Skip to content

Commit 47506fe

Browse files
ADubhlaoichADubhlaoich
committed
feat: Restructure Kubernetes documentation IA, update references
1 parent 4351403 commit 47506fe

File tree

10 files changed

+108
-88
lines changed

10 files changed

+108
-88
lines changed

‎content/nap-waf/v4/releases/about-4.14.md‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,18 +16,23 @@ March 18th, 2025
1616
- NGINX App Protect WAF Enforcer now supports multiple signature versions
1717
- Changed the maximum memory of the XML processing engine to 8GB
1818
- Upgraded the Go compiler to 1.23.7
19+
1920
---
2021

22+
## Important notes
23+
24+
- Alpine 3.17 is no longer supported
25+
2126
## Known issues
2227

23-
- "Violation Encoding" is not enabled by default
24-
- "Violation Bad Unescape" is not enabled by default
28+
- (12296) "Violation Bad Unescape" is not enabled by default
29+
- (12297) "Violation Encoding" is not enabled by default
2530

2631
---
2732

28-
## Important notes
33+
## Resolved issues
2934

30-
- Alpine 3.17 is no longer supported
35+
- (12254) A modified YAML file referenced by a JSON policy file causes a reload error when running `nginx -t`
3136

3237
---
3338

‎content/nap-waf/v5/admin-guide/deploy-on-docker.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Deploying NGINX App Protect WAF on Docker
2+
title: Deploy NGINX App Protect WAF with Docker
33
weight: 400
44
toc: true
55
type: how-to

‎content/nap-waf/v5/admin-guide/deploy-on-kubernetes/_index.md‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

content/nap-waf/v5/admin-guide/deploy-on-kubernetes/deploy-with-helm.md renamed to content/nap-waf/v5/admin-guide/deploy-with-helm.md

Lines changed: 83 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11
---
2-
title: Deploying NGINX App Protect WAF with Helm
3-
weight: 300
2+
title: Deploy NGINX App Protect WAF with Helm
3+
weight: 200
44
toc: true
55
type: how-to
66
product: NAP-WAF
77
---
88

99
## Overview
1010

11-
This document explains how to install NGINX App Protect using Helm.
11+
This document explains how to install F5 NGINX App Protect WAF with Helm.
12+
13+
---
1214

1315
## Prerequisites
1416

@@ -120,23 +122,32 @@ You are ready to [Build the image](#build-image).
120122

121123
Next, push it to your private image repository, ensuring it's accessible to your Kubernetes cluster.
122124

125+
---
126+
123127
## Pull the Chart
124-
1. Login to the registry
125-
```
126-
helm registry login private-registry.nginx.com
127-
```
128128

129-
1. Pull the chart
130-
```
131-
helm pull oci://private-registry.nginx.com/nap/nginx-app-protect --version <release-version> --untar
132-
```
129+
Login to the registry:
133130

134-
1. Change your working directory to nginx-app-protect
135-
```
136-
cd nginx-app-protect
137-
```
131+
```shell
132+
helm registry login private-registry.nginx.com
133+
```
134+
135+
Pull the chart:
136+
137+
```shell
138+
helm pull oci://private-registry.nginx.com/nap/nginx-app-protect --version <release-version> --untar
139+
```
140+
141+
Change your working directory to nginx-app-protect:
142+
143+
```shell
144+
cd nginx-app-protect
145+
```
146+
147+
---
138148

139149
## Deployment
150+
140151
1. Set NGINX Docker Image and Tag
141152

142153
Update the appprotect.nginx.image.repository and appprotect.nginx.image.tag in values.yaml with your built NGINX image.
@@ -174,7 +185,7 @@ Next, push it to your private image repository, ensuring it's accessible to your
174185
```
175186
Replace `<release-name>` with your desired release name.
176187
177-
3. Verify the Deployment
188+
1. Verify the Deployment
178189
179190
Use the following commands to verify the deployment:
180191
```
@@ -183,71 +194,78 @@ Next, push it to your private image repository, ensuring it's accessible to your
183194
```
184195
Replace <namespace> with the namespace specified in the values.yaml.
185196
186-
## Upgrade the Chart
197+
## Upgrade the chart
187198
188199
To upgrade the release `<release-name>`:
189200
```
190201
helm upgrade <release-name> .
191202
```
192203
193-
## Uninstall the Chart
204+
## Uninstall the chart
194205
195206
To uninstall/delete the release `<release-name>`:
196207
197-
```
208+
```shell
198209
helm uninstall <release-name>
199210
```
200211

