F5BigFwPolicy

Overview

Function

Declares a firewall policy for a CNE instance, defining the ordered rules that match traffic by protocol, source, and destination, and the action to apply. Each rule either sets an inline action or references a firewall rule list.

When applying a new resource, firewall rules are first sent to the Application Firewall Management (AFM) pod to be compiled into a binary large object (BLOB), improving processing performance. Once the firewall BLOB is compiled, it is sent to the TMM pod to begin inspecting and filtering network packets.

Names

Singular name	Plural name	Short name
f5-big-fw-policy	f5-big-fw-policies	fwpol

API group and version

k8s.f5net.com/v1

Scope

Namespace

Specification

metadata

Parameter	Description
name	The name of the Firewall Policy. This value is referenced by BIG-IP Next for Kubernetes Traffic Management CRs.
namespace	The namespace of Kubernetes in with firewall policy is installed.

spec

Field	Required	Default	Description
rule array	No	[]	List of firewall rules.
description string	No	""	Description of the policy.

spec.rule[]

Each rule sets either action or ruleList, but not both. When you set ruleList, don’t set action, source, destination, ipProtocol, logging, or servicePolicy.

Field	Required	Default	Description
name string	Yes	—	Name of the rule. Maximum length is 255 characters.
action string	No	—	Action to apply to matching traffic. Set this when you don’t set ruleList. Accepted values: accept, accept-decisively, reject, drop.
ruleList string	No	""	Name of a F5BigFwRulelist resource to apply. Set this when you don’t set action. Maximum length is 255 characters.
ipProtocol string	No	any	IP protocol to match. Accepted values include any, tcp, udp, sctp, icmp, and other IANA protocol names. When ipProtocol isn’t tcp, udp, or sctp, don’t set source or destination ports or port lists.
description string	No	""	Description of the rule.
source object	No	{}	Source match criteria for the rule.
destination object	No	{}	Destination match criteria for the rule.
logging boolean	No	false	Turns on logging for the rule. Accepted values: true, false.
servicePolicy string	No	—	Name of the service policy to apply. Maximum length is 255 characters.

Note

When a rule specifies any VLAN zone in the source or destination, the rule can’t specify source VLANs.

spec.rule[].source

Field	Required	Default	Description
vlans array	No	[]	Source VLAN names. Each name is up to 255 characters.
zones array	No	[]	Source zone names. Each name is up to 255 characters.
addresses array	No	[]	Source IPv4 or IPv6 addresses, CIDR ranges, or address ranges.
addressLists array	No	[]	Source address list names. Each name is up to 255 characters.
ports array	No	[]	Source ports or port ranges. Accepted values: 0 to 65535, or a range such as 80-443.
portLists array	No	[]	Source port list names. Each name is up to 255 characters.
geos array	No	[]	Source geographic location codes. Each value is up to 255 characters.
fqdns array	No	[]	Source fully qualified domain names. Each name is up to 254 characters.
namespaces array	No	[]	Kubernetes namespaces to match. Each name is up to 63 characters.

spec.rule[].destination

Field	Required	Default	Description
zones array	No	[]	Destination zone names. Each name is up to 255 characters.
addresses array	No	[]	Destination IPv4 or IPv6 addresses, CIDR ranges, or address ranges.
addressLists array	No	[]	Destination address list names. Each name is up to 255 characters.
ports array	No	[]	Destination ports or port ranges. Accepted values: 0 to 65535, or a range such as 80-443.
portLists array	No	[]	Destination port list names. Each name is up to 255 characters.
geos array	No	[]	Destination geographic location codes. Each value is up to 255 characters.
fqdns array	No	[]	Destination fully qualified domain names. Each name is up to 254 characters.
namespaces array	No	[]	Kubernetes namespaces to match. Each name is up to 63 characters.

Example manifest

This section provides the sample resource use cases. For more details to apply this resource, see Firewall policy in Gateway API

F5BigFwPolicy CR with ACLs attached to GatewayClass

Following is an example F5BigFwPolicy CR with ACLs attached to GatewayClass:

apiVersion: "k8s.f5net.com/v1"
kind: F5BigFwPolicy
metadata:
  name: fwpolicy-global-1
  namespace: f5-bnk
spec:
  rule:
  - name: sc-rule-1
    ipProtocol: any
    source:  
      addresses:
      - 11.19.10.9
    logging: true
    action: drop

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: SecPolicy
metadata:
  name: secpolicy-gatewayclass
  namespace: f5-bnk
spec:
  extensionRefs:
  - name: fwpolicy-global-1
    group: k8s.f5net.com
    kind: F5BigFwPolicy
  targetRefs:
  - name: f5-gateway-class
    kind: GatewayClass
    group: gateway.networking.k8s.io

Note

SecPolicy, FirewallPolicy resources should be in f5-bnk namespace when attached to GatewayClass.

F5BigFwPolicy with ACLs attached to Gateway

Following is an example resource with ACLs attached to Gateway:

apiVersion: "k8s.f5net.com/v1"
kind: F5BigFwPolicy
metadata:
  name: fwpolicy-virtual-1
  namespace: gatewayns
spec:
  rule:
  - name: sc-rule-1
    ipProtocol: any
    source:
      addresses:
      - 11.19.10.8
    logging: true
    action: drop

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: SecPolicy
metadata:
  name: secpolicy-virtual-1
  namespace: gatewayns
spec:
  extensionRefs:
  - name: fwpolicy-virtual-1
    group: k8s.f5net.com
    kind: F5BigFwPolicy
  targetRefs:
  - name: f5-gateway
    kind: Gateway
    group: gateway.networking.k8s.io

SecPolicy with ACLs attached to Gateway Listeners:

Following is an example SecPolicy resource with ACLs attached to Gateway Listeners:

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: SecPolicy
metadata:
  name: secpolicy-virtual-1
  namespace: gatewayns
spec:
  extensionRefs:
  - name: fwpolicy-virtual-1
    group: k8s.f5net.com
    kind: F5BigFwPolicy
  targetRefs:
  - name: f5-gateway
    kind: Gateway
    group: gateway.networking.k8s.io
    sectionName: tcp-listener

Note

SecPolicy, Gateway, and FirewallPolicy resources should be in same namespace when attached to Gateway or Gateway Listener.