Skip to content

Commit 5009870

Browse files
author
Alan Dooley
committed
Merge branch 'main' into ngf/rework-manifest-install
2 parents 19066e4 + e4b8653 commit 5009870

6 files changed

Lines changed: 25 additions & 11 deletions

File tree

‎content/ngf/traffic-management/basic-routing.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -479,5 +479,5 @@ If your issue persists, [contact us](https://github.com/nginx/nginx-gateway-fabr
479479
To learn more about the Gateway API and the resources we created in this guide, check out the following resources:
480480

481481
- [Gateway API Overview](https://gateway-api.sigs.k8s.io/concepts/api-overview/)
482-
- [Deploying a simple Gateway](https://gateway-api.sigs.k8s.io/guides/simple-gateway/)
482+
- [Deploying a simple Gateway](https://gateway-api.sigs.k8s.io/guides/getting-started/simple-gateway/)
483483
- [HTTP Routing](https://gateway-api.sigs.k8s.io/guides/http-routing/)

‎content/nginxaas-azure/changelog/changelog.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,14 @@ To review older entries, visit the [Changelog archive]({{< ref "/nginxaas-azure/
1616

1717
## December 16, 2025
1818

19+
- {{% icon-feature %}} **Notification on update to deployments using the Stable Upgrade Channel**
20+
21+
NGINXaaS for Azure deployments using the **Stable** [Upgrade Channel]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}) will be updated to [NGINX Plus Release 36 (R36)]({{< ref "/nginx/releases.md#nginxplusrelease-36-r36" >}}) during the week of Jan 05-09, 2026. This will also include updates to the following NGINX Plus modules:
22+
- nginx-plus-module-njs
23+
24+
Please review the [NGINX Plus Release 36 (R36)]({{< ref "/nginx/releases.md#nginxplusrelease-36-r36" >}}) Release Notes carefully. If you have any concerns, it's recommended to validate your configuration against NGINX Plus R36 by setting up a test deployment using the **Preview** [Upgrade Channel]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). See [these instructions]({{< ref "/nginxaas-azure/quickstart/recreate.md" >}}) on how to set up a deployment similar to your current one.
25+
26+
If you have any other questions or concerns, please [contact us]({{< ref "/nginxaas-azure/get-help.md" >}}).
1927
- {{% icon-feature %}} **NGINXaaS for Azure is now generally available in more regions**
2028

2129
NGINXaaS for Azure is now available in the following additional regions:

‎content/nginxaas-google/getting-started/create-deployment/deploy-console.md‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,15 @@ NGINXaaS requires a [network attachment](https://cloud.google.com/vpc/docs/about
2727
1. Access the [Google Cloud Console](https://console.cloud.google.com/).
2828
1. Create a consumer VPC network and subnetwork. See [Google's documentation on creating a VPC and subnet](https://cloud.google.com/vpc/docs/create-modify-vpc-networks#console_1) for a step-by-step guide.
2929
- The region you select for the network attachment determines the region where your NGINXaaS deployment will be created. You do not manually select a region when creating an NGINXaaS deployment; it will automatically be created in the same region as the network attachment.
30-
1. Create a network attachment in your new subnet. See [Google's documentation on creating a network attachment](https://cloud.google.com/vpc/docs/create-manage-network-attachments#create-network-attachments) for a step-by-step guide.
31-
- For **production use cases**, we recommend setting the **Connection preference** on the Network Attachment resource to **Accept connections from selected projects**. This lets you manually approve trusted connections, as this setting cannot be changed later. To start, you can leave the list of accepted projects empty and add the NGINXaaS deployment project after it is created.
32-
- For **development use cases**, you can set the **Connection preference** to **Automatically accept connections from all projects**, which allows connections without manual approval. If you choose this option, you don't need to explicitly allow the NGINXaaS deployment project.
33-
1. Make a note of the network attachment ID. You will need it in the next steps to create your NGINXaaS deployment.
30+
1. Create a network attachment in your new subnet. See [Google's documentation on creating a network attachment](https://cloud.google.com/vpc/docs/create-manage-network-attachments#create-network-attachments) for a step-by-step guide. To ensure secure and controlled access to your network attachments, we strongly recommend configuring the **Connection preference** on the Network Attachment resource to **Accept connections from selected projects**. This option helps maintain security by ensuring only trusted providers can connect to your service by letting you manually approve trusted connections. To start, you can leave the list of accepted projects empty and add the NGINXaaS deployment project after it is created.
31+
32+
{{< call-out "caution" >}}
33+
For development and testing purposes, or in scenarios where speed and simplicity are prioritized over security, you have the option to configure the **Connection Preference** to **Automatically accept connections for all projects**. Please note that this approach is inherently less secure and may expose your service to unintended or unauthorized access. We encourage you to exercise caution if using the less restrictive option and to avoid using it in production or sensitive environments.
34+
{{< /call-out >}}
35+
36+
1. Make a note of the network attachment ID as it will be needed in the next steps to create your NGINXaaS deployment. You can find the network attachment ID in the Google Cloud Console by following the steps below:
37+
1. Go to Network Attachments at the following link: https://console.cloud.google.com/net-services/psc/list/networkAttachments?project=my-google-project (replace `my-google-project` in the URL with your project name).
38+
1. Open the desired network attachment and copy the value from the `Network Attachment` field. **Example format:** `projects/my-google-project/regions/us-east1/networkAttachments/my-network-attachment`.
3439

