Standard rules
Built on OWASP Coraza and the OWASP Core Rule Set v4, embedded in the engine. Your own rules and exclusions are written in SecLang, the ModSecurity rule language.
Early development: the engine works today, the operator is being built
One web application firewall for every ingress in your cluster
Inkwall protects HTTP traffic behind any proxy with the same policy. Write a WAFPolicy,
and the operator wires the engine into the proxy that serves the route, using that proxy’s own hook.
One WAF per proxy is a tax
Running a WAF in Kubernetes usually means one per proxy: ModSecurity for ingress-nginx, a plugin for Traefik, a WASM filter for Envoy, an agent for HAProxy, each with its own configuration, rules and failure modes. Change your ingress, and you rebuild your WAF.
Inkwall makes the WAF a Kubernetes primitive, the way cert-manager did for TLS. Policies stay the same when you move routes from one proxy to another.
- The operator watches your routes and policies, injects the engine next to the proxy and wires it in.
- The engine answers the proxy’s own protocol and returns allow or deny before the request reaches your app.
- Status on each policy shows how far it got: accepted, programmed into the proxy, enforced by every engine.
What you get
Fast by design
The engine runs next to the proxy, inside its pod, and skips what doesn’t need inspection before any rule runs. Benchmarks gate every pull request.
Safe by default
New routes start in detect mode: log, never block. In block mode nothing is forwarded uninspected; a request that can’t be inspected in time is rejected.
Policy as Kubernetes objects
Write a WAFPolicy against an Ingress. Rules are compiled when you save them, so a typo is a kubectl error with a line number, not an outage.
Test rules without traffic
inkwallctl test shows the verdict and matching rules for a request, a raw HTTP file or a browser HAR, and works as a CI check for rule changes.
GitOps first, SaaS optional
The objects in Git are the source of truth and everything enforces offline. Open source under Apache 2.0.
Where things stand
No release exists yet. This table is kept honest: it lists what you can run today and what is still ahead.
| Integration | Hook | Status | Notes |
|---|---|---|---|
| Standalone reverse proxy | HTTP | Works today | In front of any HTTP service, in or out of Kubernetes |
| Traefik | ForwardAuth | Works today | Engine as a sidecar, tested on kind; wiring by the operator in progress |
| Any proxy with a hook | POST /v1/check | Works today | The engine’s own API, protobuf or JSON |
| Kubernetes operator | CRDs | In progress | CRDs, validating webhook and signed policy bundles; delivery to the engines next |
| Envoy, Envoy Gateway, Istio | ext_proc / ext_authz | Planned | |
| ingress-nginx | Lua plugin | Planned | |
| HAProxy | SPOE | Planned | |
| Caddy | Module | Planned |
Try the engine in a minute
The engine runs today as a reverse proxy in front of any HTTP service, with the Core Rule Set built in.
It starts in detect mode; --mode block enforces.
Getting started also covers the Traefik setup on a local kind cluster.
$ make build
$ ./bin/inkwall-engine proxy \
--upstream http://localhost:3000 --mode block
$ curl -s -o /dev/null -w '%{http_code}\n' \
'localhost:8480/?id=1%27%20OR%20%271%27%3D%271'
403