diff --git a/.cloudcannon/schemas/nms/policy.md b/.cloudcannon/schemas/nms/policy.md index 074bf86b4..4f5d0054c 100644 --- a/.cloudcannon/schemas/nms/policy.md +++ b/.cloudcannon/schemas/nms/policy.md @@ -153,7 +153,7 @@ Confirm the policy is being enforced: -For help resolving common issues when setting up and configuring the policy, follow the steps in this section. If you cannot find a solution to your specific issue, reach out to [NGINX Customer Support]({{< relref "support/contact-support.md" >}}) for assistance. +For help resolving common issues when setting up and configuring the policy, follow the steps in this section. If you cannot find a solution to your specific issue, reach out to [NGINX Customer Support]({{< ref "support/contact-support.md" >}}) for assistance. ### Issue 1 diff --git a/CONTRIBUTING_DOCS.md b/CONTRIBUTING_DOCS.md index 58c264644..28b99cab1 100644 --- a/CONTRIBUTING_DOCS.md +++ b/CONTRIBUTING_DOCS.md @@ -91,7 +91,7 @@ Here are two examples: ```md To install , refer to the [installation instructions]({{< ref "install.md" >}}). -To install , refer to the [integration instructions]({{< relref "/integration/thing.md#section" >}}). +To install , refer to the [integration instructions]({{< ref "/integration/thing.md#section" >}}). ``` ### How to add images diff --git a/content/agent/contribute/dev-environment-setup.md b/content/agent/contribute/dev-environment-setup.md index 58e69d2c6..7f75df9d8 100644 --- a/content/agent/contribute/dev-environment-setup.md +++ b/content/agent/contribute/dev-environment-setup.md @@ -18,7 +18,7 @@ While most Linux or FreeBSD operating systems can be used to contribute to the N ## Install NGINX -Follow the steps in the [Installation]({{< relref "/agent/installation-upgrade/" >}}) section to download, install, and run NGINX and NGINX Agent. +Follow the steps in the [Installation]({{< ref "/agent/installation-upgrade/" >}}) section to download, install, and run NGINX and NGINX Agent. ## Clone the NGINX Agent Repository diff --git a/content/agent/installation-upgrade/container-environments/docker-images.md b/content/agent/installation-upgrade/container-environments/docker-images.md index e898134b1..d12f94e5e 100644 --- a/content/agent/installation-upgrade/container-environments/docker-images.md +++ b/content/agent/installation-upgrade/container-environments/docker-images.md @@ -14,7 +14,7 @@ NGINX Agent is a companion daemon for NGINX Open Source or NGINX Plus instances If you want to use NGINX Agent with NGINX Plus, you need to purchase an NGINX Plus license. Contact your F5 Sales representative for assistance. -See the requirements and supported operating systems in the [NGINX Agent Technical Specifications]({{< relref "/agent/technical-specifications.md" >}}) topic. +See the requirements and supported operating systems in the [NGINX Agent Technical Specifications]({{< ref "/agent/technical-specifications.md" >}}) topic. ## Deploy Offical NGINX and NGINX Plus Containers @@ -113,7 +113,7 @@ docker tag docker-registry.nginx.com/nginx/agent:mainline nginx-agent docker run --name nginx-agent -d nginx-agent ``` -{{}}To learn more about the configuration options, refer to the NGINX Agent [Configuration Overview]({{< relref "/agent/configuration/configuration-overview" >}}).{{}} +{{}}To learn more about the configuration options, refer to the NGINX Agent [Configuration Overview]({{< ref "/agent/configuration/configuration-overview" >}}).{{}} ### Enable the gRPC interface diff --git a/content/agent/installation-upgrade/container-environments/docker-support.md b/content/agent/installation-upgrade/container-environments/docker-support.md index 5dbad4826..2f9c5eafc 100644 --- a/content/agent/installation-upgrade/container-environments/docker-support.md +++ b/content/agent/installation-upgrade/container-environments/docker-support.md @@ -10,9 +10,9 @@ type: ## Overview -The NGINX Agent repository includes [Dockerfiles](https://github.com/nginx/agent/tree/main/scripts/docker) that can be used to [build custom container images]({{< relref "/agent/installation-upgrade/container-environments/docker-images.md" >}}). Images are created with an NGINX Open Source or NGINX Plus instance and are available for various operating systems. +The NGINX Agent repository includes [Dockerfiles](https://github.com/nginx/agent/tree/main/scripts/docker) that can be used to [build custom container images]({{< ref "/agent/installation-upgrade/container-environments/docker-images.md" >}}). Images are created with an NGINX Open Source or NGINX Plus instance and are available for various operating systems. -See the [Technical Specifications]({{< relref "/agent/technical-specifications.md#container-support" >}}) for a list of supported operationg systems. +See the [Technical Specifications]({{< ref "/agent/technical-specifications.md#container-support" >}}) for a list of supported operationg systems. NGINX Agent running in a container has some limitations that need to be considered, and are listed below. diff --git a/content/agent/installation-upgrade/getting-started.md b/content/agent/installation-upgrade/getting-started.md index 388fb5bde..e3dc9f3a2 100644 --- a/content/agent/installation-upgrade/getting-started.md +++ b/content/agent/installation-upgrade/getting-started.md @@ -176,5 +176,5 @@ NGINX Agent uses formatted log files to collect metrics. Expanding log formats a {{< important >}} Without log rotation or storage on a separate partition, log files could use up all the free drive space and cause your system to become unresponsive to certain services. -For more information, see [NGINX Agent Log Rotation]({{< relref "/agent/configuration/configuration-overview.md#nginx-agent-log-rotation" >}}). +For more information, see [NGINX Agent Log Rotation]({{< ref "/agent/configuration/configuration-overview.md#nginx-agent-log-rotation" >}}). {{< /important >}} diff --git a/content/agent/installation-upgrade/installation-oss.md b/content/agent/installation-upgrade/installation-oss.md index 9c22416d7..92c3a3306 100644 --- a/content/agent/installation-upgrade/installation-oss.md +++ b/content/agent/installation-upgrade/installation-oss.md @@ -15,7 +15,7 @@ Learn how to install NGINX Agent from the NGINX Open Source repository. ## Prerequisites - NGINX installed. Once installed, ensure it is running. If you don't have it installed already, follow these steps to install [NGINX](https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/) -- A [supported operating system and architecture]({{< relref "/agent/technical-specifications.md#supported-distributions" >}}) +- A [supported operating system and architecture]({{< ref "/agent/technical-specifications.md#supported-distributions" >}}) - `root` privilege ## Configure NGINX OSS Repository for installing NGINX Agent diff --git a/content/agent/installation-upgrade/installation-plus.md b/content/agent/installation-upgrade/installation-plus.md index 16209abcb..6ee2482d4 100644 --- a/content/agent/installation-upgrade/installation-plus.md +++ b/content/agent/installation-upgrade/installation-plus.md @@ -16,7 +16,7 @@ Learn how to install NGINX Agent from NGINX Plus repository - An NGINX Plus subscription (purchased or trial) - NGINX Plus installed. Once installed, ensure it is running. If you don't have it installed already, follow these steps to install [NGINX Plus](https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/) -- A [supported operating system and architecture]({{< relref "/agent/technical-specifications.md#supported-distributions" >}}) +- A [supported operating system and architecture]({{< ref "/agent/technical-specifications.md#supported-distributions" >}}) - `root` privilege - Your credentials to the MyF5 Customer Portal, provided by email from F5, Inc. - Your NGINX Plus certificate and public key (`nginx-repo.crt` and `nginx-repo.key` files), provided by email from F5, Inc. diff --git a/content/amplify/changelog.md b/content/amplify/changelog.md index 9b876ca73..6024dcfad 100644 --- a/content/amplify/changelog.md +++ b/content/amplify/changelog.md @@ -39,4 +39,4 @@ This release includes the following updates: ### Known Issues -- You can find information about known issues with NGINX Amplify in the [Known Issues]({{< relref "/amplify/known-issues.md" >}}) topic. +- You can find information about known issues with NGINX Amplify in the [Known Issues]({{< ref "/amplify/known-issues.md" >}}) topic. diff --git a/content/amplify/faq/metrics-and-metadata.md b/content/amplify/faq/metrics-and-metadata.md index 3ec976fad..ea7820bd5 100644 --- a/content/amplify/faq/metrics-and-metadata.md +++ b/content/amplify/faq/metrics-and-metadata.md @@ -8,6 +8,6 @@ docs: DOCS-957 ### What Data Does F5 NGINX Amplify Agent Gather? -[NGINX Amplify Agent Metrics and Metadata]({{< relref "/amplify/nginx-amplify-agent/metadata-metrics-collection" >}}) +[NGINX Amplify Agent Metrics and Metadata]({{< ref "/amplify/nginx-amplify-agent/metadata-metrics-collection" >}}) -{{< note >}}For a complete list of metrics, refer to the [Metrics and Metadata documentation]({{< relref "/amplify/metrics-metadata" >}}).{{< /note >}} \ No newline at end of file +{{< note >}}For a complete list of metrics, refer to the [Metrics and Metadata documentation]({{< ref "/amplify/metrics-metadata" >}}).{{< /note >}} \ No newline at end of file diff --git a/content/amplify/faq/nginx-amplify-agent.md b/content/amplify/faq/nginx-amplify-agent.md index 3e705104b..e075a0292 100644 --- a/content/amplify/faq/nginx-amplify-agent.md +++ b/content/amplify/faq/nginx-amplify-agent.md @@ -68,7 +68,7 @@ Previous versions were powered by Python 2.6 and 2.7, depending on the target pl 2552 ? S 0:00 amplify-agent ``` -For manual installation, please check the [user guide]({{< relref "/amplify/nginx-amplify-agent/install/installing-amplify-agent#installing-the-agent-manually" >}}). +For manual installation, please check the [user guide]({{< ref "/amplify/nginx-amplify-agent/install/installing-amplify-agent#installing-the-agent-manually" >}}). ### What Do I Need to Configure NGINX Amplify Agent to Report Metrics Correctly? @@ -76,29 +76,29 @@ Once you install NGINX Amplify Agent, it will automatically begin sending metric If you don't see the new system or NGINX in the web interface, or (some) metrics aren't being collected, please check the following: -1. The NGINX Amplify Agent package has been successfully [installed]({{< relref "/amplify/nginx-amplify-agent/install/installing-amplify-agent.md" >}}), and no warnings were shown during the installation. +1. The NGINX Amplify Agent package has been successfully [installed]({{< ref "/amplify/nginx-amplify-agent/install/installing-amplify-agent.md" >}}), and no warnings were shown during the installation. -2. The `amplify-agent` process is running and updating its [log file]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#agent-logfile" >}}). +2. The `amplify-agent` process is running and updating its [log file]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#agent-logfile" >}}). 3. NGINX Amplify Agent is running under the same user as your NGINX worker processes. 4. The NGINX instance is started with an absolute path. Currently, NGINX Amplify Agent **can't** detect NGINX instances launched with a relative path (e.g., "./nginx"). -5. The [user ID that is used by NGINX Amplify Agent and NGINX ]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#overriding-the-effective-user-id" >}}), can run *ps(1)* to see all system processes. If *ps(1)* is restricted for non-privileged users, NGINX Amplify Agent won't be able to find and properly detect the NGINX master process. +5. The [user ID that is used by NGINX Amplify Agent and NGINX ]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#overriding-the-effective-user-id" >}}), can run *ps(1)* to see all system processes. If *ps(1)* is restricted for non-privileged users, NGINX Amplify Agent won't be able to find and properly detect the NGINX master process. 6. The time is set correctly. If the time on the system where NGINX Amplify Agent runs is ahead or behind the world's clock, you won't be able to see the graphs. -7. *stub_status* is [properly configured]({{< relref "/amplify/nginx-amplify-agent/configuring-metric-collection" >}}), and the *stub_status module* is included in the NGINX build (this can be checked with `nginx -V`). +7. *stub_status* is [properly configured]({{< ref "/amplify/nginx-amplify-agent/configuring-metric-collection" >}}), and the *stub_status module* is included in the NGINX build (this can be checked with `nginx -V`). 8. NGINX [access.log](http://nginx.org/en/docs/http/ngx_http_log_module.html) and [error.log](http://nginx.org/en/docs/ngx_core_module.html#error_log) files are readable by the user `nginx` (or by the [user](http://nginx.org/en/docs/ngx_core_module.html#user) set in NGINX config). 9. All NGINX configuration files are readable by the NGINX Amplify Agent user ID (check owner, group, and permissions). -10. Extra [configuration steps have been performed as required]({{< relref "/amplify/metrics-metadata/nginx-metrics#additional-nginx-metrics" >}}) for the additional metrics to be collected. +10. Extra [configuration steps have been performed as required]({{< ref "/amplify/metrics-metadata/nginx-metrics#additional-nginx-metrics" >}}) for the additional metrics to be collected. 11. The system DNS resolver is correctly configured, and *receiver.amplify.nginx.com* can be successfully resolved. -12. Outbound TLS/SSL from the system to *receiver.amplify.nginx.com* is not restricted. This can be checked with *curl(1)*. [Configure a proxy server]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#setting-up-a-proxy" >}}) for NGINX Amplify Agent if required. +12. Outbound TLS/SSL from the system to *receiver.amplify.nginx.com* is not restricted. This can be checked with *curl(1)*. [Configure a proxy server]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#setting-up-a-proxy" >}}) for NGINX Amplify Agent if required. 13. *selinux(8)*, *apparmor(7)* or [grsecurity](https://grsecurity.net) are not interfering with the metric collection. E.g. for *selinux(8)* check **/etc/selinux/config**, try `setenforce 0` temporarily and see if it improves the situation for certain metrics. @@ -146,7 +146,7 @@ Under 10% of the CPU and a few dozen MBs of RSS memory will be consumed. If you ### How Can I Uninstall NGINX Amplify Agent? -Guide to [uninstall NGINX Amplify Agent]({{< relref "/amplify/nginx-amplify-agent/install/uninstalling-amplify-agent" >}}) +Guide to [uninstall NGINX Amplify Agent]({{< ref "/amplify/nginx-amplify-agent/install/uninstalling-amplify-agent" >}}) ### How Can I Override System Hostname? @@ -169,7 +169,7 @@ The hostname should be valid — the following aren't valid hostnames: ### How Can I Override the User ID for NGINX Amplify Agent to Use? -Refer to the [Configuring NGINX Amplify Agent]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#overriding-the-effective-user-id" >}}) section in the documentation. +Refer to the [Configuring NGINX Amplify Agent]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#overriding-the-effective-user-id" >}}) section in the documentation. ### Can I Use NGINX Amplify Agent with Docker? diff --git a/content/amplify/faq/user-interface.md b/content/amplify/faq/user-interface.md index 517837eef..26277afee 100644 --- a/content/amplify/faq/user-interface.md +++ b/content/amplify/faq/user-interface.md @@ -27,6 +27,6 @@ To completely delete a previously monitored object follow these steps: 2. Delete objects from the web interface 3. Delete alarms -To delete a system using the web interface — find it in the [Inventory]({{< relref "/amplify/user-interface/inventory" >}}), and select the [i] icon. You can delete objects from the popup window that appears next. +To delete a system using the web interface — find it in the [Inventory]({{< ref "/amplify/user-interface/inventory" >}}), and select the [i] icon. You can delete objects from the popup window that appears next. {{< important >}}Deleting objects in the User Interface will not stop NGINX Amplify Agent. To completely remove a system from monitoring, please stop or uninstall NGINX Amplify Agent, clean it up in the web interface, and clean up any alerts.{{< /important >}} diff --git a/content/amplify/metrics-metadata/metrics-overview.md b/content/amplify/metrics-metadata/metrics-overview.md index d49a09ce4..6a6b34f2c 100644 --- a/content/amplify/metrics-metadata/metrics-overview.md +++ b/content/amplify/metrics-metadata/metrics-overview.md @@ -6,6 +6,6 @@ toc: true docs: DOCS-972 --- -Most metrics are collected by F5 NGINX Amplify Agent without requiring the user to perform any additional setup. For troubleshooting, see [Troubleshooting Metrics Collection]({{< relref "/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md" >}}). +Most metrics are collected by F5 NGINX Amplify Agent without requiring the user to perform any additional setup. For troubleshooting, see [Troubleshooting Metrics Collection]({{< ref "/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md" >}}). -Some additional metrics for NGINX monitoring will only be reported if the NGINX configuration file is modified accordingly. See [Additional NGINX Metrics]({{< relref "/amplify/metrics-metadata/nginx-metrics#additional-nginx-metrics" >}}), and review the *Source* and *Variable* fields in the metric descriptions that follow. \ No newline at end of file +Some additional metrics for NGINX monitoring will only be reported if the NGINX configuration file is modified accordingly. See [Additional NGINX Metrics]({{< ref "/amplify/metrics-metadata/nginx-metrics#additional-nginx-metrics" >}}), and review the *Source* and *Variable* fields in the metric descriptions that follow. \ No newline at end of file diff --git a/content/amplify/metrics-metadata/other-metrics.md b/content/amplify/metrics-metadata/other-metrics.md index e02ed3ef4..83b583573 100644 --- a/content/amplify/metrics-metadata/other-metrics.md +++ b/content/amplify/metrics-metadata/other-metrics.md @@ -53,7 +53,7 @@ To start monitoring PHP-FPM, follow the steps below: 6. If your PHP-FPM is configured to use a TCP socket instead of a Unix domain socket, make sure you can query the PHP-FPM metrics manually with *cgi-fcgi*. Double check that your TCP socket configuration is secure (ideally, PHP-FPM pool listening on 127.0.0.1, and *listen.allowed_clients* enabled as well). -7. [Update]({{< relref "/amplify/nginx-amplify-agent/install/updating-amplify-agent.md" >}}) NGINX Amplify Agent to the most recent version. +7. [Update]({{< ref "/amplify/nginx-amplify-agent/install/updating-amplify-agent.md" >}}) NGINX Amplify Agent to the most recent version. 8. Make sure that the following options are set in **/etc/amplify-agent/agent.conf** @@ -70,9 +70,9 @@ To start monitoring PHP-FPM, follow the steps below: NGINX Amplify Agent should be able to detect the PHP-FPM master and workers, obtain the access to status, and collect the necessary metrics. -With all of the above successfully configured, the result should be an additional tab displayed on the [Graphs]({{< relref "/amplify/user-interface/graphs.md" >}}) page, with the pre-defined visualization of the PHP-FPM metrics. +With all of the above successfully configured, the result should be an additional tab displayed on the [Graphs]({{< ref "/amplify/user-interface/graphs.md" >}}) page, with the pre-defined visualization of the PHP-FPM metrics. -The PHP-FPM metrics on the [Graphs]({{< relref "/amplify/user-interface/graphs.md" >}})) page are cumulative, across all automatically detected pools. If you need per-pool graphs, go to [Dashboards]({{< relref "/amplify/user-interface/dashboards.md" >}}) and create custom graphs per pool. +The PHP-FPM metrics on the [Graphs]({{< ref "/amplify/user-interface/graphs.md" >}})) page are cumulative, across all automatically detected pools. If you need per-pool graphs, go to [Dashboards]({{< ref "/amplify/user-interface/dashboards.md" >}}) and create custom graphs per pool. Here is the list of caveats to look for if the PHP-FPM metrics are not being collected: @@ -82,7 +82,7 @@ Here is the list of caveats to look for if the PHP-FPM metrics are not being col - Agent can't connect to the TCP socket (when using PHP-FPM with a TCP socket). - Agent can't parse the PHP-FPM configuration. A possible workaround is to not have any ungrouped directives. Try to move any ungrouped directives under [global] and pool section headers. -If checking the above issues didn't help, please enable NGINX Amplify Agent's [debug log]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md" >}}), restart NGINX Amplify Agent, wait a few minutes, and then please submit a support request through https://my.f5.com/, please attach the debug log to the support case. +If checking the above issues didn't help, please enable NGINX Amplify Agent's [debug log]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md" >}}), restart NGINX Amplify Agent, wait a few minutes, and then please submit a support request through https://my.f5.com/, please attach the debug log to the support case. Below is the list of supported PHP-FPM metrics. @@ -221,7 +221,7 @@ To start monitoring MySQL, follow the instructions below. {{< note >}} NGINX Amplify Agent doesn't use *mysql(1)* for metric collection, however it implements a similar query mechanism via a Python module.{{< /note >}} -3. [Update]({{< relref "/amplify/nginx-amplify-agent/install/updating-amplify-agent.md" >}}) NGINX Amplify Agent to the most recent version. +3. [Update]({{< ref "/amplify/nginx-amplify-agent/install/updating-amplify-agent.md" >}}) NGINX Amplify Agent to the most recent version. 4. Add the following to **/etc/amplify-agent/agent.conf** @@ -246,9 +246,9 @@ To start monitoring MySQL, follow the instructions below. # service amplify-agent restart ``` -With the above configuration steps NGINX Amplify Agent should be able to detect the MySQL master, obtain the access to status, and collect the necessary metrics. The end result should be an additional tab displayed on the [Graphs]({{< relref "/amplify/user-interface/graphs.md" >}})) page, with the pre-defined visualization of the key MySQL metrics. +With the above configuration steps NGINX Amplify Agent should be able to detect the MySQL master, obtain the access to status, and collect the necessary metrics. The end result should be an additional tab displayed on the [Graphs]({{< ref "/amplify/user-interface/graphs.md" >}})) page, with the pre-defined visualization of the key MySQL metrics. -If the above didn't work, please enable NGINX Amplify Agent's [debug log]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md#agent-logfile" >}}), restart NGINX Amplify Agent, wait a few minutes, and then create a support request through https://my.f5.com/, please attach the debug log to the support case. +If the above didn't work, please enable NGINX Amplify Agent's [debug log]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md#agent-logfile" >}}), restart NGINX Amplify Agent, wait a few minutes, and then create a support request through https://my.f5.com/, please attach the debug log to the support case. NGINX Amplify Agent retrieves most of the metrics from the MySQL global [status variables](https://dev.mysql.com/doc/refman/5.7/en/server-status-variables.html). diff --git a/content/amplify/nginx-amplify-agent/amplify-agent-overview.md b/content/amplify/nginx-amplify-agent/amplify-agent-overview.md index b4fe8dd60..235fb15cd 100644 --- a/content/amplify/nginx-amplify-agent/amplify-agent-overview.md +++ b/content/amplify/nginx-amplify-agent/amplify-agent-overview.md @@ -14,13 +14,13 @@ Once you install NGINX Amplify Agent, it will automatically begin sending metric NGINX Amplify can currently monitor and collect performance metrics for: - 1. Operating system (see the list of supported OS [here]({{< relref "/amplify/faq/nginx-amplify-agent#what-operating-systems-are-supported" >}}))) + 1. Operating system (see the list of supported OS [here]({{< ref "/amplify/faq/nginx-amplify-agent#what-operating-systems-are-supported" >}}))) 2. NGINX and NGINX Plus - 3. [PHP-FPM]({{< relref "/amplify/metrics-metadata/other-metrics.md#php-fpm-metrics" >}}) - 4. [MySQL]({{< relref "/amplify/metrics-metadata/other-metrics.md#mysql-metrics" >}}) + 3. [PHP-FPM]({{< ref "/amplify/metrics-metadata/other-metrics.md#php-fpm-metrics" >}}) + 4. [MySQL]({{< ref "/amplify/metrics-metadata/other-metrics.md#mysql-metrics" >}}) The NGINX Amplify Agent identifies an NGINX instance as any running NGINX master process with either a unique binary path or a unique configuration. {{< note >}}There's no need to manually add or configure anything in the web interface after installing NGINX Amplify Agent. When NGINX Amplify Agent is started, the metrics and the metadata are automatically reported to the Amplify backend and visualized in the web interface.