Github - https://github.com/hiteshjoshi1/helm-k8s-poc.git

Target

• Build two Docker images (node + orders) inside Minikube’s Docker.
• Install ingress-nginx via Helm with WAF enabled.
• Generate certs: a CA, a server cert for test.com, and a client cert.
• Create k8s secrets for TLS + client CA.
• helm upgrade --install the app chart.
• Map test.com → Minikube IP in /etc/hosts (this simulates owning the domain).
• curl with/without the client cert to see mTLS enforcement, rate limits, and WAF in action.

Prerequisite: install docker

brew install minikube

brew install helm

Provide at least 8GB to docker in docker desktop settings

minikube start --cpus=4 --memory=8g

Helm + K8s POC: Ingress + mTLS + WAF (Minikube)

This POC gives us two tiny APIs, a full Helm chart to deploy them with 2 replicas each, and an NGINX Ingress with TLS termination, mutual TLS (mTLS) client auth, rate limiting, and WAF (ModSecurity + OWASP CRS). It is designed for Minikube.

Stack: Node.js (Express) apps → ClusterIP Services → NGINX Ingress Controller (Helm) → Ingress (TLS + mTLS + WAF + rate limit)

0) Directory Layout

helm-k8s-poc/
├── apps/
│   ├── node/
│   │   ├── package.json
│   │   ├── server.js
│   │   └── Dockerfile
│   └── orders/
│       ├── package.json
│       ├── server.js
│       └── Dockerfile
├── helm/
│   ├── poc-apps/
│   │   ├── Chart.yaml
│   │   ├── values.yaml
│   │   └── templates/
│   │       ├── deployment-node.yaml
│   │       ├── service-node.yaml
│   │       ├── deployment-orders.yaml
│   │       ├── service-orders.yaml
│   │       └── ingress.yaml
│   └── ingress-nginx/
│       └── ingress-nginx-waf.yaml
└── scripts/
    └── gen-certs.sh