For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Explore options to troubleshoot WAFPolicy configurations to find out why requests are blocked unexpectedly, are not blocked when expected, and WAF-related 500 errors are returned.

Step 1: Inspect WAFPolicy status

Get the details of the WAFPolicy to verify whether the policy is accepted and attached to the correct HTTPRoute.

kubectl describe wafpolicy <name> -n <namespace>

Look for the following information:

• status.conditions[type=Ready]:
  • True: The waf-server accepted the policy.
  • False: The policy compilation failed. Review the message field to find more details about the error.
• status.ancestors: Confirm that the policy is attached to the expected EnterpriseKgatewayTrafficPolicy.

Invalid policies are handled fail-closed and cause 500 HTTP response errors on the affected route.

Step 2: Inspect waf-server logs

Use these logs for policy sync errors, rule compilation failures, and blocked-request details.

kubectl logs deploy/waf-server-enterprise-kgateway -n kgateway-system 

You can optionally increase the log verbosity to get more detailed logs by setting the logLevel: debug in the EnterpriseKgatewayParameters resource as shown in the following example configuration.

kubectl apply -f- <<EOF
apiVersion: enterprisekgateway.solo.io/v1alpha1
kind: EnterpriseKgatewayParameters
metadata:
  name: enterprise-kgateway-params
  namespace: kgateway-system
spec:
  kube:
    sharedExtensions:
      waf:
        enabled: true
        logLevel: debug
EOF

Step 3: Inspect controller logs

Inspect the Solo Enterprise for kgateway logs when the WAFPolicy does not seem to take affect. Common issues include a missing or unresolved WAFPolicyRef.

kubectl logs deploy/enterprise-kgateway -n kgateway-system

Step 4: Enable waf-server pprof

If you experience performance-related issues with your waf-server, such as unexpected CPU and memory consumption or slow requests, you can the profiling tools that are built into Go. These tools look at runtime data, such as CPU and memory allocation, goroutine stacks, and execution traces.

1. Enable the WAF admin server.

   kubectl apply -f- <<EOF
   apiVersion: enterprisekgateway.solo.io/v1alpha1
   kind: EnterpriseKgatewayParameters
   metadata:
     name: waf-params
     namespace: default
   spec:
     kube:
       sharedExtensions:
         waf:
           enabled: true
           admin:
             enabled: true
   EOF

2. Port-forward to the waf-server pod on port 9095.

   kubectl port-forward -n kgateway-system deploy/waf-server-enterprise-kgateway 9095:9095

3. Choose between the following endpoints to capture your profile.

   `http://127.0.0.1:9095/debug/pprof/`
   `http://127.0.0.1:9095/debug/pprof/profile`
   `http://127.0.0.1:9095/debug/pprof/trace`

4. Use Go profiling tools to analyze your output.

   go tool pprof