DEV Community

Lia
Lia

Posted on

How to Set Up SafeLine WAF on Kubernetes

#devops #kubernetes #security #webdev

How to Set Up SafeLine WAF on Kubernetes

If your apps already run on Kubernetes, SafeLine fits right in — it's a containerized reverse-proxy WAF, so you deploy it like any other workload and route protected traffic through it.

Where SafeLine sits 

Client → Ingress / LoadBalancer → SafeLine Service → SafeLine pod → upstream app Service
Enter fullscreen mode Exit fullscreen mode

SafeLine becomes the inspection tier in front of the services you want to protect. Each protected app is configured as an upstream pointing at its in-cluster Service DNS (for example http://my-app.default.svc.cluster.local:8080).

Approach

The common pattern:

  1. Deploy SafeLine as a Deployment + Service. The Service exposes the console port (:9443) for management and the proxy ports (:80 / :443) that receive inspected traffic.
  2. Point your Ingress (or LoadBalancer) at the SafeLine Service for the hosts you want protected, instead of pointing directly at the app.
  3. Add protected sites in the SafeLine console (https://<safeline-ip>:9443), with each upstream set to the target app's cluster-internal Service address.

A minimal Deployment shape looks like:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: safeline
  namespace: safeline
spec:
  replicas: 1
  selector:
    matchLabels: { app: safeline }
  template:
    metadata:
      labels: { app: safeline }
    spec:
      containers:
        - name: safeline
          image: chaitin/safeline:latest   # confirm the exact image/tag in the official docs
          ports:
            - { containerPort: 9443 }      # management console
            - { containerPort: 80 }        # proxy
            - { containerPort: 443 }       # proxy (TLS)
          resources:
            requests: { cpu: "1", memory: "1Gi" }
Enter fullscreen mode Exit fullscreen mode

Confirm the exact image, tag, and any companion services (database / cache the stack uses) against the official documentation before applying.

Persistence and scaling

  • Mount a PersistentVolumeClaim for SafeLine's config and logs so they survive pod restarts.
  • For higher throughput, scale replicas and keep configuration consistent across them.

FAQ

Can one SafeLine protect several apps in the cluster?

Yes — each protected site maps a domain to an in-cluster Service upstream, so multiple apps behind one SafeLine is straightforward.

Where do I terminate TLS?

Either at SafeLine or at your Ingress; forward to the upstream over HTTP or HTTPS as you prefer.

Free tier?

The Community Edition covers 10 apps at 800 QPS for free.

That's it — SafeLine runs as a normal Kubernetes workload and filters traffic to your services.

Top comments (0)