1. Home
  2. Guides
  3. Next-Gen WAF
  4. Setup and configuration
  5. Kubernetes

Kubernetes Agent + Module

In this example, the Next-Gen WAF agent is deployed in a docker sidecar, communicating with a module deployed on the application.

Integrating the Next-Gen WAF agent

Refer to the Agent container image integration.

Next-Gen WAF agent with a web application and Next-Gen WAF module installed

This deployment example configures the example helloworld application to use the sigsci-agent via RPC and deploys the sigsci-agent container as a sidecar to process these RPC requests.

To configure Next-Gen WAF with this deployment type you must:

  • Modify your application to add the appropriate Next-Gen WAF module, configured it to communicate with a sigsci-agent via RPC.
  • Add the sigsci-agent container to the pod, configured in RPC mode.
  • Add an emptyDir{} volume as a place for the sigsci-agent to write temporary data and share the RPC address.

Modifying and configuring the application container

The helloworld example is a language based module (Golang) that has already been modified to enable communication to the sigsci-agent via RPC if configured to do so. This configuration is done via arguments passed to the helloworld example application as follows:

  • Listening address (defaults to localhost:8000).
  • Optional Next-Gen WAF agent RPC address (default is to not use the sigsci-agent). Other language based modules are similar. Web server based modules must have the Next-Gen WAF module added to the container.

For this helloworld application to work with the sigsci-agent it must have the sigsci-agent address configured as the second program argument and the sigsci-tmp volume mounted so that it can write to the socket file:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
...
      containers:
      # Example helloworld app running on port 8000 against sigsci-agent via UDP /sigsci/tmp/sigsci.sock
      - name: helloworld
        image: signalsciences/example-helloworld:latest
        imagePullPolicy: IfNotPresent
        args:
          # Address for the app to listen on
          - localhost:8000
          # Address sigsci-agent RPC is listening on
          - /sigsci/tmp/sigsci.sock
        ports:
        - containerPort: 8000
        volumeMounts:
        # Shared mount with sigsci-agent container where the socket is shared via emptyDir volume
        - name: sigsci-tmp
          mountPath: /sigsci/tmp

Adding and configuring the agent container as a sidecar

The sigsci-agent container will default to RPC mode with a Unix Domain Socket (UDS) file at /sigsci/tmp/sigsci.sock. There must be a temp volume mounted at /sigsci/tmp to capture this socket file and must be shared with the pod. The web application must be configured to communicate with the sigsci-agent via this UDS socket. The deployment YAML must be modified from the example above by adding a second argument to specify the sigsci-agent RPC address of /sigsci/tmp/sigsci.sock.

HINT: It is possible to use a TCP based listener for the sigsci-agent RPC, but this is not recommended for performance reasons. If TCP is needed (or UDS is not available, such as in Windows), then the RPC address can be specified as ip:port or host:port instead of a UDS path. In this case, the volume does not have to be shared with the app, but it does need to be created for the sigsci-agent container to have a place to write temporary data such as geodata.

Adding the sigsci-agent container as a sidecar

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
...
      containers:
      # Example helloworld app running on port 8000 against sigsci-agent via UDP /sigsci/tmp/sigsci.sock
      - name: helloworld
        image: signalsciences/example-helloworld:latest
        imagePullPolicy: IfNotPresent
        args:
          # Address for the app to listen on
          - localhost:8000
          # Address sigsci-agent RPC is listening on
          - /sigsci/tmp/sigsci.sock
        ports:
        - containerPort: 8000
        volumeMounts:
        # Shared mount with sigsci-agent container where the socket is shared via emptyDir volume
        - name: sigsci-tmp
          mountPath: /sigsci/tmp
      # Next-Gen WAF agent running in default RPC mode
      - name: sigsci-agent
        image: signalsciences/sigsci-agent:latest
        imagePullPolicy: Always
        env:
        - name: SIGSCI_ACCESSKEYID
          valueFrom:
            secretKeyRef:
              # This secret needs added (see docs on sigsci secrets)
              name: sigsci.my-site-name-here
              key: accesskeyid
        - name: SIGSCI_SECRETACCESSKEY
          valueFrom:
            secretKeyRef:
              # This secret needs added (see docs on sigsci secrets)
              name: sigsci.my-site-name-here
              key: secretaccesskey
        # If required (default is /sigsci/tmp/sigsci.sock for the container)
        #- name: SIGSCI_RPC_ADDRESS
        #  value: /path/to/socket for UDS OR host:port if TCP
        securityContext:
          # The sigsci-agent container should run with its root filesystem read only
          readOnlyRootFilesystem: true
        volumeMounts:
        # Default volume mount location for sigsci-agent writeable data
        # NOTE: Also change `SIGSCI_SHARED_CACHE_DIR` (default `/sigsci/tmp/cache`)
        #       if mountPath is changed, but best not to change.
        - name: sigsci-tmp
          mountPath: /sigsci/tmp

NOTE: The above sigsci-agent configuration assumes that sigsci secrets were added to the system section above.

Adding the agent temp volume definition to the deployment

Finally, the agent temp volume needs to be defined for use by the other containers in the pod. This uses the builtin emptyDir: {} volume type.

...
      volumes:
      # Define a volume where sigsci-agent will write temp data and share the socket file,
      # which is required with the root filesystem is mounted read only
      - name: sigsci-tmp
        emptyDir: {}

Related content

Fastly
© Fastly 2026