Skip to content

Update NMS references #6802

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 18, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
docs: remove further NMS mentions
  • Loading branch information
JTorreG committed Nov 13, 2024
commit bb39b60613742a165d3fe3e0749d6fe243d104b3
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ NGINX Ingress Controller requires custom resource definitions (CRDs) installed i

If you do not use the custom resources that require those CRDs (which corresponds to `controller.enableCustomResources` set to `false` and `controller.appprotect.enable` set to `false` and `controller.appprotectdos.enable` set to `false`), the installation of the CRDs can be skipped by specifying `--skip-crds` for the helm install command.

---
---

### Upgrade the CRDs

Expand Down Expand Up @@ -287,7 +287,7 @@ The steps you should follow depend on the Helm release name:

## Run multiple NGINX Ingress Controllers

If you are running NGINX Ingress Controller releases in your cluster with custom resources enabled, the releases will share a single version of the CRDs.
If you are running NGINX Ingress Controller releases in your cluster with custom resources enabled, the releases will share a single version of the CRDs.

Ensure the NGINX Ingress Controller versions match the version of the CRDs. When uninstalling a release, ensure that you don’t remove the CRDs until there are no other NGINX Ingress Controller releases running in the cluster.

Expand Down Expand Up @@ -473,7 +473,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
|**nginxAgent.instanceManager.tls.enable** | Enable TLS for Instance Manager connection. | true |
|**nginxAgent.instanceManager.tls.skipVerify** | Skip certification verification for Instance Manager connection. | false |
|**nginxAgent.instanceManager.tls.caSecret** | Name of `nginx.org/ca` secret used for verification of Instance Manager TLS. | "" |
|**nginxAgent.instanceManager.tls.secret** | Name of `kubernetes.io/tls` secret with a TLS certificate and key for using mTLS between NGINX Agent and Instance Manager. See the NGINX Instance Manager [docs](https://docs.nginx.com/nginx-management-suite/admin-guides/configuration/secure-traffic/#mutual-client-certificate-auth-setup-mtls) and the NGINX Agent [docs](https://docs.nginx.com/nginx-agent/configuration/encrypt-communication/) for more details. | "" |
|**nginxAgent.instanceManager.tls.secret** | Name of `kubernetes.io/tls` secret with a TLS certificate and key for using mTLS between NGINX Agent and Instance Manager. See the NGINX Instance Manager [docs](https://docs.nginx.com/nginx-instance-manager/system-configuration/secure-traffic/#mutual-client-certificate-authentication-setup-mtls) and the NGINX Agent [docs](https://docs.nginx.com/nginx-agent/configuration/encrypt-communication/) for more details. | "" |
|**nginxAgent.syslog.host** | Address for NGINX Agent to run syslog listener. | 127.0.0.1 |
|**nginxAgent.syslog.port** | Port for NGINX Agent to run syslog listener. | 1514 |
|**nginxAgent.napMonitoring.collectorBufferSize** | Buffer size for collector. Will contain log lines and parsed log lines. | 50000 |
Expand Down
10 changes: 5 additions & 5 deletions site/content/releases.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ toc: true
weight: 2100

---
{{< note >}}
{{< note >}}
FIPS compliant images are currently impacted by compatibility issues with a dependent library.

We recommend against:
Expand All @@ -23,7 +23,7 @@ This will not affect logs generated by NGINX.
To ensure backwards compatibility, we will ensure the existing log format, `glog`, will be maintained through a configuration option for the next 3 releases.
{{< /note >}}

{{< important >}}
{{< important >}}
CRD version removal notice.
In our next major release, `v4.0.0`, support for the following apiVersions for these listed CRDs will be dropped:
1. `k8s.nginx.org/v1alpha` for `GlobalConfiguration`
Expand Down Expand Up @@ -165,7 +165,7 @@ versions: 1.25-1.30.
25 Jun 2024