212+
---
213+
201214
## Configuration
202-
The following tables lists the configurable parameters of the NGINX App Protect chart and their default values.
203215

216+
This table lists the configurable parameters of the NGINX App Protect chart and their default values.
217+
218+
It should help you quickly understand the referenced configuration settings in the `values.yaml` file.
219+
220+
{{< bootstrap-table "table table-striped table-bordered" >}}
204221
| **Section** | **Key** | **Description** | **Default Value** |
205222
|-------------|---------|-----------------|-------------------|
206-
| **Namespace** | `namespace` | The target Kubernetes namespace where the Helm chart will be deployed. | N/A |
207-
| **App Protect Configuration** | `appprotect.replicas` | The number of replicas of the Nginx App Protect deployment. | 1 |
208-
| | `appprotect.readOnlyRootFilesystem` | Specifies if the root filesystem is read-only. | false |
209-
| | `appprotect.annotations` | Custom annotations for the deployment. | {} |
210-
| **NGINX Configuration** | `appprotect.nginx.image.repository` | Docker image repository for NGINX. | \<your-private-registry>/nginx-app-protect-5 |
211-
| | `appprotect.nginx.image.tag` | Docker image tag for NGINX. | latest |
212-
| | `appprotect.nginx.imagePullPolicy` | Image pull policy. | IfNotPresent |
213-
| | `appprotect.nginx.resources` | The resources of the NGINX container. | requests: cpu=10m,memory=16Mi |
214-
| **WAF Config Manager** | `appprotect.wafConfigMgr.image.repository` | Docker image repository for the WAF Configuration Manager. | private-registry.nginx.com/nap/waf-config-mgr |
215-
| | `appprotect.wafConfigMgr.image.tag` | Docker image tag for the WAF Configuration Manager. | 5.6.0 |
216-
| | `appprotect.wafConfigMgr.imagePullPolicy` | Image pull policy. | IfNotPresent |
217-
| | `appprotect.wafConfigMgr.resources` | The resources of the WAF Config Manager container. | requests: cpu=10m,memory=16Mi |
218-
| **WAF Enforcer** | `appprotect.wafEnforcer.image.repository` | Docker image repository for the WAF Enforcer. | private-registry.nginx.com/nap/waf-enforcer |
219-
| | `appprotect.wafEnforcer.image.tag` | Docker image tag for the WAF Enforcer. | 5.6.0 |
220-
| | `appprotect.wafEnforcer.imagePullPolicy` | Image pull policy. | IfNotPresent |
221-
| | `appprotect.wafEnforcer.env.enforcerPort` | Port for the WAF Enforcer. | 50000 |
222-
| | `appprotect.wafEnforcer.resources` | The resources of the WAF Enforcer container. | requests: cpu=20m,memory=256Mi |
223-
| **Config** | `appprotect.config.name` | The name of the ConfigMap used by the NGINX container. | nginx-config |
224-
| | `appprotect.config.annotations` | The annotations of the ConfigMap. | {} |
225-
| | `appprotect.config.nginxJWT` | JWT license for NGINX. | "" |
226-
| | `appprotect.config.nginxConf` | NGINX configuration file content. | See `values.yaml` |
227-
| | `appprotect.config.nginxDefault` | Default server block configuration for NGINX. | {} |
228-
| | `appprotect.config.entries` | Extra entries of the ConfigMap for customizing NGINX configuration. | {} |
229-
| **mTLS Configuration** | `appprotect.mTLS.serverCert` | The base64-encoded TLS certificate for the App Protect Enforcer (server). | "" |
230-
| | `appprotect.mTLS.serverKey` | The base64-encoded TLS key for the App Protect Enforcer (server). | "" |
231-
| | `appprotect.mTLS.serverCACert` | The base64-encoded TLS CA certificate for the App Protect Enforcer (server). | "" |
232-
| | `appprotect.mTLS.clientCert` | The base64-encoded TLS certificate for the NGINX (client). | "" |
233-
| | `appprotect.mTLS.clientKey` | The base64-encoded TLS key for the NGINX (client). | "" |
234-
| | `appprotect.mTLS.clientCACert` | The base64-encoded TLS CA certificate for the NGINX (client). | "" |
235-
| **Extra Volumes** | `appprotect.volumes` | The extra volumes of the NGINX container. | [] |
236-
| **Extra Volume Mounts** | `appprotect.volumeMounts` | The extra volume mounts of the NGINX container. | [] |
237-
| **Service** | `appprotect.service.nginx.ports.port` | Service port. | 80 |
238-
| | `appprotect.service.nginx.ports.protocol` | Protocol used. | TCP |
239-
| | `appprotect.service.nginx.ports.targetPort` | Target port inside the container. | 80 |
240-
| | `appprotect.service.nginx.type` | Service type. | NodePort |
241-
| **Storage Configuration** | `appprotect.storage.bundlesPath.name` | Bundles volume name used by WAF Config Manager container for storing policy bundles | app-protect-bundles |
242-
| | `appprotect.storage.bundlesPath.mountPath` | Bundles mount path used by WAF Config Manager container, which is the path to the app_protect_policy_file in nginx.conf. | /etc/app_protect/bundles |
243-
| | `appprotect.storage.pv.hostPath` | Host path for persistent volume. | /mnt/nap5_bundles_pv_data |
244-
| | `appprotect.storage.pvc.bundlesPvc.storageClass` | Storage class for PVC. | manual |
245-
| | `appprotect.storage.pvc.bundlesPvc.storageRequest` | Storage request size. | 2Gi |
246-