{{< /note >}} -When an NGINX instance is no longer in use it must be manually deleted in the web interface. The "Remove object" button can be found in the metadata viewer popup — see the [User Interface]({{< relref "/amplify/user-interface/">}}) documentation. \ No newline at end of file +When an NGINX instance is no longer in use it must be manually deleted in the web interface. The "Remove object" button can be found in the metadata viewer popup — see the [User Interface]({{< ref "/amplify/user-interface/">}}) documentation. \ No newline at end of file diff --git a/content/amplify/nginx-amplify-agent/configuration-analysis.md b/content/amplify/nginx-amplify-agent/configuration-analysis.md index d402a81fc..eff066d47 100644 --- a/content/amplify/nginx-amplify-agent/configuration-analysis.md +++ b/content/amplify/nginx-amplify-agent/configuration-analysis.md @@ -6,7 +6,7 @@ toc: true docs: DOCS-961 --- -F5 NGINX Amplify Agent can automatically find all relevant NGINX configuration files, parse them, extract their logical structure, and send the associated JSON data to the Amplify backend for further analysis and reporting. For more information on configuration analysis, please see the [Analyzer]({{< relref "/amplify/user-interface/analyzer.md" >}})) documentation. +F5 NGINX Amplify Agent can automatically find all relevant NGINX configuration files, parse them, extract their logical structure, and send the associated JSON data to the Amplify backend for further analysis and reporting. For more information on configuration analysis, please see the [Analyzer]({{< ref "/amplify/user-interface/analyzer.md" >}})) documentation. After NGINX Amplify Agent finds a particular NGINX configuration, it then automatically starts to keep track of its changes. When a change is detected with NGINX — e.g., a master process restarts, or the NGINX config is edited, an update is sent to the Amplify backend. diff --git a/content/amplify/nginx-amplify-agent/configuring-metric-collection.md b/content/amplify/nginx-amplify-agent/configuring-metric-collection.md index f2c73b619..b9ab5b37c 100644 --- a/content/amplify/nginx-amplify-agent/configuring-metric-collection.md +++ b/content/amplify/nginx-amplify-agent/configuring-metric-collection.md @@ -6,7 +6,7 @@ toc: true docs: DOCS-963 --- -To monitor an NGINX instance, F5 NGINX Amplify Agent must [find the relevant NGINX master process]({{< relref "/amplify/nginx-amplify-agent/detecting-monitoring-instances" >}}) and determine its key characteristics. +To monitor an NGINX instance, F5 NGINX Amplify Agent must [find the relevant NGINX master process]({{< ref "/amplify/nginx-amplify-agent/detecting-monitoring-instances" >}}) and determine its key characteristics. ## Metrics from stub_status @@ -51,7 +51,7 @@ Test your nginx configuration after you've added the `stub_status` section above {{< note >}} If you use the `conf.d*`directory to keep common parts of your NGINX configuration that are then automatically included in the [server](http://nginx.org/en/docs/http/ngx_http_core_module.html#server) sections across your NGINX config, do not use the snippet above. Instead, you should configure [stub_status](http://nginx.org/en/docs/http/ngx_http_stub_status_module.html) manually within an appropriate location or server block. {{< /note >}} -The above is an example `nginx_status` URI for [stub_status](http://nginx.org/en/docs/http/ngx_http_stub_status_module.html). NGINX Amplify Agent will determine the correct URI automatically upon parsing your NGINX configuration. Please make sure that the directory and the actual configuration file with `stub_status` are readable by NGINX Amplify Agent; otherwise, NGINX Amplify Agent won't be able to determine the `stub_status` URL correctly. If NGINX Amplify Agent fails to find `stub_status`, please refer to the workaround described [here]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#configuring-the-url-for-stub_status-or-status-api" >}}). +The above is an example `nginx_status` URI for [stub_status](http://nginx.org/en/docs/http/ngx_http_stub_status_module.html). NGINX Amplify Agent will determine the correct URI automatically upon parsing your NGINX configuration. Please make sure that the directory and the actual configuration file with `stub_status` are readable by NGINX Amplify Agent; otherwise, NGINX Amplify Agent won't be able to determine the `stub_status` URL correctly. If NGINX Amplify Agent fails to find `stub_status`, please refer to the workaround described [here]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#configuring-the-url-for-stub_status-or-status-api" >}}). Please ensure the `stub_status` [ACL](http://nginx.org/en/docs/http/ngx_http_access_module.html) is correctly configured, especially if your system is IPv6-enabled. Test the reachability of `stub_status` metrics with `wget(1)` or `curl(1)`. When testing, use the exact URL matching your NGINX configuration. @@ -85,7 +85,7 @@ nginx.http.request.writing = stub_status.writing For NGINX Plus, NGINX Amplify Agent will automatically use similar metrics available from the status API. -For more information about the metric list, please refer to [Metrics and Metadata]({{< relref "/amplify/metrics-metadata" >}}). +For more information about the metric list, please refer to [Metrics and Metadata]({{< ref "/amplify/metrics-metadata" >}}). ## Metrics from access.log and error.log @@ -95,11 +95,11 @@ You don't have to specifically point NGINX Amplify Agent to either the NGINX con NGINX Amplify Agent will also try to detect the [log format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) for a particular log to parse it properly and try to extract even more useful metrics, e.g., [$upstream_response_time](http://nginx.org/en/docs/http/ngx_http_upstream_module.html#var_upstream_response_time). -{{< note >}}Several metrics outlined in [Metrics and Metadata]({{< relref "metrics-metadata" >}}) will only be available if the corresponding variables are included in a custom [access.log](http://nginx.org/en/docs/http/ngx_http_log_module.html) format used for logging requests. You can find a complete list of NGINX log variables [here](http://nginx.org/en/docs/varindex.html).{{< /note >}} +{{< note >}}Several metrics outlined in [Metrics and Metadata]({{< ref "metrics-metadata" >}}) will only be available if the corresponding variables are included in a custom [access.log](http://nginx.org/en/docs/http/ngx_http_log_module.html) format used for logging requests. You can find a complete list of NGINX log variables [here](http://nginx.org/en/docs/varindex.html).{{< /note >}} ## Using Syslog for Metric Collection -If you configured NGINX Amplify Agent for syslog metric collection (see the [configuring syslog]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#configuring-syslog" >}}) documentation), make sure to add the following settings to the NGINX configuration: +If you configured NGINX Amplify Agent for syslog metric collection (see the [configuring syslog]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#configuring-syslog" >}}) documentation), make sure to add the following settings to the NGINX configuration: 1. Check that you are using NGINX version 1.9.5 or newer (or NGINX Plus Release 8 or newer). 2. Edit the NGINX configuration file and specify the syslog listener address as the first parameter to the [access.log](http://nginx.org/en/docs/http/ngx_http_log_module.html) directive. Include the `amplify` tag, and your preferred log format: @@ -108,7 +108,7 @@ If you configured NGINX Amplify Agent for syslog metric collection (see the [con access_log syslog:server=127.0.0.1:12000,tag=amplify,severity=info main_ext; ``` - (see also how to extend the NGINX log format to collect [additional metrics]({{< relref "/amplify/metrics-metadata/nginx-metrics#additional-nginx-metrics" >}})) + (see also how to extend the NGINX log format to collect [additional metrics]({{< ref "/amplify/metrics-metadata/nginx-metrics#additional-nginx-metrics" >}})) 3. Reload NGINX: diff --git a/content/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md b/content/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md index 40f2e8bce..b8d5e3f41 100644 --- a/content/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md +++ b/content/amplify/nginx-amplify-agent/install/configuring-amplify-agent.md @@ -58,7 +58,7 @@ NGINX Amplify Agent won't start unless a valid hostname is defined. The followin {{< note >}} You can also use the above method to replace the system's hostname with an arbitrary alias. Remember that if you redefine the hostname for a live object, the existing object will be marked as failed in the web interface. Redefining the hostname in NGINX Amplify Agent's configuration creates a new UUID and a new system for monitoring. {{< /note >}} -Alternatively, you can define an "alias" for the host in the UI (see the [Graphs]({{< relref "/amplify/user-interface/graphs" >}}) section). +Alternatively, you can define an "alias" for the host in the UI (see the [Graphs]({{< ref "/amplify/user-interface/graphs" >}}) section). ## Configuring the URL for stub_status or Status API @@ -97,14 +97,14 @@ configfile = /etc/nginx/nginx.conf ## Configuring Host Tags -You can define arbitrary tags on a "per-host" basis. Tags can be configured in the UI (see the [Graphs]({{< relref "/amplify/user-interface/graphs" >}}) documentation), or set in the `/etc/amplify-agent.conf` file: +You can define arbitrary tags on a "per-host" basis. Tags can be configured in the UI (see the [Graphs]({{< ref "/amplify/user-interface/graphs" >}}) documentation), or set in the `/etc/amplify-agent.conf` file: ```nginx [tags] tags = foo,bar,foo:bar ``` -You can use tags to build custom graphs, configure alerts, and filter the systems on the [Graphs]({{< relref "/amplify/user-interface/graphs" >}}) page. +You can use tags to build custom graphs, configure alerts, and filter the systems on the [Graphs]({{< ref "/amplify/user-interface/graphs" >}}) page. ## Configuring Syslog @@ -126,7 +126,7 @@ Restart NGINX Amplify Agent to have it reload the configuration and start listen service amplify-agent restart ``` -Make sure to [add the `syslog` settings]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#configuring-syslog" >}}) to your NGINX configuration as well. +Make sure to [add the `syslog` settings]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#configuring-syslog" >}}) to your NGINX configuration as well. ## Excluding Certain NGINX Log Files @@ -157,7 +157,7 @@ NGINX Amplify Agent maintains its log file in `/var/log/amplify-agent/agent.log` Upon installation, NGINX Amplify Agent's log rotation schedule is added to `/etc/logrotate.d/amplify-agent`. -The default level of logging for NGINX Amplify Agent is `INFO`. If you ever need to debug NGINX Amplify Agent, change the level to `DEBUG` as described below. The log file size can grow fast when using the `DEBUG` level. After you change the log level, please [restart]({{< relref "/amplify/nginx-amplify-agent/install/installing-amplify-agent#starting-and-stopping-the-agent" >}}) NGINX Amplify Agent. +The default level of logging for NGINX Amplify Agent is `INFO`. If you ever need to debug NGINX Amplify Agent, change the level to `DEBUG` as described below. The log file size can grow fast when using the `DEBUG` level. After you change the log level, please [restart]({{< ref "/amplify/nginx-amplify-agent/install/installing-amplify-agent#starting-and-stopping-the-agent" >}}) NGINX Amplify Agent. ```nginx [logger_agent-default] diff --git a/content/amplify/nginx-amplify-agent/install/uninstalling-amplify-agent.md b/content/amplify/nginx-amplify-agent/install/uninstalling-amplify-agent.md index b31c632d2..341d5d1bb 100644 --- a/content/amplify/nginx-amplify-agent/install/uninstalling-amplify-agent.md +++ b/content/amplify/nginx-amplify-agent/install/uninstalling-amplify-agent.md @@ -25,10 +25,10 @@ To completely delete a previously monitored object, perform the following steps: ### Delete objects from the web interface -To delete a system using the web interface — find it in the [Inventory]({{< relref "/amplify/user-interface/inventory" >}}), and click on the "Trash" icon. +To delete a system using the web interface — find it in the [Inventory]({{< ref "/amplify/user-interface/inventory" >}}), and click on the "Trash" icon. Deleting objects in the UI will not stop NGINX Amplify Agent. To completely remove a system from monitoring, stop and uninstall NGINX Amplify Agent first, then clean it up in the web interface. ### Delete alerts - Check the [Alerts]({{< relref "/amplify/user-interface/alerts" >}}) page and remove or mute the irrelevant rules. + Check the [Alerts]({{< ref "/amplify/user-interface/alerts" >}}) page and remove or mute the irrelevant rules. diff --git a/content/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md b/content/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md index 79bef938d..5501b2fbe 100644 --- a/content/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md +++ b/content/amplify/nginx-amplify-agent/troubleshooting-metrics-collection.md @@ -6,21 +6,21 @@ toc: true docs: DOCS-966 --- -After you [install and start]({{< relref "/amplify/nginx-amplify-agent/install/installing-amplify-agent" >}}) F5 NGINX Amplify Agent, it should start reporting right away, pushing aggregated data to the Amplify backend at regular 1 minute intervals. It'll take about a minute for a new system to appear in the Amplify web interface. +After you [install and start]({{< ref "/amplify/nginx-amplify-agent/install/installing-amplify-agent" >}}) F5 NGINX Amplify Agent, it should start reporting right away, pushing aggregated data to the Amplify backend at regular 1 minute intervals. It'll take about a minute for a new system to appear in the Amplify web interface. If you don't see the new system or NGINX instance in the web interface, or (some) metrics aren't being collected, please review the following: - 1. The NGINX Amplify Agent package has been successfully [installed]({{< relref "/amplify/nginx-amplify-agent/install/installing-amplify-agent" >}}), and no warnings were reported during the installation. - 2. The `amplify-agent` process is running and updating its [log file]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#agent-logfile" >}}). + 1. The NGINX Amplify Agent package has been successfully [installed]({{< ref "/amplify/nginx-amplify-agent/install/installing-amplify-agent" >}}), and no warnings were reported during the installation. + 2. The `amplify-agent` process is running and updating its [log file]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#agent-logfile" >}}). 3. NGINX Amplify Agent is running under the same user as your NGINX worker processes. 4. The NGINX instance is started with an absolute path. NGINX Amplify Agent **can't** detect NGINX instances launched with a relative path (e.g. "./nginx"). - 5. The [user ID that is used by NGINX Amplify Agent and the NGINX instance ]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#overriding-the-effective-user-id" >}}), can run `ps(1)` to see all system processes. If `ps(1)` is restricted for non-privileged users, NGINX Amplify Agent won't be able to find and properly detect the NGINX master process. + 5. The [user ID that is used by NGINX Amplify Agent and the NGINX instance ]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#overriding-the-effective-user-id" >}}), can run `ps(1)` to see all system processes. If `ps(1)` is restricted for non-privileged users, NGINX Amplify Agent won't be able to find and properly detect the NGINX master process. 6. The time is set correctly. If the time on the system where NGINX Amplify Agent runs is ahead or behind the world's clock, you won't be able to see the graphs. - 7. `stub_status` is [configured correctly]({{< relref "/amplify/nginx-amplify-agent/configuring-metric-collection" >}}), and the `stub_status module` is included in the NGINX build (this can be confirmed with `nginx -V`). + 7. `stub_status` is [configured correctly]({{< ref "/amplify/nginx-amplify-agent/configuring-metric-collection" >}}), and the `stub_status module` is included in the NGINX build (this can be confirmed with `nginx -V`). 8. NGINX [access.log](http://nginx.org/en/docs/http/ngx_http_log_module.html) and [error.log](http://nginx.org/en/docs/ngx_core_module.html#error_log) files are readable by the user `nginx` (or by the [user](http://nginx.org/en/docs/ngx_core_module.html#user) set in NGINX config). 9. All NGINX configuration files are readable by NGINX Amplify Agent user ID (check owner, group, and permissions). - 10. Extra [configuration steps have been performed as required]({{< relref "/amplify/metrics-metadata/nginx-metrics#additional-nginx-metrics" >}}) for the additional metrics to be collected. + 10. Extra [configuration steps have been performed as required]({{< ref "/amplify/metrics-metadata/nginx-metrics#additional-nginx-metrics" >}}) for the additional metrics to be collected. 11. The system DNS resolver is correctly configured, and *receiver.amplify.nginx.com* can be successfully resolved. - 12. Outbound TLS/SSL from the system to *receiver.amplify.nginx.com* is not restricted. This can be confirmed with `curl(1)`. [Configure a proxy server]({{< relref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#setting-up-a-proxy" >}}) for NGINX Amplify Agent if required. + 12. Outbound TLS/SSL from the system to *receiver.amplify.nginx.com* is not restricted. This can be confirmed with `curl(1)`. [Configure a proxy server]({{< ref "/amplify/nginx-amplify-agent/install/configuring-amplify-agent#setting-up-a-proxy" >}}) for NGINX Amplify Agent if required. 13. *selinux(8)*, *apparmor(7)* or [grsecurity](https://grsecurity.net) are not interfering with the metric collection. E.g., for _selinux_(8)* review **/etc/selinux/config**. Try `setenforce 0` temporarily and see if it improves the situation for certain metrics. 14. Some VPS providers use hardened Linux kernels that may restrict non-root users from accessing */proc* and */sys*. Metrics describing system and NGINX disk I/O are usually affected. There is no easy workaround except for allowing NGINX Amplify Agent to run as `root`. Sometimes fixing permissions for */proc* and */sys/block* may work. diff --git a/content/amplify/user-interface/account-settings.md b/content/amplify/user-interface/account-settings.md index 039707c6d..9c8bdb3b5 100644 --- a/content/amplify/user-interface/account-settings.md +++ b/content/amplify/user-interface/account-settings.md @@ -39,4 +39,4 @@ The "Agent settings section is where you enable or disable account-wide behavior * Periodic NGINX configuration syntax checking with "nginx -t" * Analyzing SSL certs -Per-system settings are accessible via the "Settings" icon that can be found for a particular NGINX on the [**Analyzer**]({{< relref "/amplify/user-interface/analyzer.md" >}}) page. Per-system settings override the global settings. If you prefer to monitor your NGINX configurations on all but some specific systems, you can uncheck the corresponding settings. +Per-system settings are accessible via the "Settings" icon that can be found for a particular NGINX on the [**Analyzer**]({{< ref "/amplify/user-interface/analyzer.md" >}}) page. Per-system settings override the global settings. If you prefer to monitor your NGINX configurations on all but some specific systems, you can uncheck the corresponding settings. diff --git a/content/amplify/user-interface/analyzer.md b/content/amplify/user-interface/analyzer.md index 83ca976f1..9b011311f 100644 --- a/content/amplify/user-interface/analyzer.md +++ b/content/amplify/user-interface/analyzer.md @@ -40,12 +40,12 @@ The following information is provided when a report is generated from an NGINX c * Key security measures (e.g., *stub_status* is unprotected) * Typical errors in configuring locations, especially with *regex* -To parse SSL certificate metadata, NGINX Amplify Agent uses standard OpenSSL(1) functions. SSL certificates are parsed and analyzed only when the corresponding [settings]({{< relref "/amplify/user-interface/account-settings" >}}) are turned on. SSL certificate analysis is *off* by default. +To parse SSL certificate metadata, NGINX Amplify Agent uses standard OpenSSL(1) functions. SSL certificates are parsed and analyzed only when the corresponding [settings]({{< ref "/amplify/user-interface/account-settings" >}}) are turned on. SSL certificate analysis is *off* by default. Static analysis will only include information about specific issues with the NGINX configuration if those are found in your NGINX setup. In the future, the **Analyzer** page will also include *dynamic analysis*, effectively linking the observed NGINX behavior to its configuration — e.g., when it makes sense to increase or decrease certain parameters like [proxy_buffers](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers), etc. -{{< note >}} Config analysis is *on* by default. If you don't want your NGINX configuration to be checked, unset the corresponding setting in either Global, or Local (per-system) settings. See [**Settings**]({{< relref "/amplify/user-interface/account-settings" >}}). {{< /note >}} +{{< note >}} Config analysis is *on* by default. If you don't want your NGINX configuration to be checked, unset the corresponding setting in either Global, or Local (per-system) settings. See [**Settings**]({{< ref "/amplify/user-interface/account-settings" >}}). {{< /note >}} {{< img src="amplify/amplify-analyzer-settings.png" alt="Analyzer Settings" >}} \ No newline at end of file diff --git a/content/amplify/user-interface/dashboards.md b/content/amplify/user-interface/dashboards.md index d057d03ea..3b6167309 100644 --- a/content/amplify/user-interface/dashboards.md +++ b/content/amplify/user-interface/dashboards.md @@ -44,7 +44,7 @@ Because NGINX Amplify is **not** a SaaS log analyzer, the additional slicing for Essentially, NGINX Amplify Agent performs a combination of real-time log analytics and standard metrics collection (e.g., metrics from the *stub_status* module). NGINX Amplify Agent does only the **real-time log processing**, and always on the same host where it is running. -Metric filters can be really powerful. By using the filters and creating additional "metric dimensions", it is possible to build highly granular and informative graphs. To enable NGINX Amplify Agent to slice the metrics you must add the corresponding log variables to the active NGINX log format. Please see the [Additional NGINX metrics]({{< relref "/amplify/metrics-metadata/nginx-metrics#additional-nginx-metrics" >}}) section below. +Metric filters can be really powerful. By using the filters and creating additional "metric dimensions", it is possible to build highly granular and informative graphs. To enable NGINX Amplify Agent to slice the metrics you must add the corresponding log variables to the active NGINX log format. Please see the [Additional NGINX metrics]({{< ref "/amplify/metrics-metadata/nginx-metrics#additional-nginx-metrics" >}}) section below. Metric filters are available only for the metrics generated from the log files. For other metrics some additional modifiers can be set when editing a graph. E.g., for NGINX Plus it is possible to specify the status API zones to build more detailed visualizations. diff --git a/content/amplify/user-interface/graphs.md b/content/amplify/user-interface/graphs.md index 5556fbaff..701138cb7 100644 --- a/content/amplify/user-interface/graphs.md +++ b/content/amplify/user-interface/graphs.md @@ -24,4 +24,4 @@ Above the graphs, you will find the following: You can also copy a predefined graph to a custom dashboard by focusing on the graph and clicking on the arrow in the top right corner. -Check the [Metrics and Metadata]({{< relref "/amplify/metrics-metadata" >}}) documentation to learn more about the displayed metrics. +Check the [Metrics and Metadata]({{< ref "/amplify/metrics-metadata" >}}) documentation to learn more about the displayed metrics. diff --git a/content/amplify/user-interface/overview.md