Hybrid web application firewall

1 . A method for operating a containerized firewall, the method comprising:

receiving instructions to configure a web application firewall being executed within a first container-based architecture, wherein the web application firewall executes a plurality of containers including a proxy service and a filter and the received instructions include changes to a previous network traffic policy;

storing the received instructions as a changelog that indicates an updated network traffic policy to be implemented by the web application firewall;

communicating the updated network traffic policy to:

a first object store associated with the first container-based architecture,

a proxy service associated with the web application firewall;

receiving at an application programming interface (API) service configuration data of the updated network traffic policy, wherein the configuration data includes routing information for the proxy service and specifies which ports are to be used for routing traffic, how routes are to be configured, and certificates and keys for servers;

monitoring, using the web application firewall, first traffic to a web application running in the first container-based architecture and second traffic intended for a non-container application that is outside of the first container-based architecture; and

processing the first network traffic based on the updated network traffic policy by using a fully qualified domain name (FQDN) to track the IP address of the web application running in the first container-based architecture; and

processing the second network traffic based on the updated network traffic policy in accordance with the configuration data received by the API service by routing traffic to the application that is outside of the first container-based architecture through the use of at least one fully qualified domain name (FQDN).

2 . The method of claim 1 further comprising:

periodically referencing the first object store to obtain configuration data, and

confirming the web application firewall is configured in accord with the configuration data obtained from the first object store.

3 . The method of claim 1 further comprising:

replicating the updated network traffic policy from the first object store to a second object store associated with a second container-based architecture including a second web application firewall, and

configuring the second web application firewall in accord with the updated network traffic policy.

4 . The method of claim 3 further comprising:

periodically referencing the second object store to obtain configuration data, and

confirming the second web application firewall is configured in accord with the configuration data obtained from the second object store.

5 . The method of claim 1 wherein the updated network traffic policy is specific to an application.

6 . The method of claim 1 wherein processing the first network traffic includes:

identifying metadata associated with the first network traffic, and

transmitting the metadata to prepopulate a user interface.

7 . The method of claim 1 wherein processing the first network traffic includes:

identifying the web application associated with the first network traffic executing in the first container-based architecture, and

enabling specification of the updated network traffic policy for the web application.

8 . A system for operating a containerized firewall, the system comprising:

a web application firewall being executed within a first container-based architecture, wherein the web application firewall executes a plurality of containers including a proxy service and a filter;

an interface for at least receiving instructions to configure the web application firewall, wherein the received instructions include changes to a previous network traffic policy;

a changelog processor configured to process the received instructions as a changelog that indicates an updated network traffic policy to be implemented by the web application firewall;

a first object store comprising a memory configured to store the updated network traffic policy;

an application programming interface (API) service positioned to receive from the changelog processor configuration data of the updated network traffic policy including routing information for the proxy service, wherein the configuration data specifies which ports are to be used for routing traffic, how routes are to be configured, and certificates and keys for servers, wherein the web application firewall is configured to:

monitor first traffic to a web application running in the first container-based architecture and second traffic intended for a non-container application that is outside of the first container-based architecture, and

process the first network traffic based on the updated network traffic policy by using a fully qualified domain name (FQDN) to track the IP address of the web application running in the first container-based architecture; and

process the second network traffic based on the updated network traffic policy in accordance with the configuration data received by the API service by routing traffic to the application that is outside of the first container-based architecture through the use of at least one FQDN.

9 . The system of claim 8 , further comprising a synchronization component executing in the first container-based architecture and configured to:

periodically reference the first object store to obtain configuration data, and

confirm the web application firewall is configured in accord with the configuration data obtained from the first object store.

10 . The system of claim 8 , further comprising a configuration service executing in the first container-based architecture to receive the changelog from the changelog processor and communicate configuration instructions to the proxy service to configure the web application firewall based on the updated network traffic policy.

11 . The system of claim 8 , further comprising:

a second container-based architecture executing a second web application firewall, and

a second object store associated with the second container-based architecture, wherein the updated network traffic policy is replicated from the first object store to the second object store to configure the second web application firewall in accord with the updated network traffic policy.

12 . The system of claim 11 , further comprising a second synchronization component executing in the second container-based architecture and configured to:

periodically reference the second object store to obtain configuration data, and

confirm the second web application firewall is configured in accord with the configuration data obtained from the second object store.

13 . The system of claim 8 wherein the updated network traffic policy is specific to an application.

14 . The system of claim 8 wherein the proxy service processes the first network traffic by:

identifying metadata associated with the first network traffic, and

transmitting the metadata to prepopulate a user interface.

15 . The system of claim 8 wherein the proxy service processes the first network traffic by:

identifying the web application associated with the first network traffic executing in the first container-based architecture, and

enabling specification of the updated network traffic policy for the web application.

16 . A computer program product for operating a containerized firewall, the computer program product comprising a non-transitory computer readable media that includes computer executable code that, when executing on one or more processors, performs the steps of:

receiving instructions to configure a web application firewall being executed within a first container-based architecture, wherein the web application firewall executes a plurality of containers including a proxy service and a filter and the received instructions include changes to a previous network traffic policy;

storing the received instructions as a changelog that indicates an updated network traffic policy to be implemented by the web application firewall;

communicating the updated network traffic policy to:

a first object store associated with the first container-based architecture, and

a proxy service associated with the web application firewall;

receiving at an application programming interface (API) service configuration data of the updated network traffic policy, wherein the configuration data includes routing information for the proxy service and specifies which ports are to be used for routing traffic, how routes are to be configured, and certificates and keys for servers;

monitoring, using the web application firewall, first traffic to a web application running in the first container-based architecture and second traffic intended for a non-container application that is outside of the first container-based architecture; and

processing the first network traffic based on the updated network traffic policy by using a fully qualified domain name (FQDN) to track the IP address of the web application running in the first container-based architecture; and

processing the second network traffic based on the updated network traffic policy in accordance with the configuration data received by the API service by routing traffic to the application that is outside of the first container-based architecture through the use of at least one fully qualified domain name (FQDN).

17 . The computer program product of claim 16 further comprising computer executable code that, when executing on one or more processors, performs the steps of:

periodically referencing the first object store to obtain configuration data, and

confirming the web application firewall is configured in accord with the configuration data obtained from the first object store.

18 . The computer program product of claim 16 further comprising computer executable code that, when executing on one or more processors, performs the steps of:

replicating the updated network traffic policy from the first object store to a second object store associated with a second container-based architecture including a second web application firewall, and

configuring the second web application firewall in accord with the updated network traffic policy.

19 . The computer program product of claim 18 further comprising computer executable code that, when executing on one or more processors, performs the steps of:

periodically referencing the second object store to obtain configuration data, and

confirming the second web application firewall is configured in accord with the configuration data obtained from the second object store.

20 . The computer program product of claim 16 wherein the updated network traffic policy is specific to an application.