kubeWAF
Kubernetes-native Web Application Firewall using ModSecurity-compatible rules and OWASP CRS
kubeWAF is a Kubernetes operator that defines WAF policy as Custom Resources and enforces it inside Envoy — across Envoy Gateway, Istio, and Cilium.
Rules are ModSecurity-compatible SecLang (structured YAML) plus optional
OWASP CRS. Evaluation runs in modsecurity-proxy-wasm; you can add an
optional PoW challenge in front via spec.challenge on the WAF resource.
Alpha Software
kubeWAF is currently in alpha.
Core features work in real environments, but APIs may still change. Prefer non-critical workloads for production today.
Why kubeWAF?
Structured as CRDs
Write rules in readable YAML (SecRule, SecAction) instead of opaque .conf files. Full GitOps support.
Powerful RuleSets
Group, reuse, and compose rules across namespaces with automatic resolution and status conditions.
Multi-gateway data plane
Push one rule model over ECDS to Envoy Gateway, Istio, and Cilium — only the filter slot differs.
CRS + optional challenge
Enable OWASP CRS with one flag; optionally put a PoW challenge in front of the WAF.
Get started
Quick Start
Deploy a protected service end to end.
Installation
Helm install (replicas, ECDS, wasm serve).
Architecture
Control plane, data plane, and HA.
GitHub
Source, issues, and e2e matrix.
Common tasks
| Task | Doc |
|---|---|
| Write custom rules | Writing security rules |
| Enable OWASP CRS | Using CRS |
| Enable PoW challenge | Proof-of-Work challenge |
| Pick / override the WAF engine | WAF engine |
| Wire Envoy Gateway | Envoy Gateway |
| Metrics and dashboards | Observability |
Current status (Alpha)
| Status | Feature |
|---|---|
| ✅ | SecRule + SecAction CRDs with SecLang conversion |
| ✅ | RuleSet with cross-namespace refs and recursion |
| ✅ | WAF + gRPC ECDS config push |
| ✅ | Providers: Envoy Gateway, Istio, Cilium |
| ✅ | Engine: modsecurity-proxy-wasm (embedded CRS) |
| ✅ | Optional PoW challenge (spec.challenge) |
| ✅ | Multi-replica HA (leader writes, all pods serve dataplane) |
| ✅ | Provider e2e suite |
Roadmap highlights: full WAFInstance, validation webhooks, deeper Cilium path.
Other documentation roots
This site has three separate docs roots (switch tabs in the sidebar):
| Root | URL | About |
|---|---|---|
| kubeWAF (this tree) | /docs/kubewaf | Operator, CRDs, providers |
| modsecurity-proxy-wasm | /docs/modsecurity-proxy-wasm | WAF engine project |
| pow-proxy-wasm | /docs/pow-proxy-wasm | PoW challenge project |
Operator-facing engine usage stays here: engine · challenge.
Need help? Open an issue on GitHub or email hello@kubewaf.io.