b/content/amplify/user-interface/overview.md index f358b5e1f..a797c8c77 100644 --- a/content/amplify/user-interface/overview.md +++ b/content/amplify/user-interface/overview.md @@ -10,7 +10,7 @@ The Overview page is designed to provide a quick summary of the state of your NG Five key overlay graphs are displayed for the selected period. By switching over various periods, you can compare trends and see if anything abnormal shows up. -The cumulative [metrics]({{< relref "/amplify/metrics-metadata" >}}) displayed on the **Overview** page are: +The cumulative [metrics]({{< ref "/amplify/metrics-metadata" >}}) displayed on the **Overview** page are: * Total requests — sum of **nginx.http.request.count** * HTTP 5xx errors — sum of **nginx.http.status.5xx** diff --git a/content/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md b/content/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md index f9c44b289..f4cdadd2f 100644 --- a/content/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md +++ b/content/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md @@ -21,7 +21,7 @@ NGINX Controller automatically takes a snapshot of the embedded config database - **NFS**: The backup files are located in the path on the NFS server host that was specified during installation and have the following naming scheme: `backup_.tar`. -These automated config backups do not include backups of metrics data, which must be backed up separately; refer to [Backup & Restore the Metrics Database]({{< relref "/controller/admin-guides/backup-restore/backup-restore-metrics-db.md" >}}) for those instructions. +These automated config backups do not include backups of metrics data, which must be backed up separately; refer to [Backup & Restore the Metrics Database]({{< ref "/controller/admin-guides/backup-restore/backup-restore-metrics-db.md" >}}) for those instructions. {{< tip >}} As a best practice, we recommend that you make scheduled backups of the entire config DB volume and keep the backups off-site for safekeeping. @@ -35,7 +35,7 @@ As a best practice, we recommend that you make scheduled backups of the entire c This section explains how to restore the embedded config database from the latest backup file or a specific, timestamped file. -{{< important >}}If you restore the config database on top of a new installation of NGINX Controller, make sure to follow the steps to [restore your NGINX config and encryption keys]({{< relref "/controller/admin-guides/backup-restore/backup-restore-cluster-config.md" >}}) afterward. {{< /important >}} +{{< important >}}If you restore the config database on top of a new installation of NGINX Controller, make sure to follow the steps to [restore your NGINX config and encryption keys]({{< ref "/controller/admin-guides/backup-restore/backup-restore-cluster-config.md" >}}) afterward. {{< /important >}} - To restore the embedded NGINX Controller config database **from the latest automated backup**, run the following command: @@ -51,7 +51,7 @@ This section explains how to restore the embedded config database from the lates - If you installed the embedded config database on a **local volume**, the backup files are located in `/opt/nginx-controller/postgres_data/`. - - If you installed the embedded config database on an **NFS volume**, follow the steps in [(NFS) Copy Config Database Backup to Local Volume for Restoration]({{< relref "/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md#nfs-copy-config-database-backup-to-local-volume-for-restoration" >}}) to download the backup file to your local volume, and then use the `helper.sh` script to restore from it. + - If you installed the embedded config database on an **NFS volume**, follow the steps in [(NFS) Copy Config Database Backup to Local Volume for Restoration]({{< ref "/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md#nfs-copy-config-database-backup-to-local-volume-for-restoration" >}}) to download the backup file to your local volume, and then use the `helper.sh` script to restore from it.   @@ -155,7 +155,7 @@ Take the following steps to copy an embedded config database backup file from an ## What's Next -- [Backup & Restore the Metrics Database]({{< relref "/controller/admin-guides/backup-restore/backup-restore-metrics-db.md" >}}) +- [Backup & Restore the Metrics Database]({{< ref "/controller/admin-guides/backup-restore/backup-restore-metrics-db.md" >}}) {{< versions "3.12" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/admin-guides/backup-restore/backup-restore-external-config-db.md b/content/controller/admin-guides/backup-restore/backup-restore-external-config-db.md index b409601ea..983ec1321 100644 --- a/content/controller/admin-guides/backup-restore/backup-restore-external-config-db.md +++ b/content/controller/admin-guides/backup-restore/backup-restore-external-config-db.md @@ -75,7 +75,7 @@ Take the following steps to back up the external NGINX Controller config databas ## Restore External Config Database -{{< important >}}If you restore the config database on top of a new installation of NGINX Controller, make sure to follow the steps to [restore your NGINX config and encryption keys]({{< relref "/controller/admin-guides/backup-restore/backup-restore-cluster-config.md" >}}) afterward. {{< /important >}} +{{< important >}}If you restore the config database on top of a new installation of NGINX Controller, make sure to follow the steps to [restore your NGINX config and encryption keys]({{< ref "/controller/admin-guides/backup-restore/backup-restore-cluster-config.md" >}}) afterward. {{< /important >}} To restore the external NGINX Controller config database: @@ -113,7 +113,7 @@ To restore the external NGINX Controller config database: ## What's Next -- [Backup & Restore the Metrics Database]({{< relref "/controller/admin-guides/backup-restore/backup-restore-metrics-db.md" >}}) +- [Backup & Restore the Metrics Database]({{< ref "/controller/admin-guides/backup-restore/backup-restore-metrics-db.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/admin-guides/config-agent/about-controller-agent.md b/content/controller/admin-guides/config-agent/about-controller-agent.md index 9c21dd66e..3976422ab 100644 --- a/content/controller/admin-guides/config-agent/about-controller-agent.md +++ b/content/controller/admin-guides/config-agent/about-controller-agent.md @@ -14,11 +14,11 @@ The F5 NGINX Controller Agent is a compact application written in Golang. NGINX ## How NGINX Controller Agent Works -You need to [install the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) on all of the hosts you'd like to monitor. +You need to [install the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) on all of the hosts you'd like to monitor. Once installed, the NGINX Controller Agent automatically starts to report metrics. You should see the real-time metrics data in the NGINX Controller user interface after about one minute. -There's no need to manually add or configure anything in the NGINX Controller user interface after installing the Agent. When the Agent is started, the metrics and the metadata are automatically reported to NGINX Controller and are visualized in the user interface. You can, however, [configure the NGINX Controller Agent]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) to customize how it collects and reports metrics. +There's no need to manually add or configure anything in the NGINX Controller user interface after installing the Agent. When the Agent is started, the metrics and the metadata are automatically reported to NGINX Controller and are visualized in the user interface. You can, however, [configure the NGINX Controller Agent]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) to customize how it collects and reports metrics. All communications between the NGINX Controller Agent and the backend are done securely over SSL/TLS. All traffic is always initiated by the NGINX Controller Agent. The backend system doesn't set up any connections back to the NGINX Controller Agent. @@ -63,10 +63,10 @@ NGINX Controller, the NGINX Controller Agent, and the NGINX Controller Applicati #### Analytics, Visibility, and Reporting Daemon (AVRD) -NGINX Controller v3.1 and later use an Analytics, Visibility, and Reporting daemon (AVRD) to aggregate and report app-centric metrics, which you can use to track and check the health of your apps. To learn more about these metrics, see the [NGINX Metrics Catalog]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) topic. +NGINX Controller v3.1 and later use an Analytics, Visibility, and Reporting daemon (AVRD) to aggregate and report app-centric metrics, which you can use to track and check the health of your apps. To learn more about these metrics, see the [NGINX Metrics Catalog]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) topic. {{< see-also >}} -See the [NGINX Controller Technical Specifications]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) for the complete list of system requirements for NGINX Controller and the NGINX Controller Agent. +See the [NGINX Controller Technical Specifications]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) for the complete list of system requirements for NGINX Controller and the NGINX Controller Agent. {{< /see-also >}} ## Supported Python Versions @@ -75,8 +75,8 @@ NGINX Controller and the NGINX Controller Agent versions 3.6 and earlier require ## What's Next -- [Install the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) -- [Customize how the NGINX Controller Agent collects metrics]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) +- [Install the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) +- [Customize how the NGINX Controller Agent collects metrics]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/admin-guides/config-agent/configure-metrics-collection.md b/content/controller/admin-guides/config-agent/configure-metrics-collection.md index a24b19e16..492cbd5e1 100644 --- a/content/controller/admin-guides/config-agent/configure-metrics-collection.md +++ b/content/controller/admin-guides/config-agent/configure-metrics-collection.md @@ -11,7 +11,7 @@ type: ## Before You Begin -- Before you can set up metrics collection, you first need to [install and start the F5 NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}), so that the Agent can start pushing aggregated data to NGINX Controller. +- Before you can set up metrics collection, you first need to [install and start the F5 NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}), so that the Agent can start pushing aggregated data to NGINX Controller. ## Objectives @@ -25,7 +25,7 @@ The Agent is able to automatically find all relevant NGINX configuration files, ### SSL Certificate Parsing and Analysis -To parse SSL certificate metadata, the NGINX Controller Agent uses standard `openssl(1)` functions. SSL certificates are parsed and analyzed only when the corresponding [settings]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md#default-agent-settings" >}}) are turned on. SSL certificate analysis is *on* by default. +To parse SSL certificate metadata, the NGINX Controller Agent uses standard `openssl(1)` functions. SSL certificates are parsed and analyzed only when the corresponding [settings]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md#default-agent-settings" >}}) are turned on. SSL certificate analysis is *on* by default. To enable or disable analyzing SSL certs: @@ -47,7 +47,7 @@ The `/api` location settings that NGINX Controller creates will override any set If you use NGINX Controller solely to monitor your NGINX Plus instances, you may need to enable the `/api` location on your instances manually. Refer to the [Configuring the API](https://docs.nginx.com/nginx/admin-guide/monitoring/live-activity-monitoring/#configuring-the-api) section of the NGINX Plus Admin Guide for instructions. -For more information about the metrics list, refer to [Overview: Metrics and Metadata]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}). +For more information about the metrics list, refer to [Overview: Metrics and Metadata]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}). ### Metrics from `access.log` and `error.log` @@ -61,7 +61,7 @@ The Agent will try to detect the [log format](https://nginx.org/en/docs/http/ngx #### Enable Custom `access.log` Metrics -Some metrics included in the [NGINX Metrics reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) are not available unless the corresponding variables are included in a custom [access.log](https://nginx.org/en/docs/http/ngx_http_log_module.html) format in the NGINX config. +Some metrics included in the [NGINX Metrics reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) are not available unless the corresponding variables are included in a custom [access.log](https://nginx.org/en/docs/http/ngx_http_log_module.html) format in the NGINX config. {{< see-also >}} @@ -94,7 +94,7 @@ Take the steps in this section to enable the NGINX Controller Agent to collect m ``` {{< note >}} -By default, the Controller Agent processes all access logs that it finds in your log directory. If you define a new log file with the extended log format that contains entries that are already being logged to another access log, your metrics might be counted twice. Refer to the [Agent configuration]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) guide to learn how to exclude specific log files from processing. +By default, the Controller Agent processes all access logs that it finds in your log directory. If you define a new log file with the extended log format that contains entries that are already being logged to another access log, your metrics might be counted twice. Refer to the [Agent configuration]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) guide to learn how to exclude specific log files from processing. {{< /note >}} 4. Set the [error.log](https://nginx.org/en/docs/ngx_core_module.html#error_log) log level to `warn`. @@ -110,11 +110,11 @@ By default, the Controller Agent processes all access logs that it finds in your ``` When the Controller Agent discovers these metrics, the NGINX Controller **Analytics Dashboards Overview** will automatically update with a predefined set of graphs. -You can also use these metrics to build more specific set of [custom Dashboards]({{< relref "/controller/analytics/dashboards/custom-dashboards.md" >}}). +You can also use these metrics to build more specific set of [custom Dashboards]({{< ref "/controller/analytics/dashboards/custom-dashboards.md" >}}). ### Collect Metrics from Syslog -If you set up the Controller Agent to [use Syslog]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md#logging-to-syslog" >}}), you need to set up the Controller Agent to collect metrics from Syslog. +If you set up the Controller Agent to [use Syslog]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md#logging-to-syslog" >}}), you need to set up the Controller Agent to collect metrics from Syslog. Take the steps below to enable metrics collection from Syslog: @@ -142,8 +142,8 @@ To send the NGINX logs to both the existing logging facility and the NGINX Contr ## What's Next -- [Overview: NGINX Metrics and Metadata]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) -- [What to check if the Controller Agent isn't reporting metrics]({{< relref "/controller/support/troubleshooting-controller.md#troubleshooting-metrics" >}}) +- [Overview: NGINX Metrics and Metadata]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) +- [What to check if the Controller Agent isn't reporting metrics]({{< ref "/controller/support/troubleshooting-controller.md#troubleshooting-metrics" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/admin-guides/config-agent/configure-the-agent.md b/content/controller/admin-guides/config-agent/configure-the-agent.md index df01388c1..37a7d5c7b 100644 --- a/content/controller/admin-guides/config-agent/configure-the-agent.md +++ b/content/controller/admin-guides/config-agent/configure-the-agent.md @@ -45,7 +45,7 @@ The configuration file for the NGINX Controller Agent is located at `/etc/contro ## Change the API Key -When you first [install the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}), your API key is written to the `agent.conf` file automatically. If you ever need to change the API key, you can edit the following section in `agent.conf` accordingly: +When you first [install the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}), your API key is written to the `agent.conf` file automatically. If you ever need to change the API key, you can edit the following section in `agent.conf` accordingly: ``` nginx [credentials] @@ -106,7 +106,7 @@ If, for some reason, the NGINX Controller Agent cannot find the NGINX configurat configfile = /etc/nginx/nginx.conf ``` -{{< note >}} We recommend using this option only as a workaround if needed. If you do need to add the path to the NGINX config file, we ask that you [contact NGINX Support]({{< relref "/controller/support/contact-support.md" >}}) so they can help troubleshoot the issue.{{< /note >}} +{{< note >}} We recommend using this option only as a workaround if needed. If you do need to add the path to the NGINX config file, we ask that you [contact NGINX Support]({{< ref "/controller/support/contact-support.md" >}}) so they can help troubleshoot the issue.{{< /note >}} ## Set Host Tags @@ -148,7 +148,7 @@ To configure the NGINX Controller Agent to send logs to `syslog`: ``` {{< important >}} -Make sure you [add the `syslog` settings to your NGINX configuration file]({{< relref "/controller/admin-guides/config-agent/configure-metrics-collection.md#collect-metrics-from-syslog" >}}) as well. +Make sure you [add the `syslog` settings to your NGINX configuration file]({{< ref "/controller/admin-guides/config-agent/configure-metrics-collection.md#collect-metrics-from-syslog" >}}) as well. {{< /important >}} ## Exclude Certain NGINX Log Files @@ -204,11 +204,11 @@ To change the log level for the NGINX Controller Agent: ... ``` -1. [Restart the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/agent-restart.md#Starting-and-Stopping-the-Agent" >}}) to make the changes take effect. +1. [Restart the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/agent-restart.md#Starting-and-Stopping-the-Agent" >}}) to make the changes take effect. ## What's Next -- [Set up Metrics Collection]({{< relref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) +- [Set up Metrics Collection]({{< ref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/admin-guides/install/get-n-plus-cert-and-key.md b/content/controller/admin-guides/install/get-n-plus-cert-and-key.md index 7a40e98e2..48a9ecef5 100644 --- a/content/controller/admin-guides/install/get-n-plus-cert-and-key.md +++ b/content/controller/admin-guides/install/get-n-plus-cert-and-key.md @@ -11,13 +11,13 @@ type: ## Overview -This topic explains how to use the [F5 NGINX Controller REST API](https://docs.nginx.com/nginx-controller/api/ctlr-platform-api/) to download your NGINX Plus `nginx.crt` and `nginx.key` files. You'll need these files if you're [installing NGINX Plus as part of an NGINX Controller trial]({{< relref "/controller/admin-guides/install/try-nginx-controller.md" >}}). +This topic explains how to use the [F5 NGINX Controller REST API](https://docs.nginx.com/nginx-controller/api/ctlr-platform-api/) to download your NGINX Plus `nginx.crt` and `nginx.key` files. You'll need these files if you're [installing NGINX Plus as part of an NGINX Controller trial]({{< ref "/controller/admin-guides/install/try-nginx-controller.md" >}}).   ## Authenticate with the NGINX Controller API -The NGINX Controller API uses session cookies to authenticate requests. The session cookie is returned in response to a `GET /api/v1/platform/login` request. See the Login endpoint in the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}) documentation for information about session cookie timeouts and invalidation. +The NGINX Controller API uses session cookies to authenticate requests. The session cookie is returned in response to a `GET /api/v1/platform/login` request. See the Login endpoint in the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}) documentation for information about session cookie timeouts and invalidation. {{< tip >}} You can send a GET request to the login endpoint to find the status of the session token. @@ -44,7 +44,7 @@ For example: ## Download the NGINX Plus Certificate and Key Bundle -To use the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to download your NGINX Plus certificate and key bundle as a gzip or JSON file, send a GET request to the `/platform/licenses/nginx-plus-licenses/controller-provided` endpoint. +To use the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to download your NGINX Plus certificate and key bundle as a gzip or JSON file, send a GET request to the `/platform/licenses/nginx-plus-licenses/controller-provided` endpoint. For example: @@ -77,7 +77,7 @@ gunzip nginx-plus-certs.gz ## What's Next -- [Trial NGINX Controller with NGINX Plus]({{< relref "/controller/admin-guides/install/try-nginx-controller.md" >}}) +- [Trial NGINX Controller with NGINX Plus]({{< ref "/controller/admin-guides/install/try-nginx-controller.md" >}})   diff --git a/content/controller/admin-guides/install/install-agent-non-root.md b/content/controller/admin-guides/install/install-agent-non-root.md index b73ad2d7f..51934094a 100644 --- a/content/controller/admin-guides/install/install-agent-non-root.md +++ b/content/controller/admin-guides/install/install-agent-non-root.md @@ -18,7 +18,7 @@ This document provides the instructions to run F5 NGINX Controller Agent as a no ## Before You Begin -Before you follow the steps to deploy and run the Controller Agent as a non-root user, [install NGINX Controller]({{< relref "/controller/admin-guides/install/install-nginx-controller" >}}) following the normal installation process. Once you reach the step **Install NGINX Controller Agent** follow the steps in this guide instead. +Before you follow the steps to deploy and run the Controller Agent as a non-root user, [install NGINX Controller]({{< ref "/controller/admin-guides/install/install-nginx-controller" >}}) following the normal installation process. Once you reach the step **Install NGINX Controller Agent** follow the steps in this guide instead.   @@ -37,7 +37,7 @@ Take the following steps to add an instance to NGINX Controller: 1. To add the instance to an existing Location, select a Location from the list. Or to create a Location, select **Create New**. {{< important >}} -Once set, the Location for an instance cannot be changed. If you need to change or remove the Location for an instance, you must [remove the instance from NGINX Controller]({{< relref "/controller/infrastructure/instances/manage-instances.md#delete-an-instance" >}}), and then add it back. +Once set, the Location for an instance cannot be changed. If you need to change or remove the Location for an instance, you must [remove the instance from NGINX Controller]({{< ref "/controller/infrastructure/instances/manage-instances.md#delete-an-instance" >}}), and then add it back. {{< /important >}} 1. (Optional) By default, registration of NGINX Plus instances is performed over a secure connection. To use self-signed certificates with the Controller Agent, select **Allow insecure server connections to NGINX Controller using TLS**. For security purposes, we recommend that you secure the Controller Agent with signed certificates when possible. diff --git a/content/controller/admin-guides/install/install-for-controller.md b/content/controller/admin-guides/install/install-for-controller.md index 1ed1bfdb9..b359e637d 100644 --- a/content/controller/admin-guides/install/install-for-controller.md +++ b/content/controller/admin-guides/install/install-for-controller.md @@ -9,11 +9,11 @@ type: - how-to --- -**Note:** Refer to the [F5 NGINX Controller Technical Specifications]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) guide to find out which distributions are supported for use with NGINX Controller and NGINX Controller Agent. +**Note:** Refer to the [F5 NGINX Controller Technical Specifications]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) guide to find out which distributions are supported for use with NGINX Controller and NGINX Controller Agent. ## Setup -Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4/admin-guide/install#prerequisites" >}}), [Platform Security Considerations]({{< relref "/nap-waf/v4/admin-guide/install#platform-security-considerations" >}}) and [User Permissions]({{< relref "/nap-waf/v4/admin-guide/install#user-permissions" >}}) sections of the NGINX App Protect WAF Admin Guide. +Before proceeding, you should review the [Prerequisites]({{< ref "/nap-waf/v4/admin-guide/install#prerequisites" >}}), [Platform Security Considerations]({{< ref "/nap-waf/v4/admin-guide/install#platform-security-considerations" >}}) and [User Permissions]({{< ref "/nap-waf/v4/admin-guide/install#user-permissions" >}}) sections of the NGINX App Protect WAF Admin Guide. ## Install NGINX App Protect WAF @@ -44,7 +44,7 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 nginx-repo.crt ``` - **See Also:** You can use the [NGINX Controller REST API to download the key and cert files]({{< relref "/controller/admin-guides/install/get-n-plus-cert-and-key" >}}). + **See Also:** You can use the [NGINX Controller REST API to download the key and cert files]({{< ref "/controller/admin-guides/install/get-n-plus-cert-and-key" >}}). 