Firewall Policy in Gateway API

Introduction

Gateway resources can be configured to attach F5-specific firewall policies. This allows you to define ingress traffic rules, ensuring that data (traffic) is processed and flows securely through the data path.

This section shows how the Gateway API supports firewall policies. The policy is attached to Gateway API objects via BNKSecPolicy by configuring the targetRefs and extensionRefs sections. The F5 Controller handles the ACL policies configured using Gateway API objects.

You can define a logging policy in a dedicated namespace that targets Gateway or EgressGateway resources across multiple namespaces. This allows you to reuse a single logging configuration centrally, rather than duplicating it in each namespace.

For more details, refer to:

• F5 Lifecycle Operator

• Gateway API

About F5BigFwPolicy CRD

The F5BigFwPolicy Custom Resource (CR) applies industry-standard firewall rules to the Traffic Management Microkernel (TMM), ensuring that only connections initiated by trusted clients will be accepted. When applying a new F5BigFwPolicy CR configuration, firewall rules are first sent to the Application Firewall Management (AFM) Pod to be compiled into a binary large object (BLOB), improving processing performance. Once the firewall BLOB is compiled, it is sent to the TMM Proxy Pod to begin inspecting and filtering network packets.

To integrate Gateway API, the targetRefs field must be added for direct policy attachment, according to GEP 2648: Direct Policy Attachment .

Refer to F5BigFWPolicy.

SecPolicy

The SecPolicy CR supports general extensions. Refer to SecPolicy for additional details.

Sample SecPolicy CR

This YAML configuration defines a custom resource of kind SecPolicy, which specifies security policies to be applied to targeted Gateway resources using the F5 controller.

This resource attaches a F5BigFwPolicy named fwpolicy1 to:

• The Gateway mygw in the namespace gatewayns.

• Specifically, the listener section myhttp2 on the Gateway.

apiVersion: "gateway.k8s.f5.com/v1"
kind: SecPolicy
metadata:
  name: mySecPolicy
  namespace: gatewayns
spec:
  extensionRefs:
  - kind: F5BigFwPolicy
    name: fwpolicy1
    group: k8s.f5net.com
  targetRefs:
  - kind: Gateway
    name: mygw
    group: gateway.networking.k8s.io
    sectionName: "myhttp2"

About F5GlobalOptions

The F5GlobalOptions CRD is used to configure multiple behaviors at the global level, such as the default action to apply on traffic.

Refer to F5GlobalOptions.

This table summarizes the roles and relationships of CRs

CR	Description	Scope
GatewayClass	Defines the controller responsible for managing gateways.	Can manage multiple Gateways and associates with one SecPolicy.
Gateway	Handles external traffic and routes it through multiple Listeners or applies SecPolicies for security.	Can associate one SecPolicy with multiple Listeners in a Gateway.
Gateway Listener	Specifies port, protocol, and traffic routing configuration for the Gateway.	Can associate one SecPolicy with specific Listeners.
SecPolicy	Applies security policies to Gateways or Listeners and bridges them with firewall rules.	Can integrate one F5BigFwPolicy with one Gateway or multiple Gateways/Listeners.
F5BigFwPolicy	Defines detailed firewall rules, including action, source/destination IPs, ports, and protocol.	Can associate with multiple SecPolicies.

Applying Gateway, SecPolicy and F5BigFwPolicy CR

• Apply the CR files using kubectl apply command in the specific namespace.

kubectl apply -n <namespace> -f <filename>.yaml

For Example

kubectl apply -n appns-1 -f my-f5bigfwpolicy.yaml

Note:

• The GatewayClass CR is cluster scoped, thus it will not be in any namespace.

• The SecPolicy and F5BigFwPolicy must be in the same namespace as the Gateway CR if SecPolicy is targeting a Gateway.

• The SecPolicy and the F5BigFwPolicy must be in the controller’s namespace if the SecPolicy is targeting a GatewayClass.

• The SecPolicy, FWBigFWPolicy and Gateway must be in the controller’s namespace if SecPolicy is targeting GatewayClass and Gateway.

Deleting Gateway, SecPolicy and F5BigFwPolicy CR

• Delete the CR files using kubectl delete command in the specific namespace.

kubectl delete -n <namespace> -f <filename>.yaml

For Example

kubectl delete -n appns-1 -f my-f5bigfwpolicy.yaml

Editing Gateway, SecPolicy and F5BigFwPolicy CR

• Delete the CR.

• Modify the .yaml file for the specific CR.

• Apply the CR.

Use cases

The use cases are defined based on the scope of the firewall policy.

