What this use case demonstrates
This use case deploys NGINX Gateway Fabric (NGF) on the Kubernetes Gateway API as the in-cluster data plane. WAF and API protection are provided by F5 Distributed Cloud (XC) at the edge.
It covers all four ADSP areas: Delivery, Security, Deployment, and xOps.
- Delivery: F5 Distributed Cloud HTTP load balancer at the edge, NGF (running NGINX Plus) handling in-cluster delivery via the Gateway API.
- Security: XC WAF in blocking mode, XC API protection built from an OpenAPI spec, with validation and fall-through both in report mode by default.
- Deployment: XC consumed as SaaS, GKE Standard with private nodes, NGF installed via OCI Helm chart, the application deployed via a separate OCI Helm chart and exposed through a Gateway API HTTPRoute.
- xOps: The OpenAPI spec lives in the repo at config/uc4/app/oas/openapi.json. The OAS is the source of truth for API protection policy, change the spec, push, and enforcement follows.
Architecture
What gets deployed:
- A GCP VPC with a dedicated k8s subnet (with secondary ranges for pods and services), management subnet, and NAT for private nodes
- A GKE Standard zonal cluster with private nodes and a control plane locked down by authorized networks
- NGINX Gateway Fabric running NGINX Plus, installed from oci://ghcr.io/nginx/charts/nginx-gateway-fabric. The NGF control plane provisions a data plane Deployment and a LoadBalancer Service when the Gateway is created.
- Comfy Capybara deployed via oci://ghcr.io/knowbase/charts/comfy-capybara, exposed through a Gateway API HTTPRoute attached to the NGF Gateway
- An F5 Distributed Cloud HTTP load balancer with WAF and API protection. The origin pool is resolved from the NGF data plane LoadBalancer IP via Terraform remote state.
The HTTPRoute splits traffic two ways: /api to the API service with a URL rewrite that strips the prefix, / to the frontend.
DevSecOps in practice for UC4
The lead-in covers the approach. For UC4, that means:
- Terraform handles infrastructure, the GKE cluster, NGF, the application Helm release, and all F5 Distributed Cloud objects. No click-ops.
- State lives in a GCS bucket the workflow creates on the first run, with a separate state file per module. The XC origin pool reads the NGF data plane LoadBalancer IP from state/uc4/ngf, so no IP is ever pasted between configs.
- GitHub Actions runs the pipeline.
- Branch names trigger deployments, so git history shows what was meant to happen.
- GCP Workload Identity Federation replaces static service account keys.
- The XC API certificate, NGINX Plus JWT, and NGINX registry credentials live in GitHub Actions secrets, not the repo.
- The OpenAPI spec at config/uc4/app/oas/openapi.json is the source of truth for API protection. The workflow uploads it to the XC object store and binds it to the API definition.
The pipeline
Pushing to a branch runs the workflow. There is no manual terraform apply or helm install.
| Action | Branch |
|---|---|
| Validate, plan, and apply | deploy-adsp-uc4 |
| Validate only (no apply) | test-adsp-uc4 |
| Destroy all resources | destroy-adsp-uc4 |
Modules deploy sequentially: state bucket - infra - GKE - NGF - app - XC. Destroy runs in reverse.
What’s in the repo
f5devcentral/F5-ADSP-Automation:
| Directory | Purpose |
|---|---|
| infra/gcp/ | VPC, subnets with pod/service secondary ranges, NAT, firewall |
| k8s/gcp/ | GKE Standard cluster and node pool |
| f5/ngf/gcp/ | NGINX Gateway Fabric, Gateway API CRDs, Gateway, secrets |
| f5/xc/ | F5 Distributed Cloud HTTP LB, WAF, API definition (shared with other XC use cases) |
| app/gcp/ | Comfy Capybara Helm release and HTTPRoute |
| config/uc4/gcp/env.json | GCP, GKE, and NGF config |
| config/uc4/app/env.json | Application chart and route config |
| config/uc4/app/oas/openapi.json | OpenAPI spec the XC API definition is built from |
| config/uc4/xc/env.json | XC tenant, LoadBalancer, WAF and API feature flags |
| .github/workflows/ | CI/CD workflows |
Prerequisites, secrets, and troubleshooting are in the UC4 deployment guide.
Demo
Try it
Fork f5devcentral/F5-ADSP-Automation, set the secrets and tfvars from the deployment guide, and push to deploy-adsp-uc4. Push to destroy-adsp-uc4 to tear it down.
Contribute
Issues and PRs welcome at f5devcentral/F5-ADSP-Automation.
ADSP Architecture Article Series:
Automating F5 ADSP Deployments (Intro)
Automating F5 ADSP Deployments (Part 1 - F5 XC WAF and BIG-IP Adv. WAF)
Automating F5 ADSP Deployments (Part 2 - F5 XC API Security and NGINX Ingress & App Protect)
Automating F5 ADSP Deployments (Part 3 - F5 XC API Protection and NGINX Ingress)
Automating F5 ADSP Deployments (Part 4 - F5 XC API Security and NGINX Gateway Fabric)
Automating F5 ADSP Deployments (Part 5 - F5 XC, BIG-IP APM, CIS, and NGINX Ingress)
Minimizing Security Complexity: Managing Distributed WAF Policies