feat(manager): show the WAF management UI when the WAF extension is on

[electricjesus]

Jira: https://tigera.atlassian.net/browse/EV-6793

Turning on GatewayAPI.spec.extensions.waf now gives you the WAF management UI. There is no second switch to find.

The manager controller reads the WAF extension state and sets WAF_UI_ENABLED on the ui-apis container. That is the variable ui-apis already reads at startup, so this is the whole change. No new API field and no ConfigMap.

Nothing new gets watched. The manager controller has watched GatewayAPI since it started resolving the ingress gateway class (manager_controller.go:172), so flipping the extension already re-reconciles the manager.

The read mirrors isGatewayWAFEnabled in the applicationlayer controller. A missing GatewayAPI CR means no gateways, so no WAF and no UI, and that is not an error. Any other read error degrades so the controller requeues instead of reporting the feature off. Enterprise only, and off on multi-tenant, matching utils.RBACManagementEnabled.

Flipping waf.state rolls the manager Deployment. That happens on enable or disable, not during normal use.

Affected component: operator (manager controller, manager render).

Testing

go test ./pkg/controller/manager/ ./pkg/render/ pass. New controller specs cover no CR, extensions unset, Disabled, Enabled, the legacy tigera-secure CR, the Calico variant, and multi-tenant. New render spec asserts WAF_UI_ENABLED tracks the flag both ways.

Also run on a cluster, swapping only the operator image. One master hashrelease cluster, one GatewayAPI CR, nothing else changed:

operator	waf.state	WAF_UI_ENABLED
stock	no CR	absent
this PR	no CR	false
this PR	Enabled	true
stock	Enabled	absent
this PR	Enabled	true

Row 4 is the bug: stock reconciles, bumps the Deployment generation, and strips the variable back out while WAF is on.

Release Note

The WAF management UI now appears when the GatewayAPI WAF extension is enabled.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

[Copilot]

Pull request overview

This PR makes the Manager UI automatically surface the WAF management UI when the GatewayAPI WAF extension is enabled, by having the manager controller project the extension state into the ui-apis container via the WAF_UI_ENABLED env var.

Changes:

• Add a manager-controller read of the GatewayAPI CR’s WAF extension state and plumb it into render.ManagerConfiguration.
• Render WAF_UI_ENABLED onto the ui-apis container env based on the computed flag.
• Add controller and render tests to cover the new projection behavior across enabled/disabled and guard conditions.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
pkg/controller/manager/manager_controller.go	Computes WAF UI enablement from GatewayAPI and passes it into manager rendering.
pkg/controller/manager/manager_controller_test.go	Adds unit tests for wafManagementEnabled behavior (no CR, enabled/disabled, legacy name, variant/tenancy guards).
pkg/render/manager.go	Adds WAFManagementEnabled to render config and sets WAF_UI_ENABLED on the ui-apis container.
pkg/render/manager_test.go	Updates baseline env var expectations and adds a render test asserting WAF_UI_ENABLED tracks the flag.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.