Skip to content

Commit baa6c7b

Browse files
ADubhlaoichADubhlaoich
committed
feat: Add Helm instructions
1 parent fff74a1 commit baa6c7b

File tree

5 files changed

+143
-19
lines changed

5 files changed

+143
-19
lines changed

‎content/waf/install/docker.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -296,7 +296,7 @@ CMD ["sh", "/root/entrypoint.sh"]
296296

297297
{{% tab name="NGINX Plus" %}}
298298

299-
{{< include "/waf/dockerfiles/debian-oss.md" >}}
299+
{{< include "/waf/dockerfiles/debian-plus.md" >}}
300300

301301
{{% /tab %}}
302302

‎content/waf/install/kubernetes.md‎

Lines changed: 137 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,7 @@ Your folder should contain the following files:
215215
- _nginx-repo.key_
216216
- _Dockerfile_
217217

218-
To build an image, use the following command, replacing <your-image-name> as appropriate:
218+
To build an image, use the following command, replacing `<your-image-name>` as appropriate:
219219

220220
```shell
221221
sudo docker build --no-cache --platform linux/amd64 \
@@ -233,5 +233,140 @@ From this point, the steps change based on your installation method:
233233

234234
## Use Helm to install F5 WAF for NGINX
235235

236+
### Download your JSON web token
236237

237-
## Use Manifests to install F5 WAF for NGINX
238+
{{< include "licensing-and-reporting/download-jwt-from-myf5.md" >}}
239+
240+
### Get the Helm chart
241+
242+
To get the Helm chart, first configure Docker for the F5 Container Registry.
243+
244+
{{< include "waf/install-services-registry.md" >}}
245+
246+
Then use `helm pull` to get the chart, replacing `<release-version>`:
247+
```shell
248+
helm pull oci://private-registry.nginx.com/nap/nginx-app-protect --version <release-version> --untar
249+
```
250+
251+
Change the working directory afterwards:
252+
253+
```shell
254+
cd nginx-app-protect
255+
```
256+
257+
### Deploy the Helm chart
258+
259+
You will need to edit the `values.yaml` file for a few changes:
260+
261+
- Update _appprotect.nginx.image.repository_ and _appprotect.nginx.image.tag_ with the image name chosen during when [building the Docker image](#build-the-docker-image).
262+
- Update _appprotect.config.nginxJWT_ with your JSON web token
263+
- Update _dockerConfigJson_ to contain the base64 encoded Docker registration credentials
264+
265+
You can encode your credentials with the following command:
266+
267+
```shell
268+
echo '{
269+
"auths": {
270+
"private-registry.nginx.com": {
271+
"username": "<JWT Token>",
272+
"password": "none"
273+
}
274+
}
275+
}' | base64 -w 0```
276+
```
277+
278+
Alternatively, you can use `kubectl` to create a secret:
279+
280+
```shell
281+
kubectl create secret docker-registry regcred -n <namespace> \
282+
--docker-server=private-registry.nginx.com \
283+
--docker-username=<JWT Token> \
284+
--docker-password=none
285+
```
286+
287+
Once you have updated `values.yaml`, you can install F5 WAF for NGINX using `helm install`:
288+
289+
```shell
290+
helm install <release-name> .
291+
```
292+
293+
You can verify the deployment is successful with `kubectl get`, replacing `namespace` accordingly:
294+
295+
```shell
296+
kubectl get pods -n <namespace>
297+
kubectl get svc -n <namespace>
298+
```
299+
300+
{{< call-out "note" >}}
301+
302+
At this stage, you have finished deploying F5 WAF for NGINX and can look at [Post-installation checks](#post-installation-checks).
303+
304+
{{< /call-out >}}
305+
306+
### Helm Chart parameters
307+
308+
This table lists the configurable parameters of the F5 WAF for NGINX Helm chart and their default values.
309+
310+
To understand the _mTLS Configuration_ options, view the [Secure traffic between NGINX and WAF enforcer]() topic.
311+
312+
{{< table >}}
313+
| **Section** | **Key** | **Description** | **Default Value** |
314+
|-------------|---------|-----------------|-------------------|
