NGINX Gateway Fabric: WAFPolicy로 F5 WAF 정책 적용

$ kubectl get gatewayclass

NAME    CONTROLLER                                   ACCEPTED   AGE
nginx   gateway.nginx.org/nginx-gateway-controller   True       2d23h

$ kubectl get pods -n nginx-gateway

NAME                                        READY   STATUS    RESTARTS   AGE
ngf-nginx-gateway-fabric-76bcf4cc77-ft6h9   1/1     Running   0          2d23h

$ kubectl get deployments -n nginx-gateway

NAME                       READY   UP-TO-DATE   AVAILABLE   AGE
ngf-nginx-gateway-fabric   1/1     1            1           2d23h

$ kubectl get svc -n nginx-gateway

NAME                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
ngf-nginx-gateway-fabric   ClusterIP   10.108.114.119   <none>        443/TCP   2d23h

$ mkdir -p /etc/docker/certs.d/private-registry.nginx.com
$ cp <path-to-your-nginx-repo.crt> /etc/docker/certs.d/private-registry.nginx.com/client.cert
$ cp <path-to-your-nginx-repo.key> /etc/docker/certs.d/private-registry.nginx.com/client.key

$ helm list -n nginx-gateway

NAME    NAMESPACE       REVISION        UPDATED                                 STATUS          CHART                           APP VERSION
ngf     nginx-gateway   2               2026-06-19 10:21:38.276932496 +0900 KST deployed        nginx-gateway-fabric-2.6.5      2.6.5  

$ helm upgrade ngf oci://ghcr.io/nginx/charts/nginx-gateway-fabric \
  -n nginx-gateway \
  --set nginx.image.repository=private-registry.nginx.com/nginx-gateway-fabric/nginx-plus-f5waf \
  --set nginx.plus=true \
  --set nginx.config.waf.enable=true \
  --set nginx.imagePullSecret=nginx-plus-registry-secret

Pulled: ghcr.io/nginx/charts/nginx-gateway-fabric:2.6.5
Digest: sha256:6a799f2a46f78db8790bd6e927ace8ee7699940654f3cee667ceeea465894ee9
Release "ngf" has been upgraded. Happy Helming!
NAME: ngf
LAST DEPLOYED: Fri Jun 19 10:21:38 2026
NAMESPACE: nginx-gateway
STATUS: deployed
REVISION: 3
TEST SUITE: None

$ helm get values ngf -n nginx-gateway

USER-SUPPLIED VALUES:
nginx:
  config:
    waf:
      enable: true
  image:
    repository: private-registry.nginx.com/nginx-gateway-fabric/nginx-plus-f5waf
  imagePullSecret: nginx-plus-registry-secret
  plus: true

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app1
  template:
    metadata:
      labels:
        app: app1
    spec:
      containers:
      - name: app1
        image: nginxdemos/nginx-hello:plain-text
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: app1
spec:
  selector:
    app: app1
  ports:
  - name: http
    port: 80
    targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app2
  template:
    metadata:
      labels:
        app: app2
    spec:
      containers:
      - name: app2
        image: nginxdemos/nginx-hello:plain-text
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: app2
spec:
  selector:
    app: app2
  ports:
  - name: http
    port: 80
    targetPort: 8080

$ kubectl apply -f apps.yaml

$ kubectl get deployment,pods,svc

NAME                                   READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/app1                   1/1     1            1           2d23h
deployment.apps/app2                   1/1     1            1           2d23h
NAME                                        READY   STATUS    RESTARTS   AGE
pod/app1-8455b5554c-tqrwx                   1/1     Running   0          2d23h
pod/app2-657c5d4769-2lml5                   1/1     Running   0          2d23h
NAME                           TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
service/app1                   ClusterIP      10.111.215.35   <none>        80/TCP         2d23h
service/app2                   ClusterIP      10.96.139.192   <none>        80/TCP         2d23h

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shared-gateway
spec:
  gatewayClassName: nginx
  listeners:
  - name: http
    port: 80
    protocol: HTTP

$ kubectl apply -f gateway.yaml

$ kubectl get gateway shared-gateway
$ kubectl describe gateway shared-gateway

NAME             CLASS   ADDRESS   PROGRAMMED   AGE
shared-gateway   nginx             True         2d23h

...
Status:
  Conditions:
    Message:               The Gateway is accepted
    Reason:                Accepted
    Status:                True
    Type:                  Accepted
    Message:               The Gateway is programmed
    Reason:                Programmed
    Status:                True
    Type:                  Programmed
...

