Airlock Microgateway WAF · Airlock® by Ergon, operated by us

A Swiss WAF inside your cluster. Not in front of it.

A Kubernetes-native web application firewall (WAF) by Ergon, running on your Managed Kubernetes (NKE) cluster as an optional service. We install the operator and run the Gateways. You configure routing with the Kubernetes Gateway API and decide what gets in.

Talk to an expert Is this for me?

from CHF 427.– per month Data stays in Switzerland No in-house WAF team needed

Use Cases Managed Service Architecture Getting Started Pricing FAQ

Use cases

Sound familiar?

“We want protection, but not our own security team for it.”

How Airlock helps

We install the Airlock Microgateway operator, create the Gateways and run them for you, including monitoring, patching and licence management. Your team owns the routing and security policies in its own namespaces.

“Our data must not leave Switzerland.”

How Airlock helps

The firewall runs directly in your Managed Kubernetes cluster, in our data centres in Switzerland. There is no external WAF provider in between, and your traffic takes no detour.

“Our web app and APIs are a target.”

How Airlock helps

Airlock Microgateway protects your workloads against common web attacks, including the OWASP Top 10. Add Airlock policies such as traffic filtering, header rewriting and rate limiting per route.

“Our APIs need more than a port filter.”

How Airlock helps

Requests are validated against your OpenAPI specification or GraphQL schema. Access control with OIDC and JWT runs directly at the Gateway, and identity information is passed on to your backend for single sign-on.

And you can see what happens: Every request is logged as structured JSON, including whether it was allowed or blocked. With Loki enabled, you query the access logs in Grafana. And you can show custom error pages to your visitors.

Managed Service

You take care of your app. We take care of the firewall.

Airlock Microgateway is not self-service at the moment. We set it up together with you, then we run it.

We handle

Install the Airlock Microgateway operator on your Managed Kubernetes cluster

Create and run the Gateways in the nine-system namespace, each with its own load balancer IP and a stable hostname

Let’s Encrypt issuers: certificates for your domains are issued and renewed automatically

Monitoring, patching and licence management of the operator

You decide

Which applications are routed through a Gateway, with ListenerSet and HTTPRoute in your own namespace

Which Airlock policies apply, and what is allowed or blocked

Architecture

How it all fits together

Airlock Gateway

Managed Kubernetes →

Runs in the nine-system namespace on your Managed Kubernetes cluster, managed by us

Your application →

Attached via ListenerSet and HTTPRoute in your own namespace

Loki & Grafana →

Access logs and observability, if enabled on your cluster

Your application, the WAF inspection and the underlying hardware all run on our own infrastructure in Swiss data centres.

Getting started

Protected in four steps

01
Conversation
We clarify your expected request volume and your requirements.
02
Setup
We install the operator and create your Gateways, including automatic TLS certificates.
03
Connection
You attach your apps via the Gateway API, set your policies and point your domains at the Gateway.
04
Operations
We run the operator and the Gateways for you.

Pricing

You pay by number of requests

up to 1M requests / month CHF 427.–

up to 2M requests / month CHF 520.–

up to 5M requests / month CHF 720.–

up to 10M requests / month CHF 933.–

Test environments from CHF 42.70

Requests are cumulated across all production Gateways. Staging and test environments have their own tiers (up to 1M requests per month, cumulated across all non-production Gateways). All tiers in the Price Calculator. More than 10M requests per month? Talk to us.

Trust

Swiss product, Swiss operations

Airlock by Ergon, Switzerland ISO 9001 ISO/IEC 27001 Our own hardware instead of hyperscalers No third-country transit

«Nine supported us optimally with their Managed Kubernetes solution to migrate our client's application to Kubernetes.»

Silvan MühlemannCTO & Co-Founder

«We can highly recommend Nine as an uncomplicated, highly professional provider.»

Dominik EistererManaging Director

«Thanks to collaboration with Nine, we can focus on what we do best: developing software solutions for healthcare.»

Moritz HabeggerCTO

Case studies: Keera Demokratis swissICT Salary Survey View All →

FAQ

Frequently asked questions

Can I order Airlock myself?

Not yet. Get in touch and we’ll install the operator and set up the Gateways on your Managed Kubernetes cluster.

Do I need to change my application?

Your application itself stays unchanged. Routing does change: Airlock Microgateway is configured exclusively through the Kubernetes Gateway API and does not work with Ingress resources, so you route traffic with ListenerSet and HTTPRoute instead.

Do I need a sidecar in my pods?

No. Airlock Microgateway runs sidecarless via the Kubernetes Gateway API, as a standalone Gateway that we operate, not as a sidecar container in your application pods.

Who takes care of TLS certificates?

We set up Let’s Encrypt issuers on your cluster. You add an annotation to your ListenerSet and certificates are issued and renewed automatically.

Can I start in a test environment first?

Yes, there are dedicated, cheaper tiers from CHF 42.70 per month. For testing, we recommend the airlock-letsencrypt-staging issuer to avoid Let’s Encrypt rate limits, then switch to airlock-letsencrypt-production for real certificates.

Does it work for multiple applications?

Yes. There is one operator per Managed Kubernetes cluster, and it can back as many Gateways as you need, for example one per environment.

Can I see what was blocked?

Yes. Every request is logged with a request ID and its decision. With Loki enabled on your cluster, you see the access logs in Grafana.

Does plain HTTP traffic also run through the Gateway?

Yes. Each Gateway comes with a built-in HTTP listener on port 80, which you can attach an HTTPRoute to directly, without a ListenerSet. The same port is used to solve Let’s Encrypt HTTP01 challenges.

Do you support Red Hat OpenShift?

No. Managed Kubernetes is not based on OpenShift, so a Red Hat OpenShift certification for Airlock Microgateway is not relevant for us.

Technical questions? You’ll find the details in the documentation.

From the docs

Go deeper on docs.nine.ch

All Managed Kubernetes docs

Airlock Microgateway →How we run the operator and Gateways on Managed Kubernetes. Custom error responses →Replace error pages with CustomResponse and CustomResponsePolicy. Access logs →Query allowed and blocked requests in Grafana with Loki. Ingress →The HAProxy ingress controller we use elsewhere on Managed Kubernetes. Loki →Collect logs from your Managed Kubernetes cluster. Grafana →Dashboards and log queries for your cluster.

One provider

One provider, from rack to app.

From colocation to Root and Managed Products, platforms and services: all with us, in our Swiss data centres. The highlighted layer is this page. Grow from one layer to the next without switching providers.

One Swiss teamGrow without switching providers

Services

Databases OpenSearch SLA Monitoring Managed Services Cloudflare

Platform Products

Deploio vCluster Airlock Microgateway WAF

Managed Products

Managed Dedicated Server Managed Virtual Server Managed GPU Server Managed Kubernetes

Root Products

Root Dedicated Server Root CloudVM Root GPU Server

Storage & Backup

Object Storage

Colocation & Housing