NGINX Gateway Fabric 2.7 builds on the momentum of 2.6 with a strong focus on AI security, WAF lifecycle management, and tighter integration across the F5 portfolio. From protecting AI inference traffic to bringing BIG-IP integration to the Gateway API, this release extends enterprise-grade capabilities natively into Kubernetes. Here’s what’s new.
Securing AI interactions with F5 AI Guardrails
What’s new: We have enhanced the Gateway API Inference Extension in NGINX Gateway Fabric by adding support for Gateway API-aligned payload processing for AI traffic. This enables prompts and responses in OpenAI-compatible inference flows to be inspected and protected using external processors such as F5 AI Guardrails. As a result, platform teams can apply security controls to AI inference traffic while staying aligned with Gateway API patterns.
Why it matters: As organisations rush to ship AI-powered applications, securing the prompts and responses flowing to and from models becomes critical. Applying inspection at the Gateway means teams can protect these workloads without touching application code, keeping security consistent and centrally managed while staying true to Gateway API patterns.
F5 WAF for NGINX Phase 2: Policy Lifecycle Manager
What’s new: Building on the F5 WAF support introduced in 2.6, this second phase lets you define WAF policies as Kubernetes custom resources directly. The entire policy lifecycle now happens inside Kubernetes, making it self-contained and cluster-scoped, and helping teams adopt GitOps workflows with standard tooling such as Argo CD and Flux.
Why it matters: Phase 1 brought WAF policies to the Gateway API through the ClickOps flow. Phase 2 makes policy management fully declarative and native to Kubernetes, giving teams a version-controlled, auditable approach that fits the workflows they already trust, with no external management plane required.
GatewayLink: BIG-IP/CIS Integration
What’s new: GatewayLink provides a declarative integration between BIG-IP/CIS and NGINX Gateway Fabric. As part of this, we’re introducing a new `ExternalLoadBalancer` resource, designed to be extensible to other F5 load balancers in the future. Stay tuned for more on that.
The integration requires no new CRD and no code changes on the CIS side. When CIS is present in the cluster, NGF handles the integration as part of the Gateway deployment. CIS populates the IPs of the NGINX pods and configures a virtual server on BIG-IP that load-balances traffic to the NGF pods.
Why it matters: This brings the proven BIG-IP integration story to the Gateway API world with zero disruption to existing CIS deployments. The extensible `ExternalLoadBalancer` resource also lays the groundwork for supporting additional load balancers down the line, giving teams a consistent, declarative integration model. Since microservices in Kubernetes are ephemeral, IP address keeps changing. Without this integration, BIG-IP maybe forwarding traffic to services inside Kubernetes whose IP maybe changing constantly. Through GatewayLink, BIG-IP can forward traffic to a predictable, stable endpoint inside Kubernetes, which is NGINX Gateway Fabric.
External Authentication with HTTPExternalAuthFilter
What’s new: This release adds a Gateway API-conformant way to authenticate requests via an external authorization proxy before routing traffic to backend applications, through the new `ExternalAuth` filter. Under the hood, this adds support for NGINX’s `http_auth_request` module to enable external authentication checks.
Why it matters: External auth is a common requirement for enterprise applications, and doing it in a Gateway API-conformant way means teams get a portable, standards-based approach rather than relying on custom snippets or bespoke solutions. It integrates cleanly alongside NGF’s existing authentication capabilities.
Gateway API 1.6 Conformance
What’s new: TCPRoute and UDPRoute move from v1alpha2 to v1, following their graduation out of experimental in Gateway API 1.6. Multiple L4 routes can now attach to the same listener, though only the oldest is used. The conformance suite passes with all the new TCP and UDP tests. TLS listeners also gain Terminate mode, alongside the existing passthrough.
Why it matters: A stable API version is what a platform team waits for before it puts L4 traffic on a Gateway in production - v1alpha2 is a fine place to experiment and a hard thing to standardize on. Your TCP and UDP routes now sit at the same API maturity as your HTTP ones, and Terminate mode means a TLS listener can end the connection at the Gateway rather than passing it through untouched.
HTTP/2 to Service Support
What’s new: NGINX Gateway Fabric now supports HTTP/2 as a client to upstream services, built on the HTTP/2 client capability recently added to NGINX.
Why it matters: HTTP/2 to upstreams unlocks better performance and more efficient connection handling between NGF and backend services, ensuring modern protocol support end to end rather than just at the edge.
Bug Fixes and Smaller Enhancements
This release also includes multiple stability improvements, bug fixes, and community-driven enhancements, including:
* Support for Cluster IP services: NGF can now work with `ClusterIP` services, giving teams more flexibility in how they wire up their backends. Thanks to SidharathBansal on GitHub for this contribution.
* Least time load balancing moves to OSS: NGF now supports the `least_time` load balancing method in open source, which routes requests to the upstream with the lowest average response time. Thanks to yogarajalakshmi-s on GitHub for this contribution.
* F5 WAF Security Monitoring is now available on NGINX Instance Manager
Head over to the [GitHub release page]([u]https://github.com/nginx/nginx-gateway-fabric/releases[/u]) and our [public release docs]([u]https://docs.nginx.com/nginx-gateway-fabric/[/u]) for the full picture. You can also follow [this link]([u]https://docs.nginx.com/nginx-gateway-fabric/[/u]) to upgrade NGINX Gateway Fabric, and check out the [Kubernetes NGINX landing page]([u]https://kubernetes.nginx.org/[/u]) to learn more about migrating from NGINX Ingress Controller to NGINX Gateway Fabric.
Thanks to our Community
Finally, this release blog focuses on the new enterprise-grade features in NGINX Gateway Fabric, but NGINX Gateway Fabric 2.7 also includes some significant open source features built by the team, with contributions from our open source community. For more info on these, read through our community blog here: NGINX Gateway Fabric 2.7: Gateway API 1.6 conformance, external authentication, and fewer snippets – NGINX Community Blog
We’re proud of what the team put together here, and we can’t wait to share it with the community and our Customers.