315+
| **Namespace** | _namespace_ | The target Kubernetes namespace where the Helm chart will be deployed. | N/A |
316+
| **App Protect Configuration** | _appprotect.replicas_ | The number of replicas of the Nginx App Protect deployment. | 1 |
317+
| | _appprotect.readOnlyRootFilesystem_ | Specifies if the root filesystem is read-only. | false |
318+
| | _appprotect.annotations_ | Custom annotations for the deployment. | {} |
319+
| **NGINX Configuration** | _appprotect.nginx.image.repository_ | Docker image repository for NGINX. | \<your-private-registry>/nginx-app-protect-5 |
320+
| | _appprotect.nginx.image.tag_ | Docker image tag for NGINX. | latest |
321+
| | _appprotect.nginx.imagePullPolicy_ | Image pull policy. | IfNotPresent |
322+
| | _appprotect.nginx.resources_ | The resources of the NGINX container. | requests: cpu=10m,memory=16Mi |
323+
| **WAF Config Manager** | _appprotect.wafConfigMgr.image.repository_ | Docker image repository for the WAF Configuration Manager. | private-registry.nginx.com/nap/waf-config-mgr |
324+
| | _appprotect.wafConfigMgr.image.tag_ | Docker image tag for the WAF Configuration Manager. | 5.6.0 |
325+
| | _appprotect.wafConfigMgr.imagePullPolicy_ | Image pull policy. | IfNotPresent |
326+
| | _appprotect.wafConfigMgr.resources_ | The resources of the WAF Config Manager container. | requests: cpu=10m,memory=16Mi |
327+
| **WAF Enforcer** | _appprotect.wafEnforcer.image.repository_ | Docker image repository for the WAF Enforcer. | private-registry.nginx.com/nap/waf-enforcer |
328+
| | _appprotect.wafEnforcer.image.tag_ | Docker image tag for the WAF Enforcer. | 5.6.0 |
329+
| | _appprotect.wafEnforcer.imagePullPolicy_ | Image pull policy. | IfNotPresent |
330+
| | _appprotect.wafEnforcer.env.enforcerPort_ | Port for the WAF Enforcer. | 50000 |
331+
| | _appprotect.wafEnforcer.resources_ | The resources of the WAF Enforcer container. | requests: cpu=20m,memory=256Mi |
332+
| **WAF IP Intelligence** | _appprotect.wafIpIntelligence.enable | Enable or disable the use of the IP intelligence container | false |
333+
| | _appprotect.wafIpIntelligence.image.repository_ | Docker image repository for the WAF IP Intelligence. | private-registry.nginx.com/nap/waf-ip-intelligence |
334+
| | _appprotect.wafIpIntelligence.image.tag_ | Docker image tag for the WAF Enforcer. | 5.6.0 |
335+
| | _appprotect.wafIpIntelligence.imagePullPolicy_ | Image pull policy. | IfNotPresent |
336+
| | _appprotect.wafIpIntelligence.resources_ | The resources of the WAF Enforcer container. | requests: cpu=10m,memory=256Mi |
337+
| **Config** | _appprotect.config.name_ | The name of the ConfigMap used by the NGINX container. | nginx-config |
338+
| | _appprotect.config.annotations_ | The annotations of the ConfigMap. | {} |
339+
| | _appprotect.config.nginxJWT_ | JWT license for NGINX. | "" |
340+
| | _appprotect.config.nginxConf_ | NGINX configuration file content. | See _values.yaml_ |
341+
| | _appprotect.config.nginxDefault_ | Default server block configuration for NGINX. | {} |
342+
| | _appprotect.config.entries_ | Extra entries of the ConfigMap for customizing NGINX configuration. | {} |
343+
| **mTLS Configuration** | _appprotect.mTLS.serverCert_ | The base64-encoded TLS certificate for the App Protect Enforcer (server). | "" |
344+
| | _appprotect.mTLS.serverKey_ | The base64-encoded TLS key for the App Protect Enforcer (server). | "" |
345+
| | _appprotect.mTLS.serverCACert_ | The base64-encoded TLS CA certificate for the App Protect Enforcer (server). | "" |
346+
| | _appprotect.mTLS.clientCert_ | The base64-encoded TLS certificate for the NGINX (client). | "" |
347+
| | _appprotect.mTLS.clientKey_ | The base64-encoded TLS key for the NGINX (client). | "" |
348+
| | _appprotect.mTLS.clientCACert_ | The base64-encoded TLS CA certificate for the NGINX (client). | "" |
