Skip to content

Commit 3e620c9

Browse files
liadlevif5liadlevif5
committed
feat: install nap 5 with helm chart
1 parent 6a2c2be commit 3e620c9

File tree

3 files changed

+272
-1
lines changed

3 files changed

+272
-1
lines changed

‎content/nap-waf/v5/admin-guide/deploy-on-kubernetes/_index.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
description: Learn how to deploy, upgrade, and manage F5 NGINX App Protect WAF v5 and App
3+
Protect Signatures.
4+
menu:
5+
docs:
6+
parent: v5
7+
title: Deploy on Kubernetes
8+
weight: 100
9+
url: /nginx-app-protect-waf/v5/admin-guide/deploy-on-kubernetes
10+
---

‎content/nap-waf/v5/admin-guide/deploy-on-kubernetes/deploy-with-helm.md‎

Lines changed: 261 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,261 @@
1+
---
2+
title: Deploying NGINX App Protect WAF with Helm
3+
weight: 300
4+
toc: true
5+
type: how-to
6+
product: NAP-WAF
7+
docs: DOCS-1366
8+
---
9+
10+
## Overview
11+
12+
This document explains how to install NGINX App Protect using Helm.
13+
14+
## Prerequisites
15+
* Kubernetes cluster
16+
* Helm installed
17+
* NGINX Docker Image
18+
* NGINX JWT License (if NGINX Plus is used)
19+
* Docker registry credentials for private-registry.nginx.com
20+
21+
## Build the NGINX Image
22+
23+
Follow the instructions below to build a Docker image containing the NGINX and the NGINX App Protect module.
24+
25+
### Download Certificates
26+
27+
{{< include "nap-waf/download-certificates.md" >}}
28+
29+
Proceed, by creating a `Dockerfile` using one of the examples provided below.
30+
31+
### Dockerfile Based on the Official NGINX Image
32+
33+
{{< include "nap-waf/build-from-official-nginx-image.md" >}}
34+
35+
### NGINX Open Source Dockerfile
36+
37+
{{<tabs name="nap5_nginx_OSS_dockerfiles">}}
38+
{{%tab name="Alpine Linux"%}}
39+
40+
{{< include "nap-waf/config/v5/build-nginx-image-oss/build-alpine.md" >}}
41+
42+
{{%/tab%}}
43+
{{%tab name="Amazon Linux 2"%}}
44+
45+
{{< include "nap-waf/config/v5/build-nginx-image-oss/build-amazon.md" >}}
46+
47+
{{%/tab%}}
48+
{{%tab name="CentOS"%}}
49+
50+
{{< include "nap-waf/config/v5/build-nginx-image-oss/build-centos.md" >}}
51+
52+
{{%/tab%}}
53+
{{%tab name="Debian"%}}
54+
55+
{{< include "nap-waf/config/v5/build-nginx-image-oss/build-debian.md" >}}
56+
57+
{{%/tab%}}
58+
{{%tab name="Oracle Linux 8"%}}
59+
60+
{{< include "nap-waf/config/v5/build-nginx-image-oss/build-oracle.md" >}}
61+
62+
{{%/tab%}}
63+
{{%tab name="RHEL"%}}
64+
65+
{{< include "nap-waf/config/v5/build-nginx-image-oss/build-rhel.md" >}}
66+
67+
{{%/tab%}}
68+
{{%tab name="Ubuntu"%}}
69+
70+
{{< include "nap-waf/config/v5/build-nginx-image-oss/build-ubuntu.md" >}}
71+
72+
{{%/tab%}}
73+
{{</tabs>}}
74+
75+
You are ready to [Build the image](#build-image).
76+
77+
### NGINX Plus Dockerfile
78+
79+
{{<tabs name="nap5_nginx_plus_dockerfiles">}}
80+
{{%tab name="Alpine Linux"%}}
81+
82+
{{< include "nap-waf/config/v5/build-nginx-image-plus/build-alpine.md" >}}
83+
84+
{{%/tab%}}
85+
{{%tab name="Amazon Linux 2"%}}
86+
87+
{{< include "nap-waf/config/v5/build-nginx-image-plus/build-amazon.md" >}}
88+
89+
{{%/tab%}}
90+
{{%tab name="CentOS"%}}
91+
92+
{{< include "nap-waf/config/v5/build-nginx-image-plus/build-centos.md" >}}
93+
94+
{{%/tab%}}
95+
{{%tab name="Debian"%}}
96+
97+
{{< include "nap-waf/config/v5/build-nginx-image-plus/build-debian.md" >}}
98+
99+
{{%/tab%}}
100+
{{%tab name="Oracle Linux 8"%}}
101+
102+
{{< include "nap-waf/config/v5/build-nginx-image-plus/build-oracle.md" >}}
103+
104+
{{%/tab%}}
105+
{{%tab name="RHEL"%}}
106+
107+
{{< include "nap-waf/config/v5/build-nginx-image-plus/build-rhel.md" >}}
108+
109+
{{%/tab%}}
110+
{{%tab name="Ubuntu"%}}
111+
112+
{{< include "nap-waf/config/v5/build-nginx-image-plus/build-ubuntu.md" >}}
113+
114+
{{%/tab%}}
115+
{{</tabs>}}
116+
117+
### Build Image
118+
119+
{{< include "nap-waf/build-nginx-image-cmd.md" >}}
120+
121+
Next, push it to your private image repository, ensuring it's accessible to your Kubernetes cluster.
122+
123+
## Pull the Chart
124+
1. Login to the registry
