Securing Kubernetes: F5 WAF for NGINX Gateway Fabric using NGINX One Console

Key Concepts

• F5 WAF for Nginx Gateway Fabric: A container-native Web Application Firewall (WAF) integrated directly into the Kubernetes data plane.
• Nginx Gateway Fabric: A Kubernetes-native implementation of the Gateway API for traffic routing.
• Nginx One Console: A centralized management platform for SecOps to author and manage security policies.
• Data Guard: A feature within the WAF that masks sensitive information (e.g., credit card numbers, SSNs) in real-time.
• Declarative Security: The practice of defining security policies as code/resources within Kubernetes.
• OWASP Top 10: The standard baseline for web application security risks that the F5 WAF covers out of the box.

---

1. The Security Gap in Kubernetes

The video highlights a critical industry shift: over 50% of internet traffic is now API-driven, making APIs the primary attack surface. While the Kubernetes Gateway API provides robust traffic routing, it lacks built-in security. F5 addresses this by embedding WAF protection directly into the Nginx Gateway Fabric data plane, eliminating the need for sidecars or external proxies.

2. Operational Framework: SecOps vs. Platform Teams

The solution utilizes a decoupled operating model to bridge the gap between security and infrastructure teams:

• SecOps: Uses the Nginx One Console to author, compile, and publish security policies. This provides a GUI-based environment for managing signatures and threat intelligence.
• Platform Teams: Consume these policies declaratively within Kubernetes. They reference specific Policy IDs in their Gateway resources, allowing for automated updates without requiring application restarts or redeployments.

3. Step-by-Step Implementation Process

1. Policy Creation: Define a WAF policy in the Nginx One Console, set the enforcement mode (e.g., "Blocking"), and retrieve the unique Object ID.
2. Resource Configuration: In the Kubernetes cluster, update the WAF policy resource manifest to include:
   • The Policy ID.
   • Secure credentials for policy retrieval.
   • Security logging configurations to stream events back to the Nginx One Console.
3. Deployment: Apply the manifest via kubectl. The Gateway Fabric dynamically updates the data plane to begin traffic inspection.
4. Verification: Use the Nginx One Console dashboard to confirm that the policy is active and to monitor real-time traffic violations.

4. Real-World Application: Data Guard and Threat Mitigation

The video demonstrates two primary security functions:

• Attack Prevention: By injecting a Cross-Site Scripting (XSS) payload, the system demonstrated an immediate block, providing the attacker with a support ID while protecting the back-end application.
• Data Masking (Data Guard): The system identified sensitive data (Credit Card and SSN) leaking in plain text from the application. By updating the policy to "Data Guard Blocking" in the console and applying it to the cluster, the system automatically masked the sensitive data (showing only the last four digits) without requiring any changes to the application code.

5. Key Arguments and Evidence

• Efficiency: The integration allows for "zero downtime" updates. When SecOps pushes a policy change, the Gateway Fabric picks it up automatically.
• Visibility: The Nginx One Console provides a centralized view of security posture, including top violations, attack signatures, and attacker IP addresses.
• Technical Precision: The system supports REST, GraphQL, and gRPC, ensuring that modern API architectures are protected alongside traditional web traffic.

6. Notable Quotes

• "The Kubernetes Gateway API gives you powerful traffic routing, but it wasn't designed to protect your applications. That's the gap we're closing."
• "No sidecar, no external proxy. OWASP Top 10 coverage out of the box."

7. Synthesis and Conclusion

F5 WAF for Nginx Gateway Fabric provides a streamlined, enterprise-grade security layer that integrates seamlessly into Kubernetes environments. By separating policy management (SecOps) from policy consumption (Platform Teams), organizations can achieve rapid security deployment and consistent protection against evolving threats. The ability to mask sensitive data and block sophisticated attacks like XSS without modifying application code represents a significant advancement in cloud-native security operations.