| **Docker Configuration** | `dockerConfigJson` | A base64-encoded string representing the Docker registry credentials in JSON format. | N/A |
247-
248-
This table should help you quickly understand and reference the configuration settings in the `values.yaml` file.
249-
250-
## Using Compiled Policy and Logging Profile Bundles in NGINX
223+
| **Namespace** | _namespace_ | The target Kubernetes namespace where the Helm chart will be deployed. | N/A |
224+
| **App Protect Configuration** | _appprotect.replicas_ | The number of replicas of the Nginx App Protect deployment. | 1 |
225+
| | _appprotect.readOnlyRootFilesystem_ | Specifies if the root filesystem is read-only. | false |
226+
| | _appprotect.annotations_ | Custom annotations for the deployment. | {} |
227+
| **NGINX Configuration** | _appprotect.nginx.image.repository_ | Docker image repository for NGINX. | \<your-private-registry>/nginx-app-protect-5 |
228+
| | _appprotect.nginx.image.tag_ | Docker image tag for NGINX. | latest |
229+
| | _appprotect.nginx.imagePullPolicy_ | Image pull policy. | IfNotPresent |
230+
| | _appprotect.nginx.resources_ | The resources of the NGINX container. | requests: cpu=10m,memory=16Mi |
231+
| **WAF Config Manager** | _appprotect.wafConfigMgr.image.repository_ | Docker image repository for the WAF Configuration Manager. | private-registry.nginx.com/nap/waf-config-mgr |
232+
| | _appprotect.wafConfigMgr.image.tag_ | Docker image tag for the WAF Configuration Manager. | 5.6.0 |
233+
| | _appprotect.wafConfigMgr.imagePullPolicy_ | Image pull policy. | IfNotPresent |
234+
| | _appprotect.wafConfigMgr.resources_ | The resources of the WAF Config Manager container. | requests: cpu=10m,memory=16Mi |
235+
| **WAF Enforcer** | _appprotect.wafEnforcer.image.repository_ | Docker image repository for the WAF Enforcer. | private-registry.nginx.com/nap/waf-enforcer |
236+
| | _appprotect.wafEnforcer.image.tag_ | Docker image tag for the WAF Enforcer. | 5.6.0 |
237+
| | _appprotect.wafEnforcer.imagePullPolicy_ | Image pull policy. | IfNotPresent |
238+
| | _appprotect.wafEnforcer.env.enforcerPort_ | Port for the WAF Enforcer. | 50000 |
239+
| | _appprotect.wafEnforcer.resources_ | The resources of the WAF Enforcer container. | requests: cpu=20m,memory=256Mi |
240+
| **Config** | _appprotect.config.name_ | The name of the ConfigMap used by the NGINX container. | nginx-config |
241+
| | _appprotect.config.annotations_ | The annotations of the ConfigMap. | {} |
242+
| | _appprotect.config.nginxJWT_ | JWT license for NGINX. | "" |
243+
| | _appprotect.config.nginxConf_ | NGINX configuration file content. | See _values.yaml_ |
244+
| | _appprotect.config.nginxDefault_ | Default server block configuration for NGINX. | {} |
245+
| | _appprotect.config.entries_ | Extra entries of the ConfigMap for customizing NGINX configuration. | {} |
246+
| **mTLS Configuration** | _appprotect.mTLS.serverCert_ | The base64-encoded TLS certificate for the App Protect Enforcer (server). | "" |
247+
| | _appprotect.mTLS.serverKey_ | The base64-encoded TLS key for the App Protect Enforcer (server). | "" |
248+
| | _appprotect.mTLS.serverCACert_ | The base64-encoded TLS CA certificate for the App Protect Enforcer (server). | "" |
249+
| | _appprotect.mTLS.clientCert_ | The base64-encoded TLS certificate for the NGINX (client). | "" |
250+
| | _appprotect.mTLS.clientKey_ | The base64-encoded TLS key for the NGINX (client). | "" |
251+
| | _appprotect.mTLS.clientCACert_ | The base64-encoded TLS CA certificate for the NGINX (client). | "" |
252+
| **Extra Volumes** | _appprotect.volumes_ | The extra volumes of the NGINX container. | [] |
253+
| **Extra Volume Mounts** | _appprotect.volumeMounts_ | The extra volume mounts of the NGINX container. | [] |
254+
| **Service** | _appprotect.service.nginx.ports.port_ | Service port. | 80 |
255+
| | _appprotect.service.nginx.ports.protocol_ | Protocol used. | TCP |
256+
| | _appprotect.service.nginx.ports.targetPort_ | Target port inside the container. | 80 |
257+
| | _appprotect.service.nginx.type_ | Service type. | NodePort |
258+
| **Storage Configuration** | _appprotect.storage.bundlesPath.name_ | Bundles volume name used by WAF Config Manager container for storing policy bundles | app-protect-bundles |
259+
| | _appprotect.storage.bundlesPath.mountPath_ | Bundles mount path used by WAF Config Manager container, which is the path to the app_protect_policy_file in nginx.conf. | /etc/app_protect/bundles |
260+
| | _appprotect.storage.pv.hostPath_ | Host path for persistent volume. | /mnt/nap5_bundles_pv_data |
261+
| | _appprotect.storage.pvc.bundlesPvc.storageClass_ | Storage class for PVC. | manual |
262+
| | _appprotect.storage.pvc.bundlesPvc.storageRequest_ | Storage request size. | 2Gi |
263+
| **Docker Configuration** | _dockerConfigJson_ | A base64-encoded string representing the Docker registry credentials in JSON format. | N/A |
264+
{{< /bootstrap-table >}}
265+
266+
---
267+
268+
## Use compiled Policy and Logging Profile bundles in NGINX
251269