• Global firewall Policy

• Listener-Specific firewall Policy

• Gateway-Wide firewall Policy

Use case	Firewall policy scope	Target	Target reference fields in SecPolicy	TMM Attachment point	Behavior
Global firewall Policy	Global Context	GatewayClass	name field: Specifies the GatewayClass name. sectionName field: Not applicable	Attached to the Global Context in all TMMs (Traffic Management Microkernel) across the cluster.	Applies cluster-wide ACL rules to all TMMs, independent of specific Gateways or Listeners.
Listener-Specific firewall Policy	Listener-Specific Context	Gateway Listener	name field: Specifies the Gateway name. sectionName field: Specifies the Listener name within the Gateway (e.g., http, https).	Attached only to ingress Virtual Servers corresponding to the specified Gateway Listener.	ACL rules are applied to inbound traffic for the specific Listener. Overrides gateway-wide ACL policies for the Listener’s ingress traffic.
Gateway-Wide firewall Policy	Gateway-Wide Context	Entire Gateway	name field: Specifies the Gateway name. sectionName field: No specific section is targeted if this field is empty.	Attached to ingress and egress Virtual Servers corresponding to the Gateway.	ACL rules apply to all traffic for the Gateway. Listener-specific ACL policies supersede these rules for ingress Virtual Servers tied to those Listeners.

Using SecPolicy, you can attach ‌targets with specific namespace requirements for each scenario. Each scenario ensures namespace consistency and proper resource scoping to prevent cross-namespace violations or misconfigurations.

• GatewayClass: When the SecPolicy is attached to a GatewayClass, both the SecPolicy and F5BigFwPolicy custom resources (CRs) must be created in the Controller’s namespace.

• Gateway: When the SecPolicy is attached to a Gateway, both the SecPolicy and F5BigFwPolicy CRs must be created in the same namespace as the Gateway CR.

• Gateway Listener (a section in the Gateway CR): When the SecPolicy is attached to a specific section of a Gateway (referred to as a Gateway Listener), both the SecPolicy and F5BigFwPolicy CRs must be created in the same namespace as the Gateway CR.

Global firewall Policy

This section provides sample YAML files to configure Kubernetes Gateway, a security policy and a firewall rule. This allows you to attach the firewall policy to the Global Context in all TMMs in the cluster.

GatewayClass

• Defines a custom GatewayClass named my-gatewayclass.

• Links to the F5 BIG-IP Controller (f5.com/controller-ns-f5-cne-controller).

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: my-gatewayclass
spec:
  controllerName: f5.com/controller-ns-f5-cne-controller
  description: F5 BIG-IP Kubernetes Gateway

SecPolicy

• Creates SecPolicy named global-secpolicy in the controller-ns namespace.

• Associates a security policy (my-global-firewall-policy) with the my-gatewayclass.

• Targets the entire GatewayClass for implementing all the security policies.

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: SecPolicy
metadata:
  name: global-secpolicy
  namespace: controller-ns
spec:
  extensionRefs:
  - name: my-global-firewall-policy
	kind: F5BigFwPolicy
  targetRefs:
  - kind: GatewayClass
    name: my-gatewayclass
    sectionName: ''

F5BigFwPolicy

• Creates a firewall policy my-global-firewall-policy in the controller-ns namespace.

• Includes a rule allowing all TCP traffic. The name of the rule is tcp-acceptmy-global-firewall-policy

apiVersion: k8s.f5net.com/v1
kind: F5BigFwPolicy
metadata:
  name: my-global-firewall-policy
  namespace: controller-ns
spec:
  rule:
  - action: accept
    destination:
      addresses:
      - 0.0.0.0/0
      ports:
      - '8000'
    ipProtocol: tcp
    logging: true
    name: tcp-acceptmy-global-firewall-policy
    source:
      addresses:
      - 0.0.0.0/0

Listener-Specific firewall Policy

This section provides sample YAML files to configure a listener-specific ACL policy by attaching a F5BigFwPolicy to a Gateway Listener via a SecPolicy.

GatewayClass

• Defines a custom GatewayClass named my-gatewayclass.

• Links to the F5 BIG-IP Controller (f5.com/controller-ns-f5-cne-controller).

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: my-gatewayclass
spec:
  controllerName: f5.com/controller-ns-f5-cne-controller
  description: F5 BIG-IP Kubernetes Gateway

Gateway

• Creates a Gateway resource my-gateway in the app-ns-1 namespace.

• Manages external traffic bound to the IP address 22.22.22.2.

• Includes a listener named http on port 8000 to handle HTTP traffic.

• Allows traffic to be routed using HTTPRoute resources.

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-gateway
  namespace: app-ns-1
spec:
  addresses:
  - type: IPAddress
    value: 22.22.22.2
  gatewayClassName: my-gatewayclass
  listeners:
  - allowedRoutes:
      kinds:
      - kind: HTTPRoute
    name: http
    port: 8000
    protocol: HTTP

HTTPRoute

• Creates a HTTPRoute (my-httproute) in the app-ns-1 namespace.

• Links to the http listener of my-gateway.

• Routes incoming traffic to the backend service nginx-service-1 on port 8001.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-httproute
  namespace: app-ns-1
spec:
  parentRefs:
  - name: my-gateway
    sectionName: http
  rules:
  - backendRefs:
    - name: nginx-service-1
      port: 8001

SecPolicy

• Attaches SecPolicy named my-gateway-listener-secpolicy to the http section of my-gateway.

