Skip to main content
Calico Cloud documentation

Enable Gateway WAF

note

This feature is tech preview. Tech preview features may be subject to significant changes before they become GA.

Gateway WAF is off by default. Turning it on is a one-line change to the operator's GatewayAPI CR — no new workload is deployed, so there's no extra resource footprint to plan for.

Prerequisites​

  • Your cluster is connected to Calico Cloud.
  • Calico Ingress Gateway is already set up. See About Calico Ingress Gateway.
  • Cluster-admin rights — the GatewayAPI CR is a cluster-scoped operator resource.
note

Customer-installed (BYO) Envoy Gateway is not supported. Gateway WAF requires the Ingress Gateway that Calico Cloud manages.

Enable Gateway WAF​

  1. Set spec.extensions.waf.state to Enabled on the GatewayAPI resource named tigera-secure, which you created when you set up the ingress gateway. The default is Disabled.

    kubectl patch gatewayapi tigera-secure --type merge -p '{"spec":{"extensions":{"waf":{"state":"Enabled"}}}}'

    The operator installs the six WAF CRDs and the validating admission webhook, and wires the WAF reconcilers into the existing calico-kube-controllers pod in calico-system. No new workload is deployed.

  2. Confirm the six CRDs are installed:

    kubectl get crd | grep applicationlayer.projectcalico.org
    globalwafplugins.applicationlayer.projectcalico.org
    globalwafpolicies.applicationlayer.projectcalico.org
    globalwafvalidationpolicies.applicationlayer.projectcalico.org
    wafplugins.applicationlayer.projectcalico.org
    wafpolicies.applicationlayer.projectcalico.org
    wafvalidationpolicies.applicationlayer.projectcalico.org

    All six must be present before you create any WAF resources.

  3. Confirm the admission webhook is active:

    kubectl get validatingwebhookconfigurations | grep waf

    You should see one entry. If it's absent, check the calico-kube-controllers pod logs in the calico-system namespace.

Disable Gateway WAF​

Set spec.extensions.waf.state back to Disabled on the same GatewayAPI resource to turn the feature off:

kubectl patch gatewayapi tigera-secure --type merge -p '{"spec":{"extensions":{"waf":{"state":"Disabled"}}}}'

The operator removes the admission webhook and stops the WAF reconcilers; existing WAFPolicy, GlobalWAFPolicy, and other WAF resources stay on the cluster but are no longer reconciled or enforced until you re-enable the feature.

Next steps​