How to Set Up SafeLine WAF on Kubernetes

How to Set Up SafeLine WAF on Kubernetes If your apps already run on Kubernetes, SafeLine fits right in — it's a containerized reverse-proxy WAF, so you deploy it like any other workload and route protected traffic through it. Where SafeLine sits Client → Ingress / LoadBalancer → SafeLine Service → SafeLine pod → upstream app Service Enter fullscreen mode Exit fullscreen mode SafeLine becomes the inspection tier in front of the services you want to protect. Each protected app is configured as an upstream pointing at its in-cluster Service DNS (for example http://my-app.default.svc.cluster.local:8080). Approach The common pattern: Deploy SafeLine as a Deployment + Service. The Service exposes the console port (:9443) for management and the proxy ports (:80 / :443) that receive inspected traffic. Point your Ingress (or LoadBalancer) at the SafeLine Service for the hosts you want protected, instead of pointing directly at the app. Add protected sites in the SafeLine console (https://:9443), with each upstream set to the target app's cluster-internal Service address. A minimal Deployment shape looks like: apiVersion: apps/v1 kind: Deployment metadata: name: safeline namespace: safeline spec: replicas: 1 selector: matchLabels: { app: safeline } template: metadata: labels: { app: safeline } spec: containers: - name: safeline image: chaitin/safeline:latest # confirm the exact image/tag in the official docs ports: - { containerPort: 9443 } # management console - { containerPort: 80 } # proxy - { containerPort: 443 } # proxy (TLS) resources: requests: { cpu: "1", memory: "1Gi" } Enter fullscreen mode Exit fullscreen mode Confirm the exact image, tag, and any companion services (database / cache the stack uses) against the official documentation before applying. Persistence and scaling Mount a PersistentVolumeClaim for SafeLine's config and logs so they survive pod restarts. For higher throughput, scale replicas and keep configuration consistent across them. FAQ Can one SafeLine protect several apps in the cluster? Yes — each protected site maps a domain to an in-cluster Service upstream, so multiple apps behind one SafeLine is straightforward. Where do I terminate TLS? Either at SafeLine or at your Ingress; forward to the upstream over HTTP or HTTPS as you prefer. Free tier? The Community Edition covers 10 apps at 800 QPS for free. That's it — SafeLine runs as a normal Kubernetes workload and filters traffic to your services. ⭐ SafeLine WAF on GitHub — give it a star if you find it useful 🔗 Official Docs — installation guide, configuration, and API reference 🧪 Live Demo — see the dashboard in action (no login required)