You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| Latest release | For production use |[Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.1/deploy). |[Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.1/examples).|
51
-
| Edge | For experimental use and latest features |[Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/main/deploy).|[Examples](https://github.com/nginx/nginx-gateway-fabric/tree/main/examples). |
48
+
| Version | Description | Installation Manifests | Documentation and Examples |
| Latest release | For production use |[Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.1/deploy). |[Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.1/examples). |
51
+
| Edge | For experimental use and latest features |[Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/main/deploy). |[Examples](https://github.com/nginx/nginx-gateway-fabric/tree/main/examples). |
Copy file name to clipboardExpand all lines: charts/nginx-gateway-fabric/README.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -194,7 +194,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
194
194
> Viewing the `values.yaml` file directly can show all available options.
195
195
196
196
| Key | Description | Type | Default |
197
-
|-----|-------------|------|---------|
197
+
|-----|-------------|------|---------|
198
198
|`certGenerator`| The certGenerator section contains the configuration for the cert-generator Job. | object |`{"affinity":{},"agentTLSSecretName":"agent-tls","annotations":{},"enable":true,"nodeSelector":{},"overwrite":false,"serverTLSSecretName":"server-tls","tolerations":[],"topologySpreadConstraints":[],"ttlSecondsAfterFinished":30}`|
199
199
|`certGenerator.affinity`| The affinity of the cert-generator pod. | object |`{}`|
200
200
|`certGenerator.agentTLSSecretName`| The name of the base Secret containing TLS CA, certificate, and key for the NGINX Agent to securely communicate with the NGINX Gateway Fabric control plane. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string |`"agent-tls"`|
|**HTTP Basic Authentication**| ✅ | ✅ |[ngx_http_auth_basic](https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html)| Requires a username and password sent in an HTTP header.|
43
-
|**JWT (JSON Web Token)**| ❌ | ✅|[ngx_http_auth_jwt_module](https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html)| Tokens are used for stateless authentication between client and server. |
44
-
|**OpenID Connect**| ❌ | ✅ |[ngx_http_oidc_module](https://nginx.org/en/docs/http/ngx_http_oidc_module.html)| Allows authentication through third-party providers like Google.|
|**HTTP Basic Authentication**| ✅ | ✅ |[ngx_http_auth_basic](https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html)| Requires a username and password sent in an HTTP header. |
43
+
|**JWT (JSON Web Token)**| ❌ | ✅ |[ngx_http_auth_jwt_module](https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html)| Tokens are used for stateless authentication between client and server. |
44
+
|**OpenID Connect**| ❌ | ✅ |[ngx_http_oidc_module](https://nginx.org/en/docs/http/ngx_http_oidc_module.html)| Allows authentication through third-party providers like Google. |
Copy file name to clipboardExpand all lines: docs/proposals/nap-waf.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -716,17 +716,17 @@ According to the [Policy and Metaresources GEP](https://gateway-api.sigs.k8s.io/
716
716
717
717
The `Accepted` Condition must be populated on the `WAFPolicy` CRD using the reasons defined in the [PolicyCondition API](https://github.com/kubernetes-sigs/gateway-api/blob/main/apis/v1alpha2/policy_types.go). Below are example implementation-specific reasons that describe the lifecycle phases and potential issues encountered while processing the policy:
| **PolicySourceInvalid** | The `policySource` contains invalid or incomplete information. | "The policy source is invalid. Ensure fileLocation is correct." |
722
-
| **PolicyFetchError** | Failed to fetch the policy due to network issues, authentication problems, or source misconfiguration. | "Failed to fetch policy bundle due to a network issue or invalid credentials." |
723
-
| **PolicyIntegrityInvalid**| Checksum verification failed for the fetched policy bundle. | "Policy integrity check failed because of a checksum mismatch." |
724
-
| **PolicyValidationError** | The WAF policy bundle failed schema or format validation for NGINX App Protect WAF. | "The policy bundle did not pass schema validation. Update the policy and retry compilation." |
725
-
| **PolicyDeployed** | The policy was successfully deployed to the NGINX Data Plane (Pods). | "The policy has been successfully deployed and is now protecting the targeted resources." |
726
-
| **PolicyDeployedUpdate** | An updated version of the policy was successfully deployed to the NGINX Data Plane (Pods) after polling or change detection. | "The policy has been updated and successfully redeployed to the targeted resources." |
727
-
| **PolicyDeploymentError** | The data plane (NGINX Pods) failed to apply the policy. | "Failed to deploy the WAF policy to the NGINX Pods." |
728
-
| **AuthenticationError** | Authentication to the external store (e.g., S3, HTTP) failed. | "Authentication error while trying to fetch the policy bundle." |
729
-
| **PolicyConfigError** | The policy configuration prevents proper processing. | "The policy configuration is incomplete or incorrectly formatted. Correct the configuration and retry." |