252270
In this setup, copy your compiled policy and logging profile bundles to `/mnt/nap5_bundles_pv_data` on a cluster node. Make sure that input files are accessible to UID 101. Then, in your NGINX configuration, refer to these files from `/etc/app_protect/bundles`.
253271

content/nap-waf/v5/admin-guide/deploy-on-kubernetes/deploy-with-manifests.md renamed to content/nap-waf/v5/admin-guide/deploy-with-manifests.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Deploying NGINX App Protect WAF with Manifests
2+
title: Deploy NGINX App Protect WAF with Manifests
33
weight: 300
44
toc: true
55
type: how-to

‎content/nap-waf/v5/admin-guide/install.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Installing NGINX App Protect WAF
3-
weight: 200
3+
weight: 400
44
toc: true
55
type: how-to
66
product: NAP-WAF

‎content/nap-waf/v5/admin-guide/overview.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ NGINX App Protect WAF v5 supports a range of deployment scenarios to meet variou
5050
- Deploys both NGINX and WAF components within containers.
5151
- Suitable for environments across development, testing, and production stages.
5252

53-
2. [Kubernetes Deployment]({{< relref "/nap-waf/v5/admin-guide/deploy-on-kubernetes.md" >}})
53+
2. [Kubernetes Deployment]({{< ref "/nap-waf/v5/admin-guide/deploy-with-helm.md" >}})
5454
- Integrates both NGINX and WAF components in a single pod.
5555
- Ideal for scalable, cloud-native environments.
5656