4. Copy the above two files to the CentOS server's `/etc/ssl/nginx/` directory. Use an SCP client or another secure file transfer tool to perform this task. @@ -80,7 +80,7 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 10. Install the latest NGINX App Protect WAF package. - **See Also:** Please refer to [NGINX App Protect Compatibility Matrix]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-app-protect-compatibility-matrix" >}}) for specific version compatibility. + **See Also:** Please refer to [NGINX App Protect Compatibility Matrix]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-app-protect-compatibility-matrix" >}}) for specific version compatibility. If you wish to install a specific version, please replace `app-protect` with the target version, for example `app-protect-25+3.671.0`: @@ -94,9 +94,9 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 sudo nginx -v ``` -12. Configure SELinux as appropriate per your organization’s security policies. NGINX App Protect WAF applies the prebuilt SELinux policy module during the installation. If you encounter any issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). +12. Configure SELinux as appropriate per your organization’s security policies. NGINX App Protect WAF applies the prebuilt SELinux policy module during the installation. If you encounter any issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). - **Note:** NGINX Controller has specific [requirements regarding SELinux configuration]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#supported-distributions" >}}). + **Note:** NGINX Controller has specific [requirements regarding SELinux configuration]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#supported-distributions" >}}). 13. Start the NGINX service: @@ -125,7 +125,7 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 ps -ef | grep bd_agent ``` -16. To upgrade your signature package to the latest version and obtain the best protection, refer to [Updating App Protect Attack Signatures]({{< relref "/nap-waf/v4/admin-guide/install#centos--rhel-74--amazon-linux-2">}}). +16. To upgrade your signature package to the latest version and obtain the best protection, refer to [Updating App Protect Attack Signatures]({{< ref "/nap-waf/v4/admin-guide/install#centos--rhel-74--amazon-linux-2">}}). {{%/tab%}} @@ -212,7 +212,7 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 11. Install the latest NGINX App Protect WAF package. - **See Also:** Please refer to [NGINX App Protect Compatibility Matrix]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-app-protect-compatibility-matrix" >}}) for specific version compatibility. + **See Also:** Please refer to [NGINX App Protect Compatibility Matrix]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-app-protect-compatibility-matrix" >}}) for specific version compatibility. If you wish to install a specific version, please replace `app-protect` with the target version, for example `app-protect-25+3.671.0`: @@ -226,9 +226,9 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 sudo nginx -v ``` -13. Configure SELinux as appropriate per your organization’s security policies. NGINX App Protect WAF applies the prebuilt SELinux policy module during the installation. If you encounter any issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). +13. Configure SELinux as appropriate per your organization’s security policies. NGINX App Protect WAF applies the prebuilt SELinux policy module during the installation. If you encounter any issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). - **Note:** NGINX Controller has specific [requirements regarding SELinux configuration]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#supported-distributions" >}}). + **Note:** NGINX Controller has specific [requirements regarding SELinux configuration]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#supported-distributions" >}}). 14. Start the NGINX service: @@ -257,7 +257,7 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 ps -ef | grep bd_agent ``` -17. To upgrade your signature package to the latest version and obtain the best protection, refer to [Updating App Protect Attack Signatures]({{< relref "/nap-waf/v4/admin-guide/install#centos--rhel-74--amazon-linux-2" >}}). +17. To upgrade your signature package to the latest version and obtain the best protection, refer to [Updating App Protect Attack Signatures]({{< ref "/nap-waf/v4/admin-guide/install#centos--rhel-74--amazon-linux-2" >}}). {{%/tab%}} @@ -326,7 +326,7 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 11. Update the repository and install the lastest supported NGINX App Protect WAF packages. - **See Also:** Please refer to [NGINX App Protect Compatibility Matrix]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-app-protect-compatibility-matrix" >}}) for specific version compatibility. + **See Also:** Please refer to [NGINX App Protect Compatibility Matrix]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-app-protect-compatibility-matrix" >}}) for specific version compatibility. ```shell sudo apt-get update @@ -377,7 +377,7 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 ps -ef | grep bd_agent ``` -16. To upgrade your signature package to the latest version and obtain the best protection, refer to [Updating App Protect Attack Signatures]({{< relref "/nap-waf/v4/admin-guide/install#debian-10" >}}). +16. To upgrade your signature package to the latest version and obtain the best protection, refer to [Updating App Protect Attack Signatures]({{< ref "/nap-waf/v4/admin-guide/install#debian-10" >}}). {{%/tab%}} @@ -444,7 +444,7 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 11. Update the repository and install the latest App Protect WAF package. - **See Also:** Please refer to [NGINX App Protect Compatibility Matrix]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-app-protect-compatibility-matrix" >}}) for specific version compatibility. + **See Also:** Please refer to [NGINX App Protect Compatibility Matrix]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-app-protect-compatibility-matrix" >}}) for specific version compatibility. ```shell sudo apt-get update @@ -495,7 +495,7 @@ Before proceeding, you should review the [Prerequisites]({{< relref "/nap-waf/v4 ps -ef | grep bd_agent ``` -16. To upgrade your signature package to the latest version and obtain the best protection, refer to [Updating App Protect Attack Signatures]({{< relref "/nap-waf/v4/admin-guide/install#ubuntu-1804" >}}). +16. To upgrade your signature package to the latest version and obtain the best protection, refer to [Updating App Protect Attack Signatures]({{< ref "/nap-waf/v4/admin-guide/install#ubuntu-1804" >}}). **Note:** Ubuntu 20.04 activates **AppArmor** by default, but NGINX App Protect WAF will run in unconfined mode after being installed as it is shipped with no AppArmor profile. To benefit from AppArmor access control capabilities for NGINX App Protect WAF, you will have to write your own AppArmor profile for NGINX App Protect WAF executables found in `/opt/app_protect/bin` such that it best suits your environment. @@ -518,9 +518,9 @@ Using NGINX App Protect WAF with NGINX Controller isn't supported on Alpine. ## Add NGINX App Protect WAF to NGINX Controller -If this NGINX Plus instance is already managed by Controller, [restart the Agent]({{< relref "/controller/admin-guides/install/agent-restart" >}}) after NGINX App Protect WAF is installed. +If this NGINX Plus instance is already managed by Controller, [restart the Agent]({{< ref "/controller/admin-guides/install/agent-restart" >}}) after NGINX App Protect WAF is installed. -Otherwise, complete the tasks in the NGINX Controller [Add an NGINX App Protect WAF Instance]({{< relref "/controller/infrastructure/instances/add-nap-instance.md#add-the-nginx-app-protect-instance" >}}) guide. +Otherwise, complete the tasks in the NGINX Controller [Add an NGINX App Protect WAF Instance]({{< ref "/controller/infrastructure/instances/add-nap-instance.md#add-the-nginx-app-protect-instance" >}}) guide. ## Use NGINX App Protect WAF with NGINX Controller @@ -528,6 +528,6 @@ Otherwise, complete the tasks in the NGINX Controller [Add an NGINX App Protect Refer to the following NGINX Controller user guides for further information about how to secure your apps and/or APIs with NGINX Controller: -- [Learn about App Security for the NGINX Controller App Delivery module]({{< relref "/controller/app-delivery/security/concepts/what-is-waf" >}}) -- [Add Security to your Apps with the NGINX Controller App Delivery module]({{< relref "/controller/app-delivery/security/tutorials/add-app-security-with-waf" >}}) -- [Add Advanced Security (WAF) to your APIs with the NGINX Controller API Management module]({{< relref "/controller/api-management/manage-apis.md#define-the-routing-rules" >}}). +- [Learn about App Security for the NGINX Controller App Delivery module]({{< ref "/controller/app-delivery/security/concepts/what-is-waf" >}}) +- [Add Security to your Apps with the NGINX Controller App Delivery module]({{< ref "/controller/app-delivery/security/tutorials/add-app-security-with-waf" >}}) +- [Add Advanced Security (WAF) to your APIs with the NGINX Controller API Management module]({{< ref "/controller/api-management/manage-apis.md#define-the-routing-rules" >}}). diff --git a/content/controller/admin-guides/install/install-nginx-controller-agent.md b/content/controller/admin-guides/install/install-nginx-controller-agent.md index aa336e58d..594f865c1 100644 --- a/content/controller/admin-guides/install/install-nginx-controller-agent.md +++ b/content/controller/admin-guides/install/install-nginx-controller-agent.md @@ -22,7 +22,7 @@ You can use the NGINX Controller Agent to monitor your systems with the NGINX Co ## Install the NGINX Controller Agent -{{< see-also >}} If you want to run the NGINX Controller Agent as a non-root user, follow the alternative instructions in the [Install NGINX Controller Agent for Non-root User]({{< relref "/controller/admin-guides/install/install-agent-non-root.md" >}}) guide instead of the steps provided in this section. {{< /see-also >}} +{{< see-also >}} If you want to run the NGINX Controller Agent as a non-root user, follow the alternative instructions in the [Install NGINX Controller Agent for Non-root User]({{< ref "/controller/admin-guides/install/install-agent-non-root.md" >}}) guide instead of the steps provided in this section. {{< /see-also >}} Take the following steps to add an instance to NGINX Controller: @@ -32,15 +32,15 @@ Take the following steps to add an instance to NGINX Controller: 4. On the **Instances** overview page, select **Create**. 5. On the **Create Instance** page, select **Add an existing instance**. 6. Add a name for the instance. If you don't provide a name, the hostname of the instance is used by default. -7. To add the instance to an existing [Instance Group]({{< relref "/controller/infrastructure/instances/manage-instances.md#instance-groups" >}}), select an Instance Group from the list. Or to create an Instance Group, select **Create New**. +7. To add the instance to an existing [Instance Group]({{< ref "/controller/infrastructure/instances/manage-instances.md#instance-groups" >}}), select an Instance Group from the list. Or to create an Instance Group, select **Create New**. 8. To add the instance to an existing Location, select a Location from the list. Or to create a Location, select **Create New**. {{< important >}} -Once set, the Location for an instance cannot be changed. If you need to change or remove the Location for an instance, you must [remove the instance from NGINX Controller]({{< relref "/controller/infrastructure/instances/manage-instances.md#delete-an-instance" >}}), and then add it back. +Once set, the Location for an instance cannot be changed. If you need to change or remove the Location for an instance, you must [remove the instance from NGINX Controller]({{< ref "/controller/infrastructure/instances/manage-instances.md#delete-an-instance" >}}), and then add it back. {{< /important >}} {{< important >}} -Instances and the instance groups they belong to should specify the same location; however, this requirement is not currently enforced. If different locations are specified, the instance group's location takes precedence. This is important to remember when [assigning locations to workload groups]({{< relref "/controller/app-delivery/manage-apps.md#workload-groups">}}). +Instances and the instance groups they belong to should specify the same location; however, this requirement is not currently enforced. If different locations are specified, the instance group's location takes precedence. This is important to remember when [assigning locations to workload groups]({{< ref "/controller/app-delivery/manage-apps.md#workload-groups">}}). {{< /important >}} 9. (Optional) By default, registration of NGINX Plus instances is performed over a secure connection. To use self-signed certificates with the Controller Agent, select **Allow insecure server connections to NGINX Controller using TLS**. For security purposes, we recommend that you secure the Controller Agent with signed certificates when possible. @@ -60,7 +60,7 @@ After a few minutes, the NGINX instance will appear on the **Instances** overvie ## Update the NGINX Controller Agent -When you [update NGINX Controller]({{< relref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}), you also need to update the NGINX Controller Agent software on each monitored NGINX Plus instance. +When you [update NGINX Controller]({{< ref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}), you also need to update the NGINX Controller Agent software on each monitored NGINX Plus instance. To update the NGINX Controller Agent, take the following steps: @@ -79,7 +79,7 @@ NGINX Controller 3.6 and earlier require Python 2.6 or 2.7. You'll be prompted t ## Uninstall the Analytics, Visibility, and Reporting Daemon (AVRD) -NGINX Controller uses an [Analytics, Visibility, and Reporting daemon (AVRD)]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) to aggregate and report app-centric metrics. You can use these metrics to monitor your apps' performance and health. +NGINX Controller uses an [Analytics, Visibility, and Reporting daemon (AVRD)]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) to aggregate and report app-centric metrics. You can use these metrics to monitor your apps' performance and health. To uninstall AVRD and the supporting modules, run the following command on each dataplane instance: @@ -171,10 +171,10 @@ Take the following steps to uninstall the Controller Agent and delete an instanc ## What's Next -- [Customize how the NGINX Controller Agent collects metrics]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) -- [Start or Stop the Agent Service]({{< relref "/controller/admin-guides/install/agent-restart.md" >}}) -- [Manage your NGINX Instances]({{< relref "/controller/infrastructure/instances/manage-instances.md" >}}) -- [Manage Locations for your Instances]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}) +- [Customize how the NGINX Controller Agent collects metrics]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) +- [Start or Stop the Agent Service]({{< ref "/controller/admin-guides/install/agent-restart.md" >}}) +- [Manage your NGINX Instances]({{< ref "/controller/infrastructure/instances/manage-instances.md" >}}) +- [Manage Locations for your Instances]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/admin-guides/install/install-nginx-controller-rhel-8.md b/content/controller/admin-guides/install/install-nginx-controller-rhel-8.md index c330312c8..82d4e9651 100644 --- a/content/controller/admin-guides/install/install-nginx-controller-rhel-8.md +++ b/content/controller/admin-guides/install/install-nginx-controller-rhel-8.md @@ -129,7 +129,7 @@ Take the following steps to finish preparing the RHEL 8 control plane host for N sudo swapoff -a ``` -1. Complete the steps in the NGINX Controller Installation guide to [install NGINX Controller]({{< relref "/controller/admin-guides/install/install-nginx-controller.md#install-nginx-controller" >}}). +1. Complete the steps in the NGINX Controller Installation guide to [install NGINX Controller]({{< ref "/controller/admin-guides/install/install-nginx-controller.md#install-nginx-controller" >}}). ## Preparing the Data Plane Host @@ -140,7 +140,7 @@ Take the following steps to finish preparing the RHEL 8 control plane host for N sudo dnf install -y xerces-c ``` -2. Complete the steps in the NGINX Controller Agent Installation guide to [install the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent" >}}). +2. Complete the steps in the NGINX Controller Agent Installation guide to [install the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent" >}}). ## Troubleshooting diff --git a/content/controller/admin-guides/install/install-nginx-controller.md b/content/controller/admin-guides/install/install-nginx-controller.md index b0e3225e2..d6d6eb972 100644 --- a/content/controller/admin-guides/install/install-nginx-controller.md +++ b/content/controller/admin-guides/install/install-nginx-controller.md @@ -27,7 +27,7 @@ To get started, download and run the installer. The installer will: ### Open Source Software Dependencies -NGINX Controller uses a number of open source software packages in the product. You can find information about these dependencies in the [NGINX Controller Technical Specifications]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}). +NGINX Controller uses a number of open source software packages in the product. You can find information about these dependencies in the [NGINX Controller Technical Specifications]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}).   @@ -47,7 +47,7 @@ Things you'll need before installing NGINX Controller: - A license file for NGINX Controller, accessible via the [MyF5 Customer Portal](https://account.f5.com/myf5); -- A dedicated environment (bare metal, VM, or cloud-hosted instance) on which to install NGINX Controller. For the supported Operating Systems and recommended specifications, see the [NGINX Controller Technical Specifications]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs" >}}) guide; +- A dedicated environment (bare metal, VM, or cloud-hosted instance) on which to install NGINX Controller. For the supported Operating Systems and recommended specifications, see the [NGINX Controller Technical Specifications]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs" >}}) guide;   @@ -236,7 +236,7 @@ Install NGINX Controller on a dedicated node that **does not** already have Kube {{< important >}}Before installing NGINX Controller, you must **disable swap on the host**; this is required by Kubernetes in order for the kubelet to work properly. Refer to your Linux distribution documentation for specific instructions for disabling swap for your system. For more information about this requirement, see the AskF5 knowledge base article [K82655201](https://support.f5.com/csp/article/K82655201) and the [kubeadm installation guide](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#before-you-begin) in the Kubernetes documentation.{{< /important >}} -{{< caution >}}**For RHEL 8 deployments**, complete the additional prerequisite steps in the [Installing NGINX on RHEL 8]({{< relref "/controller/admin-guides/install/install-nginx-controller-rhel-8.md" >}}) guide before installing NGINX Controller. RHEL 8 support is a **beta** feature.{{< /caution >}} +{{< caution >}}**For RHEL 8 deployments**, complete the additional prerequisite steps in the [Installing NGINX on RHEL 8]({{< ref "/controller/admin-guides/install/install-nginx-controller-rhel-8.md" >}}) guide before installing NGINX Controller. RHEL 8 support is a **beta** feature.{{< /caution >}} To install NGINX Controller, take the following steps: @@ -264,7 +264,7 @@ To install NGINX Controller, take the following steps: - **Config database configuration**. Specify whether to use an embedded, self-hosted PostgreSQL database for the config database, or if you want to provide your own external PostgreSQL database. If you choose to provide your own database, make sure you've reviewed the [PostgreSQL prerequisites](#postgresql-optional). - **Config database volume type**: Specify the type of volume to use to store the config database: local, NFS, or AWS. We recommend choosing `local` only for demo and trial purposes. - {{< see-also >}}Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#local-or-external-storage" >}}) for more information about the volume options and requirements.{{< /see-also >}} + {{< see-also >}}Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#local-or-external-storage" >}}) for more information about the volume options and requirements.{{< /see-also >}} - **Analytics database volume type**: Specify the type of volume to use to store the analytics database: local, NFS, or AWS. We recommend choosing `local` for demo and trial purposes. - **EULA**: Read the end-user license agreement. Type either `y` to accept or `n` to exit. @@ -307,7 +307,7 @@ To add a license to NGINX Controller, take the following steps: 1. Select **Save license**. {{< see-also >}} -To add a license using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PUT request to the `/platform/license` endpoint. Provide your CAT or NGINX Controller license as a base64-encoded string in the JSON request body. +To add a license using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PUT request to the `/platform/license` endpoint. Provide your CAT or NGINX Controller license as a base64-encoded string in the JSON request body. {{< /see-also >}} @@ -363,7 +363,7 @@ When updating NGINX Controller on a multi-node cluster, run the `update.sh` scri {{< caution >}} We strongly recommend that you make a backup of the following information before proceeding, to avoid potential data and/or configuration loss: -- [Back up the NGINX Controller databases]({{< relref "/controller/admin-guides/backup-restore" >}}). +- [Back up the NGINX Controller databases]({{< ref "/controller/admin-guides/backup-restore" >}}). - Back up the NGINX Controller cluster configuration and encryption keys. These are required if you need to restore the config database on top of a new installation of NGINX Controller. ```bash @@ -407,7 +407,7 @@ We strongly recommend that you make a backup of the following information before - To sign out, select your username in the upper right-hand corner, and then select "Sign Out". For optimal performance, also flush your browser cache. -{{< important >}} After you upgrade NGINX Controller, you also need to [update the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent" >}}) to the latest version. {{< /important >}} +{{< important >}} After you upgrade NGINX Controller, you also need to [update the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent" >}}) to the latest version. {{< /important >}}   @@ -426,7 +426,7 @@ To uninstall NGINX Controller, run the uninstall script: --- ## Install NGINX Controller Agent -{{< see-also >}} If you want to run the NGINX Controller Agent as a non-root user, follow the alternative instructions in the [Install NGINX Controller Agent for Non-root User]({{< relref "/controller/admin-guides/install/install-agent-non-root.md" >}}) guide instead of the steps provided in this section. {{< /see-also >}} +{{< see-also >}} If you want to run the NGINX Controller Agent as a non-root user, follow the alternative instructions in the [Install NGINX Controller Agent for Non-root User]({{< ref "/controller/admin-guides/install/install-agent-non-root.md" >}}) guide instead of the steps provided in this section. {{< /see-also >}} Install the Controller Agent on each NGINX Plus instance that you want to manage and monitor. @@ -438,15 +438,15 @@ Take the following steps to add an instance to NGINX Controller: 4. On the **Instances** overview page, select **Create**. 