: 128Mi

multiZone: false

diskBodyInspection: true # When true, request bodies exceeding the in-memory limit are buffered to disk for inspection

​
Target Workload

  • targetWorkload — The internal DNS name of the workload to proxy traffic to. Uses the format WORKLOAD_NAME.GVC_NAME.cpln.local. This must be changed before deploying.
  • targetPort — The port on the target workload that Coraza should forward requests to.
  • WAFPort — The port on the Coraza workload exposed to the internet (default 80).

​
Resources

  • resources.cpu / resources.memory — CPU and memory allocated to the WAF workload.
  • multiZone — When true, deploys replicas across multiple zones for higher availability.
Not all locations support multi-zone deployments. Confirm that your target location supports multi-zone before enabling this option.

​
Body Inspection

  • diskBodyInspection — Controls how request bodies larger than the 512KB in-memory limit are handled:
ValueBehavior
true (default)Bodies exceeding 512KB are buffered to disk at /tmp/coraza, enabling full inspection up to 12.5MB
falseAll body inspection stays in memory; bodies up to 12.5MB are held in memory, avoiding disk I/O at the cost of higher memory pressure on large requests

​
Custom Rules

After installation, custom WAF rules can be added by editing the secret named <release-name>-coraza-custom-rules. The secret includes an example rule to get started: 
SecRule REQUEST_URI "@rx attack" "id:1001,phase:1,deny,msg:'Blocked attack attempt'"
After modifying the custom rules secret, you must restart the workload replicas for the changes to take effect.

​
Logging

All Coraza logs are sent to /dev/stdout and are readable in the Control Plane built-in logging interface. Logging behavior can be adjusted through environment variables in the workload configuration after installation.

​
External References

OWASP Coraza Documentation

Official Coraza WAF documentation and tutorials

OWASP CRS Documentation

Core Rule Set documentation and custom rule authoring

Coraza CRS Docker

Coraza CRS Docker image reference

Coraza Template

View the source files, default values, and chart definition