Need indicators
This capability is usually relevant when these signals appear in the operating environment.
Many service-to-service calls.
Need for lightweight protection.
Limited internal integration control.
Back to solutions
Discuss your use case
What is this solution?
A microgateway places enforcement close to a microservice or set of routes instead of relying only on a centralized edge gateway. Requests pass through service-specific identity, schema, or consumption policies. In Kubernetes, placement and isolation depend on the deployment and actual traffic paths.
A Kubernetes microgateway inspects API requests close to the workloads they target and applies security policies to service-to-service traffic on managed paths.
Practical example
An application team adds a microservice. It tests request policy close to the service in a staging environment before releasing it.
Technical summary and scope of use
Technical explanation
A lightweight security gateway for Kubernetes protects APIs, microservices, and web applications in containerized environments.
The gateway sits in front of services and applications. It inspects incoming requests, checks identity and authorization, and applies security policies to block known attacks before traffic reaches covered workloads.
This technology helps to protect applications and APIs within Kubernetes environments by placing a security layer in front of services, so that all requests are checked before they reach the application.
The technology verifies the user’s identity or system, verifies access validity, scans requests against known attacks, and then only allows reliable requests to access the service.
The development and operating teams also help implement a standard protection policy within Kubernetes environments, with the possibility of integrating protection into development, operation and automation processes.
This technology is used in environments that rely on micro-service, modern applications and APIs, especially when it needs continuous and expanding protection.
Scope of use
The technology works within the Kubernetes environments, and can be operated as an internal gateway or as an entrance point for applications and services within the cities.
The technology is used in:
- Protection of Web Applications
- Protecting the API
- Microservices protection
- Application of the Zero Trust Model
- Protection for internal and external workloads
- Supporting modern development and operating environments
The technical objective is:
- Prohibition of unauthorized access
- Protect applications and services from known attacks
- Implementation of Unified Access Policy
- Improving the security of APIs
- Integration of security within development and operation environments
- Support for automation and security policy management
What it delivers
Core capabilities that turn the requirement into practical controls.
Application and API protection
Identity management and access control
Networking and routing
Expected value
The impact security teams and leadership can expect from the right implementation.
More precise service controls
Less reliance on a single protection point
Better distributed app protection
Technical capabilities
Feature availability depends on product version, target systems, deployment, and integrations.
Application and API protection
Protect Web Applications and APIs within Kubernetes Environments
Support deployment in the covered container environment; test networking, storage, and secret handling before production.
Multi-level security filters to protect against known attacks
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Protecting from OWASP Top 10 Attacks
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Examination and analysis of applications.
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
API schema enforcement
Check incoming API requests against the approved schema and test that an invalid request is rejected before it reaches the service.
Analysis of JSON requests
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Implementation of OpenAPI Specifications
Compare request structure with the agreed API contract before forwarding it; test unexpected fields.
Check the GraphQL Schedules
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Protection of services at the level of service
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
The principle of default protection
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Identity management and access control
Only permitted for approved and commissioned requests
Associate users or groups with authorized scope and review how membership changes affect access.
OIDC support for identity verification
Federate sign-in through an identity provider; validate token issuer, audience, and expiry.
JWT support for verification of requests
Verify token signature, issuer, audience, and expiry before accepting the request.
Mutual TLS (mTLS) to secure communications
Associate users or groups with authorized scope and review how membership changes affect access.
Step-up authentication support
Associate users or groups with authorized scope and review how membership changes affect access.
Application of the Zero Trust Model
The technology is based on verifying all applications and not presuming trust within the operating environment.
Token exchange between identity providers
Associate users or groups with authorized scope and review how membership changes affect access.
Networking and routing
Working as a reverse door.
Select the request destination by route and policy and verify what happens when no route matches.
Implementation of guidelines for requests
Turn organizational requirements into testable settings and define who may approve exceptions.
End of TLS.
Terminate TLS at the gateway for inspection and define how the connection to the application is protected.
Support for HTTP/1.1
Select the request destination by route and policy and verify what happens when no route matches.
Support for HTTP/2
Select the request destination by route and policy and verify what happens when no route matches.