| **PolicySourceInvalid** | The `policySource` contains invalid or incomplete information. | "The policy source is invalid. Ensure fileLocation is correct." |
722
+
| **PolicyFetchError** | Failed to fetch the policy due to network issues, authentication problems, or source misconfiguration. | "Failed to fetch policy bundle due to a network issue or invalid credentials." |
723
+
| **PolicyIntegrityInvalid**| Checksum verification failed for the fetched policy bundle. | "Policy integrity check failed because of a checksum mismatch." |
724
+
| **PolicyValidationError** | The WAF policy bundle failed schema or format validation for NGINX App Protect WAF. | "The policy bundle did not pass schema validation. Update the policy and retry compilation." |
725
+
| **PolicyDeployed** | The policy was successfully deployed to the NGINX Data Plane (Pods). | "The policy has been successfully deployed and is now protecting the targeted resources." |
726
+
| **PolicyDeployedUpdate** | An updated version of the policy was successfully deployed to the NGINX Data Plane (Pods) after polling or change detection. | "The policy has been updated and successfully redeployed to the targeted resources." |
727
+
| **PolicyDeploymentError** | The data plane (NGINX Pods) failed to apply the policy. | "Failed to deploy the WAF policy to the NGINX Pods." |
728
+
| **AuthenticationError** | Authentication to the external store (e.g., S3, HTTP) failed. | "Authentication error while trying to fetch the policy bundle." |
729
+
| **PolicyConfigError** | The policy configuration prevents proper processing. | "The policy configuration is incomplete or incorrectly formatted. Correct the configuration and retry." |
|`sessionName`|`name`| Direct mapping to `sticky cookie` name.|
135
-
|`absoluteTimeout`|`expires`| Only used when `cookieConfig.lifetimeType=Permanent`; not enforced for `Session` cookies.|
136
-
|`idleTimeout`|_not supported_| NGINX does not support idle-based invalidation for sticky cookies. Sessions expire only when the cookie expires or the session ends.|
137
-
|`type`|`cookie`| Only cookie-based persistence is supported. If Header is specified, the sessionPersistence spec is ignored and a warning/status message is reported on the route, but the route itself remains valid. |
138
-
|`cookieConfig.lifetimeType=Session`|_no `expires` set_| Session cookies expire when the browser session ends.|
139
-
|`cookieConfig.lifetimeType=Permanent`|`expires=<absoluteTimeout>`| Cookie persists until the specified timeout. `absoluteTimeout` is required when `lifetimeType` is `Permanent`.|
140
-
| no matching spec field |_no `domain` attribute_| Cookies are host-only for both `HTTPRoute` and `GRPCRoute`.|
141
-
| no matching spec field |`path`| Behavior is described separately for `HTTPRoute` below.|
|`sessionName`|`name`| Direct mapping to `sticky cookie` name. |
135
+
|`absoluteTimeout`|`expires`| Only used when `cookieConfig.lifetimeType=Permanent`; not enforced for `Session` cookies. |
136
+
|`idleTimeout`|_not supported_| NGINX does not support idle-based invalidation for sticky cookies. Sessions expire only when the cookie expires or the session ends.|
137
+
|`type`|`cookie`| Only cookie-based persistence is supported. If Header is specified, the sessionPersistence spec is ignored and a warning/status message is reported on the route, but the route itself remains valid. |
138
+
|`cookieConfig.lifetimeType=Session`|_no `expires` set_| Session cookies expire when the browser session ends. |
139
+
|`cookieConfig.lifetimeType=Permanent`|`expires=<absoluteTimeout>`| Cookie persists until the specified timeout. `absoluteTimeout` is required when `lifetimeType` is `Permanent`. |
140
+
| no matching spec field |_no `domain` attribute_| Cookies are host-only for both `HTTPRoute` and `GRPCRoute`. |
141
+
| no matching spec field |`path`| Behavior is described separately for `HTTPRoute` below. |
142
142
143
143
#### Domain and Path selection for Routes
144
144
@@ -148,11 +148,12 @@ For **HTTPRoutes**, we do not set the `domain` attribute. Deriving a broader dom
148
148
149
149
To determine the cookie `path` for HTTPRoutes, we handle the simple case where there is a single path match as follows:
150
150
151
-
| Path Value | Path Match Type | Cookie `Path` Value | Cookie Match Expectations |
|`/hello-exact`| Exact |`/hello-exact`| Cookie header is sent for `/hello-exact` path only. |
154
-
|`/hello-prefix`| Prefix |`/hello-prefix`| Cookie header is sent for `/hello-prefix` and any subpath starting with `/hello-prefix` (e.g. `/hello-prefix/foo`). |
155
-
|`/hello-regex/[a-zA-Z0-9_-]+$`| Regex |`/hello-regex`| No `path` attribute is set for pathType `RegularExpression`|
151
+
| Path Value | Path Match Type | Cookie `Path` Value | Cookie Match Expectations |
|`/hello-exact`| Exact |`/hello-exact`| Cookie header is sent for `/hello-exact` path only. |
155
+
|`/hello-prefix`| Prefix |`/hello-prefix`| Cookie header is sent for `/hello-prefix` and any subpath starting with `/hello-prefix` (e.g. `/hello-prefix/foo`). |
156
+
|`/hello-regex/[a-zA-Z0-9_-]+$`| Regex |`/hello-regex`| No `path` attribute is set for pathType `RegularExpression`|
156
157
157
158
When there are multiple path matches that share the same sessionPersistence configuration, we derive a single cookie path by computing the longest common prefix that ends on a path-segment boundary `/`. If no non-empty common prefix on a segment boundary exists, we fall back to `/` which is allowing all paths.
0 commit comments