NAP WAF Design

[mpstefan]

As a maintainer of NGF
I want a design to describe what the UX and high level implementation details I need for WAF v5
So that I can implement that design later to build the feature in NGF.

Acceptance

• Design should include UX around:
  • How does the user "enable" WAF v5
  • How does the user update signatures
  • How does the design work with SecOps and cluster operator personas?
• An extension to the Gateway API is included to configure WAF v5 functionality
• How NGF deployments change when deploying with WAF v5
• Identify major UX gaps

[ciarams87]

Proposed task breakdown (high-level, pending enhancement proposal acceptance)

1. Create CRD for WafPolicy
2. Build Waf enabled NGINX plus image & extend pipelines to publish image
3. Extend NGINXProxy with waf enabled toggle & conditionally deploy WAF containers as part of the NGINX deployment when enabled
4. Implement WafPolicy controller & generate the correct NGINX configuration (Route and Gateway; Policy bundle and security logs configurations)
5. Apply status to WafPolicy and affected resources
6. Implement Policy Fetcher implementation for WafPolicy (including distributing the policies to NGINX via Agent; policy integrity validation via Checksum validation)
7. Implement Auth for policy fetcher (native cloud auth, http basic auth, http bearer token auth)
8. Implement polling for policy bundle changes - checksum-based change detection
9. Add telemetry for WAF enablement
10. Complete TMA for WAF integration
11. Create functional tests for the WAF integration
12. Extend NFR tests to cover WAF integration
13. Create user guide for NAP WAF integration
14. Extend the rest of the documentation for WAF integration where required