Added support for the latest generation of NGINX App Protect Web Application Firewall, v5. NGINX Ingress Controller will continue to support the NGINX App Protect v4 family to allow customers to implement new Policy Bundle workflow at their own pace.
NGINX App Protect WAF v5 does not accept the JSON based policies, instead requiring users to compile a Policy Bundle outside of the NGINX Ingress Controller pod. Policy bundles contain a combination of custom Policy, signatures, and campaigns. Bundles can be compiled using either App Protect [compiler](https://docs.nginx.com/nginx-app-protect-waf/v5/admin-guide/compiler/), or [NGINX Instance Manager](https://docs.nginx.com/nginx-management-suite/nim/how-to/app-protect/manage-waf-security-policies/#list-security-policy-bundles). Learn more here, https://docs.nginx.com/nginx-ingress-controller/installation/integrations/app-protect-waf-v5/.
NGINX App Protect WAF v5 does not accept the JSON based policies, instead requiring users to compile a Policy Bundle outside of the NGINX Ingress Controller pod. Policy bundles contain a combination of custom Policy, signatures, and campaigns. Bundles can be compiled using either App Protect [compiler](https://docs.nginx.com/nginx-app-protect-waf/v5/admin-guide/compiler/), or [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager/app-protect/manage-waf-security-policies/#list-security-policy-bundles). Learn more here, https://docs.nginx.com/nginx-ingress-controller/installation/integrations/app-protect-waf-v5/.

With this release, NGINX Ingress Controller is implementing a new image maintenance policy. Container images for subscribed users will be updated on a regular basis in-between releases to reduce the CVE vulnerabilities.
Customers can observe the 3.6.x tag when listing images in the registry and select the latest image to update to for the current release.
Expand Down Expand Up @@ -280,12 +280,12 @@ versions: 1.23-1.29.

26 Mar 2024

NGINX Ingress Controller and NGINX App Protect WAF users can can now view violations through NGINX Instance Manager Security Monitor. Security Monitor can be used to build Policy bundles, reducing reload time impacts on NGINX Ingress Controller. Read more information in [NGINX App Protect WAF Bundles](https://docs.nginx.com/nginx-ingress-controller/installation/integrations/app-protect-waf/configuration/#waf-bundles) and [Security Monitoring](https://docs.nginx.com/nginx-management-suite/security/).
NGINX Ingress Controller and NGINX App Protect WAF users can can now view violations through NGINX Instance Manager Security Monitor. Security Monitor can be used to build Policy bundles, reducing reload time impacts on NGINX Ingress Controller. Read more information in [NGINX App Protect WAF Bundles](https://docs.nginx.com/nginx-ingress-controller/installation/integrations/app-protect-waf/configuration/#waf-bundles) and [Security Monitoring](https://docs.nginx.com/nginx-instance-manager/security-monitoring/).

When using NGINX Plus for two version [split rollouts](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#split), you can now control progressive rollouts of a new backend version without reloading NGINX using the [**-weight-changes-dynamic-reload**](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#-weight-changes-dynamic-reload) command line argument.

The [**use-cluster-ip**](https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#backend-services-upstreams) annotation is now available for the Ingress resource.
**use-cluster-ip** supports service meshes and specific use cases where the backend service should be the target instead of individual backend service pods, bypassing upstream load balancing.
**use-cluster-ip** supports service meshes and specific use cases where the backend service should be the target instead of individual backend service pods, bypassing upstream load balancing.

### <i class="fa-solid fa-rocket"></i> Features
- [5179](https://github.com/nginxinc/kubernetes-ingress/pull/5179) & [5051](https://github.com/nginxinc/kubernetes-ingress/pull/5051) Add NIM Security Dashboard integration for App Protect WAF security violations
Expand Down
2 changes: 1 addition & 1 deletion site/content/tutorials/security-monitoring.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ This document explains how to use NGINX Ingress Controller to configure NGINX Ag

## Prerequisites

This guide assumes that you have an installation of NGINX Instance Manager with [NGINX Security Monitoring](https://docs.nginx.com/nginx-management-suite/installation/vm-bare-metal/install-security-monitoring/) which is reachable from the Kubernetes cluster on which NGINX Ingress Controller is deployed.
This guide assumes that you have an installation of NGINX Instance Manager with [NGINX Security Monitoring](https://docs.nginx.com/nginx-instance-manager/monitoring/security-monitoring/deploy/install-security-monitoring/) which is reachable from the Kubernetes cluster on which NGINX Ingress Controller is deployed.

If you use custom container images, NGINX Agent must be installed along with NGINX App Protect WAF. See the [Dockerfile](https://github.com/nginxinc/kubernetes-ingress/tree/v{{< nic-version >}}/build/Dockerfile) for examples of how to install NGINX Agent or the [NGINX Agent installation documentation](https://docs.nginx.com/nginx-agent/installation-upgrade/) for more information.

