---
title: "Enable Gateway WAF"
description: "Turn Gateway WAF on or off by setting the operator GatewayAPI CR's extensions.waf.state field."
product: "Calico Cloud"
version: "v24.0.0"
section: "Threat defense"
canonical_url: "https://docs.tigera.io/calico-cloud/threat/gateway-waf/enable"
---

# Enable Gateway WAF

> **SECONDARY:** This feature is tech preview. Tech preview features may be subject to significant changes before they become GA.

Gateway WAF is off by default. Turning it on is a one-line change to the operator's `GatewayAPI` CR — no new workload is deployed, so there's no extra resource footprint to plan for.

## Prerequisites

- Your cluster is connected to Calico Cloud.
- Calico Ingress Gateway is already set up. See [About Calico Ingress Gateway](https://docs.tigera.io/calico-cloud/networking/ingress-gateway/about-calico-ingress-gateway.md).
- Cluster-admin rights — the `GatewayAPI` CR is a cluster-scoped operator resource.

> **SECONDARY:** Customer-installed (BYO) Envoy Gateway is not supported. Gateway WAF requires the Ingress Gateway that Calico Cloud manages.

## Enable Gateway WAF

1. Set `spec.extensions.waf.state` to `Enabled` on the `GatewayAPI` resource named `tigera-secure`, which you created when you set up the ingress gateway. The default is `Disabled`.

   ```bash
   kubectl patch gatewayapi tigera-secure --type merge -p '{"spec":{"extensions":{"waf":{"state":"Enabled"}}}}'
   ```

   The operator installs the six WAF CRDs and the validating admission webhook, and wires the WAF reconcilers into the existing `calico-kube-controllers` pod in `calico-system`. No new workload is deployed.

2. Confirm the six CRDs are installed:

   ```bash
   kubectl get crd | grep applicationlayer.projectcalico.org
   ```

   ```text
   globalwafplugins.applicationlayer.projectcalico.org
   globalwafpolicies.applicationlayer.projectcalico.org
   globalwafvalidationpolicies.applicationlayer.projectcalico.org
   wafplugins.applicationlayer.projectcalico.org
   wafpolicies.applicationlayer.projectcalico.org
   wafvalidationpolicies.applicationlayer.projectcalico.org
   ```

   All six must be present before you create any WAF resources.

3. Confirm the admission webhook is active:

   ```bash
   kubectl get validatingwebhookconfigurations | grep waf
   ```

   You should see one entry. If it's absent, check the `calico-kube-controllers` pod logs in the `calico-system` namespace.

## Disable Gateway WAF

Set `spec.extensions.waf.state` back to `Disabled` on the same `GatewayAPI` resource to turn the feature off:

```bash
kubectl patch gatewayapi tigera-secure --type merge -p '{"spec":{"extensions":{"waf":{"state":"Disabled"}}}}'
```

The operator removes the admission webhook and stops the WAF reconcilers; existing `WAFPolicy`, `GlobalWAFPolicy`, and other WAF resources stay on the cluster but are no longer reconciled or enforced until you re-enable the feature.

## Next steps

- [Tutorial](https://docs.tigera.io/calico-cloud/threat/gateway-waf/tutorial.md) — deploy a test app and block your first attack.
- [Set a cluster-wide baseline for Gateway WAF](https://docs.tigera.io/calico-cloud/threat/gateway-waf/set-a-baseline.md) — start your production rollout.