5. On the **Create Instance** page, select **Add an existing instance**. 6. Add a name for the instance. If you don't provide a name, the hostname of the instance is used by default. -7. To add the instance to an existing [Instance Group]({{< relref "/controller/infrastructure/instances/manage-instances.md#instance-groups" >}}), select an Instance Group from the list. Or to create an Instance Group, select **Create New**. +7. To add the instance to an existing [Instance Group]({{< ref "/controller/infrastructure/instances/manage-instances.md#instance-groups" >}}), select an Instance Group from the list. Or to create an Instance Group, select **Create New**. 8. To add the instance to an existing Location, select a Location from the list. Or to create a Location, select **Create New**. {{< important >}} -Once set, the Location for an instance cannot be changed. If you need to change or remove the Location for an instance, you must [remove the instance from NGINX Controller]({{< relref "/controller/infrastructure/instances/manage-instances.md#delete-an-instance" >}}), and then add it back. +Once set, the Location for an instance cannot be changed. If you need to change or remove the Location for an instance, you must [remove the instance from NGINX Controller]({{< ref "/controller/infrastructure/instances/manage-instances.md#delete-an-instance" >}}), and then add it back. {{< /important >}} {{< important >}} -Instances and the instance groups they belong to should specify the same location; however, this requirement is not currently enforced. If different locations are specified, the instance group's location takes precedence. This is important to remember when [assigning locations to workload groups]({{< relref "/controller/app-delivery/manage-apps.md#workload-groups">}}). +Instances and the instance groups they belong to should specify the same location; however, this requirement is not currently enforced. If different locations are specified, the instance group's location takes precedence. This is important to remember when [assigning locations to workload groups]({{< ref "/controller/app-delivery/manage-apps.md#workload-groups">}}). {{< /important >}} 9. (Optional) By default, registration of NGINX Plus instances is performed over a secure connection. To use self-signed certificates with the Controller Agent, select **Allow insecure server connections to NGINX Controller using TLS**. For security purposes, we recommend that you secure the Controller Agent with signed certificates when possible. diff --git a/content/controller/admin-guides/install/nginx-controller-tech-specs.md b/content/controller/admin-guides/install/nginx-controller-tech-specs.md index 59f9d3d0d..1940cf75d 100644 --- a/content/controller/admin-guides/install/nginx-controller-tech-specs.md +++ b/content/controller/admin-guides/install/nginx-controller-tech-specs.md @@ -42,7 +42,7 @@ NGINX Controller, the NGINX Controller Agent, and the NGINX Controller Applicati #### Analytics, Visibility, and Reporting Daemon (AVRD) -NGINX Controller v3.1 and later use an Analytics, Visibility, and Reporting daemon (AVRD) to aggregate and report app-centric metrics, which you can use to track and check the health of your apps. To learn more about these metrics, see the [NGINX Metrics Catalog]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) topic. +NGINX Controller v3.1 and later use an Analytics, Visibility, and Reporting daemon (AVRD) to aggregate and report app-centric metrics, which you can use to track and check the health of your apps. To learn more about these metrics, see the [NGINX Metrics Catalog]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) topic.   @@ -119,7 +119,7 @@ NGINX Controller supports the following [NGINX Plus](https://www.f5.com/products The App Security add-on for the NGINX Controller Application Delivery module is compatible with the versions of NGINX Plus and NGINX App Protect shown in the table below. New releases of NGINX Controller ADC support the last four versions of NGINX Plus at release time. {{< see-also >}} -Refer to [Using NGINX App Protect with NGINX Controller]({{< relref "controller/admin-guides/install/install-for-controller.md" >}}) for installation instructions and additional information. +Refer to [Using NGINX App Protect with NGINX Controller]({{< ref "controller/admin-guides/install/install-for-controller.md" >}}) for installation instructions and additional information. {{< /see-also >}} {{< bootstrap-table "table table-striped table-bordered" >}} @@ -177,9 +177,9 @@ The following minimum hardware specifications are required for each node running - RAM: 8 GB RAM - CPU: 8-Core CPU @ 2.40 GHz or similar -- Disk space: 155–255 GB free disk space. 255 GB of free space is recommended if NGINX Controller App Security is enabled. See the [Storage Requirements]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#storage-requirements" >}}) section for a categorized list of the storage requirements. +- Disk space: 155–255 GB free disk space. 255 GB of free space is recommended if NGINX Controller App Security is enabled. See the [Storage Requirements]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#storage-requirements" >}}) section for a categorized list of the storage requirements. -The NGINX Controller Agent consumes as little memory and CPU as possible. CPU usage should be under 10%, and RSS memory consumption should be just a few dozen MBs. If you notice the NGINX Controller Agent consuming resources at a higher rate, you should [contact NGINX Support]({{< relref "/controller/support/contact-support.md" >}}) for assistance. +The NGINX Controller Agent consumes as little memory and CPU as possible. CPU usage should be under 10%, and RSS memory consumption should be just a few dozen MBs. If you notice the NGINX Controller Agent consuming resources at a higher rate, you should [contact NGINX Support]({{< ref "/controller/support/contact-support.md" >}}) for assistance.   @@ -202,7 +202,7 @@ We recommend using a local volume for the analytics and config databases for tri When using local storage for the analytics and/or config database, we recommend the following specs: - 100 IOPS -- 155–255 GB free disk space. 255 GB of free space is recommended if NGINX Controller App Security is enabled. See the [Storage Requirements]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#storage-requirements" >}}) section for a categorized list of the storage requirements. +- 155–255 GB free disk space. 255 GB of free space is recommended if NGINX Controller App Security is enabled. See the [Storage Requirements]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#storage-requirements" >}}) section for a categorized list of the storage requirements. {{< tip >}} To conserve IO and/or disk space, you can use a separate disk for the local storage directory `/opt/nginx-controller/clickhouse_data`. @@ -232,7 +232,7 @@ If you are installing NGINX Controller on [AWS EC2 instances](https://aws.amazon You will need add an IAM role like that shown below. -- IAM Role for [Single-Node Installation]({{< relref "/controller/admin-guides/install/install-nginx-controller.md" >}}) +- IAM Role for [Single-Node Installation]({{< ref "/controller/admin-guides/install/install-nginx-controller.md" >}}) ```json { @@ -275,7 +275,7 @@ You will need add an IAM role like that shown below. } ``` -- IAM Role for [Multi-Node Installation]({{< relref "/controller/admin-guides/install/resilient-cluster-aws.md" >}}) +- IAM Role for [Multi-Node Installation]({{< ref "/controller/admin-guides/install/resilient-cluster-aws.md" >}}) ```json { diff --git a/content/controller/admin-guides/install/resilient-cluster-aws.md b/content/controller/admin-guides/install/resilient-cluster-aws.md index 0d3ad51d1..f544492e6 100644 --- a/content/controller/admin-guides/install/resilient-cluster-aws.md +++ b/content/controller/admin-guides/install/resilient-cluster-aws.md @@ -58,7 +58,7 @@ Larger clusters aren't supported. Before installing or configuring NGINX Controller as a multi-node cluster, review the following list of considerations to assist with planning: -- Configuring NGINX Controller as a multi-node cluster on AWS requires **NGINX Controller 3.14 or later**. To upgrade from an earlier version, refer to the [Update NGINX Controller]({{< relref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}) steps for instructions. +- Configuring NGINX Controller as a multi-node cluster on AWS requires **NGINX Controller 3.14 or later**. To upgrade from an earlier version, refer to the [Update NGINX Controller]({{< ref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}) steps for instructions. - Data migration is not supported, so it's not possible to implement a multi-node cluster with local volumes without reinstalling NGINX Controller. - If you plan to run NGINX Controller on AWS EC2 instances, we recommend using NFS shares for the external volumes. Using EBS shares for multi-node clusters is not recommended because of the [EBS Availability Zone limitations](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volumes-multi.html#considerations); for example, the requirement to have EC2 instances and EBS volumes in the same Availability Zone. - Cluster config changes are orchestrated by a primary control plane node that writes to the external config database. Each NGINX Controller control plane node hosts a set of services (pods) that read and write data. Only the node that hosts the pod that manages the config data writes to the external config database. @@ -82,7 +82,7 @@ Things you'll need before installing NGINX Controller as a resilient cluster: - A tool to send API requests, such as Postman or curl - An external volume for the config database - When installing NGINX Controller, you can choose to have NGINX Controller install and manage a self-hosted -- also known as "embedded" -- [PostgreSQL](https://www.postgresql.org/) database for you; this is the recommended implementation. Alternatively, you can [install your own PostgreSQL database for the config database]({{< relref "/controller/admin-guides/install/install-nginx-controller.md#postgresql-optional" >}}), which you manage; this is sometimes referred to as an "external config database" because it is externally managed by you. Regardless of whether you use an embedded or an externally managed config database, the config database must be on an external volume for resilient clusters. + When installing NGINX Controller, you can choose to have NGINX Controller install and manage a self-hosted -- also known as "embedded" -- [PostgreSQL](https://www.postgresql.org/) database for you; this is the recommended implementation. Alternatively, you can [install your own PostgreSQL database for the config database]({{< ref "/controller/admin-guides/install/install-nginx-controller.md#postgresql-optional" >}}), which you manage; this is sometimes referred to as an "external config database" because it is externally managed by you. Regardless of whether you use an embedded or an externally managed config database, the config database must be on an external volume for resilient clusters. - An external volume for the analytics database @@ -174,7 +174,7 @@ If you are installing NGINX Controller on [AWS EC2 instances](https://aws.amazon ## Install NGINX Controller -- Complete the steps in the [NGINX Controller Installation Guide]({{< relref "/controller/admin-guides/install/install-nginx-controller.md" >}}) to install NGINX Controller on the first node. +- Complete the steps in the [NGINX Controller Installation Guide]({{< ref "/controller/admin-guides/install/install-nginx-controller.md" >}}) to install NGINX Controller on the first node.   @@ -182,7 +182,7 @@ If you are installing NGINX Controller on [AWS EC2 instances](https://aws.amazon ## License NGINX Controller -- Follow the steps to [license NGINX Controller]({{< relref "/controller/platform/licensing-controller.md" >}}). +- Follow the steps to [license NGINX Controller]({{< ref "/controller/platform/licensing-controller.md" >}}).   @@ -216,7 +216,7 @@ Take the following steps to add a node to the cluster: ``` 1. Upload and extract the `controller-installer-.tar.gz` tarball. -1. Run the `install.sh` command with the join-key that you copied in the previous step. If you get an error that the join-key has expired, you can get a new one by following the steps in this topic to add a node using the web interface or the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}). +1. Run the `install.sh` command with the join-key that you copied in the previous step. If you get an error that the join-key has expired, you can get a new one by following the steps in this topic to add a node using the web interface or the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}). ```bash cd controller-installer @@ -227,7 +227,7 @@ Take the following steps to add a node to the cluster: 1. Repeat these steps for each node that you want to add to the cluster. {{< see-also >}} -To add nodes to your cluster using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a POST request to the `/platform/nodes` endpoint. +To add nodes to your cluster using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a POST request to the `/platform/nodes` endpoint. {{< /see-also >}}   @@ -238,7 +238,7 @@ To add nodes to your cluster using the [NGINX Controller REST API]({{< relref "/ You must add the hostname or IP address for the load balancer as a CNAME or A record for the domain that's used as the Fully Qualified Domain Name (FQDN) for NGINX Controller. -To get the hostname or IP address for the load balancer using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a GET request to the `/platform/global` endpoint. +To get the hostname or IP address for the load balancer using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a GET request to the `/platform/global` endpoint.   @@ -255,7 +255,7 @@ Deleting nodes can cause NGINX Controller to become momentarily unavailable whil {{< /important >}} {{< see-also >}} -To delete nodes from your cluster using the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}), send a DELETE request to the Nodes endpoint. +To delete nodes from your cluster using the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}), send a DELETE request to the Nodes endpoint. {{< /see-also >}} To delete a node from the cluster using the web interface: @@ -275,7 +275,7 @@ To delete a node from the cluster using the web interface: ``` {{< see-also >}} -To delete nodes from your cluster using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a DELETE request to the `/platform/nodes` endpoint. +To delete nodes from your cluster using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a DELETE request to the `/platform/nodes` endpoint. {{< /see-also >}}   @@ -309,7 +309,7 @@ Active users will be logged out from NGINX Controller during an update. We recom To update your cluster to a newer version of NGINX Controller, take the following steps: -1. Before updating the cluster, [check each node's status]({{< relref "/controller/platform/manage-cluster.md#view-node-status" >}}) to confirm the nodes are healthy. Resolve any degradations before updating. +1. Before updating the cluster, [check each node's status]({{< ref "/controller/platform/manage-cluster.md#view-node-status" >}}) to confirm the nodes are healthy. Resolve any degradations before updating. 1. Download the new installer package from the [MyF5 Customer Portal](https://my.f5.com/manage/s/downloads). 1. Extract the installer package and save the contents to each node: diff --git a/content/controller/admin-guides/install/resilient-cluster-private-cloud.md b/content/controller/admin-guides/install/resilient-cluster-private-cloud.md index a0209f61e..22cc5e1db 100644 --- a/content/controller/admin-guides/install/resilient-cluster-private-cloud.md +++ b/content/controller/admin-guides/install/resilient-cluster-private-cloud.md @@ -63,7 +63,7 @@ Larger clusters aren't supported. Before installing or configuring NGINX Controller as a multi-node cluster, review the following list of considerations to assist with planning: -- Configuring NGINX Controller as a multi-node cluster on a private cloud requires **NGINX Controller 3.12 or later**. To upgrade from an earlier version, refer to the [Update NGINX Controller]({{< relref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}) steps for instructions. +- Configuring NGINX Controller as a multi-node cluster on a private cloud requires **NGINX Controller 3.12 or later**. To upgrade from an earlier version, refer to the [Update NGINX Controller]({{< ref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}) steps for instructions. - Data migration is not supported, so it's not possible to implement a multi-node cluster with local volumes without reinstalling NGINX Controller. - If you plan to run NGINX Controller on AWS EC2 instances, we recommend using NFS shares for the external volumes. Using EBS shares for multi-node clusters is not recommended because of the [EBS Availability Zone limitations](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volumes-multi.html#considerations); for example, the requirement to have EC2 instances and EBS volumes in the same Availability Zone. - Cluster config changes are orchestrated by a primary control plane node that writes to the external config database. Each NGINX Controller control plane node hosts a set of services (pods) that read and write data. Only the node that hosts the pod that manages the config data writes to the external config database. @@ -78,7 +78,7 @@ Things you'll need before installing NGINX Controller as a resilient cluster: - A tool to send API requests, such as Postman or curl - An external volume for the config database - When installing NGINX Controller, you can choose to have NGINX Controller install and manage a self-hosted -- also known as "embedded" -- [PostgreSQL](https://www.postgresql.org/) database for you; this is the recommended implementation. Alternatively, you can [install your own PostgreSQL database for the config database]({{< relref "/controller/admin-guides/install/install-nginx-controller.md#postgresql-optional" >}}), which you manage; this is sometimes referred to as an "external config database" because it is externally managed by you. Regardless of whether you use an embedded or an externally managed config database, the config database must be on an external volume for resilient clusters. + When installing NGINX Controller, you can choose to have NGINX Controller install and manage a self-hosted -- also known as "embedded" -- [PostgreSQL](https://www.postgresql.org/) database for you; this is the recommended implementation. Alternatively, you can [install your own PostgreSQL database for the config database]({{< ref "/controller/admin-guides/install/install-nginx-controller.md#postgresql-optional" >}}), which you manage; this is sometimes referred to as an "external config database" because it is externally managed by you. Regardless of whether you use an embedded or an externally managed config database, the config database must be on an external volume for resilient clusters. - An external volume for the analytics database @@ -88,7 +88,7 @@ Things you'll need before installing NGINX Controller as a resilient cluster: ## Install NGINX Controller -- Complete the steps in the [NGINX Controller Installation Guide]({{< relref "/controller/admin-guides/install/install-nginx-controller.md" >}}) to install NGINX Controller on the first node. +- Complete the steps in the [NGINX Controller Installation Guide]({{< ref "/controller/admin-guides/install/install-nginx-controller.md" >}}) to install NGINX Controller on the first node.   @@ -96,7 +96,7 @@ Things you'll need before installing NGINX Controller as a resilient cluster: ## License NGINX Controller -- Follow the steps to [license NGINX Controller]({{< relref "/controller/platform/licensing-controller.md" >}}). +- Follow the steps to [license NGINX Controller]({{< ref "/controller/platform/licensing-controller.md" >}}).   @@ -130,7 +130,7 @@ Take the following steps to add a node to the cluster: ``` 1. Upload and extract the `controller-installer-.tar.gz` tarball. -1. Run the `install.sh` command with the join-key that you copied in the previous step. If you get an error that the join-key has expired, you can get a new one by following the steps in this topic to add a node using the web interface or the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}). +1. Run the `install.sh` command with the join-key that you copied in the previous step. If you get an error that the join-key has expired, you can get a new one by following the steps in this topic to add a node using the web interface or the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}). ```bash cd controller-installer @@ -141,7 +141,7 @@ Take the following steps to add a node to the cluster: 1. Repeat these steps for each node that you want to add to the cluster. {{< see-also >}} -To add nodes to your cluster using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a POST request to the `/platform/nodes` endpoint. +To add nodes to your cluster using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a POST request to the `/platform/nodes` endpoint. {{< /see-also >}}   @@ -172,7 +172,7 @@ Take the following steps to add a floating IP for your private cloud cluster: 1. Complete the steps to [update the FQDN](#update-the-fqdn) to use the floating IP. {{< see-also >}} -To set a floating IP using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. +To set a floating IP using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. {{< /see-also >}}   @@ -208,7 +208,7 @@ To change the FQDN for NGINX Controller using the web interface, take the follow 1. Follow the steps to [update the FQDN for Controller Agents](#update-the-fqdn-for-controller-agents). {{< see-also >}} -To change the FQDN for NGINX Controller using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. +To change the FQDN for NGINX Controller using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. {{< /see-also >}}   @@ -253,7 +253,7 @@ Take the following steps to update the API Gateway SSL certificate: 1. Select **Save**. {{< see-also >}} -To update the API Gateway SSL certificate and key using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. +To update the API Gateway SSL certificate and key using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. {{< /see-also >}}   @@ -265,7 +265,7 @@ To update the API Gateway SSL certificate and key using the [NGINX Controller RE Take the following steps to view the status for a node: {{< see-also >}} -To view a node's status using the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}), send a GET request to the Nodes endpoint. +To view a node's status using the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}), send a GET request to the Nodes endpoint. {{< /see-also >}} 1. Open the NGINX Controller web interface and log in. @@ -288,7 +288,7 @@ Deleting nodes can cause NGINX Controller to become momentarily unavailable whil {{< /important >}} {{< see-also >}} -To delete nodes from your cluster using the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}), send a DELETE request to the Nodes endpoint. +To delete nodes from your cluster using the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}), send a DELETE request to the Nodes endpoint. {{< /see-also >}} To delete a node from the cluster using the web interface: @@ -308,7 +308,7 @@ To delete a node from the cluster using the web interface: ``` {{< see-also >}} -To delete nodes from your cluster using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a DELETE request to the `/platform/nodes` endpoint. +To delete nodes from your cluster using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a DELETE request to the `/platform/nodes` endpoint. {{< /see-also >}}   @@ -342,7 +342,7 @@ Active users will be logged out from NGINX Controller during an update. We recom To update your cluster to a newer version of NGINX Controller, take the following steps: -1. Before updating the cluster, [check each node's status]({{< relref "/controller/platform/manage-cluster.md#view-node-status" >}}) to confirm the nodes are healthy. Resolve any degradations before updating. +1. Before updating the cluster, [check each node's status]({{< ref "/controller/platform/manage-cluster.md#view-node-status" >}}) to confirm the nodes are healthy. Resolve any degradations before updating. 