Expand Down
39 changes: 19 additions & 20 deletions site/content/usage-reporting.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@ This page describes how to enable Usage Reporting for F5 NGINX Ingress Controlle

## Overview

Usage Reporting is a Kubernetes controller that connects to the NGINX Management Suite and reports the number of NGINX Ingress Controller nodes in the cluster. It is installed as a Kubernetes Deployment in the same cluster as NGINX Ingress Controller whose nodes you would like reported.
Usage Reporting is a Kubernetes controller that connects to the NGINX Instance Manager and reports the number of NGINX Ingress Controller nodes in the cluster. It is installed as a Kubernetes Deployment in the same cluster as NGINX Ingress Controller whose nodes you would like reported.

To use Usage Reporting, you must have access to NGINX Management Suite. For more information, see [NGINX Management Suite](https://www.f5.com/products/nginx/instance-manager/). Usage Reporting is a requirement of the new Flexible Consumption Program for NGINX Ingress Controller.
To use Usage Reporting, you must have access to NGINX Instance Manager. For more information, see [NGINX Instance Manager](https://www.f5.com/products/nginx/instance-manager/). Usage Reporting is a requirement of the new Flexible Consumption Program for NGINX Ingress Controller.

---

Expand All @@ -24,28 +24,27 @@ To use Usage Reporting, you must have access to NGINX Management Suite. For more
To deploy Usage Reporting, you must have the following:

- [NGINX Ingress Controller 3.2.0](https://docs.nginx.com/nginx-ingress-controller) or later
- [NGINX Management Suite 2.11](https://docs.nginx.com/nginx-management-suite) or later

In addition to the software requirements, you will need:

- Access to an NGINX Management Suite username and password for basic authentication. You will need the URL of your NGINX Management Suite system, and a username and password for Usage Reporting. The Usage Reporting user account must have access to the `/api/platform/v1/k8s-usage` endpoint.
- Access to an NGINX Instance Manager username and password for basic authentication. You will need the URL of your NGINX Instance Manager system, and a username and password for Usage Reporting. The Usage Reporting user account must have access to the `/api/platform/v1/k8s-usage` endpoint.
- Access to the Kubernetes cluster where NGINX Ingress Controller is deployed, with the ability to deploy a Kubernetes Deployment and a Kubernetes Secret.
- Access to public internet to pull the Usage Reporting image. This image is hosted in the NGINX container registry at `docker-registry.nginx.com/cluster-connector`. You can pull the image and push it to a private container registry for deployment.

[//]: # ( TODO: Update the image and tag after publish)

---

## Add a user account to NGINX Management Suite
## Add a user account to NGINX Instance Manager

Usage Reporting needs a user account to send usage data to NGINX Instance Manager: these are the steps involved.

1. Create a role following the steps in [Create a Role](https://docs.nginx.com/nginx-management-suite/admin-guides/access-control/set-up-rbac/#create-role) section of the NGINX Management Suite documentation. Select these permissions in step 6 for the role:
1. Create a role following the steps in [Create a Role](https://docs.nginx.com/nginx-instance-manager/admin-guide/rbac/create-roles/#create-roles) section of the NGINX Instance Manager documentation. Select these permissions in step 6 for the role:
- Module: Instance Manager
- Feature: NGINX Plus Usage
- Access: CRUD

1. Create a user account following the steps in [Add Users](https://docs.nginx.com/nginx-management-suite/admin-guides/access-control/set-up-rbac/#add-users) section of the NGINX Management Suite documentation. In step 6, assign the user to the role created above. Note that currently only "basic auth" authentication is supported for usage reporting purposes.
1. Create a user account following the steps in [Add Users](https://docs.nginx.com/nginx-instance-manager/admin-guide/rbac/assign-roles/#assign-roles-to-users-basic-authentication) section of the NGINX Instance Manager documentation. In step 5, assign the user to the role created above. Note that currently only "basic auth" authentication is supported for usage reporting purposes.

---

Expand All @@ -61,11 +60,11 @@ Create the Kubernetes namespace `nginx-cluster-connector` for Usage Reporting:

---

### Pass the credential to the NGINX Management Suite API
### Pass the credential to the NGINX Instance Manager API

To make the credential available to Usage Reporting, create a Kubernetes secret. The username and password created in the previous section are required to connect the NGINX Management Suite API.
To make the credential available to Usage Reporting, create a Kubernetes secret. The username and password created in the previous section are required to connect the NGINX Instance Manager API.