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app1-route
spec:
  parentRefs:
  - name: shared-gateway
  hostnames:
  - "app1.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: app1
      port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app2-route
spec:
  parentRefs:
  - name: shared-gateway
  hostnames:
  - "app2.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: app2
      port: 80

$ kubectl apply -f httproutes.yaml

$ kubectl get httproute

NAME         HOSTNAMES              AGE
app1-route   ["app1.example.com"]   8m40s
app2-route   ["app2.example.com"]   8m40s

$ kubectl describe httproute app1-route
$ kubectl describe httproute app2-route

apiVersion: v1
kind: ConfigMap
metadata:
  name: waf-policy-definitions
data:
  attack-signatures-blocking.json: |
    {
      "policy": {
        "name": "attack-signatures-blocking",
        "template": {
          "name": "POLICY_TEMPLATE_NGINX_BASE"
        },
        "applicationLanguage": "utf-8",
        "enforcementMode": "blocking",
        "signature-sets": [
          {
            "name": "All Signatures",
            "block": true,
            "alarm": true
          }
        ]
      }
    }

$ kubectl apply -f waf-policy-definitions.yaml

$ kubectl get configmap waf-policy-definitions

NAME                     DATA   AGE
waf-policy-definitions   1      53s

apiVersion: apps/v1
kind: Deployment
metadata:
  name: bundle-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: bundle-server
  template:
    metadata:
      labels:
        app: bundle-server
    spec:
      imagePullSecrets:
        - name: nginx-plus-registry-secret
      initContainers:
        - name: compile-attack-signatures
          image: private-registry.nginx.com/nap/waf-compiler:5.13.1
          args:
            - -p
            - /policies/attack-signatures-blocking.json
            - -o
            - /bundles/attack-signatures-blocking.tgz
          volumeMounts:
            - name: policies
              mountPath: /policies
            - name: bundles
              mountPath: /bundles
      containers:
        - name: bundle-server
          image: nginx:alpine
          ports:
            - containerPort: 80
          volumeMounts:
            - name: bundles
              mountPath: /usr/share/nginx/html
      volumes:
        - name: policies
          configMap:
            name: waf-policy-definitions
        - name: bundles
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: bundle-server
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
      name: http
  selector:
    app: bundle-server

$ kubectl apply -f bundle-server.yaml

$ kubectl get deployments bundle-server
$ kubectl get pods -l app=bundle-server
$ kubectl get svc bundle-server

NAME                   READY   UP-TO-DATE   AVAILABLE   AGE
bundle-server          1/1     1            1           30s
NAME                            READY   STATUS    RESTARTS   AGE
bundle-server-6645858f5-ddwsp   1/1     Running   0          46s
NAME            TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
bundle-server   ClusterIP   10.97.208.228   <none>        80/TCP    52s

apiVersion: gateway.nginx.org/v1alpha1
kind: WAFPolicy
metadata:
  name: gateway-waf-policy
spec:
  type: HTTP
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: shared-gateway
  policySource:
    httpSource:
      url: http://bundle-server.default.svc.cluster.local/attack-signatures-blocking.tgz # url의 형태는 "Service 이름.namespace.svc.cluster.local.앞에서 waf-compiler가 만든 WAF bundle 파일 이름" 입니다.
  securityLogs:
    - destination:
        type: stderr
      logSource:
        defaultProfile: log_blocked

$ kubectl apply -f gateway-waf-policy.yaml

$ kubectl get wafpolicy gateway-waf-policy

NAME                 AGE
gateway-waf-policy   7s

$ curl -H "Host: app1.example.com" http://127.0.0.1:8080/
$ curl -H "Host: app2.example.com" http://127.0.0.1:8080/

Server address: 10.244.49.159:8080
Server name: app1-8455b5554c-tqrwx
Date: 22/Jun/2026:02:50:58 +0000
URI: /
Request ID: 83859c7d3e2ef9578143db326c8206f9
Server address: 10.244.49.163:8080
Server name: app2-657c5d4769-2lml5
Date: 22/Jun/2026:02:50:58 +0000
URI: /
Request ID: 13a977dcf08ef999965b3962ec403888

$ curl -H "Host: app1.example.com" \
  "http://127.0.0.1:8080/?q=<script>alert(1)</script>"
$ curl -H "Host: app2.example.com" \
  "http://127.0.0.1:8080/?q=<script>alert(1)</script>"

<html><head><title>Request Rejected</title></head>
<body>
The requested URL was rejected. Please consult with your administrator.
Your support ID is: 5853220945358267012
</body></html>

$ kubectl logs shared-gateway-nginx-7dd5fb469d-dl8sg -n default --all-containers=true | grep 5853220945358267012

request_status="blocked"
outcome="REJECTED"
outcome_reason="SECURITY_WAF_VIOLATION"
policy_name="attack-signatures-blocking"
support_id="5853220945358267012"
severity="Critical"
violations="Illegal meta character in value,Attack signature detected,Violation Rating Threat detected,Bot Client Detected"
sig_names="XSS script tag end (Parameter) (2),XSS script tag (Parameter),alert() (Parameter)..."