1. Download the new installer package from the [MyF5 Customer Portal](https://my.f5.com/manage/s/downloads). 1. Extract the installer package and save the contents to each node: diff --git a/content/controller/admin-guides/install/try-nginx-controller-app-sec.md b/content/controller/admin-guides/install/try-nginx-controller-app-sec.md index f25430c85..74b41240b 100644 --- a/content/controller/admin-guides/install/try-nginx-controller-app-sec.md +++ b/content/controller/admin-guides/install/try-nginx-controller-app-sec.md @@ -25,7 +25,7 @@ Take the steps in this guide to deploy NGINX Controller with App Security and de ## Technical Requirements -Be sure to review the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) for additional requirements for your desired distribution and configuration. +Be sure to review the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) for additional requirements for your desired distribution and configuration. ### Supported Distributions @@ -42,14 +42,14 @@ The following minimum hardware specifications are required for each node running - RAM: 8 GB RAM - CPU: 8-Core CPU @ 2.40 GHz or similar -- Disk space: 155–255 GB free disk space. 255 GB of free space is recommended if NGINX Controller App Security is enabled. See the [Storage Requirements]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#storage-requirements" >}}) section for a categorized list of the storage requirements. +- Disk space: 155–255 GB free disk space. 255 GB of free space is recommended if NGINX Controller App Security is enabled. See the [Storage Requirements]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#storage-requirements" >}}) section for a categorized list of the storage requirements. ### Supported NGINX Versions The App Security add-on for the NGINX Controller Application Delivery module is compatible with the versions of NGINX Plus and NGINX App Protect shown in the table below. New releases of NGINX Controller ADC support the last four versions of NGINX Plus at release time. {{< see-also >}} -Refer to [Using NGINX App Protect with NGINX Controller]({{< relref "controller/admin-guides/install/install-for-controller.md" >}}) for installation instructions and additional information. +Refer to [Using NGINX App Protect with NGINX Controller]({{< ref "controller/admin-guides/install/install-for-controller.md" >}}) for installation instructions and additional information. {{< /see-also >}} {{< bootstrap-table "table table-striped table-bordered" >}} @@ -94,7 +94,7 @@ First, you need to sign up for a trial license for NGINX Controller. The trial i 1. On the MyF5 landing page, activate the NGINX Controller free trial. 1. On the MyF5 **Trials** page, select Launch Your Trial. 1. Download the NGINX Controller package. -1. Make note of your Association Token. You will use this to [license your NGINX Controller instance]({{< relref "/controller/platform/licensing-controller.md#add-a-license-to-nginx-controller" >}}). +1. Make note of your Association Token. You will use this to [license your NGINX Controller instance]({{< ref "/controller/platform/licensing-controller.md#add-a-license-to-nginx-controller" >}}).   @@ -119,7 +119,7 @@ Install NGINX Controller on a dedicated node that **does not** already have Kube {{< important >}}Before installing NGINX Controller, you must **disable swap on the host**; this is required by Kubernetes in order for the kubelet to work properly. Refer to your Linux distribution documentation for specific instructions for disabling swap for your system. For more information about this requirement, see the AskF5 knowledge base article [K82655201](https://support.f5.com/csp/article/K82655201) and the [kubeadm installation guide](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#before-you-begin) in the Kubernetes documentation.{{< /important >}} -{{< caution >}}**For RHEL 8 deployments**, complete the additional prerequisite steps in the [Installing NGINX on RHEL 8]({{< relref "/controller/admin-guides/install/install-nginx-controller-rhel-8.md" >}}) guide before installing NGINX Controller. RHEL 8 support is a **beta** feature.{{< /caution >}} +{{< caution >}}**For RHEL 8 deployments**, complete the additional prerequisite steps in the [Installing NGINX on RHEL 8]({{< ref "/controller/admin-guides/install/install-nginx-controller-rhel-8.md" >}}) guide before installing NGINX Controller. RHEL 8 support is a **beta** feature.{{< /caution >}} To install NGINX Controller, take the following steps: @@ -143,7 +143,7 @@ To install NGINX Controller, take the following steps: - **Config database volume type**: Specify the type of volume to use to store the config database: local, NFS, or AWS. We recommend choosing `local` for demo and trial purposes. - {{< see-also >}}Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#local-or-external-storage" >}}) for more information about the volume options and requirements.{{< /see-also >}} + {{< see-also >}}Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#local-or-external-storage" >}}) for more information about the volume options and requirements.{{< /see-also >}} - **Analytics database volume type**: Specify the type of volume to use to store the analytics database: local, NFS, or AWS. We recommend choosing `local` for demo and trial purposes. - **EULA**: Read the end-user license agreement. Type either `y` to accept or `n` to exit. @@ -187,7 +187,7 @@ To add a license to NGINX Controller, take the following steps: 1. Select **Save license**. {{< see-also >}} -To add a license using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PUT request to the `/platform/license` endpoint. Provide your CAT or NGINX Controller license as a base64-encoded string in the JSON request body. +To add a license using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PUT request to the `/platform/license` endpoint. Provide your CAT or NGINX Controller license as a base64-encoded string in the JSON request body. {{< /see-also >}} @@ -208,13 +208,13 @@ NGINX Controller App Security is supported for use with a limited subset of the ### Prerequisites - Be sure to review the [NGINX Plus Technical Specifications](https://docs.nginx.com/nginx/technical-specs/) for the requirements for your distribution and desired configuration. -- You'll need the NGINX Plus certificate and public key files (`nginx-repo.crt` and `nginx-repo.key`) when installing NGINX App Protect. If you don't have these files, you can use the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to download them. +- You'll need the NGINX Plus certificate and public key files (`nginx-repo.crt` and `nginx-repo.key`) when installing NGINX App Protect. If you don't have these files, you can use the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to download them. #### Download the NGINX App Protect Cert and Key Take the steps below to download the cert and key files by using the NGINX Controller REST API. -The NGINX Controller API uses session cookies to authenticate requests. The session cookie is returned in response to a `GET /api/v1/platform/login` request. See the Login endpoint in the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}) documentation for information about session cookie timeouts and invalidation. +The NGINX Controller API uses session cookies to authenticate requests. The session cookie is returned in response to a `GET /api/v1/platform/login` request. See the Login endpoint in the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}) documentation for information about session cookie timeouts and invalidation. {{< tip >}} You can send a GET request to the login endpoint to find the status of the session token. @@ -237,7 +237,7 @@ For example:
-To use the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to download your NGINX Plus certificate and key bundle as a gzip or JSON file, send a GET request to the `/platform/licenses/nginx-plus-licenses/controller-provided` endpoint. +To use the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to download your NGINX Plus certificate and key bundle as a gzip or JSON file, send a GET request to the `/platform/licenses/nginx-plus-licenses/controller-provided` endpoint. For example: @@ -270,7 +270,7 @@ gunzip nginx-plus-certs.gz
-Install NGINX App Protect on a host accessible by your NGINX Controller instance by following the appropriate steps for your operating system in the [Using NGINX App Protect with NGINX Controller]({{< relref "controller/admin-guides/install/install-for-controller.md" >}}) guide. +Install NGINX App Protect on a host accessible by your NGINX Controller instance by following the appropriate steps for your operating system in the [Using NGINX App Protect with NGINX Controller]({{< ref "controller/admin-guides/install/install-for-controller.md" >}}) guide. {{< note >}} If you install NGINX App Protect by using any of the OS-specific install guides, **do not make changes to the `nginx.conf` file**. @@ -295,10 +295,10 @@ The NGINX Controller Agent manages `nginx.conf` settings and will make the appro You should now be ready to start your NGINX Controller with App Security trial. Refer to the following topics to get started: -- [Configure the NGINX Controller Agent]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) -- [Set Up Metrics Collection]({{< relref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) -- [Forward Metrics Data to an External Service]({{< relref "/controller/analytics/forwarders/_index.md" >}}) -- [Set up NGINX Controller Services]({{< relref "/controller/services/overview.md" >}}) +- [Configure the NGINX Controller Agent]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) +- [Set Up Metrics Collection]({{< ref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) +- [Forward Metrics Data to an External Service]({{< ref "/controller/analytics/forwarders/_index.md" >}}) +- [Set up NGINX Controller Services]({{< ref "/controller/services/overview.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/admin-guides/install/try-nginx-controller.md b/content/controller/admin-guides/install/try-nginx-controller.md index 147903fb6..c5565c412 100644 --- a/content/controller/admin-guides/install/try-nginx-controller.md +++ b/content/controller/admin-guides/install/try-nginx-controller.md @@ -15,7 +15,7 @@ This quick-start tutorial shows you how to get started using F5 NGINX Controller {{< caution >}}In this tutorial, NGINX Controller will install an embedded, self-hosted PostgreSQL database suitable for demo and trial purposes only. **These instructions are not meant for use in production environments**.{{< /caution >}} -{{< see-also >}}If you want to try out NGINX Controller with the Application Security add-on, refer to [Trial NGINX Controller with App Security]({{< relref "/controller/admin-guides/install/try-nginx-controller-app-sec.md" >}}).{{< /see-also >}} +{{< see-also >}}If you want to try out NGINX Controller with the Application Security add-on, refer to [Trial NGINX Controller with App Security]({{< ref "/controller/admin-guides/install/try-nginx-controller-app-sec.md" >}}).{{< /see-also >}}   @@ -23,7 +23,7 @@ This quick-start tutorial shows you how to get started using F5 NGINX Controller ## Technical Requirements -Make sure to review the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) for the requirements for your distribution and desired configuration. +Make sure to review the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) for the requirements for your distribution and desired configuration. ### Supported Distributions @@ -54,7 +54,7 @@ NGINX Controller, the NGINX Controller Agent, and the NGINX Controller Applicati #### Analytics, Visibility, and Reporting Daemon (AVRD) -NGINX Controller v3.1 and later use an Analytics, Visibility, and Reporting daemon (AVRD) to aggregate and report app-centric metrics, which you can use to track and check the health of your apps. To learn more about these metrics, see the [NGINX Metrics Catalog]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) topic. +NGINX Controller v3.1 and later use an Analytics, Visibility, and Reporting daemon (AVRD) to aggregate and report app-centric metrics, which you can use to track and check the health of your apps. To learn more about these metrics, see the [NGINX Metrics Catalog]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) topic. ### Hardware Specs @@ -62,7 +62,7 @@ The following minimum hardware specifications are required for each node running - RAM: 8 GB RAM - CPU: 8-Core CPU @ 2.40 GHz or similar -- Disk space: 155–255 GB free disk space. 255 GB of free space is recommended if NGINX Controller App Security is enabled. See the [Storage Requirements]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#storage-requirements" >}}) section for a categorized list of the storage requirements. +- Disk space: 155–255 GB free disk space. 255 GB of free space is recommended if NGINX Controller App Security is enabled. See the [Storage Requirements]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#storage-requirements" >}}) section for a categorized list of the storage requirements. ### Supported NGINX Plus Versions @@ -98,7 +98,7 @@ First, you need to sign up for a trial license for NGINX Controller. The trial i 1. On the MyF5 landing page, activate the NGINX Controller free trial. 1. On the MyF5 **Trials** page, select Launch Your Trial. 1. Download the NGINX Controller package. -1. Make note of your Association Token. You will use this to [license your NGINX Controller instance]({{< relref "/controller/platform/licensing-controller.md#add-a-license-to-nginx-controller" >}}). +1. Make note of your Association Token. You will use this to [license your NGINX Controller instance]({{< ref "/controller/platform/licensing-controller.md#add-a-license-to-nginx-controller" >}}).   @@ -118,7 +118,7 @@ Install NGINX Controller on a dedicated node that **does not** already have Kube {{< important >}}Before installing NGINX Controller, you must **disable swap on the host**; this is required by Kubernetes in order for the kubelet to work properly. Refer to your Linux distribution documentation for specific instructions for disabling swap for your system. For more information about this requirement, see the AskF5 knowledge base article [K82655201](https://support.f5.com/csp/article/K82655201) and the [kubeadm installation guide](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#before-you-begin) in the Kubernetes documentation.{{< /important >}} -{{< caution >}}**For RHEL 8 deployments**, complete the additional prerequisite steps in the [Installing NGINX on RHEL 8]({{< relref "/controller/admin-guides/install/install-nginx-controller-rhel-8.md" >}}) guide before installing NGINX Controller. RHEL 8 support is a **beta** feature.{{< /caution >}} +{{< caution >}}**For RHEL 8 deployments**, complete the additional prerequisite steps in the [Installing NGINX on RHEL 8]({{< ref "/controller/admin-guides/install/install-nginx-controller-rhel-8.md" >}}) guide before installing NGINX Controller. RHEL 8 support is a **beta** feature.{{< /caution >}} To install NGINX Controller, take the following steps: @@ -142,7 +142,7 @@ To install NGINX Controller, take the following steps: - **Config database volume type**: Specify the type of volume to use to store the config database: local, NFS, or AWS. We recommend choosing `local` for demo and trial purposes. - {{< see-also >}}Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#local-or-external-storage" >}}) for more information about the volume options and requirements.{{< /see-also >}} + {{< see-also >}}Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#local-or-external-storage" >}}) for more information about the volume options and requirements.{{< /see-also >}} - **Analytics database volume type**: Specify the type of volume to use to store the analytics database: local, NFS, or AWS. We recommend choosing `local` for demo and trial purposes. - **EULA**: Read the end-user license agreement. Type either `y` to accept or `n` to exit. @@ -186,7 +186,7 @@ To add a license to NGINX Controller, take the following steps: 1. Select **Save license**. {{< see-also >}} -To add a license using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PUT request to the `/platform/license` endpoint. Provide your CAT or NGINX Controller license as a base64-encoded string in the JSON request body. +To add a license using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PUT request to the `/platform/license` endpoint. Provide your CAT or NGINX Controller license as a base64-encoded string in the JSON request body. {{< /see-also >}} @@ -199,11 +199,11 @@ To add a license using the [NGINX Controller REST API]({{< relref "/controller/a ### Prerequisites - Make sure to review the [NGINX Plus Technical Specifications Guide](https://docs.nginx.com/nginx/technical-specs/) for the requirements for your distribution and desired configuration. -- You'll need the NGINX Plus certificate and public key files (`nginx-repo.crt` and `nginx-repo.key`) that were provided when you signed up for the trial license. If you don't have these files, you can use the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to download them. +- You'll need the NGINX Plus certificate and public key files (`nginx-repo.crt` and `nginx-repo.key`) that were provided when you signed up for the trial license. If you don't have these files, you can use the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to download them. #### How to Download the NGINX Plus Cert and Key using the NGINX Controller API -The NGINX Controller API uses session cookies to authenticate requests. The session cookie is returned in response to a `GET /api/v1/platform/login` request. See the Login endpoint in the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}) documentation for information about session cookie timeouts and invalidation. +The NGINX Controller API uses session cookies to authenticate requests. The session cookie is returned in response to a `GET /api/v1/platform/login` request. See the Login endpoint in the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}) documentation for information about session cookie timeouts and invalidation. {{< tip >}} You can send a GET request to the login endpoint to find the status of the session token. @@ -226,7 +226,7 @@ For example:
-To use the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to download your NGINX Plus certificate and key bundle as a gzip or JSON file, send a GET request to the `/platform/licenses/nginx-plus-licenses/controller-provided` endpoint. +To use the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to download your NGINX Plus certificate and key bundle as a gzip or JSON file, send a GET request to the `/platform/licenses/nginx-plus-licenses/controller-provided` endpoint. For example: diff --git a/content/controller/admin-guides/install/using-helper-script.md b/content/controller/admin-guides/install/using-helper-script.md index 1ba4e2444..2a880d7ce 100644 --- a/content/controller/admin-guides/install/using-helper-script.md +++ b/content/controller/admin-guides/install/using-helper-script.md @@ -104,7 +104,7 @@ After installing NGINX Controller, you should back up the cluster config and enc This section explains how to restore the embedded config database from the latest backup file or a specific, timestamped file. -{{< important >}}If you restore the config database on top of a new installation of NGINX Controller, make sure to follow the steps to [restore your NGINX config and encryption keys]({{< relref "/controller/admin-guides/backup-restore/backup-restore-cluster-config.md" >}}) afterward. {{< /important >}} +{{< important >}}If you restore the config database on top of a new installation of NGINX Controller, make sure to follow the steps to [restore your NGINX config and encryption keys]({{< ref "/controller/admin-guides/backup-restore/backup-restore-cluster-config.md" >}}) afterward. {{< /important >}} - To restore the embedded NGINX Controller config database **from the latest automated backup**, run the following command: @@ -120,7 +120,7 @@ This section explains how to restore the embedded config database from the lates - If you installed the embedded config database on a **local volume**, the backup files are located in `/opt/nginx-controller/postgres_data/`. - - If you installed the embedded config database on an **NFS volume**, follow the steps in [(NFS) Copy Config Database Backup to Local Volume for Restoration]({{< relref "/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md#nfs-copy-config-database-backup-to-local-volume-for-restoration" >}}) to download the backup file to your local volume, and then use the `helper.sh` script to restore from it. + - If you installed the embedded config database on an **NFS volume**, follow the steps in [(NFS) Copy Config Database Backup to Local Volume for Restoration]({{< ref "/controller/admin-guides/backup-restore/backup-restore-embedded-config-db.md#nfs-copy-config-database-backup-to-local-volume-for-restoration" >}}) to download the backup file to your local volume, and then use the `helper.sh` script to restore from it.   @@ -134,7 +134,7 @@ To install NGINX Plus as a data plane for NGINX Controller, you need to have the {{< deprecated >}}Using the helper.sh script to download your NGINX Plus certificate and key bundle is deprecated in in NGINX Controller v3.9.{{< /deprecated >}} -{{< see-also >}}If you're running NGINX Controller v3.10+, you can use the REST API to [Download the NGINX Plus Cert and Key Bundle]({{< relref "/controller/admin-guides/install/get-n-plus-cert-and-key.md" >}}). {{< /see-also >}}  +{{< see-also >}}If you're running NGINX Controller v3.10+, you can use the REST API to [Download the NGINX Plus Cert and Key Bundle]({{< ref "/controller/admin-guides/install/get-n-plus-cert-and-key.md" >}}). {{< /see-also >}}  If you're running NGINX Controller 3.9 or earlier, use the `helper.sh` script to extract the NGINX repository key and certificate files: @@ -144,7 +144,7 @@ If you're running NGINX Controller 3.9 or earlier, use the `helper.sh` script to {{< important >}} -Make sure that you've [uploaded your license in NGINX Controller]({{< relref "licensing-controller.md" >}}) first before running the `helper.sh repository-cred` command to extract the repository files. +Make sure that you've [uploaded your license in NGINX Controller]({{< ref "licensing-controller.md" >}}) first before running the `helper.sh repository-cred` command to extract the repository files. {{< /important >}} diff --git a/content/controller/analytics/alerts/about-alerts.md b/content/controller/analytics/alerts/about-alerts.md index 5b573b18a..c870c9a75 100644 --- a/content/controller/analytics/alerts/about-alerts.md +++ b/content/controller/analytics/alerts/about-alerts.md @@ -13,7 +13,7 @@ type: The F5 NGINX Controller Analytics module lets you configure alerts and notifications, so you can stay informed about your system and app performance. In this topic, you'll learn about [alerts](#alerts), [alert rules](#alert-rules), and [alert notifications](#alert-notifications). {{< see-also >}} -Refer to [Manage Alerts]({{< relref "/controller/analytics/alerts/manage-alerts.md" >}}) to learn how to set up alerts. +Refer to [Manage Alerts]({{< ref "/controller/analytics/alerts/manage-alerts.md" >}}) to learn how to set up alerts. {{< /see-also >}} ## Alerts @@ -63,9 +63,9 @@ th { |---|---| | `name` | A unique identifier for the alert rule.| | `display name` | A human-friendly name that helps you identify what the alert rule does. | -| `metric` | The [metric]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) that you want to monitor.