Both the username and password are stored in the Kubernetes Secret and need to be converted to base64. In this example the username will be `foo` and the password will be `bar`.
Both the username and password are stored in the Kubernetes Secret and need to be converted to base64. In this example the username will be `foo` and the password will be `bar`.

To obtain the base64 representation of a string, use the following command:

Expand Down Expand Up @@ -104,7 +103,7 @@ If you are using a different namespace, change the namespace in the `metadata` s
kubectl apply -f nms-basic-auth.yaml
```

If you need to update the basic-auth credentials for NGINX Management Suite in the future, update the `username` and `password` fields, and apply the changes by running the command again. Usage Reporting will automatically detect the changes, using the new username and password without redeployment.
If you need to update the basic-auth credentials for NGINX Instance Manager in the future, update the `username` and `password` fields, and apply the changes by running the command again. Usage Reporting will automatically detect the changes, using the new username and password without redeployment.

Download and save the deployment file [cluster-connector.yaml](https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v{{< nic-version >}}/examples/shared-examples/usage-reporting/cluster-connector.yaml). Edit the following under the `args` section and then save the file:

Expand All @@ -114,10 +113,10 @@ Download and save the deployment file [cluster-connector.yaml](https://raw.githu
- -nms-basic-auth-secret=nginx-cluster-connector/nms-basic-auth
```

- `-nms-server-address` should be the address of the Usage Reporting API, which will be the combination of NGINX Management Suite server hostname and the URI `api/platform/v1`
- `-nms-server-address` should be the address of the Usage Reporting API, which will be the combination of NGINX Instance Manager server hostname and the URI `api/platform/v1`
- `nms-basic-auth-secret` should be the namespace/name of the secret created in step 3: `nginx-cluster-connector/nms-basic-auth`.

{{< note >}} OpenShift requires a SecurityContextConstraints object for NGINX Cluster Connector.
{{< note >}} OpenShift requires a SecurityContextConstraints object for NGINX Cluster Connector.

It can be created with the command `oc create -f scc.yaml`, using the file found in `shared-examples/` {{< /note >}}

Expand All @@ -135,9 +134,9 @@ kubectl apply -f cluster-connector.yaml

---

## Viewing usage data from the NGINX Management Suite API
## Viewing usage data from the NGINX Instance Manager API

Usage Reporting sends the number of NGINX Ingress Controller instances and nodes in the cluster to NGINX Management Suite. To view the usage data, query the NGINX Management Suite API. The usage data is available at the following endpoint:
Usage Reporting sends the number of NGINX Ingress Controller instances and nodes in the cluster to NGINX Instance Manager. To view the usage data, query the NGINX Instance Manager API. The usage data is available at the following endpoint:


```shell
Expand Down Expand Up @@ -243,22 +242,22 @@ kubectl delete -f cluster-connector.yaml

## Command-line arguments

Usage Reporting supports several command-line arguments, which can be specified in the `args` section of the Kubernetes deployment file.
Usage Reporting supports several command-line arguments, which can be specified in the `args` section of the Kubernetes deployment file.

The following is a list of the supported command-line arguments and their usage:

---

### -nms-server-address `<string>`

The address of the NGINX Management Suite host. IPv4 addresses and hostnames are supported.
The address of the NGINX Instance Manager host. IPv4 addresses and hostnames are supported.
Default: `http://apigw.nms.svc.cluster.local/api/platform/v1/k8s-usage`.

---

### -nms-basic-auth-secret `<string>`

Secret for basic authentication to the NGINX Management Suite API. The secret must be in `kubernetes.io/basic-auth` format using base64 encoding.
Secret for basic authentication to the NGINX Instance Manager API. The secret must be in `kubernetes.io/basic-auth` format using base64 encoding.
Format: `<namespace>/<name>`.

---
Expand All @@ -271,15 +270,15 @@ The display name of the Kubernetes cluster.

### -skip-tls-verify

Skip TLS verification for the NGINX Management Suite server.
Skip TLS verification for the NGINX Instance Manager server.

{{< warning >}} This argument is intended for using a self-assigned certificate for testing purposes only. {{< /warning >}}

---

### -min-update-interval `<string>`

The minimum interval between updates to the NGINX Management Suite.
The minimum interval between updates to the NGINX Instance Manager.
Default: `24h`.

{{< warning >}} This argument is intended for testing purposes only. {{< /warning >}}