3540
## Access the NGINXaaS Console
3641

‎content/nginxaas-google/monitoring/access-management.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ nd-product: NGOOGL
1010

1111

1212

13-
F5 NGINXaaS for Google Cloud (NGINXaaS) leverages Workload Identity Federation (WIF) to integrate with Google Cloud services. For example, when WIF is configured, NGINXaaS can export logs and metrics from your deployment to Cloud Monitoring in your chosen Google project. To learn more about WIF on Google Cloud, see [Google's Workload Identity Federation documentation](https://cloud.google.com/iam/docs/workload-identity-federation).
13+
F5 NGINXaaS for Google Cloud (NGINXaaS) uses Workload Identity Federation (WIF) to integrate with Google Cloud services. For example, with WIF configured, your NGINXaaS deployment can export logs and metrics to Cloud Monitoring in your Google project. To learn more, see [Google's Workload Identity Federation documentation](https://cloud.google.com/iam/docs/workload-identity-federation).
1414

1515
## Prerequisites
1616

@@ -28,7 +28,7 @@ F5 NGINXaaS for Google Cloud (NGINXaaS) leverages Workload Identity Federation (
2828
- `Issuer URL` must be `https://accounts.google.com`.
2929
- `Allowed audiences` must contain the full canonical resource name of the workload identity pool provider, for example, `https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>`. If `Allowed audiences` is empty, the full canonical resource name of the workload identity pool provider will be included by default.
3030
- Add the following **attribute mapping**: `google.subject=assertion.sub`.
31-
- Add the following **attribute condition**: `assertion.sub=='$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID'` where `$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID` is your NGINXaaS deployment's service account's unique ID.
31+
- Add the following **attribute condition**: `assertion.sub=='$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID'`, where `$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID` is the unique ID of your NGINXaaS deployment's service account. This ID can be found in the `F5 NGINXaaS Service Account Unique ID` field under the **Cloud Info** section in the **Details** tab of your deployment.
3232

3333
### Grant access to the WIF principal with your desired roles
3434

@@ -37,7 +37,7 @@ In the [Google Cloud Console](https://console.cloud.google.com/),
3737
1. Go to the **IAM** page.
3838
1. Select **Grant Access**.
3939
1. Enter your principal, for example, `principal://iam.googleapis.com/projects/$WIF_PROJECT_NUMBER/locations/global/workloadIdentityPools/$WIF_POOL_ID/subject/$NGINXAAS_SERVICE_ACCOUNT_UNIQUE_ID`.
40-
1. Assign roles. For example,
40+
1. Assign roles. For example,
4141
- To grant access to export logs, add the **Logs Writer** role.
4242
- To grant access to export metrics, add the **Monitoring Metric Writer** role.
4343

@@ -67,4 +67,5 @@ In the NGINXaaS Console,
6767
6868
## What's next
6969

70-
[Add SSL/TLS Certificates]({{< ref "/nginxaas-google/getting-started/ssl-tls-certificates/ssl-tls-certificates-console.md" >}})
70+
- [Monitor your deployment]({{< ref "/nginxaas-google/monitoring/enable-monitoring.md" >}})
71+
- [Enable NGINX Logs]({{< ref "/nginxaas-google/monitoring/enable-nginx-logs.md" >}})

‎content/nic/changelog/_index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ For older releases, check the changelogs for previous years: [2024]({{< ref "/ni
3232

3333
- [8690](https://github.com/nginx/kubernetes-ingress/pull/8690) Update stub_status client path
3434
- [8731](https://github.com/nginx/kubernetes-ingress/pull/8731) Update service template for ipfamilies
35-
- [8743](https://github.com/nginx/kubernetes-ingress/pull/8743) Add more validation on rewrite-target
35+
- [8743](https://github.com/nginx/kubernetes-ingress/pull/8743) Fix CVE-2025-14727 Adding more validation on rewrite-target
3636

3737
### {{% icon arrow-up %}} Dependencies
3838

‎content/waf/policies/cookie-enforcement.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ You can control the attributes within these cookies.
1616
| ------------------- | ------------- | ---------------- | --------------- |
1717
| `httpOnlyAttribute` | _true_ | _false_ | _true_ in all policies |
1818
| `secureAttribute` | _never_ | _always_ | _always_ in the strict and API policies |
19-
| `sameSiteAttribute` | _lax_ | _none-value_, _strict_, _none_ | _strict_ in the strict policy, _none_ removes the attribute entirely |
19+
| `sameSiteAttribute` | _strict_ | _none-value_, _strict_, _none_ | _strict_ in the strict policy, _none_ removes the attribute entirely |
2020

2121
In this example, HttpOnly is configured as `true`, Secure as `never`, and SameSite as `strict`.
2222

0 commit comments

Comments
 (0)