Support for HTTP/3
Select the request destination by route and policy and verify what happens when no route matches.
Operating as an entry point for applications
Identify which application paths pass through the gateway and keep direct paths outside the design restricted.
Internal gateway within Kubernetes
Place inspection on the internal paths used by the in-scope services.
Kubernetes Gateway API support
Review supported routing resource types and how they connect to target services in the cluster.
Protection for internal and external workloads
Inspect requests before they reach the service and define covered routes and rejection behavior.
DevOps and integration
Integration with Kubernetes
Support deployment in the covered container environment; test networking, storage, and secret handling before production.
Declarative configuration with Kubernetes custom resources
Define desired settings in supported custom resources and review changes and rollback.
Support of automation
Run repetitive steps under defined conditions and review failures and exceptions.
Support for DevSecOps
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Support for GitOps
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Support by Helm
Configure Helm deployment values for the version and required resources; test upgrades and rollback in a representative environment.
Kubernetes Operator support
Verify which resources the operator manages and how it handles updates or a component failure.
Suitable for container-based environments
Support deployment in the covered container environment; test networking, storage, and secret handling before production.
Supporting different cloud environments
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Administration and operations
Light and automatic.
Run repetitive steps under defined conditions and review failures and exceptions.
Controlled by Applications.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Integrated in the development phase.
Tie test results to promotion decisions and identify who reviews exceptions.
Possibility to run as an independent protective layer within Kubernetes
Support deployment in the covered container environment; test networking, storage, and secret handling before production.
Possibility of integration into a multi-class security structure
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Suitable for corporate environments.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Performance and scalability
Support for expansion within Kubernetes environments
Test how gateway replicas behave under load and whether routing policies remain consistent.
Suitable for light publication.
Measure behavior under expected load and during a component interruption or recovery.
Supporting cloud and institutional environments
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Operating support within modern container-based environments
Support deployment in the covered container environment; test networking, storage, and secret handling before production.
Use cases
Protecting Kubernetes Applications
Support deployment in the covered container environment; test networking, storage, and secret handling before production.
Protecting the API
The technology supports the application of API diagrams and verification of requests through OpenAPI, GraphQL and JSON analysis.
Application of the Zero Trust Model
The technology is based on verifying all applications and not presuming trust within the operating environment.
Protection for internal and external workloads
Inspect requests before they reach the service and define covered routes and rejection behavior.
Protecting traditional and modern applications
Inspect requests before they reach the service and define covered routes and rejection behavior.
Relationship between identity providers
Associate users or groups with authorized scope and review how membership changes affect access.
How the technology works
Examination and analysis of applications
The technology inspects and analyses input requests using multi-level security filters to protect against known attacks.
Access control
The technology requires identity verification and authorization before allowing access to services and applications.
Protecting the API
The technology supports the application of API diagrams and verification of requests through OpenAPI, GraphQL and JSON analysis.
Application of Zero Trust
The technology is based on verifying all applications and not presuming trust within the operating environment.
Safe guidance
A reverse proxy routes requests between users and services, handles TLS termination, and controls request flow.
Automated
The technology is based on automated detection settings within Kubernetes.
Integration
The technology is integrated with Kubernetes, DevSecOps and GitOps processes for the protection application within the development and operation cycle.
What to validate before rollout
- Choose the policy enforcement point for the service paths in scope.
- Define expected requests and verify the identity and authorization path.
- Validate policy with each deployment and plan rollback if integrations are affected.
Integration and scope
Verify deployment mode, container platform compatibility, and TLS placement. Identify which traffic traverses the gateway and which remains out of scope.
Challenges this solution addresses
- unauthorized access to applications and services
- Defects of API protection
- Applications to known attacks.
- Lack of verification of applications.
- Difficulty Application of Protection within Kubernetes
- The absence of zero trust.
- Weak access control.
- Complexity of management protection within modern environments
- Security integration in development stages.
- The weak unification of security policies
- Difficulty in protecting internal and external loads
- The need for security policies.
