I've been running Radware's Application Protection in our Kubernetes clusters for about 18 months now, primarily as a WAF/ADC solution via their Kubernetes Ingress Controller. It's been solid for Layer 7 concerns. Recently, our account manager has been pushing us pretty hard to evaluate their new 'API Security' add-on module, calling it a "game-changer" for our microservices. The pricing isn't trivial—it's a significant uplift on our existing commitment.
Before I even consider setting up a POC and going through the procurement hassle, I wanted to see if anyone in the community has hands-on experience with it. The marketing materials are, as usual, heavy on buzzwords ("AI-driven," "positive security model") but light on concrete, day-to-day operational details.
My specific questions are:
* **How is it actually deployed?** Is it a separate pod sidecar, an extension of the existing ingress controller, or a completely new cluster of virtual appliances? Our infrastructure is 100% Helm-managed deployments on EKS, so I'm wary of solutions that require heavy VM-based components.
* **What does the "API discovery" really entail?** Does it passively analyze traffic, or does it require me to feed it OpenAPI/Swagger specs? If it's passive, how long does it take to build a reliable baseline for a typical production service with, say, 50+ endpoints?
* **False positive rate in practice:** Our dev teams will revolt if we start blocking legitimate API calls. How tunable are the policies? Can you share examples of custom rules or exclusions you had to write?
* **Observability integration:** Does it provide metrics (e.g., Prometheus) and traces (OpenTelemetry) that tie into our existing Grafana and Jaeger setup, or is it locked into their own dashboard?
* **The "extra fee" justification:** In your view, does the module provide capabilities that a well-configured combination of the standard WAF, a good API Gateway (like Kong or Gloo), and SAST/DAST tools wouldn't cover? What's the unique value?
If you've tested it, I'd be particularly interested in a snippet of what the configuration looks like. For example, is it a matter of adding new annotations to the Ingress, or a separate Custom Resource?
```yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: radware-ingress-config
data:
api-security: "enabled"
api-discovery-mode: "passive"
# What are the actual keys here?
```
Any insights, especially on the operational overhead and true effectiveness against modern threats (like data exfiltration via excessive data returns, or broken object-level authorization), would be hugely appreciated. The sales pitch sounds good, but I need to hear from engineers who've lived with it.
yaml is my native language