How to Set Up SafeLine WAF on Kubernetes

Installing SafeLine WAF on Kubernetes involves deploying it as a containerized reverse-proxy WAF alongside your existing applications. SafeLine functions as the inspection layer in front of the services you wish to protect.

To set up, deploy SafeLine using a Deployment and Service. The Service exposes management port 9443 and proxy ports 80 and 443 for receiving inspected traffic. Configure your Ingress or LoadBalancer to route protected hosts to the SafeLine Service instead of directly to the application. In the SafeLine console, add each protected site, specifying the target app's cluster-internal Service address as the upstream.

A basic Deployment configuration includes a single replica, labeling the application as "safeline." The container runs the latest SafeLine image from the official repository, mapping ports 9443 (management), 80 (proxy), and 443 (proxy with TLS). Ensure you verify the correct image, tag, and any additional services your stack requires before deployment.

For persistence and scalability, attach a PersistentVolumeClaim to Safeline's config and logs to maintain data across pod restarts. To handle higher traffic, scale the number of replicas while keeping the configuration consistent across all instances.

SafeLine supports protecting multiple apps within the same cluster; each protected site maps a domain to an in-cluster Service upstream. You can terminate TLS at either SafeLine or your Ingress, forwarding traffic to the upstream over HTTP or HTTPS as preferred. The Community Edition provides free protection for up to 10 apps at 800 queries per second.

SafeLine operates as a standard Kubernetes workload, filtering traffic to your services seamlessly. Further resources, including installation instructions, configuration details, API reference, and a live demo, are available on the SafeLine GitHub page and official documentation.