> For the complete documentation index, see [llms.txt](https://waf-doc.inext.checkpoint.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/kubernetes/envoy-application-security-injector.md). # Envoy Application Security (Injector) CloudGuard WAF for Envoy Gateway is deployed using a Helm chart that includes a namespace-level webhook. This webhook monitors changes to the Envoy Gateway deployment and automatically injects the required WAF agent and attachment into the gateway pods. The configuration of Envoy Gateway follows standard practices for defining gateway resources and routing traffic to your services.

### Prerequisites * Envoy Gateway deployed in your Kubernetes cluster * Envoy image must use: `envoyproxy/envoy:contrib-` Kubernetes cluster with RBAC enabled and cluster-admin permissions * Helm 3 installed on your local machine * kubectl installed and configured to access your cluster * A profile created in the CloudGuard UI with the agent token copied and policy set to **Enforce** ### Installation #### Step 1 – Create profile and copy token Create any profile in the CloudGuard UI, copy the agent token, and ensure the policy is set to **Enforce**. ### Installation #### Step 1 – Create profile and copy token Create any profile in the CloudGuard UI, copy the agent token, and ensure the policy is set to **Enforce**. #### Step 2 – Label the gateway namespace ``` kubectl label namespace inject-waf-attachment="true" --overwrite ``` #### Step 3 – Label the Deployment Ensure your Envoy Gateway Deployment includes the labels required by the webhook.objectSelector: * webhook.objectSelector.labelName * webhook.objectSelector.labelValue Example: ``` kubectl label deployment = -n --overwrite ``` #### Step 4 – Install the webhook using Helm ``` helm install cloudguard-webhook \ oci://registry-1.docker.io/checkpoint/cloudguard-waf-injector \ --version \ --set webhook.objectSelector.labelValue= \ --set webhook.objectSelector.labelName= \ --set appsec.persistence.enabled=false \ --set kind=envoy_gateway \ --set webhook.envoyGatewayImageName=envoy \ --set webhook.gatewayResourceNamespace= \ --set webhook.gatewayResourceName= \ --set appsec.agentToken= \ -n ``` {% hint style="info" %} Replace \ with the latest tag in this repository - {% endhint %} #### Step 5 – Restart the gateway Deployment ``` kubectl rollout restart deployment/ -n ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/kubernetes/envoy-application-security-injector.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.