Add support for annotations that translate to NGF specific resources

[salonichf5]

As a user of NIC looking to migrate to NGF
I want to translate my Ingress annotations to NGF specific resources
So that I can easily migrate from NIC to NGF

Acceptance

• Any annotations that NIC implements on the Ingress object that can be supported by NGF-specific resources are coverted.
• The list of annotations that are and are not supported from NIC are documented in the README in the Ingress2Gateway project.

[salonichf5]

Annotations and how they translate to NGF specific Resource

Client settings Policy

nginx.org/client-max-body-size

---

WAF Policy
Dependent on EPIC

appprotect.f5.com/app-protect-policy
appprotect.f5.com/app-protect-enable
appprotect.f5.com/app-protect-security-log-enable
appprotect.f5.com/app-protect-security-log
appprotect.f5.com/app-protect-security-log-destination
appprotectdos.f5.com/app-protect-dos-resource

---

Upstream Settings Policy

nginx.org/upstream-zone-size

---


Snippets Filter - all directives not implemented by NGF or in progress fall under this category

nginx.org/proxy-connect-timeout
nginx.org/proxy-read-timeout
nginx.org/proxy-send-timeout
nginx.org/proxy-buffering
nginx.org/proxy-buffers
nginx.org/proxy-buffer-size
nginx.org/proxy-max-temp-file-size
nginx.org/server-tokens
nginx.org/proxy-pass-headers (unsure about this)
nginx.org/hsts-behind-proxy (unsure about this as well)
nginx.org/basic-auth-secret
nginx.org/basic-auth-realm
nginx.com/jwt-key
nginx.com/jwt-realm
nginx.com/jwt-token
nginx.com/jwt-login-url
nginx.org/lb-method
nginx.org/max-fails
nginx.org/max-conns
nginx.org/fail-timeout
nginx.com/sticky-cookie-services
nginx.com/health-checks
nginx.com/health-checks-mandatory
nginx.com/health-checks-mandatory-queue
nginx.com/slow-start
nginx.org/use-cluster-ip
nginx.org/limit-req-rate
nginx.org/limit-req-key
nginx.org/limit-req-zone-size
nginx.org/limit-req-delay
nginx.org/limit-req-no-delay
nginx.org/limit-req-burst
nginx.org/limit-req-dry-run
nginx.org/limit-req-log-level
nginx.org/limit-req-reject-code
nginx.org/limit-req-scale
nginx.org/location-snippets
nginx.org/server-snippets
nginx.org/keepalive

---

[salonichf5]

For more clarification on the ticket

Conversion of existing NGINX directives already in use within NGINX Gateway Fabric to the SnippetsFilter spec is out of scope and should not be implemented or considered.

For example :

We will try to replace the lb-method to least_time; , let's replace that using snippetsFilter

apiVersion: gateway.nginx.org/v1alpha1
kind: SnippetsFilter
metadata:
  name: lb-method
spec:
  snippets:
    - context: http.server.location
      value: least_time;

Results in GatewayNotProgrammed

      Message:               The Listener is not programmed due to a failure to reload nginx with the configuration: msg: Config apply failed, rolling back config; error: failed to parse config "least_time" directive is not allowed here in /etc/nginx/includes/SnippetsFilter_http.server.location_default_rate-limiting-sf.conf:1

So, do not implement any of the pre-existing NGINX directives being used in NGINX Gateway Fabric to be translated to SnippetsFilter spec.

[sjberman]

@salonichf5 Lb method is specified in the upstream, not a location, so we can't set that value in a SnippetsFilter. As of right now there's no way to change that value in NGF.