349+
| **Extra Volumes** | _appprotect.volumes_ | The extra volumes of the NGINX container. | [] |
350+
| **Extra Volume Mounts** | _appprotect.volumeMounts_ | The extra volume mounts of the NGINX container. | [] |
351+
| **Service** | _appprotect.service.nginx.ports.port_ | Service port. | 80 |
352+
| | _appprotect.service.nginx.ports.protocol_ | Protocol used. | TCP |
353+
| | _appprotect.service.nginx.ports.targetPort_ | Target port inside the container. | 80 |
354+
| | _appprotect.service.nginx.type_ | Service type. | NodePort |
355+
| **Storage Configuration** | _appprotect.storage.bundlesPath.name_ | Bundles volume name used by WAF Config Manager container for storing policy bundles | app-protect-bundles |
356+
| | _appprotect.storage.bundlesPath.mountPath_ | Bundles mount path used by WAF Config Manager container, which is the path to the app_protect_policy_file in nginx.conf. | /etc/app_protect/bundles |
357+
| | _appprotect.storage.pv.hostPath_ | Host path for persistent volume. | /mnt/nap5_bundles_pv_data |
358+
| | _appprotect.storage.pvc.bundlesPvc.storageClass_ | Storage class for PVC. | manual |
359+
| | _appprotect.storage.pvc.bundlesPvc.storageRequest_ | Storage request size. | 2Gi |
360+
| **Docker Configuration** | _dockerConfigJson_ | A base64-encoded string representing the Docker registry credentials in JSON format. | N/A |
361+
{{< /table >}}
362+
363+
## Use Manifests to install F5 WAF for NGINX
364+
365+
366+
## Post-installation checks
367+
368+
{{< include "waf/install-post-checks.md" >}}
369+
370+
## Next steps
371+
372+
{{< include "waf/install-next-steps.md" >}}

‎content/waf/install/virtual-environment.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
# We use sentence case and present imperative tone
3-
title: "Virtual environment"
3+
title: "Virtual machine or bare metal"
44
# Weights are assigned in increments of 100: determines sorting order
55
weight: 100
66
# Creates a table of contents and sidebar, useful for large documents
@@ -23,7 +23,7 @@ I'm identifying shared steps for it: depending on how large the steps might be,
2323

2424
{{</ call-out >}}
2525

26-
This page describes how to install F5 WAF for NGINX with NGINX Plus on a virtual machine or bare metal environment.
26+
This page describes how to install F5 WAF for NGINX in a virtual machine or bare metal environment.
2727

2828
## Before you begin
2929

‎content/waf/tools/converters.md‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,6 @@ nd-content-type: how-to
1212
nd-product: NAP-WAF
1313
---
1414

15-
{{< call-out "warning" "Information architecture note" >}}
16-
17-
This page replaces/combined information from the following two pages:
18-
19-
- [v4 Converter tools]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#converter-tools" >}})
20-
- [v5 Converter tools]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#converter-tools" >}})
21-
22-
It presumes contextual information from [Build and use the compiler tool]({{< ref "/waf/tools/compiler.md" >}}), trusting that the user has set-up a standalone compiler image for the sake of the examples.
23-
24-
{{</ call-out>}}
25-
2615
F5 WAF for NGINX has multiple tools for converting existing resources or configuration files for use from a BIG-IP for use from a BIG-IP environment.
2716

2817
{{< call-out "important" >}}

‎data/product-selector.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@
1616
- title: "NGINX Agent"
1717
url: "nginx-agent"
1818

19-
- productGroup: NGINX App Protect
19+
- productGroup: F5 WAF for NGINX
2020
products:
2121
- title: "F5 WAF for NGINX"
22-
url: "nginx-app-protect-waf"
23-
- title: "NGINX App Protect DoS"
22+
url: "waf"
23+
- title: "F5 DoS for NGINX"
2424
url: "nginx-app-protect-dos"
2525

2626
- productGroup: NGINX as a Service

0 commit comments

Comments
 (0)