[EV-6466]: Add Gateway WAF (per-route & namespaced) docs section#2758
[EV-6466]: Add Gateway WAF (per-route & namespaced) docs section#2758electricjesus wants to merge 6 commits into
Conversation
Add a Calico Enterprise docs section for the Gateway-API WAF feature (OWASP CRS via a Coraza WASM filter on Envoy Gateway): overview, concepts (families, global vs namespaced, merge order + enforcement), get-started (operator-native enable + quickstart), persona-oriented how-tos (CO baseline, AO attach/rules/validate, multi-tenant), and a CRD / Rego / SecRule-ID-range / status-condition reference, plus troubleshooting. - New section under threat/gateway-waf/ (16 pages) + sidebar category. - Deprecation note on deploying-waf-ingress-gateway (superseded by the new per-route/namespaced model). Refs: PMREQ-384, designs#25, cp#12137 (Rego engine, EV-6656). Docs: EV-6466.
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Build status — ✅ The new
These are outside this PR's scope. Leaving the "Build completed successfully" checkbox unchecked until they're resolved (or confirmed handled by CI's build matrix). |
- Add WAF terms to the CalicoTerminology vocab (Rego, allowlist, the six WAF CRD kinds, and targetRefs/namespaceSelector/paranoiaLevel/ coreRuleSet/defaultAction/enforcementMode/SecLang). - Reword two "another's" possessives (Vale.Spelling false positive). - "walks through" -> "walks you through" (CalicoStyle.Walkthrough). Verified with scripts/vale-lint.sh --minAlertLevel=error: 0 errors.
The reviewdog/Vale gate fails on warnings too, and Vale.Terms flagged the bare acronym "CRS" as a miscasing of "CRs" (the custom-resources term). Replace the bare acronym in prose with "Core Rule Set"; code blocks and inline-code literals (e.g. the Rego rule messages) are left unchanged so examples stay accurate. Verified with scripts/vale-lint.sh: 0 errors, 0 warnings, 0 suggestions.
Replace the ASCII architecture diagram in the Gateway WAF overview with a Mermaid flowchart, and introduce @docusaurus/theme-mermaid to the repo (first Mermaid usage here). The repo builds with future.faster.ssgWorkerThreads, under which theme-mermaid's context hooks (useColorMode/useThemeConfig) throw during worker-thread SSG. So the diagram is rendered client-side via <BrowserOnly> + @theme/Mermaid, and markdown.mermaid is intentionally NOT enabled (it would auto-transform ```mermaid fences and crash SSG repo-wide). Verified BUILD_NEXT build: the gateway-waf pages render cleanly; the only build failure is pre-existing broken links in unrelated calico/calico-cloud next docs.
|
Heads-up for reviewers: this PR introduces Mermaid to the docs site for the first time.
|
Replace the overview's ASCII pipeline with a static SVG (static/img/calico-enterprise/gateway-waf-architecture.svg) and revert the Mermaid introduction. @docusaurus/theme-mermaid is incompatible with this repo's multi-docs-instance + yarn-berry setup: @docusaurus/theme-common (peer dep @docusaurus/plugin-content-docs: "*") is instantiated as two virtual copies, so the classic theme's <ColorModeProvider> and theme-mermaid's useColorMode() bind different React contexts -> ReactContextError during both worker-thread SSG and client render. The SVG carries descriptive alt text for accessibility.
|
Update — reverted the Mermaid introduction; the architecture diagram is now a static SVG.
Rather than repo-wide yarn |
Fix text overflow and tighten spacing flagged in review: widen the canvas to 940x360, split the admission-webhook caption to two lines, widen the input/process boxes so every label fits with margin, and clean up the pass/fail arrow routing. Same colour palette.
1 participant
Product Version(s):
Calico Enterprise (next / unreleased) — tech preview. Not applicable to Calico OSS or Calico Cloud.
Issue:
2026/PMREQ-384-per-route-namespaced-waf); Rego engine: calico-private#12137 (EV-6656)Link to docs preview:
SME review:
DOCS review:
Additional information:
Adds a new Gateway WAF section under
calico-enterprise/threat/gateway-waf/documenting the per-route & namespaced WAF feature (OWASP CRS via a Coraza WASM filter on Envoy Gateway). 16 pages + sidebar category:GatewayAPI.spec.extensions.waf.state+ license); 5-minute quickstart.Also adds a deprecation note to
threat/deploying-waf-ingress-gateway.mdx, which this feature supersedes.Notes for reviewers:
WAFPolicy,GlobalWAFPolicy,WAFPlugin, …) from designs#25, not the olderWebApplicationFirewall*names in the ticket text.package waf/violations) per designs#25 + cp#12137, not the prototype's CEL.kubectl wafplugin, web UI/BFF (PMREQ-857), and L7 OTEL logging are out of scope here and referenced as "coming" at most.deploying-waf-ingress-gatewaypage.Merge checklist: