Skip to content

Commit 30bab0a

Browse files
ADubhlaoichADubhlaoich
committed
feat: Finish Manifest deployment
1 parent baa6c7b commit 30bab0a

File tree

6 files changed

+339
-17
lines changed

6 files changed

+339
-17
lines changed

‎content/includes/waf/install-update-configuration.md‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -122,10 +122,4 @@ server {
122122
Once you have updated your configuration files, you can reload NGINX to apply the changes. You have two options depending on your environment:
123123

124124
- `nginx -s reload`
125-
- `sudo systemctl reload nginx`
126-
127-
{{< call-out "note" >}}
128-
129-
If you're using a V4 package, you have finished installing F5 WAF for NGINX and can look at [Post-installation checks](#post-installation-checks).
130-
131-
{{< /call-out >}}
125+
- `sudo systemctl reload nginx`

‎content/waf/fundamentals/overview.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,15 @@ For more details, see the [Supported security policy features]({{< ref "/waf/fun
2525

2626
It is platform-agnostic and supports a range of deployment options for operational needs:
2727

28-
1. [Virtual environment (Bare metal)]({{< ref "/waf/install/virtual-environment.md" >}})
28+
1. [Virtual machine or bare metal]({{< ref "/waf/install/virtual-environment.md" >}})
2929
- NGINX operates on the host system
3030
- WAF components are deployed in containers
3131
- Ideal for existing NGINX virtual environments
32-
1. [Docker]({{< ref "/waf/install/docker.md" >}})
33-
- NGINX and WAF components are deployed as containers
34-
- Suitable for environments with multiple deployment stages
3532
1. [Kubernetes]({{< ref "/waf/install/kubernetes.md" >}})
3633
- Integrates NGINX and WAF components in a single pod
3734
- Ideal for scalable, cloud-native environments
35+
1. [Docker]({{< ref "/waf/install/docker.md" >}})
36+
- NGINX and WAF components are deployed as containers
37+
- Suitable for environments with multiple deployment stages
3838

3939
F5 WAF for NGINX is part of the [NGINX One](https://www.f5.com/products/nginx/one) premium packages and runs natively on [NGINX Plus](https://www.f5.com/products/nginx/nginx-plus) and [NGINX Ingress Controller](https://www.f5.com/products/nginx/nginx-ingress-controller).

‎content/waf/install/docker.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# We use sentence case and present imperative tone
33
title: "Docker"
44
# Weights are assigned in increments of 100: determines sorting order
5-
weight: 200
5+
weight: 300
66
# Creates a table of contents and sidebar, useful for large documents
77
toc: true
88
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
@@ -739,6 +739,12 @@ docker ps
739739

740740
{{< include "waf/install-update-configuration.md" >}}
741741

742+
{{< call-out "note" >}}
743+
744+
If you're using a V4 package, you have finished installing F5 WAF for NGINX and can look at [Post-installation checks](#post-installation-checks).
745+
746+
{{< /call-out >}}
747+
742748
## Configure Docker services
743749

744750
{{< include "waf/install-services-docker.md" >}}

‎content/waf/install/kubernetes.md‎

Lines changed: 227 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# We use sentence case and present imperative tone
33
title: "Kubernetes"
44
# Weights are assigned in increments of 100: determines sorting order
5-
weight: 300
5+
weight: 200
66
# Creates a table of contents and sidebar, useful for large documents
77
toc: true
88
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
@@ -284,6 +284,8 @@ kubectl create secret docker-registry regcred -n <namespace> \
284284
--docker-password=none
285285
```
286286

287+
The `<JWT Token>` argument should be the _contents_ of the file, not the file itself. Ensure there are no additional characters such as extra whitespace.
288+
287289
Once you have updated `values.yaml`, you can install F5 WAF for NGINX using `helm install`:
288290

289291
```shell
@@ -310,10 +312,10 @@ This table lists the configurable parameters of the F5 WAF for NGINX Helm chart
310312
To understand the _mTLS Configuration_ options, view the [Secure traffic between NGINX and WAF enforcer]() topic.
311313

312314
{{< table >}}
313-
| **Section** | **Key** | **Description** | **Default Value** |
315+
| **Topic** | **Parameter** | **Description** | **Default value** |
314316
|-------------|---------|-----------------|-------------------|
315317
| **Namespace** | _namespace_ | The target Kubernetes namespace where the Helm chart will be deployed. | N/A |
316-
| **App Protect Configuration** | _appprotect.replicas_ | The number of replicas of the Nginx App Protect deployment. | 1 |
318+
| **F5 WAF for NGINX Configuration** | _appprotect.replicas_ | The number of replicas for the F5 WAF for NGINX deployment. | 1 |
317319
| | _appprotect.readOnlyRootFilesystem_ | Specifies if the root filesystem is read-only. | false |
318320
| | _appprotect.annotations_ | Custom annotations for the deployment. | {} |
319321
| **NGINX Configuration** | _appprotect.nginx.image.repository_ | Docker image repository for NGINX. | \<your-private-registry>/nginx-app-protect-5 |
@@ -362,11 +364,233 @@ To understand the _mTLS Configuration_ options, view the [Secure traffic between
362364

363365
## Use Manifests to install F5 WAF for NGINX
364366

367+
### Update configuration files
368+
369+
{{< include "waf/install-update-configuration.md" >}}
370+
371+
### Create a Secret
372+
373+
Before you can start the Manifest deployment, you need a Kubernetes secret for the Docker registry.
374+
375+
You can create the secret using `kubectl create`:
376+
377+
```shell
378+
kubectl create secret docker-registry regcred --docker-server=private-registry.nginx.com --docker-username=<JWT Token> --docker-password=none
379+
```
380+
381+
The `<JWT Token>` argument should be the _contents_ of the file, not the file itself. Ensure there are no additional characters such as extra whitespace.
382+
383+
384+
### Edit Manifest files
385+
386+
The default configuration provided creates two replicas, each hosting NGINX and WAF services together in a single Kubernetes pod.
387+
388+
Create all of these files in a single folder (Such as `/manifests`).
389+
390+
In each file, replace `<your-private-registry>/waf:<your-tag>` with your actual image tag.
391+
392+
393+
{{< tabs name="manifest-files" >}}
394+
395+
{{% tab name="waf-storage.yaml" %}}
396+
397+
{{< call-out "note" >}}
398+
399+
This configuration uses a _hostPath_ backed persistent volume claim.
400+
401+
{{< /call-out >}}
402+
403+
```yaml
404+
apiVersion: apps/v1
405+
kind: Deployment
406+
metadata:
407+
name: nap5-deployment
408+
spec:
409+
selector:
410+
matchLabels:
411+
app: nap5
412+
replicas: 2
413+
template:
414+
metadata:
415+
labels:
416+
app: nap5
417+
spec:
418+
imagePullSecrets:
419+
- name: regcred
420+
containers:
421+
- name: nginx
422+
image: <your-private-registry>/waf:<your-tag>
423+
imagePullPolicy: IfNotPresent
424+
volumeMounts:
425+
- name: app-protect-bd-config
426+
mountPath: /opt/app_protect/bd_config
427+
- name: app-protect-config
428+
mountPath: /opt/app_protect/config
429+
- name: waf-enforcer
430+
image: private-registry.nginx.com/nap/waf-enforcer:<version-tag>
431+
imagePullPolicy: IfNotPresent
432+
env:
433+
- name: ENFORCER_PORT
434+
value: "50000"
435+
volumeMounts:
436+
- name: app-protect-bd-config
437+
mountPath: /opt/app_protect/bd_config
438+
- name: waf-config-mgr
439+
image: private-registry.nginx.com/nap/waf-config-mgr:<version-tag>
440+
imagePullPolicy: IfNotPresent
441+
securityContext:
442+
allowPrivilegeEscalation: false
443+
capabilities:
444+
drop:
445+
- all
446+
volumeMounts:
447+
- name: app-protect-bd-config
448+
mountPath: /opt/app_protect/bd_config
449+
- name: app-protect-config
450+
mountPath: /opt/app_protect/config
451+
- name: app-protect-bundles
452+
mountPath: /etc/app_protect/bundles
453+
volumes:
454+
- name: app-protect-bd-config
455+
emptyDir: {}
456+
- name: app-protect-config
457+
emptyDir: {}
458+
- name: app-protect-bundles
459+
persistentVolumeClaim:
460+
claimName: nap5-bundles-pvc
461+
```
462+
463+
{{% /tab %}}
464+
465+
{{% tab name="waf-deployment.yaml" %}}
466+
467+
```yaml
468+
apiVersion: apps/v1
469+
kind: Deployment
470+
metadata:
471+
name: nap5-deployment
472+
spec:
473+
selector:
474+
matchLabels:
475+
app: nap5
476+
replicas: 2
477+
template:
478+
metadata:
479+
labels:
480+
app: nap5
481+
spec:
482+
imagePullSecrets:
483+
- name: regcred
484+
containers:
485+
- name: nginx
486+
image: <your-private-registry>/waf:<your-tag>
487+
imagePullPolicy: IfNotPresent
488+
volumeMounts:
489+
- name: app-protect-bd-config
490+
mountPath: /opt/app_protect/bd_config
491+
- name: app-protect-config
492+
mountPath: /opt/app_protect/config
493+
- name: waf-enforcer
494+
image: private-registry.nginx.com/nap/waf-enforcer:<version-tag>
495+
imagePullPolicy: IfNotPresent
496+
env:
497+
- name: ENFORCER_PORT
498+
value: "50000"
499+
volumeMounts:
500+
- name: app-protect-bd-config
501+
mountPath: /opt/app_protect/bd_config
502+
- name: waf-config-mgr
503+
image: private-registry.nginx.com/nap/waf-config-mgr:<version-tag>
504+
imagePullPolicy: IfNotPresent
505+
securityContext:
506+
allowPrivilegeEscalation: false
507+
capabilities:
508+
drop:
509+
- all
510+
volumeMounts:
511+
- name: app-protect-bd-config
512+
mountPath: /opt/app_protect/bd_config
513+
- name: app-protect-config
514+
mountPath: /opt/app_protect/config
515+
- name: app-protect-bundles
516+
mountPath: /etc/app_protect/bundles
517+
volumes:
518+
- name: app-protect-bd-config
519+
emptyDir: {}
520+
- name: app-protect-config
521+
emptyDir: {}
522+
- name: app-protect-bundles
523+
persistentVolumeClaim:
524+
claimName: nap5-bundles-pvc
525+
```
526+
527+
{{% /tab %}}
528+
529+
{{% tab name="waf-service.yaml" %}}
530+
531+
```yaml
532+
apiVersion: v1
533+
kind: Service
534+
metadata:
535+
name: nginx
536+
spec:
537+
selector:
538+
app: nap5
539+
ports:
540+
- protocol: TCP
541+
port: 80
542+
targetPort: 80
543+
type: NodePort
544+
```
545+
546+
{{% /tab %}}
547+
548+
{{< /tabs >}}
549+
550+
551+
### Start the Manifest deployment
552+
553+
From the folder containing the YAML files from the previous step (Suggested as `/manifests`), deploy F5 WAF for NGINX using `kubectl`:
554+
555+
```shell
556+
kubectl apply -f manifests/
557+
```
558+
559+
It will apply all the configuration defined in the files to your Kubernetes cluster.
560+
561+
You can then check the status of the deployment with `kubectl get`:
562+
563+
```shell
564+
kubectl get deployments
565+
kubectl get pods
566+
kubectl get services
567+
```
568+
569+
You should see output similar to the following:
570+
571+
```text
572+
deployment.apps/nap5-deployment created
573+
service/nginx created
574+
persistentvolume/nap5-bundles-pv created
575+
persistentvolumeclaim/nap5-bundles-pvc created
576+
```
577+
578+
{{< call-out "note" >}}
579+
580+
At this stage, you have finished deploying F5 WAF for NGINX and can look at [Post-installation checks](#post-installation-checks).
581+
582+
{{< /call-out >}}
365583

366584
## Post-installation checks
367585

368586
{{< include "waf/install-post-checks.md" >}}
369587

588+
Or from an external host:
589+
590+
```shell
591+
curl "<node-external-ip>:<node-port>/<script>"
592+
```
593+
370594
## Next steps
371595

372596
{{< include "waf/install-next-steps.md" >}}

‎content/waf/install/virtual-environment.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -485,6 +485,12 @@ sudo dnf install app-protect
485485

486486
{{< include "waf/install-update-configuration.md" >}}
487487

488+
{{< call-out "note" >}}
489+
490+
If you're using a V4 package, you have finished installing F5 WAF for NGINX and can look at [Post-installation checks](#post-installation-checks).
491+
492+
{{< /call-out >}}
493+
488494
## Configure Docker services
489495

490496
{{< include "waf/install-services-docker.md" >}}

0 commit comments

Comments
 (0)