125+
```
126+
helm registry login private-registry.nginx.com
127+
```
128+
129+
1. Pull the chart
130+
```
131+
helm pull oci://private-registry.nginx.com/nap/nginx-app-protect --version <release-version> --untar
132+
```
133+
134+
1. Change your working directory to nginx-app-protect
135+
```
136+
cd nginx-app-protect
137+
```
138+
139+
## Deployment
140+
1. Set NGINX Docker Image and Tag
141+
142+
Update the appprotect.nginx.image.repository and appprotect.nginx.image.tag in values.yaml with your built NGINX image.
143+
144+
1. Set NGINX JWT License
145+
146+
Update the appprotect.config.nginxJWT in values.yaml with your JWT License Token.
147+
148+
1. Set Docker Registry Credentials
149+
150+
In values.yaml, update the dockerConfigJson to contain the base64 encoded Docker registration credentials
151+
```
152+
echo '{
153+
"auths": {
154+
"private-registry.nginx.com": {
155+
"username": "<JWT Token>",
156+
"password": "none"
157+
}
158+
}
159+
}' | base64 -w 0
160+
```
161+
OR create the secret using the following command:
162+
```
163+
kubectl create secret docker-registry regcred -n <namespace> \
164+
--docker-server=private-registry.nginx.com \
165+
--docker-username=<JWT Token> \
166+
--docker-password=none
167+
```
168+
169+
1. Deploy the Helm Chart
170+
171+
Use the following command to deploy the Helm chart:
172+
```
173+
helm install <release-name> .
174+
```
175+
Replace `<release-name>` with your desired release name.
176+
177+
3. Verify the Deployment
178+
179+
Use the following commands to verify the deployment:
180+
```
181+
kubectl get pods -n <namespace>
182+
kubectl get svc -n <namespace>
183+
```
184+
Replace <namespace> with the namespace specified in the values.yaml.
185+
186+
## Upgrade the Chart
187+
188+
To upgrade the release `<release-name>`:
189+
```
190+
helm upgrade <release-name> .
191+
```
192+
193+
## Uninstall the Chart
194+
195+
To uninstall/delete the release `<release-name>`:
196+
197+
```
198+
helm uninstall <release-name>
199+
```
200+
201+
## Configuration
202+
The following tables lists the configurable parameters of the NGINX App Protect chart and their default values.
203+
204+
| **Section** | **Key** | **Description** | **Default Value** |
205+
|-------------|---------|-----------------|-------------------|
206+
| **Namespace** | `namespace` | The target Kubernetes namespace where the Helm chart will be deployed. | N/A |
207+
| **App Protect Configuration** | `appprotect.replicas` | The number of replicas of the Nginx App Protect deployment. | 1 |
208+
| | `appprotect.readOnlyRootFilesystem` | Specifies if the root filesystem is read-only. | false |
209+
| | `appprotect.annotations` | Custom annotations for the deployment. | {} |
210+
| **NGINX Configuration** | `appprotect.nginx.image.repository` | Docker image repository for NGINX. | \<your-private-registry>/nginx-app-protect-5 |
211+
| | `appprotect.nginx.image.tag` | Docker image tag for NGINX. | latest |
212+
| | `appprotect.nginx.imagePullPolicy` | Image pull policy. | IfNotPresent |
213+
| | `appprotect.nginx.resources` | The resources of the NGINX container. | requests: cpu=10m,memory=16Mi |
214+
| **WAF Config Manager** | `appprotect.wafConfigMgr.image.repository` | Docker image repository for the WAF Configuration Manager. | private-registry.nginx.com/nap/waf-config-mgr |
215+
| | `appprotect.wafConfigMgr.image.tag` | Docker image tag for the WAF Configuration Manager. | 5.6.0 |
216+
| | `appprotect.wafConfigMgr.imagePullPolicy` | Image pull policy. | IfNotPresent |
217+
| | `appprotect.wafConfigMgr.resources` | The resources of the WAF Config Manager container. | requests: cpu=10m,memory=16Mi |
218+
| **WAF Enforcer** | `appprotect.wafEnforcer.image.repository` | Docker image repository for the WAF Enforcer. | private-registry.nginx.com/nap/waf-enforcer |
219+
| | `appprotect.wafEnforcer.image.tag` | Docker image tag for the WAF Enforcer. | 5.6.0 |
220+
| | `appprotect.wafEnforcer.imagePullPolicy` | Image pull policy. | IfNotPresent |
221+
