Ingress DDoS Protection in Gateway API¶

Introduction¶

The Ingress DDoS Protection in Gateway API improves the Gateway API for Kubernetes by preventing DDoS attacks. It supports global DDoS policies at different levels, including GatewayClass, Gateway, and Route. The strategies protect Layer 4 DDoS attacks for protocols such as HTTP, TCP, and UDP, ensuring better control over incoming traffic. This section provides information about Gateway API support for Ingress DDoS Protection.

For more details on FLO, see Install F5 Lifecycle Operator (FLO)

GatewayClass¶

You can apply the GatewayClass resource to the cluster to integrate with the F5 Controller. This allows the controller to manage the resources of GatewayClass. Also ensure that BNK is also deployed in the same namespace of the cluster.

Sample GatewayClass CR¶

Note: Make sure the name of the Gateway Class resource deployed in the cluster matches the name specified in the targetref field of the DDoS customer resource.

This sample code shows gateway-class a custom GatewayClass, which is managed by the f5.com/default-f5-gateway-controller. Here, default indicates the namespace.

Sample: Define GatewayClass

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: gateway-class
spec:
  controllerName: "f5.com/default-f5-gateway-controller"
  description: "F5 BIG-IP Kubernetes Gateway"

Applying GatewayClass to a cluster¶

To apply a GatewayClass,

Create a yaml file by copying the above sample code.
Save the file. For example, <GatewayClass>.yaml
Execute the below command to apply the resource in the default namespace.
```
kubectl apply -f <GatewayClass>.yaml
```

Verifying GatewayClass¶

To verify if the GatewayClass was created successfully, execute the below command.

kubectl get gatewayclass

Output Example:

NAME             CONTROLLER
gateway-class    f5.com/default-f5-gateway-controller

Global DDoS policy¶

The GatewayClass attaches the DDoS policy to the global context (F5BigDdosGlobal) configured in TMM. As the Gateway Class object is a cluster-wide resource, by default, the DDoS policy will affect the entire cluster.

To integrate Global DDoS policy with Gateway API you must:

Create Global DDoS policy CR with the targetRef field.
Attach Global DDoS Policy to Gateway API using direct policy attachment.

Note: Gateway class is required for Global DDoS policy to be configured and applied to the cluster.

Sample Global DDoS policy CR¶

Sample: This sample code shows how the targetRef attribute is defined to refer to the GatewayClass.

Sample: DDoS policy with targetRef parameter

apiVersion: "k8s.f5net.com/v1"
kind: F5BigDdosGlobal
metadata:
   name: "gateway-global-ddos"
   namespace: alpha
spec:
   hslPublisher: "hsl-pub"
   targetRef:
     group: "gateway.networking.k8s.io"
     name: "f5-gateway-class"
     kind: GatewayClass
   dosGlobalOptions:
     common:
       forceSwDos: true
   vectors:
     arpFlood:
      state: "mitigation"
      rateLimit: 20
      detectionThresholdEps: 20
     ipv4IcmpFlood:
      state: "mitigation"
      rateLimit: 20
      detectionThresholdEps: 30
      perDstIpLimitEps: 10
     ipv6IcmpFlood:
      state: "mitigation"
      rateLimit: 20
      detectionThresholdEps: 30
      perDstIpLimitEps: 10
     ipv4BadSrc:
      detectionThresholdEps: 20

Applying the resource file¶

Create a yaml file by copying the above sample code.
Save the file. For example, <GlobalDdosCR>.yaml
Execute the below command to apply the resource in the default namespace.
```
kubectl apply -f <GlobalDdosCR>.yaml
```

Verify Global DDoS status¶

To verify the status of resource in Kubernetes, execute the below command.

kubectl describe f5bigddosglobal.k8s.f5net.com/test-gw-class

Note: Make sure f5bigddosglobal CRD (f5bigddosglobal.k8s.f5net.com) exists in Kubernetes cluster and test-gw-class exists in the appropriate namespace.

Output Examples

Error status

Status:
  Conditions:
    Last Transition Time:  2025-03-05T00:36:48Z
    Message:              
    Observed Generation:   0
    Reason:                Accepted
    Status:                True
    Type:                  Accepted
    Last Transition Time:  2025-03-05T00:36:48Z
    Message:               Failure in sending CR config to grpc endpoints
    Observed Generation:   2
    Reason:                Failed
    Status:                False
    Type:                  Programmed

Successful status

Status:
  Conditions:
    Last Transition Time:  2025-03-05T00:57:50Z
    Message:              
    Observed Generation:   0
    Reason:                Accepted
    Status:                True
    Type:                  Accepted
    Last Transition Time:  2025-03-05T00:57:50Z
    Message:               CR config sent to all grpc endpoints
    Observed Generation:   2
    Reason:                Programmed
    Status:                True
    Type:                  Programmed

Global DDoS policy parameters¶

You can use these essential parameters to configure the DDoS policy, which can be attached to the global context.

The list of parameters in spec and status section.

Parameter	Description	Default Value
`targetRef`	Refers to the target resource to which the policy is applied.
`targetRef.group`	Specifies the resource group.	`gateway.networking.k8s.io`
`targetRef.name`	Specifies the target name.	gateway-class
`targetRef.kind`	Specifies the target resource.	GatewayClass

You can refer to F5BigDdosGlobal CRD for additional parameter description.

Referred CRs¶

The two major crs associated with F5BigDdosGlobal,