Enable the WAF server

Deploy the WAF server as a shared extension and enable it for a GatewayClass.

Before you begin

1. Follow the Get started guide to install Solo Enterprise for kgateway.

2. Follow the Sample app guide to create a gateway proxy with an HTTP listener and deploy the httpbin sample app.

3. Get the external address of the gateway and save it in an environment variable.

   export INGRESS_GW_ADDRESS=$(kubectl get svc -n kgateway-system http -o jsonpath="{.status.loadBalancer.ingress[0]['hostname','ip']}")
   echo $INGRESS_GW_ADDRESS  

   kubectl port-forward deployment/http -n kgateway-system 8080:8080

Enable the WAF server

WAF is a shared extension that runs as a dedicated waf-server deployment alongside the gateway proxy. You enable the WAF server by configuring an EnterpriseKgatewayParameters resource and referencing that resource from a GatewayClass.

1. Create an EnterpriseKgatewayParameters resource with WAF enabled.

   kubectl apply -f- <<EOF
   apiVersion: enterprisekgateway.solo.io/v1alpha1
   kind: EnterpriseKgatewayParameters
   metadata:
     name: enterprise-kgateway-params
     namespace: kgateway-system
   spec:
     kube:
       sharedExtensions:
         waf:
           enabled: true
   EOF

2. Reference the EnterpriseKgatewayParameters from your GatewayClass.

   In this example, you enable WAF for the enterprise-kgateway GatewayClass. When you followed the Install sample app guide, you already have a gateway proxy deployed that uses this GatewayClass. The WAF server is automatically deployed alongside your gateway proxy. If you decide to use a different GatewayClass, you must create a Gateway resource that uses this GatewayClass also so that the WAF server is deployed.

   kubectl apply -f- <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: GatewayClass
   metadata:
     name: enterprise-kgateway
   spec:
     controllerName: solo.io/enterprise-kgateway
     parametersRef:
       group: enterprisekgateway.solo.io
       kind: EnterpriseKgatewayParameters
       name: enterprise-kgateway-params
       namespace: kgateway-system
   EOF

3. Verify that the waf-server is deployed.

   kubectl get deploy -n kgateway-system -l app.kubernetes.io/name=waf-server

   Example output:

   NAME         READY   UP-TO-DATE   AVAILABLE   AGE
   waf-server   1/1     1            1           30s

Next steps

With WAF enabled, create a WAFPolicy and attach it to your routes.