Kubernetes-native WAF

Protect workloads with ModSecurity-compatible rules

kubeWAF defines WAF policy as version-controlled Custom Resources and enforces them with Wasm inside Envoy — across Envoy Gateway, Istio, and Cilium.

Alpha software — APIs may change. Feedback and stars welcome!

Three documentation roots

Each project has its own docs tree and sidebar. kubeWAF is the default.

Kubernetes operator — CRDs, rules, challenge properties, providers.

ModSecurity Proxy-Wasm engine with embedded OWASP CRS.

Stateless browser proof-of-work challenge filter for Envoy.

Write SecRule and SecAction as readable Kubernetes YAML — full GitOps, no opaque .conf files.

Group, reuse, and compose rules across namespaces with automatic resolution and status conditions.

One rule model over ECDS for Envoy Gateway, Istio, and Cilium — only the filter slot differs.

Enable OWASP CRS on the WAF CR, and optionally put a proof-of-work challenge in front of evaluation.

Helm install, wire ECDS, attach a WAF CR — minutes to first protected path.