SecPolicy

Overview

Function

Declares a security policy for a CNE instance, applying extension resources (such as a F5BigFwPolicy, F5BigLogProfile, or F5BigDdosGlobal resource) to targeted Gateway, GatewayClass, or EgressGateway resources.

The extensionRefs array specifies the extension resource configurations to apply. The targetRefs array specifies the resources to which the system applies those extensions, along with their descendants.

This resource implements the Gateway API direct policy attachment pattern defined in GEP-2648.

Note

The resources in extensionRefs and this resource must be in the same namespace. When targetRefs includes a GatewayClass resource, all resources must be in the controller’s namespace.

Names

Singular name	Plural name	Short name
secpolicy	secpolicies	—

API group and version

gateway.k8s.f5.com/v1alpha1

Scope

Namespace

Specification

spec

Field	Required	Default	Description
extensionRefs array	Yes	[]	References to extension resources to apply to the target resources. Each kind can appear only once. Must contain no more than three items.
targetRefs array	Yes	—	References to the Gateway, GatewayClass, or EgressGateway resources that the extension resources apply to. Must contain 1 to 16 items.

Note

When extensionRefs includes a F5BigDdosGlobal resource, all targetRefs must be GatewayClass resources. Gateway and egress gateway targets aren’t allowed.

spec.extensionRefs[]

Field	Required	Default	Description
kind string	Yes	—	Kind of the extension resource. Each kind can appear only once in the array. Accepted values: F5BigFwPolicy, F5BigLogProfile, F5BigDdosGlobal.
name string	Yes	—	Name of the extension resource. Must be no more than 255 characters.
group string	Yes	k8s.f5net.com	API group of the extension resource. Must be no more than 255 characters.

spec.targetRefs[]

The targetRefs array is immutable after creation. When two or more entries reference the same target, sectionName must be unique.

Field	Required	Default	Description
kind string	Yes	Gateway	Kind of the target resource. Accepted values: Gateway, GatewayClass, EgressGateway. When kind is GatewayClass, omit sectionName and namespace. When kind is EgressGateway, omit sectionName.
name string	Yes	—	Name of the target resource. Must be 1 to 255 characters.
group string	Yes	gateway.networking.k8s.io	API group of the target resource. Accepted values: gateway.networking.k8s.io, gateway.k8s.f5.com.
namespace string	No	""	Namespace of the target resource. When omitted, the target is in the same namespace as this resource.
sectionName string	No	""	Section within the target resource. For a Gateway resource, this is a listener name. Must be no more than 253 characters.

Guidelines

Target references

• Attach a security policy with a F5BigDdosGlobal extension to a GatewayClass resource only.

• Attach a security policy to multiple objects with the targetRefs array, but to only one GatewayClass resource.

• Define no more than 16 target references in a single security policy. A GatewayClass target is valid only when you apply the security policy in the controller’s namespace.

• Attach only one security policy to each target (GatewayClass, Gateway, or Gateway listener). When multiple security policies target the same resource, a conflict occurs. The system resolves conflicts with the oldest-by-creation-date-wins policy from GEP-2648.

Extension references

• Every security policy must include at least one F5BigFwPolicy, F5BigDdosGlobal, or F5BigLogProfile extension.

• You can reference the same F5BigFwPolicy or F5BigLogProfile resource from multiple security policies.

Namespace requirements

• Deploy all extension resources and the resources they reference in the same namespace as the security policy. This includes a F5BigLogProfile resource and its referenced F5BigLogHslpub resource, and a F5BigFwPolicy resource and its referenced F5BigFwRulelist resource.

• When you don’t need cross-namespace targeting, place all related resources (Gateway, EgressGateway, SecPolicy, and the extension resources) in the same namespace, and omit sectionName for a GatewayClass target.

Cross-namespace targeting

To target a Gateway or EgressGateway resource in a different namespace, apply the following label to the target resource or its namespace, with the value set to the security policy’s namespace:

labels:
  secpolicy.gateway.k8s.f5.com/allowed-cross-namespace: "sec-policies"

All matching resources in that namespace can then be targeted. A label on the Gateway or EgressGateway resource takes precedence over a namespace-level label.

Example manifests

Firewall policy attached to a gateway

apiVersion: gateway.k8s.f5.com/v1alpha1
kind: SecPolicy
metadata:
  name: secpolicy-gateway
  namespace: gatewayns
spec:
  extensionRefs:
    - group: k8s.f5net.com
      kind: F5BigFwPolicy
      name: firewallpolicy-gateway
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: f5-gateway
      sectionName: tcp-listener

DDoS policy attached to a gateway class

apiVersion: "gateway.k8s.f5.com/v1alpha1"
kind: SecPolicy
metadata:
  name: secpolicy-gatewayclass
  namespace: f5-bnk
spec:
  extensionRefs:
    - name: gateway-global-ddos
      group: k8s.f5net.com
      kind: F5BigDdosGlobal
  targetRefs:
    - name: f5-gateway-class
      kind: GatewayClass
      group: gateway.networking.k8s.io