# Envoy Application Security (Injector)

CloudGuard WAF for Envoy Gateway is deployed using a Helm chart that includes a namespace-level webhook. This webhook monitors changes to the Envoy Gateway deployment and automatically injects the required WAF agent and attachment into the gateway pods. The configuration of Envoy Gateway follows standard practices for defining gateway resources and routing traffic to your services.

<figure><img src="/files/QgoC3H0p7jCa9kKKugjj" alt=""><figcaption></figcaption></figure>

### Prerequisites

* Envoy Gateway deployed in your Kubernetes cluster
* Envoy image must use: `envoyproxy/envoy-contrib:<version>`
* Kubernetes cluster with RBAC enabled and cluster-admin permissions
* Helm 3 installed on your local machine
* kubectl installed and configured to access your cluster
* A profile created in the CloudGuard UI with the agent token copied and policy set to **Enforce**

### Installation

#### Step 1 – Create profile and copy token

Create any profile in the CloudGuard UI, copy the agent token, and ensure the policy is set to **Enforce**.

### Installation

#### Step 1 – Create profile and copy token

Create any profile in the CloudGuard UI, copy the agent token, and ensure the policy is set to **Enforce**.

#### Step 2 – Label the gateway namespace

```
kubectl label namespace <envoy gateway namespace> inject-waf-attachment="true" --overwrite
```

#### Step 3 – Label the Deployment

Ensure your Envoy Gateway Deployment includes the labels required by the webhook.objectSelector:

* webhook.objectSelector.labelName
* webhook.objectSelector.labelValue

Example:

```
kubectl label deployment <envoy gateway deployment name> <label name>=<label value> -n <envoy gateway namespace> --overwrite
```

#### Step 4 – Install the webhook using Helm

```
helm install cloudguard-webhook \
oci://registry-1.docker.io/checkpoint/cloudguard-waf-injector \
--version <version>\
--set webhook.objectSelector.labelValue=<label value> \
--set webhook.objectSelector.labelName=<label name> \
--set appsec.persistence.enabled=false \
--set kind=envoy_gateway \
--set webhook.envoyGatewayImageName=envoy \
--set webhook.gatewayResourceNamespace=<gateway resource namespace> \
--set webhook.gatewayResourceName=<gateway resource name> \
--set appsec.agentToken=<token> \
-n <envoy gateway namespace>
```

{% hint style="info" %}
Replace \<version> with the latest tag in this repository - <https://hub.docker.com/r/checkpoint/cloudguard-waf-injector/tags>
{% endhint %}

#### Step 5 – Restart the gateway Deployment

```
kubectl rollout restart deployment/<envoy gateway deployment name> -n <envoy gateway namespace>
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/kubernetes/envoy-application-security-injector.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.