<p>When reading blog posts about WAFs and Kubernetes, it seems 90+ % of the posts are written by WAF-providers, while the remaining posts seem to be sceptical. So I would like to hear what your experiences are with WAFs, do they make sense, and if so can you recommend any good open-source WAFs? We are currently not allowed to used American cloud providers, as we work with &quot;person data&quot;, and the Schrems II judgement has indicated that unencrypted &quot;person data&quot; is not allowed on their platforms (even if on EU servers).</p>
<h1>To my understanding WAF help with the following:</h1>
<ol>
<li>IP-whitelists/blacklists</li>
<li>Rate Limits</li>
<li>Scanning of HTTPS requests for SQLi and XSS</li>
<li>Cookie Poisoning and session-jacking</li>
<li>DDOS (requires a huge WAF cluster)</li>
</ol>
<h1>But I would also think that these problems can be handled elsewhere:</h1>
<ol>
<li>IP-whitelists/blacklists can be handled by the Loadbalancer or NetworkPolicies</li>
<li>Rate Limits can be configured in the Ingress</li>
<li>Handling of SQLi and XSS is done by input sanitization in the application</li>
<li>Server-side sessions bound to IPs can prevent poisoning and jacking</li>
<li>DDOS are hard to absorb, so I have no native solution here (but they are low risk?)</li>
</ol>
<p>Sure, I can see the advantage in centralizing security at the access gate to the network, but from what I have read WAFs are hard to maintain, they have tons af false positives and most companies mainly use them to be compliant with ISO-standards, and mainly in &quot;monitoring mode&quot;. Shouldn't it be secure enough to use SecurityPolicies, NetworkPolicies, Ingress Rules and Loadbalancer Rules rather than a WAF?</p>

<p>A WAF is not strictly <em>necessary</em> on Kubernetes — or on any other deployment platform. Honestly, even after consulting for dozens of companies, I've seldom encountered any site that used a WAF at all.</p>
<p>You're right that you could duplicate the functions of a WAF using other technology. But you're basically reinventing the wheel by doing so, and the programmers you assign to do it are not as expert in those security tasks than the developers of the WAF are. At least they are probably doing it as one of many other tasks they are working on, so they can't devote full-time to implementation and testing of the WAF.</p>
<p>There is also a valid argument that <a href="https://en.wikipedia.org/wiki/Defense_in_depth_(computing)" rel="nofollow noreferrer">defense in depth</a> in computing is a good thing. Even if you have other security measures in place, they might fail. It's worth creating redundant layers of security defense, to account for that possibility.</p>
<p>There's a tradeoff between implementing security (or any other feature) yourself versus paying someone else for their expert work. This is true for many areas of software development, not only a WAF.</p>
<p>For example, it has become popular to use a web application framework. Is it possible to develop your own framework? Of course it is, and sometimes it's necessary if you want the code to have very specific behavior. But most of the time you can use some third-party framework off the shelf. It saves you a lot of time, and you get the instant benefit from years of development and testing done by someone else.</p>