{{< note >}}An alert rule can monitor one metric.{{< /note >}}| +| `metric` | The [metric]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) that you want to monitor.
{{< note >}}An alert rule can monitor one metric.{{< /note >}}| | `operator` | The operator that will be applied to the value of the metric to check if an alert should be triggered. There are two available operators: `le` - less or equal and `ge` - greater or equal.| -| `threshold` | Defines the value that, when exceeded, will trigger an alert.
{{< tip >}}You can find the allowed threshold value(s) for each metric in the **unit** field of the metric's entry in the [Metrics Catalogs Reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}}). Select the "Index" button to access the list of all available metrics and jump directly to that item in the catalog.{{< /tip >}} | +| `threshold` | Defines the value that, when exceeded, will trigger an alert.
{{< tip >}}You can find the allowed threshold value(s) for each metric in the **unit** field of the metric's entry in the [Metrics Catalogs Reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}}). Select the "Index" button to access the list of all available metrics and jump directly to that item in the catalog.{{< /tip >}} | | `period` | Defines the time window in which you want to calculate the aggregated metric value.
- The maximum possible time window is `24h`.
- The minimum possible time window is `2m`.| | `filter` | Lets you refine the alert rule for a more specific set of metric values, based on dimensions.
If no filter is provided, all collected data will be used when calculating the alert rule status.| | `group by` | Groups results according to the specified dimension(s). A separate alert will be triggered for each result group. You can provide multiple dimension names as a comma-separated list.
{{}}Using a dimension with a high cardinality of values might result in a high volume of alerts.{{}}| @@ -107,7 +107,7 @@ Alert rules work in the following manner: 1. Incoming metric updates are continuously monitored against the set of alert rules. 2. The most recent metric value is checked against the threshold defined in the alert rule. -3. If the threshold is met, an alert notification is generated and the rule will continue to be monitored. In the [Alerts Status]({{< relref "/controller/analytics/alerts/manage-alerts.md#view-alert-rule-status" >}}) pane, the alert instance's status will be displayed as "ongoing". +3. If the threshold is met, an alert notification is generated and the rule will continue to be monitored. In the [Alerts Status]({{< ref "/controller/analytics/alerts/manage-alerts.md#view-alert-rule-status" >}}) pane, the alert instance's status will be displayed as "ongoing". 4. If subsequent metric updates show that the metric no longer violates the threshold for the configured period, the alert expires. ## Alert Notifications @@ -118,15 +118,15 @@ An *Alert notification* is a message either displayed in the NGINX Controller us - A notification appears in the Notifications feed immediately when an alert is triggered or expires. - Alert instance emails notify you when a single alert instance starts or expires. -If you want to stop receiving notifications for an alert rule, but you don't want to delete it, you can [mute the alert rule]({{< relref "/controller/analytics/alerts/manage-alerts.md#mute-or-unmute-an-alert-rule" >}}). -Likewise, if you want to stop receiving emails for an alert rule, but you do want to continue receiving the user interface notifications, [edit the alert rule]({{< relref "/controller/analytics/alerts/manage-alerts.md#edit-an-alert-rule" >}}) and remove your email address. +If you want to stop receiving notifications for an alert rule, but you don't want to delete it, you can [mute the alert rule]({{< ref "/controller/analytics/alerts/manage-alerts.md#mute-or-unmute-an-alert-rule" >}}). +Likewise, if you want to stop receiving emails for an alert rule, but you do want to continue receiving the user interface notifications, [edit the alert rule]({{< ref "/controller/analytics/alerts/manage-alerts.md#edit-an-alert-rule" >}}) and remove your email address. {{< note >}}If you mute an alert rule while the alert rule status is "ongoing", you will not receive any further alert notifications, including when the alert rule status changes.{{< /note >}} ### Email notifications {{< important >}} -You must [verify your email address]({{< relref "/controller/analytics/alerts/manage-registered-emails.md" >}}) in order to receive alert notification emails. +You must [verify your email address]({{< ref "/controller/analytics/alerts/manage-registered-emails.md" >}}) in order to receive alert notification emails. {{< /important >}} When an alert rule's conditions are met, NGINX Controller sends an alert email with the subject "[controller-alert] Alert started: " to all of the email addresses that are specified in the alert rule. @@ -149,7 +149,7 @@ If the threshold is exceeded for one instance, then you will receive one alert e ## How Alerts Work -NGINX Controller checks the list of configured alert rules every 30 seconds. Then, it queries the [Metrics API]({{< relref "/controller/analytics/metrics/metrics-api.md" >}}) for the data defined in each alert rule. +NGINX Controller checks the list of configured alert rules every 30 seconds. Then, it queries the [Metrics API]({{< ref "/controller/analytics/metrics/metrics-api.md" >}}) for the data defined in each alert rule. The API query uses the following template: @@ -157,7 +157,7 @@ The API query uses the following template: where -- `` is the appropriate [aggregation function]({{< relref "/controller/analytics/metrics/metrics-api.md#aggregations" >}}) for the metric. You can find this information in the [Metrics Catalog Reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}}). +- `` is the appropriate [aggregation function]({{< ref "/controller/analytics/metrics/metrics-api.md#aggregations" >}}) for the metric. You can find this information in the [Metrics Catalog Reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}}). - `AVG` applies to `gauge` metrics. Gauges are averaged over the time period configured in the alert rule. - `MAX` applies to `counter` metrics. - `SUM` applies to `incremental` metrics. @@ -192,7 +192,7 @@ Next, the alert rule status is updated. Each alert rule will be updated with a n Finally, the alert notifications for newly-created or expired alerts will be sent for any rules that are not muted. {{< important >}} -If the [Metrics API]({{< relref "/controller/analytics/metrics/metrics-api.md" >}}) query does not return any data -- for example, if there was no traffic through the instance and therefore no metric value -- NGINX Controller assumes a value of `0`. In such cases, the threshold will be compared to `0`. +If the [Metrics API]({{< ref "/controller/analytics/metrics/metrics-api.md" >}}) query does not return any data -- for example, if there was no traffic through the instance and therefore no metric value -- NGINX Controller assumes a value of `0`. In such cases, the threshold will be compared to `0`. {{< /important >}} ## Alert special cases @@ -215,9 +215,9 @@ To achieve that: ## What's Next -- [Create and Manage Alert Rules]({{< relref "/controller/analytics/alerts/manage-alerts.md" >}}) -- [Manage Registered Emails]({{< relref "/controller/analytics/alerts/manage-registered-emails.md" >}}) -- [NGINX Controller REST API Reference]({{< relref "/controller/api/_index.md" >}}) +- [Create and Manage Alert Rules]({{< ref "/controller/analytics/alerts/manage-alerts.md" >}}) +- [Manage Registered Emails]({{< ref "/controller/analytics/alerts/manage-registered-emails.md" >}}) +- [NGINX Controller REST API Reference]({{< ref "/controller/api/_index.md" >}}) {{< versions "3.13" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/alerts/manage-alerts.md b/content/controller/analytics/alerts/manage-alerts.md index 96bbb5412..de167234f 100644 --- a/content/controller/analytics/alerts/manage-alerts.md +++ b/content/controller/analytics/alerts/manage-alerts.md @@ -10,9 +10,9 @@ type: ## Overview -[Alerts]({{< relref "/controller/analytics/alerts/about-alerts.md" >}}) are notifications about the F5 NGINX Controller system and your applications' performance. +[Alerts]({{< ref "/controller/analytics/alerts/about-alerts.md" >}}) are notifications about the F5 NGINX Controller system and your applications' performance. -[Alert rules]({{< relref "/controller/analytics/alerts/about-alerts.md#alert-rules" >}}) let you specify what you want to be alerted about. This includes which metrics you want to monitor; the trigger conditions and threshold to meet; the instance(s) to monitor; and the email address(es) to use for notifications. +[Alert rules]({{< ref "/controller/analytics/alerts/about-alerts.md#alert-rules" >}}) let you specify what you want to be alerted about. This includes which metrics you want to monitor; the trigger conditions and threshold to meet; the instance(s) to monitor; and the email address(es) to use for notifications. ## Add an Alert Rule @@ -92,10 +92,10 @@ To delete an alert rule: ## What's Next -- Learn more [About Alerts]({{< relref "/controller/analytics/alerts/about-alerts.md" >}}) -- Learn more about [Metrics and Metadata]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) -- Learn more about [Traffic Metrics]({{< relref "/controller/analytics/metrics/overview-traffic-metrics.md" >}}) -- [Manage Registered Emails]({{< relref "/controller/analytics/alerts/manage-registered-emails.md" >}}) +- Learn more [About Alerts]({{< ref "/controller/analytics/alerts/about-alerts.md" >}}) +- Learn more about [Metrics and Metadata]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) +- Learn more about [Traffic Metrics]({{< ref "/controller/analytics/metrics/overview-traffic-metrics.md" >}}) +- [Manage Registered Emails]({{< ref "/controller/analytics/alerts/manage-registered-emails.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/alerts/manage-registered-emails.md b/content/controller/analytics/alerts/manage-registered-emails.md index f064fe50e..81131b9da 100644 --- a/content/controller/analytics/alerts/manage-registered-emails.md +++ b/content/controller/analytics/alerts/manage-registered-emails.md @@ -11,7 +11,7 @@ type: ## Overview -In order to receive email notifications for [Alerts]({{< relref "/controller/analytics/alerts/about-alerts.md" >}}), you need to provide a valid email address and complete the verification process. +In order to receive email notifications for [Alerts]({{< ref "/controller/analytics/alerts/about-alerts.md" >}}), you need to provide a valid email address and complete the verification process. {{< important >}} You will not receive any alert notifications via email until you verify your email address. Any alert notification emails that were triggered by alert rules prior to the email address being verified will not be re-sent. @@ -26,7 +26,7 @@ To find the list of registered email addresses: 1. On the **Alert Rules Overview** page, select **Manage Email Addresses**. 1. All registered email addresses are displayed in the Manage Email Addresses panel. To close the panel, select **Done**. -{{}}The **Manage Email Addresses** button is not displayed if you don't have any Alerts configured. If this is the case, you can add a new email address when you [create an alert rule]({{< relref "/controller/analytics/alerts/manage-alerts.md#add-an-alert-rule" >}}).{{}} +{{}}The **Manage Email Addresses** button is not displayed if you don't have any Alerts configured. If this is the case, you can add a new email address when you [create an alert rule]({{< ref "/controller/analytics/alerts/manage-alerts.md#add-an-alert-rule" >}}).{{}} ## Add a New Email Address diff --git a/content/controller/analytics/dashboards/application-health-score.md b/content/controller/analytics/dashboards/application-health-score.md index 226c576f2..5ec0bd4f0 100644 --- a/content/controller/analytics/dashboards/application-health-score.md +++ b/content/controller/analytics/dashboards/application-health-score.md @@ -82,11 +82,11 @@ By default, the AHS and other metrics on the **Overview** page are calculated fo ## What's Next -- [Overview of metrics and metadata]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) -- [Set up Metrics Collection]({{< relref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) -- [Metrics Catalog Reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) -- [Dimensions Catalog Reference]({{< relref "/controller/analytics/catalogs/dimensions.md" >}}) -- [Custom Dashboards]({{< relref "/controller/analytics/dashboards/custom-dashboards.md" >}}) +- [Overview of metrics and metadata]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) +- [Set up Metrics Collection]({{< ref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) +- [Metrics Catalog Reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) +- [Dimensions Catalog Reference]({{< ref "/controller/analytics/catalogs/dimensions.md" >}}) +- [Custom Dashboards]({{< ref "/controller/analytics/dashboards/custom-dashboards.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/dashboards/custom-dashboards.md b/content/controller/analytics/dashboards/custom-dashboards.md index dd0af1525..8a4913194 100644 --- a/content/controller/analytics/dashboards/custom-dashboards.md +++ b/content/controller/analytics/dashboards/custom-dashboards.md @@ -21,8 +21,8 @@ You can use the F5 NGINX Controller user interface to create your own Dashboards ## Before You Begin -- [Install the NGINX Controller Agent on instances that you want to monitor]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) -- [Configure Metrics collection on your NGINX instances]({{< relref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) +- [Install the NGINX Controller Agent on instances that you want to monitor]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) +- [Configure Metrics collection on your NGINX instances]({{< ref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) ## Dashboards @@ -67,7 +67,7 @@ To add an Element to a Dashboard: 6. Select a metric from the drop-down menu. 7. Select the aggregation method for the selected metric. {{< see-also >}} -For more information about metrics and supported aggregation methods, see the [Metrics Catalog Reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}}). +For more information about metrics and supported aggregation methods, see the [Metrics Catalog Reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}}). {{< /see-also >}} 8. (Optional) Add a filter to refine the data. For example, you can limit the data to a specific App or Environment. 9. (Optional) Select **Add metrics** to add more metrics. @@ -128,11 +128,11 @@ Predefined dashboards cannot be deleted or modified. ## What's Next -- [Overview Dashboard]({{< relref "/controller/analytics/dashboards/overview-dashboard.md" >}}) -- [Overview of Metrics and Metadata]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) -- [Set up Metrics Collection]({{< relref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) -- [Metrics Catalog Reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) -- [Dimensions Catalog Reference]({{< relref "/controller/analytics/catalogs/dimensions.md" >}}) +- [Overview Dashboard]({{< ref "/controller/analytics/dashboards/overview-dashboard.md" >}}) +- [Overview of Metrics and Metadata]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) +- [Set up Metrics Collection]({{< ref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) +- [Metrics Catalog Reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) +- [Dimensions Catalog Reference]({{< ref "/controller/analytics/catalogs/dimensions.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/dashboards/overview-dashboard.md b/content/controller/analytics/dashboards/overview-dashboard.md index 5bb28e8bb..c16a87cc3 100644 --- a/content/controller/analytics/dashboards/overview-dashboard.md +++ b/content/controller/analytics/dashboards/overview-dashboard.md @@ -15,17 +15,17 @@ The **Analytics Dashboards** provides an at-a-glance summary of the state of you ## Before You Begin -- [Install the NGINX Controller Agent on Instances that you want to monitor]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) +- [Install the NGINX Controller Agent on Instances that you want to monitor]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) ## Overview Dashboard -When you log in to the NGINX Controller user interface, the **Analytics Overview** page displays first by default. Select the Dashboards tab to see the **My Dashboards** list page. On the **Dashboard Overview** page, you can view the key indicators noted below. By default, the graphs display metrics for the last hour. You can select any of the default time periods -- one hour, four hours, one day, two days, or one week -- to get a better idea of your apps' overall health and performance. To view metrics over longer time periods, you can create a [custom dashboard]({{< relref "/controller/analytics/dashboards/custom-dashboards.md" >}}). +When you log in to the NGINX Controller user interface, the **Analytics Overview** page displays first by default. Select the Dashboards tab to see the **My Dashboards** list page. On the **Dashboard Overview** page, you can view the key indicators noted below. By default, the graphs display metrics for the last hour. You can select any of the default time periods -- one hour, four hours, one day, two days, or one week -- to get a better idea of your apps' overall health and performance. To view metrics over longer time periods, you can create a [custom dashboard]({{< ref "/controller/analytics/dashboards/custom-dashboards.md" >}}). -The cumulative [metrics]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) displayed on the **Analytics Overview** page are: +The cumulative [metrics]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) displayed on the **Analytics Overview** page are: ### System Metrics -- [Application Health Score]({{< relref "/controller/analytics/dashboards/application-health-score.md" >}}): the health score for your application. +- [Application Health Score]({{< ref "/controller/analytics/dashboards/application-health-score.md" >}}): the health score for your application. - Average CPU: 100 - AVG of the system.cpu.idle (CPU spent in an idle state) - Average Memory: AVG of the `system.mem.used` metric @@ -54,11 +54,11 @@ To display metrics for a specific set of hosts (for example, only for "productio ## What's Next -- [Overview of metrics and metadata]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) -- [Metrics Catalog Reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) -- [Dimensions Catalog Reference]({{< relref "/controller/analytics/catalogs/dimensions.md" >}}) -- [Application Health Score]({{< relref "/controller/analytics/dashboards/application-health-score.md" >}}) -- [Custom Dashboards]({{< relref "/controller/analytics/dashboards/custom-dashboards.md" >}}) +- [Overview of metrics and metadata]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) +- [Metrics Catalog Reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) +- [Dimensions Catalog Reference]({{< ref "/controller/analytics/catalogs/dimensions.md" >}}) +- [Application Health Score]({{< ref "/controller/analytics/dashboards/application-health-score.md" >}}) +- [Custom Dashboards]({{< ref "/controller/analytics/dashboards/custom-dashboards.