@@ -81,7 +81,7 @@ We recommend that you deploy the NGINX App Protect WAF v5 in a staging environme
8181
1. Install NGINX App Protect WAF 5 (using either nginx OSS or nginx-plus based on the need of customer's application).
8282
- [Installing NGINX App Protect WAF]({{<relref "/nap-waf/v5/admin-guide/install.md">}})
8383
- [Deploying NGINX App Protect WAF on Docker]({{<relref "/nap-waf/v5/admin-guide/deploy-on-docker.md">}})
84-
- [Deploying NGINX App Protect WAF on Kubernetes]({{<relref "/nap-waf/v5/admin-guide/deploy-on-kubernetes.md">}})
84+
- [Deploying NGINX App Protect WAF on Kubernetes]({{<relref "/nap-waf/v5/admin-guide/deploy-with-helm.md">}})
8585

8686
1. Compile your `.json` policies and logging profiles to `.tgz` bundles using [compiler-image]({{<relref "/nap-waf/v5/admin-guide/compiler.md">}}) because NGINX App Protect WAF v5 supports policies and logging profiles in a compiled bundle format only.
8787

‎content/nap-waf/v5/configuration-guide/configuration.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -787,7 +787,7 @@ To enable mTLS in NGINX, you need to perform the following steps:
787787
- ENFORCER_SERVER_KEY
788788
- ENFORCER_CA_FILE
789789

790-
Refer to the example for mTLS deployment in the admin guide, whether you're using [Docker]({{< relref "/nap-waf/v5/admin-guide/deploy-on-docker.md#docker-compose-file-with-mtls" >}}) or [Kubernetes]({{< relref "/nap-waf/v5/admin-guide/deploy-on-kubernetes.md#mtls-deployment" >}}).
790+
Refer to the example for mTLS deployment in the admin guide, whether you're using [Docker]({{< relref "/nap-waf/v5/admin-guide/deploy-on-docker.md#docker-compose-file-with-mtls" >}}) or [Kubernetes]({{< relref "/nap-waf/v5/admin-guide/deploy-with-manifests.md#mtls-deployment" >}}).
791791

792792
## Brute Force Attack Preventions
793793

‎content/nap-waf/v5/releases/about-5.4.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ November 19th, 2024
1616
## New features
1717

1818
- Added support for Amazon Linux 2023
19-
- Added support for [readOnlyFileSystem in Kubernetes deployments]({{< relref "/nap-waf/v5/admin-guide/deploy-on-kubernetes.md#configure-read-only-file-systems" >}})
19+
- Added support for [readOnlyFileSystem in Kubernetes deployments]({{< ref "/nap-waf/v5/admin-guide/deploy-with-manifests.md#configure-read-only-file-systems" >}})
2020
- Added a [a policy converter to the compiler]({{< relref "/nap-waf/v5/configuration-guide/configuration.md#policy-converter">}})
2121
- NGINX App Protect WAF now supports NGINX Plus R33
2222

‎content/nap-waf/v5/releases/about-5.6.md‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,27 +13,30 @@ March 18th, 2025
1313

1414
## New features
1515

16-
- You can now install NGINX App Protect WAF 5+ using a Helm chart
16+
- You can now [deploy NGINX App Protect WAF 5+ using a Helm chart]({{< ref "/nap-waf/v5/admin-guide/deploy-with-helm.md">}})
1717
- NGINX App Protect WAF Enforcer now supports multiple signature versions
1818
- Changed the maximum memory of the XML processing engine to 8GB
1919
- Upgraded the Go compiler to 1.23.7
2020

2121
---
2222

23+
## Important notes
24+
25+
- Alpine 3.17 is no longer supported
26+
2327
## Known issues
2428

25-
- "Violation Encoding" is not enabled by default
26-
- "Violation Bad Unescape" is not enabled by default
29+
- (12296) "Violation Bad Unescape" is not enabled by default
30+
- (12297) "Violation Encoding" is not enabled by default
2731

2832
---
2933

30-
## Important notes
34+
## Resolved issues
3135

32-
- Alpine 3.17 is no longer supported
36+
- (12254) A modified YAML file referenced by a JSON policy file causes a reload error when running `nginx -t`
3337

3438
---
3539

36-
3740
## Supported packages
3841

3942
### NGINX Open Source

0 commit comments

Comments
 (0)