• References a firewall policy (my-gateway-listener-firewall-policy) for the http listener.

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: SecPolicy
metadata:
  name: my-gateway-listener-secpolicy
  namespace: app-ns-1
spec:
  extensionRefs:
  - name: my-gateway-listener-firewall-policy
  targetRefs:
  - kind: Gateway
    name: my-gateway
    sectionName: http

F5BigFwPolicy (Firewall Policy)

• Creates a firewall policy named my-gateway-listener-firewall-policy in the app-ns-1 namespace.

• Implements a rule allowing TCP traffic.

apiVersion: k8s.f5net.com/v1
kind: F5BigFwPolicy
metadata:
  name: my-gateway-listener-firewall-policy
  namespace: app-ns-1
spec:
  rule:
  - action: accept
    destination:
      addresses:
      - 0.0.0.0/0
      ports:
      - '8000'
    ipProtocol: tcp
    logging: true
    name: tcp-acceptmy-gateway-listener-firewall-policy
    source:
      addresses:
      - 0.0.0.0/0

Gateway-Wide firewall Policy

This section has sample YAML files to set up a firewall policy for the entire gateway. You can do this by attaching a F5BigFwPolicy to the entire Gateway through a SecPolicy. These example CRs illustrate how a SecPolicy CR can be used to integrate a F5BigFWPolicy CR to the Listeners that are defined in the Gateway CR.

GatewayClass

• Defines a custom GatewayClass named my-gatewayclass.

• Links to the F5 BIG-IP Controller (f5.com/controller-ns-f5-cne-controller).

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: my-gatewayclass
spec:
  controllerName: f5.com/controller-ns-f5-cne-controller
  description: F5 BIG-IP Kubernetes Gateway

Gateway

• Creates a Gateway resource named my-gateway in the app-ns-1 namespace.

• Manages external traffic bound to the IP address 22.22.22.2.

• Configures two listeners (Listener 1 (http) and Listener 2 (http2))

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-gateway
  namespace: app-ns-1
spec:
  addresses:
  - type: IPAddress
    value: 22.22.22.2
  gatewayClassName: my-gatewayclass
  listeners:
  - allowedRoutes:
      kinds:
      - kind: HTTPRoute
    name: http
    port: 8000
    protocol: HTTP
  - allowedRoutes:
      kinds:
      - kind: HTTPRoute
    name: http2
    port: 8001
    protocol: HTTP

HTTPRoute for Listener 1

• Links HTTPRoute to the http section (port 8000) of my-gateway.

• Defines a routing rule to forward traffic to a backend service nginx-service-1 on port 8050.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-httproute
  namespace: app-ns-1
spec:
  parentRefs:
  - name: my-gateway
    sectionName: http
  rules:
  - backendRefs:
    - name: nginx-service-1
      port: 8050

HTTPRoute for Listener 2

• Links HTTPRoute to the http2 section (port 8001) of my-gateway.

• Defines a routing rule to forward traffic to a backend service nginx-service-2 on port 8052.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-httproute
  namespace: app-ns-1
spec:
  parentRefs:
  - name: my-gateway
    sectionName: http2
  rules:
  - backendRefs:
    - name: nginx-service-2
      port: 8052

SecPolicy

• Creates SecPolicy named my-gateway-wide-secpolicy.

• Applies to the my-gateway resource, a security policy for the entire gateway.

• References a firewall policy, my-gateway-wide-firewall-policy.

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: SecPolicy
metadata:
  name: my-gateway-wide-secpolicy
  namespace: app-ns-1
spec:
  extensionRefs:
  - name: my-gateway-wide-firewall-policy
	kind: F5BigFwPolicy
  targetRefs:
  - kind: Gateway
    name: my-gateway
    sectionName: ''

F5BigFwPolicy (Firewall Policy)

• Creates a firewall policy named my-gateway-wide-firewall-policy.

• Implements a rule to allow all TCP traffic on port 8000: - Source IP: Matches any (0.0.0.0/0 – all). - Destination IP: Matches any (0.0.0.0/0 – all). - Protocol: TCP.

• Enables logging to monitor traffic that matches the rule.

• Enforces security for all traffic handled by the my-gateway.

apiVersion: k8s.f5net.com/v1
kind: F5BigFwPolicy
metadata:
  name: my-gateway-wide-firewall-policy
  namespace: app-ns-1
spec:
  rule:
  - action: accept
    destination:
      addresses:
      - 0.0.0.0/0
      ports:
      - '8000'
    ipProtocol: tcp
    logging: true
    name: tcp-acceptmy-gateway-wide-firewall-policy
    source:
      addresses:
      - 0.0.0.0/0

Cross Reference

You can refer to specific page for parameter description.

• F5GlobalOptions

• F5BigFwPolicy

• F5BigFwPolicy IP Protocols

• F5BigCnePortlist

• F5BigCneAddresslist

• F5BigFwRulelist