Radware Kubernetes WAF

Short Summary

Software architecture has progressed from monolithic applications—where UI, business logic, and data layers are built as a single platform—to Service-Oriented Architecture (SOA), which breaks systems into loosely coupled networked services, often dependent on middleware or an Enterprise Service Bus. Microservices further refine SOA by decomposing coarse-grained services into smaller, autonomous components guided by separation of concerns and single-responsibility principles, typically communicating via lightweight protocols and APIs.

Microservices commonly run in containers such as Docker, often following a one-microservice-per-container approach. Because containerized microservices create large numbers of deployable units, orchestration platforms like Kubernetes, Mesos, and Swarm Mode automate deployment and management, with Kubernetes emerging as the dominant choice. While security for monoliths and SOA (e.g., IAM and traditional WAFs) is mature, containerized and orchestrated environments introduce requirements that older approaches do not adequately address. Effective solutions must integrate with orchestration platforms and CI/CD pipelines to keep pace with rapid iteration.

Radware’s Kubernetes WAF is positioned to meet these needs by providing security close to the workload: deployed as a reverse-proxy sidecar inside a Kubernetes pod, in front of microservice containers, with TLS already terminated at the application level to avoid exposing clear traffic or requiring repeated encryption/decryption. The WAF is Kubernetes-controlled, enabling centralized policy synchronization and telemetry/log collection through the Kubernetes control plane, scaling across large numbers of pods. It applies defense-in-depth using negative and positive security models, behavior-based protection, OWASP Top 10 coverage, API protections aligned to OpenAPI, and sensitive data masking for leakage prevention. Machine-learning-driven adaptive policy generation aims to reduce false positives and maintenance burden in dynamic microservices environments, complemented by dashboards and integrations with Grafana, Kibana, and SIEMs for DevSecOps visibility.

Interesting Facts

• Monolithic architectures traditionally packaged UI, data layer, and intermediate components into a single platform.
• SOA commonly relies on middleware or an Enterprise Service Bus in enterprise deployments.
• Microservices are described as a fine-grained variant of SOA built around small, autonomous services.
• Kubernetes services are available on major cloud platforms including Azure, IBM, Google, and AWS.
• Radware Kubernetes WAF can be deployed behind NGINX ingress controllers or in an Envoy–Istio service mesh setup.
• The WAF is deployed as a reverse-proxy sidecar inside the Kubernetes pod in front of microservices containers.
• Policies, telemetry, and log collection reside within the Kubernetes management control plane for this product.
• Coverage includes OWASP Top 10 vulnerabilities for web applications.
• Sensitive data masking is used to prevent leakage of information returned from a microservice.
• Standard integrations are provided for Grafana, Kibana, and external SIEM platforms via Kubernetes APIs and log data.

Notable Quotes

• “Microservices can be considered a variant of the SOA architectural style, where the coarse-grained SOA units can be decomposed into even smaller services.”
• “Each microservice is characteristically small and autonomous by using a separation-of-concerns and single-responsibility type of design principles, making microservices fine-grained.”
• “New security solutions must be built for this next generation of software architectures to support their unique environmental needs.”
• “The security solution should protect the applications and their data, but it also must provide seamless integration and interoperability with the container management and orchestration platforms where the microservices applications reside.”
• “These security solutions must also integrate well into the Continuous Integration/Continuous Deployment (CI/CD) pipelines that facilitate the automation of the software delivery process and accelerate product iterations.”
• “Radware Kubernetes WAF offers web application security before each container in a Kubernetes pod where TLS is already terminated rather than at some intermediating gateway.”
• “The Radware Kubernetes WAF is controlled by Kubernetes, allowing for a more lightweight WAF footprint and making it easier to manage.”
• “Radware Kubernetes WAF combines positive and negative security models against known and zero-day attacks.”
• “This process is continuous in that it adapts to newly detected threats and creates the rules to protect against them.”
• “Both DevOps and Security teams need to work together in a DevSecOps manner to ensure CI/CD, while at the same time ensuring the security of the applications and its data.”