Skip to content

nic: waf policy fields and example #2180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vepatel merged 4 commits into from
Jul 29, 2026
Merged

nic: waf policy fields and example #2180

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4de45e6
fix: waf policy fields and example
vepatel Jul 29, 2026
4ef0ee9
fix: example
vepatel Jul 29, 2026
c141348
fix: add line break
vepatel Jul 29, 2026
b68080e
Update content/nic/configuration/policy-resource.md
vepatel Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 76 additions & 2 deletions content/nic/configuration/policy-resource.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1335,8 +1335,8 @@ For details and examples, see [Connect F5 WAF for NGINX to bundle sources]({{< r
| ---| ---| ---| --- |
|``type`` | Source backend: ``N1C`` (NGINX One Console), ``NIM`` (NGINX Instance Manager), or ``HTTPS``. Defaults to ``HTTPS``. | ``string`` | No |
|``url`` | Tenant URL for ``N1C``/``NIM``, or full ``.tgz`` bundle URL for ``HTTPS``. Must use ``https://``. | ``string`` | Yes |
|``policyName`` | Management-plane policy name for ``N1C``/``NIM``. For ``apLogBundleSource``, set this to the log profile name. Ignored for ``HTTPS``. | ``string`` | No |
|``policyNamespace`` | Management-plane namespace or tenant. Required for ``N1C``. Not used for ``NIM`` or ``HTTPS``. | ``string`` | No |
|``name`` | Management-plane policy name for ``N1C``/``NIM``. For ``apLogBundleSource``, set this to the log profile name. Ignored for ``HTTPS``. | ``string`` | No |
|``namespace`` | Management-plane namespace or tenant. Required for ``N1C``. Not used for ``NIM`` or ``HTTPS``. | ``string`` | No |
|``enablePolling`` | Must be explicitly set. When ``true``, NIC re-fetches the bundle at ``pollInterval``. When ``false``, the bundle is fetched once at policy creation or update. | ``bool`` | Yes |
|``pollInterval`` | How often to re-fetch when ``enablePolling`` is ``true``. Minimum ``1m``, default ``5m``. | ``string`` | No |
|``secret`` | Secret in the same namespace as the Policy. For ``N1C``/``NIM``, use ``nginx.com/waf-bundle`` (token or username/password). For ``HTTPS``, use ``kubernetes.io/tls`` for client mTLS (``tls.crt`` and ``tls.key``). | ``string`` | No |
Expand All @@ -1348,6 +1348,80 @@ For details and examples, see [Connect F5 WAF for NGINX to bundle sources]({{< r

{{% /table %}}

For example, see the snippets below:

NIM
```yaml
spec:
waf:
enable: true
apBundleSource:
type: NIM
url: "https://<nim_host>"
name: "<policy_name>"
secret: "nim-credentials"
enablePolling: true
pollInterval: "5m"
securityLogs:
- enable: true
apLogBundleSource:
type: NIM
url: "https://<nim_host>"
name: "<log_profile_name>"
secret: "nim-credentials"
enablePolling: true
pollInterval: "5m"
logDest: "stderr"
```

N1C
```yaml
spec:
waf:
enable: true
apBundleSource:
type: N1C
url: "https://<tenant>.console.ves.volterra.io"
name: "<policy_name>"
namespace: "default"
secret: "n1c-credentials"
enablePolling: true
pollInterval: "5m"
securityLogs:
- enable: true
apLogBundleSource:
type: N1C
url: "https://<tenant>.console.ves.volterra.io"
name: "secops_dashboard"
namespace: "default"
secret: "n1c-credentials"
enablePolling: true
pollInterval: "5m"
logDest: "stderr"
```

HTTPS
```yaml
spec:
waf:
enable: true
apBundleSource:
url: "https://bundle-server.default.svc.cluster.local/bundles/attack-signatures-blocking.tgz"
secret: "bundle-client-tls"
trustedCertSecret: "bundle-server-ca"
enablePolling: true
pollInterval: "5m"
securityLogs:
- enable: true
apLogBundleSource:
url: "https://bundle-server.default.svc.cluster.local/bundles/log-default.tgz"
secret: "bundle-client-tls"
trustedCertSecret: "bundle-server-ca"
enablePolling: true
pollInterval: "5m"
logDest: "stderr"
```

#### WAF Merging Behavior

A VirtualServer/VirtualServerRoute can reference multiple WAF policies. However, only one can be applied. Every subsequent reference will be ignored. For example, here we reference two policies:
Expand Down
Loading