- The weak integration between security and operations
Regulatory alignment
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
NCA · ECC 2:2024For entities within the scope of the Essential Cybersecurity Controls.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Cybersecurity in the management of technical projects | Integration of security within the development, operation and automation stages Related capability: DevSecOps and Kubernetes Description Settings | Applied |
| Identity and access management | Verification of identity and authorization before accessing the services Related capability: OIDC, JWT and MTLS | Applied |
| Network Security Management | Traffic control, routing, and TLS termination Related capability: Reverse gateway and guidelines | Applied |
| Cryptography | Protection of communications in transit Related capability: MTS and TLS | Applied |
| Security of web applications. | Protect web applications and APIs from known attacks Related capability: Protect OWASP Top 10, OpenAPI and GraphQL | Applied |
| Cloud computing and hosting security | Operating support within Kubernetes cloud environments Related capability: Integration with Kubernetes | Applied |
SAMA · CSFFor financial institutions within the Saudi Central Bank framework, subject to the control's applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Identity and access management | Restriction of access to services so that only approved and authorized requests are reached Related capability: Support for OIDC, JWT and mTLS | Applied |
| Management of Privileges and Powers | Implementing authorization before passing applications to protected applications and services, reducing unautorized access Related capability: Access control at the level of requests. | Applied |
| Security of applications | Protect web applications and APIs from known attacks and check requests before they reach the Services Related capability: Multi-Level Protection Filter and OWASP Top 10 | Applied |
| Protecting the systems | Reduce the exposure of micro-service and applications to malware attacks through front protection layer Related capability: Inspection of Inbound Applications and Protection of Services | Applied |
| Protection of data | Protection of data during transfer by using encrypted communications Related capability: MTS and TLS | Applied |
| Management of Networks | Routes requests through a reverse proxy with routing rules and TLS termination Related capability: Reverse Proxy, Routing Rules and TLS Termination | Applied |
| Protection of Infrastructure | Protecting the workloads within Kubernetes through a security layer integrated with the container environment Related capability: Original Kubernetes and Gateway API integration | Applied |
| Operational Security | Supports automatic operation of security settings within Kubernetes environments and reduces dependence on manual adjustments Related capability: Kubernetes Custom Resources, Helm and Kubernetes Operator | Applied |
| Security of cloud environments | Operating support within Kubernetes, cloud and containers environments with integration in different cloud strategies Related capability: Kubernetes-native Deployment | Applied |
| Risk Management | Reduce the risks of unauthorized access and known attacks on applications and services through authentication, authorization and inspection Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Zero Trust, Applications and Access Control | Applied |
| compliance and audit | Support the implementation of standard security controls that can be identified and operated through automated identification settings Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Configuration by Kubernetes | Applied |
| Protection of sensitive financial systems | Protect APIs and web applications that may be used to provide sensitive digital services by verifying and checking before access Related capability: Protecting API and Web Workloads | Applied |
NCA · OTCC-1:2022For operational technology and industrial control environments to which the controls apply.
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Access control | Verify the identity of requests before accessing services Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: OIDC, JWT and MTLS | Applied |
| Discover threats. | Examination and analysis of applications against known attacks patterns Related capability: Multi-level safety filters | Applied |
| Isolation of networks. | Regulation of requests between users and services Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: Reverse gateway and guidelines | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Questions before you start
How do we know this solution is right for us?
Start with the risk signals on this page. If they match your environment, they can be turned into a short assessment that defines scope, priority, and a practical implementation approach.
How do we start without adding operational complexity?
Start with a focused risk and scope assessment, then define implementation priorities, technical requirements, and phased rollout steps.
Related solutions
WAAP
Web Application and API Protection
Extend application protection to APIs, bots, and abuse scenarios.
Explore solutionAPI Security
API Security Gateway
Govern API protection through validation, authorization, usage monitoring, and exposure reduction.
Explore solutionCloud Advisory
Cloud Security Advisory
Assess cloud exposure, hosting models, and control responsibilities before choosing protection tooling.
Explore solutionReady for the next step?
Turn this need into a practical assessment and clear implementation plan.
Share your use case and priority systems so we can discuss a pilot and its integration requirements.