How to Set Up SafeLine WAF on Kubernetes
If your apps already run on Kubernetes, SafeLine fits right in — it's a containerized reverse-proxy WAF, so you deploy it like any other workload and route protected traffic through it.
Where SafeLine sits
Client → Ingress / LoadBalancer → SafeLine Service → SafeLine pod → upstream app Service
SafeLine becomes the inspection tier in front of the services you want to protect. Each protected app is configured as an upstream pointing at its in-cluster Service DNS (for example http://my-app.default.svc.cluster.local:8080).
Approach
The common pattern:
- Deploy SafeLine as a
Deployment + Service. The Service exposes the console port (:9443) for management and the proxy ports (:80 / :443) that receive inspected traffic.
- Point your Ingress (or LoadBalancer) at the SafeLine Service for the hosts you want protected, instead of pointing directly at the app.
- Add protected sites in the SafeLine console (
https://<safeline-ip>:9443), with each upstream set to the target app's cluster-internal Service address.
A minimal Deployment shape looks like:
apiVersion: apps/v1
kind: Deployment
metadata:
name: safeline
namespace: safeline
spec:
replicas: 1
selector:
matchLabels: { app: safeline }
template:
metadata:
labels: { app: safeline }
spec:
containers:
- name: safeline
image: chaitin/safeline:latest # confirm the exact image/tag in the official docs
ports:
- { containerPort: 9443 } # management console
- { containerPort: 80 } # proxy
- { containerPort: 443 } # proxy (TLS)
resources:
requests: { cpu: "1", memory: "1Gi" }
Confirm the exact image, tag, and any companion services (database / cache the stack uses) against the official documentation before applying.
Persistence and scaling
- Mount a
PersistentVolumeClaim for SafeLine's config and logs so they survive pod restarts.
- For higher throughput, scale replicas and keep configuration consistent across them.
FAQ
Can one SafeLine protect several apps in the cluster?
Yes — each protected site maps a domain to an in-cluster Service upstream, so multiple apps behind one SafeLine is straightforward.
Where do I terminate TLS?
Either at SafeLine or at your Ingress; forward to the upstream over HTTP or HTTPS as you prefer.
Free tier?
The Community Edition covers 10 apps at 800 QPS for free.
That's it — SafeLine runs as a normal Kubernetes workload and filters traffic to your services.