| | `appprotect.wafEnforcer.env.enforcerPort` | Port for the WAF Enforcer. | 50000 |
222+
| | `appprotect.wafEnforcer.resources` | The resources of the WAF Enforcer container. | requests: cpu=20m,memory=256Mi |
223+
| **Config** | `appprotect.config.name` | The name of the ConfigMap used by the NGINX container. | nginx-config |
224+
| | `appprotect.config.annotations` | The annotations of the ConfigMap. | {} |
225+
| | `appprotect.config.nginxJWT` | JWT license for NGINX. | "" |
226+
| | `appprotect.config.nginxConf` | NGINX configuration file content. | See `values.yaml` |
227+
| | `appprotect.config.nginxDefault` | Default server block configuration for NGINX. | {} |
228+
| | `appprotect.config.entries` | Extra entries of the ConfigMap for customizing NGINX configuration. | {} |
229+
| **mTLS Configuration** | `appprotect.mTLS.serverCert` | The base64-encoded TLS certificate for the App Protect Enforcer (server). | "" |
230+
| | `appprotect.mTLS.serverKey` | The base64-encoded TLS key for the App Protect Enforcer (server). | "" |
231+
| | `appprotect.mTLS.serverCACert` | The base64-encoded TLS CA certificate for the App Protect Enforcer (server). | "" |
232+
| | `appprotect.mTLS.clientCert` | The base64-encoded TLS certificate for the NGINX (client). | "" |
233+
| | `appprotect.mTLS.clientKey` | The base64-encoded TLS key for the NGINX (client). | "" |
234+
| | `appprotect.mTLS.clientCACert` | The base64-encoded TLS CA certificate for the NGINX (client). | "" |
235+
| **Extra Volumes** | `appprotect.volumes` | The extra volumes of the NGINX container. | [] |
236+
| **Extra Volume Mounts** | `appprotect.volumeMounts` | The extra volume mounts of the NGINX container. | [] |
237+
| **Service** | `appprotect.service.nginx.ports.port` | Service port. | 80 |
238+
| | `appprotect.service.nginx.ports.protocol` | Protocol used. | TCP |
239+
| | `appprotect.service.nginx.ports.targetPort` | Target port inside the container. | 80 |
240+
| | `appprotect.service.nginx.type` | Service type. | NodePort |
241+
| **Storage Configuration** | `appprotect.storage.bundlesPath.name` | Bundles volume name used by WAF Config Manager container for storing policy bundles | app-protect-bundles |
242+
| | `appprotect.storage.bundlesPath.mountPath` | Bundles mount path used by WAF Config Manager container, which is the path to the app_protect_policy_file in nginx.conf. | /etc/app_protect/bundles |
243+
| | `appprotect.storage.pv.hostPath` | Host path for persistent volume. | /mnt/nap5_bundles_pv_data |
244+
| | `appprotect.storage.pvc.bundlesPvc.storageClass` | Storage class for PVC. | manual |
245+
| | `appprotect.storage.pvc.bundlesPvc.storageRequest` | Storage request size. | 2Gi |
246+
| **Docker Configuration** | `dockerConfigJson` | A base64-encoded string representing the Docker registry credentials in JSON format. | N/A |
247+
248+
This table should help you quickly understand and reference the configuration settings in the `values.yaml` file.
249+
250+
## Using Compiled Policy and Logging Profile Bundles in NGINX
251+
252+
In this setup, copy your compiled policy and logging profile bundles to `/mnt/nap5_bundles_pv_data` on a cluster node. Make sure that input files are accessible to UID 101. Then, in your NGINX configuration, refer to these files from `/etc/app_protect/bundles`.
253+
254+
For example, to apply `custom_policy.tgz` that you've placed in `/mnt/nap5_bundles_pv_data/`, use:
255+
256+
```nginx
257+
app_protect_policy_file "/etc/app_protect/bundles/custom_policy.tgz";
258+
```
259+
260+
The NGINX configuration is found in the values.yaml file `appprotect.config.nginxConf`.
261+
The bundles path and the host path can be configured in `appprotect.storage`.

‎content/nap-waf/v5/admin-guide/deploy-on-kubernetes.md‎ renamed to ‎content/nap-waf/v5/admin-guide/deploy-on-kubernetes/deploy-with-manifests.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Deploying NGINX App Protect WAF on Kubernetes
2+
title: Deploying NGINX App Protect WAF with Manifests
33
weight: 300
44
toc: true
55
type: how-to

0 commit comments

Comments
 (0)