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/data-explorer/how-to-use.md b/content/controller/analytics/data-explorer/how-to-use.md index 3016aa920..2d9129225 100644 --- a/content/controller/analytics/data-explorer/how-to-use.md +++ b/content/controller/analytics/data-explorer/how-to-use.md @@ -53,7 +53,7 @@ To view data for a resource, select the resource's name from the resource list. ## Metrics -The [list of metrics]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) is sorted alphabetically, and you can use the search feature to filter the list. As previously mentioned, the list of metrics depends on the context you've selected for the Data Explorer. For example, if you've chosen Instances for the context, then the list of metrics will be for instances. +The [list of metrics]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) is sorted alphabetically, and you can use the search feature to filter the list. As previously mentioned, the list of metrics depends on the context you've selected for the Data Explorer. For example, if you've chosen Instances for the context, then the list of metrics will be for instances. {{< img src="/ctlr/img/data-explorer_metric.png">}} @@ -61,13 +61,13 @@ When the selected metric changes, the **Aggregation** and **Group By** selectors ## Aggregation Mode -Use the Aggregation selector -- the Σ symbol with possible values of `AVG`, `MAX`, `MIN`, `RATE`, and `SUM` -- to [aggregate the data]({{< relref "/controller/analytics/metrics/metrics-api.md#aggregations" >}}). The list of possible aggregation values depends on the metrics that's selected. +Use the Aggregation selector -- the Σ symbol with possible values of `AVG`, `MAX`, `MIN`, `RATE`, and `SUM` -- to [aggregate the data]({{< ref "/controller/analytics/metrics/metrics-api.md#aggregations" >}}). The list of possible aggregation values depends on the metrics that's selected. {{< img src="/ctlr/img/data-explorer_aggregation.png">}} ## Group by Dimension -Use the **Group By** selector to [group the data by a chosen dimension]({{< relref "/controller/analytics/metrics/metrics-api.md#groupby" >}}). +Use the **Group By** selector to [group the data by a chosen dimension]({{< ref "/controller/analytics/metrics/metrics-api.md#groupby" >}}). In the following example image, the data for the `bytes_rcvd` metric is grouped by the dimension `http.request_method`, which displays a data series for the HTTP methods `DELETE`, `GET`, `LINK`, and so on. @@ -109,7 +109,7 @@ On the Data Explorer details page, you can select the **Show Query** button (eye The query updates whenever the selection options change. The query doesn't include requests for comparison data. {{< see-also >}} -For instructions on how to understand the Metrics API response, refer to the topic [Using the Metrics API]({{< relref "/controller/analytics/metrics/metrics-api#understanding-the-metrics-api-response" >}}). +For instructions on how to understand the Metrics API response, refer to the topic [Using the Metrics API]({{< ref "/controller/analytics/metrics/metrics-api#understanding-the-metrics-api-response" >}}). {{< /see-also >}}   diff --git a/content/controller/analytics/events/view-events.md b/content/controller/analytics/events/view-events.md index fd4f93bf9..39babcac8 100644 --- a/content/controller/analytics/events/view-events.md +++ b/content/controller/analytics/events/view-events.md @@ -30,7 +30,7 @@ You can select from the following Event Categories: - Agent Status Events; - Controller Events; - Audit Events -- a log of all actions performed by NGINX Controller users; -- Forwarder Notifications -- events emitted by [Data Forwarders]({{< relref "/controller/analytics/forwarders/_index.md" >}}) +- Forwarder Notifications -- events emitted by [Data Forwarders]({{< ref "/controller/analytics/forwarders/_index.md" >}}) - Workload Health Events -- events emitted by the Controller Agent when the health of an upstream server changes; To view the logs for a specific category, select the category name from the **Event Categories** list. diff --git a/content/controller/analytics/forwarders/forward-analytics-to-datadog.md b/content/controller/analytics/forwarders/forward-analytics-to-datadog.md index ee02e3566..93527425e 100644 --- a/content/controller/analytics/forwarders/forward-analytics-to-datadog.md +++ b/content/controller/analytics/forwarders/forward-analytics-to-datadog.md @@ -16,7 +16,7 @@ Follow the steps in this guide to set up an F5 NGINX Controller Integration that This guide assumes that you are already an active Datadog user. If you haven't already done so, you will need to [install and configure Datadog](https://docs.datadoghq.com/) before you proceed. -You will also need to [Create an Integration]({{< relref "/controller/platform/integrations/datadog-integration.md" >}}) for your Datadog forwarder. +You will also need to [Create an Integration]({{< ref "/controller/platform/integrations/datadog-integration.md" >}}) for your Datadog forwarder. ## Create a Forwarder @@ -45,7 +45,7 @@ Take the following steps to create a Forwarder for Datadog: {{< important >}} -Each metric will be prefixed with a common namespace -- such as "nginx-controller" -- before it is sent to Datadog. This prefix is used by Datadog only and is not applied to any of the internal NGINX Controller metrics. Refer to the [metrics catalog]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) for the full list of valid metric names. +Each metric will be prefixed with a common namespace -- such as "nginx-controller" -- before it is sent to Datadog. This prefix is used by Datadog only and is not applied to any of the internal NGINX Controller metrics. Refer to the [metrics catalog]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) for the full list of valid metric names. For events, the "nginx-controller" namespace is added to the ["ddsource" key](https://docs.datadoghq.com/api/v1/logs/#send-logs). @@ -55,7 +55,7 @@ NGINX Controller events are sent to Datadog as logs and NGINX Controller dimensi {{< see-also >}} -See the [NGINX Controller Metrics]({{< relref "/controller/analytics/metrics/_index.md" >}}) docs for more information. +See the [NGINX Controller Metrics]({{< ref "/controller/analytics/metrics/_index.md" >}}) docs for more information. {{< /see-also >}} @@ -68,7 +68,7 @@ Soon after you create the Datadog forwarder, you can view the selected metrics i ## What's Next -- Refer to [Troubleshooting Forwaders]({{< relref "/controller/support/troubleshooting-forwarders.md" >}}) for tips on resolving common issues. +- Refer to [Troubleshooting Forwaders]({{< ref "/controller/support/troubleshooting-forwarders.md" >}}) for tips on resolving common issues. {{< versions "3.8" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/forwarders/forward-analytics-to-otlp.md b/content/controller/analytics/forwarders/forward-analytics-to-otlp.md index 42f63598a..ea705f2d9 100644 --- a/content/controller/analytics/forwarders/forward-analytics-to-otlp.md +++ b/content/controller/analytics/forwarders/forward-analytics-to-otlp.md @@ -16,7 +16,7 @@ Follow the steps in this guide to set up an F5 NGINX Controller integration that This guide assumes that you already have a working instance of any OpenTelemetry Collector. -You will also need to [Create an Integration]({{< relref "/controller/platform/integrations/otlp-integration.md" >}}) for your OpenTelemetry Collector forwarder. +You will also need to [Create an Integration]({{< ref "/controller/platform/integrations/otlp-integration.md" >}}) for your OpenTelemetry Collector forwarder. ## Create a Forwarder @@ -44,7 +44,7 @@ Take the following steps to create a forwarder for OpenTelemetry Collector: {{< important >}} -Each metric is prefixed with a common namespace -- for example, "nginx-controller" -- before it's sent to OpenTelemetry Collector. This prefix is used only by OpenTelemetry Collector and is not applied to any internal NGINX Controller metrics. Refer to the [metrics catalog]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) for the full list of valid metric names. +Each metric is prefixed with a common namespace -- for example, "nginx-controller" -- before it's sent to OpenTelemetry Collector. This prefix is used only by OpenTelemetry Collector and is not applied to any internal NGINX Controller metrics. Refer to the [metrics catalog]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) for the full list of valid metric names. We have tested compatability with OTLP collector v0.33.0. We will most likely support versions higher than this, assuming backwards compatability from OTLP. @@ -52,13 +52,13 @@ We have tested compatability with OTLP collector v0.33.0. We will most likely s {{< see-also >}} -See the [NGINX Controller Metrics]({{< relref "/controller/analytics/metrics/_index.md" >}}) docs for more information. +See the [NGINX Controller Metrics]({{< ref "/controller/analytics/metrics/_index.md" >}}) docs for more information. {{< /see-also >}} ## What's Next -- Refer to [Troubleshooting Forwaders]({{< relref "/controller/support/troubleshooting-forwarders.md" >}}) for tips on resolving common issues. +- Refer to [Troubleshooting Forwaders]({{< ref "/controller/support/troubleshooting-forwarders.md" >}}) for tips on resolving common issues. {{< versions "3.16" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/forwarders/forward-analytics-to-splunk.md b/content/controller/analytics/forwarders/forward-analytics-to-splunk.md index b2ac5883d..81d2cfcd2 100644 --- a/content/controller/analytics/forwarders/forward-analytics-to-splunk.md +++ b/content/controller/analytics/forwarders/forward-analytics-to-splunk.md @@ -16,7 +16,7 @@ Follow the steps in this guide to set up an F5 NGINX Controller Integration that This guide assumes that you are already an active Splunk user. If you haven't already done so, you will need to [install and configure Splunk](https://docs.splunk.com/Documentation) before you proceed. -You will also need to [Create an Integration]({{< relref "/controller/platform/integrations/splunk-integration.md" >}}) for your Splunk forwarder. +You will also need to [Create an Integration]({{< ref "/controller/platform/integrations/splunk-integration.md" >}}) for your Splunk forwarder. ## Create a Forwarder @@ -45,7 +45,7 @@ Take the following steps to create a Forwarder for Splunk: {{< important >}} -Each metric will be prefixed with a common namespace -- such as `nginx-controller` -- before it is sent to Splunk. This prefix is used by Splunk only and is not applied to any of the internal NGINX Controller metrics. Refer to the [metrics catalog]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) for the full list of valid metric names. +Each metric will be prefixed with a common namespace -- such as `nginx-controller` -- before it is sent to Splunk. This prefix is used by Splunk only and is not applied to any of the internal NGINX Controller metrics. Refer to the [metrics catalog]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) for the full list of valid metric names. In case of events, the "nginx-controller" namespace will be placed in the ["source" key](https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/FormateventsforHTTPEventCollector#Event_metadata) and sent with each event. @@ -53,13 +53,13 @@ In case of events, the "nginx-controller" namespace will be placed in the ["sour {{< see-also >}} -See the [NGINX Controller Metrics]({{< relref "/controller/analytics/metrics/_index.md" >}}) docs for more information. +See the [NGINX Controller Metrics]({{< ref "/controller/analytics/metrics/_index.md" >}}) docs for more information. {{< /see-also >}} ## What's Next -- Refer to [Troubleshooting Forwaders]({{< relref "/controller/support/troubleshooting-forwarders.md" >}}) for tips on resolving common issues. +- Refer to [Troubleshooting Forwaders]({{< ref "/controller/support/troubleshooting-forwarders.md" >}}) for tips on resolving common issues. {{< versions "3.6" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/forwarders/forward-analytics-to-syslog.md b/content/controller/analytics/forwarders/forward-analytics-to-syslog.md index 22e5cfa2e..669046a4d 100644 --- a/content/controller/analytics/forwarders/forward-analytics-to-syslog.md +++ b/content/controller/analytics/forwarders/forward-analytics-to-syslog.md @@ -18,7 +18,7 @@ This guide assumes that you already have a working instance of any syslog server If you haven't already done so, you can use an open-source version of [Syslog-NG](https://www.syslog-ng.com/products/open-source-log-management/). -You will also need to [Create an Integration]({{< relref "/controller/platform/integrations/syslog-integration.md" >}}) for your Syslog forwarder. +You will also need to [Create an Integration]({{< ref "/controller/platform/integrations/syslog-integration.md" >}}) for your Syslog forwarder. ## Create a Forwarder @@ -44,7 +44,7 @@ Take the following steps to create a Forwarder for Splunk: ## What's Next -- Refer to [Troubleshooting Forwaders]({{< relref "/controller/support/troubleshooting-forwarders.md" >}}) for tips on resolving common issues. +- Refer to [Troubleshooting Forwaders]({{< ref "/controller/support/troubleshooting-forwarders.md" >}}) for tips on resolving common issues. {{< versions "3.16" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/metrics/metrics-api.md b/content/controller/analytics/metrics/metrics-api.md index afedb9470..29f5cef7b 100644 --- a/content/controller/analytics/metrics/metrics-api.md +++ b/content/controller/analytics/metrics/metrics-api.md @@ -11,7 +11,7 @@ type: ## Overview -You can use the F5 NGINX Controller Analytics module to monitor your NGINX instances and evaluate your applications' performance. The [Metrics API]({{< relref "/controller/api/_index.md" >}}) query parameters let you fine-tune your system data based on parameters such as time window, aggregation, time resolution, and filter. +You can use the F5 NGINX Controller Analytics module to monitor your NGINX instances and evaluate your applications' performance. The [Metrics API]({{< ref "/controller/api/_index.md" >}}) query parameters let you fine-tune your system data based on parameters such as time window, aggregation, time resolution, and filter. By using different combinations of these query parameters, you can gather information that lets you: @@ -22,7 +22,7 @@ By using different combinations of these query parameters, you can gather inform ## Usage -You can use the NGINX Controller [Metrics API]({{< relref "/controller/api/_index.md" >}}) to query for desired metric names and fine-tune the data returned based on the following parameters: +You can use the NGINX Controller [Metrics API]({{< ref "/controller/api/_index.md" >}}) to query for desired metric names and fine-tune the data returned based on the following parameters: - time window (`startTime` and `endTime`) - `filter` @@ -38,7 +38,7 @@ Because NGINX Controller is constantly evolving, these example metrics and dimen ### Understanding the Metrics API Response -The [Metrics API]({{< relref "/controller/api/_index.md" >}}) response consists of query metadata and an array of `metrics` -- one array element for each queried metric. +The [Metrics API]({{< ref "/controller/api/_index.md" >}}) response consists of query metadata and an array of `metrics` -- one array element for each queried metric. - The **metric** object includes the queried metric name and an array of data series associated with the metric. - The **series** object groups metrics data according to dimension values. The series consists of dimensions (key-value map), timestamps, and the timestamps' metric values. @@ -102,7 +102,7 @@ Likewise, you can get a full list of the available dimensions by querying the Ca curl -X GET --cookie "session=" --url "{controller-IP}/api/v1/analytics/catalogs/dimensions" ``` -This information is also provided in the [Catalogs Reference]({{< relref "/controller/analytics/catalogs/_index.md" >}})). +This information is also provided in the [Catalogs Reference]({{< ref "/controller/analytics/catalogs/_index.md" >}})). ### Querying the Metrics API @@ -112,7 +112,7 @@ The examples progress from basic usage to more advanced API queries. #### Names -The `names` parameter is the only required parameter in the [Metrics API]({{< relref "/controller/api/_index.md" >}}). +The `names` parameter is the only required parameter in the [Metrics API]({{< ref "/controller/api/_index.md" >}}). The following example query returns a response with the last recorded value for the queried metric: `http.request.count`: @@ -178,7 +178,7 @@ You must define a `startTime` when using aggregate functions. {{< /note >}} {{< see-also >}} -The list of supported aggregate functions for any particular metric is available in the [Metrics Catalog]({{< relref "/controller/analytics/catalogs/metrics.md" >}})). +The list of supported aggregate functions for any particular metric is available in the [Metrics Catalog]({{< ref "/controller/analytics/catalogs/metrics.md" >}})). {{< /see-also >}} For example, the following query returns a single value (per dimension set), which is the sum of the metric values for the last three hours. To get proper values, ensure that the `endTime` is greater than the `startTime`. @@ -187,7 +187,7 @@ For example, the following query returns a single value (per dimension set), whi curl -X GET --cookie "session=" --url "{controller-IP}/api/v1/analytics/metrics?names=SUM(http.request.count)&startTime=now-3h" ``` -It is possible to use aggregated and non-aggregated metrics in a single query. For this query, the [Metrics API]({{< relref "/controller/api/_index.md" >}}) returns a single value per dimension set. That value is the sum of all of the metric's values for the last three hours. +It is possible to use aggregated and non-aggregated metrics in a single query. For this query, the [Metrics API]({{< ref "/controller/api/_index.md" >}}) returns a single value per dimension set. That value is the sum of all of the metric's values for the last three hours. For example: @@ -196,7 +196,7 @@ curl -X GET --cookie "session=" --url "{controller-IP}/api/v1/an ``` {{< important >}} -Using AVG aggregation with traffic metrics with the `.total` suffix may cause confusion because traffic metrics are already aggregated. To learn more, refer to the [Overview: Traffic Metrics]({{< relref "/controller/analytics/metrics/overview-traffic-metrics.md" >}})) topics. +Using AVG aggregation with traffic metrics with the `.total` suffix may cause confusion because traffic metrics are already aggregated. To learn more, refer to the [Overview: Traffic Metrics]({{< ref "/controller/analytics/metrics/overview-traffic-metrics.md" >}})) topics. {{< /important >}} #### Resolution @@ -470,9 +470,9 @@ You cannot use `dimensions` with the `seriesLimit` parameter. ## What's Next -- [Metrics Reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}})) -- [Dimensions Reference]({{< relref "/controller/analytics/catalogs/dimensions.md" >}})) -- [Create Custom Dashboards]({{< relref "/controller/analytics/dashboards/custom-dashboards.md" >}})) +- [Metrics Reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}})) +- [Dimensions Reference]({{< ref "/controller/analytics/catalogs/dimensions.md" >}})) +- [Create Custom Dashboards]({{< ref "/controller/analytics/dashboards/custom-dashboards.md" >}})) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/metrics/overview-metrics-metadata.md b/content/controller/analytics/metrics/overview-metrics-metadata.md index 871ea09a0..cec6969a1 100644 --- a/content/controller/analytics/metrics/overview-metrics-metadata.md +++ b/content/controller/analytics/metrics/overview-metrics-metadata.md @@ -25,7 +25,7 @@ Metrics are published at a regular interval of 60 or 30 seconds for system and t This topic gives an overview of the traffic metrics. Also known as "app-centric" metrics, traffic metrics contain information that lets you easily identify the App to which the data applies. {{< see-also >}} -Refer to [View traffic metrics]({{< relref "/controller/analytics/metrics/view-traffic-metrics.md" >}}) for instructions on how to view traffic metrics using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}). +Refer to [View traffic metrics]({{< ref "/controller/analytics/metrics/view-traffic-metrics.md" >}}) for instructions on how to view traffic metrics using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}). {{< /see-also >}} ## Metadata and Metrics That Are Reported @@ -38,7 +38,7 @@ The NGINX Controller Agent collects the following types of data: - **NGINX metadata.** These describe your NGINX instances, and include package data, build information, the path to the binary, build configuration options, and so on. NGINX metadata also includes the NGINX configuration elements. - **System metadata.** These are the basic information about the OS environment where the Agent runs. For example, the hostname, uptime, OS flavor, and other data. -For the full list of metrics, see the [Metrics Catalog Reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) +For the full list of metrics, see the [Metrics Catalog Reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) ## Metrics Collection and Reporting Process @@ -63,16 +63,16 @@ If the Agent cannot reach the Controller server to send the accumulated metrics, The Agent is able to automatically find all relevant NGINX configuration files, parse them, extract their logical structure, and send the associated JSON data to the Controller Server for further analysis and reporting. -To parse SSL certificate metadata, the NGINX Controller Agent uses standard `openssl`(1) functions. SSL certificates are parsed and analyzed only when the corresponding [Agent settings]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md#default-agent-settings" >}}) are turned on. SSL certificate analysis is `off` by default. +To parse SSL certificate metadata, the NGINX Controller Agent uses standard `openssl`(1) functions. SSL certificates are parsed and analyzed only when the corresponding [Agent settings]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md#default-agent-settings" >}}) are turned on. SSL certificate analysis is `off` by default. ## Troubleshooting -Most metrics are collected by the Agent without requiring the user to perform any additional setup. For troubleshooting instructions, see [Troubleshooting NGINX Controller Metrics]({{< relref "/controller/support/troubleshooting-controller.md" >}}). +Most metrics are collected by the Agent without requiring the user to perform any additional setup. For troubleshooting instructions, see [Troubleshooting NGINX Controller Metrics]({{< ref "/controller/support/troubleshooting-controller.md" >}}). ## What's Next -- [Set up Metrics Collection]({{< relref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) -- [Metrics Reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) +- [Set up Metrics Collection]({{< ref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) +- [Metrics Reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/analytics/metrics/overview-traffic-metrics.md b/content/controller/analytics/metrics/overview-traffic-metrics.md index 769df0714..b1d871a6d 100644 --- a/content/controller/analytics/metrics/overview-traffic-metrics.md +++ b/content/controller/analytics/metrics/overview-traffic-metrics.md @@ -25,7 +25,7 @@ Metrics are published at a regular interval of 60 or 30 seconds for system and t This topic gives an overview of the traffic metrics. Also known as "app-centric" metrics, traffic metrics contain information that lets you easily identify the App to which the data applies. {{< see-also >}} -Refer to [View traffic metrics]({{< relref "/controller/analytics/metrics/view-traffic-metrics.md" >}}) for instructions on how to view traffic metrics using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}). +Refer to [View traffic metrics]({{< ref "/controller/analytics/metrics/view-traffic-metrics.md" >}}) for instructions on how to view traffic metrics using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}). {{< /see-also >}} ## Available traffic metrics @@ -43,7 +43,7 @@ Refer to [View traffic metrics]({{< relref "/controller/analytics/metrics/view-t - `http.request.count` {{< see-also >}} -Refer to the [NGINX Controller Metrics Catalog]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) for details about these and the other metrics that NGINX Controller reports. +Refer to the [NGINX Controller Metrics Catalog]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) for details about these and the other metrics that NGINX Controller reports. {{< /see-also>}} ## Calculating traffic metrics diff --git a/content/controller/analytics/metrics/view-traffic-metrics.md b/content/controller/analytics/metrics/view-traffic-metrics.md index 8dd7202e3..b63268ff9 100644 --- a/content/controller/analytics/metrics/view-traffic-metrics.md +++ b/content/controller/analytics/metrics/view-traffic-metrics.md @@ -11,11 +11,11 @@ type: ## Overview -This topic explains how to use the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) +This topic explains how to use the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to view traffic metrics. {{< see-also >}} -Refer to [Overview: Traffic Metrics]({{< relref "/controller/analytics/metrics/overview-traffic-metrics.md" >}}) to learn how NGINX Controller collects, aggregates, and reports traffic metrics. +Refer to [Overview: Traffic Metrics]({{< ref "/controller/analytics/metrics/overview-traffic-metrics.md" >}}) to learn how NGINX Controller collects, aggregates, and reports traffic metrics. {{< /see-also >}} ## Before You Begin @@ -24,11 +24,11 @@ To view traffic metrics, first confirm that you've correctly configured NGINX Co The following resources should have the status `Configured`: -- [Environment]({{< relref "/controller/services/manage-environments.md" >}}) -- [Gateway]({{< relref "/controller/services/manage-gateways.md" >}}) -- [App and Component]({{< relref "/controller/app-delivery/manage-apps.md" >}}) +- [Environment]({{< ref "/controller/services/manage-environments.md" >}}) +- [Gateway]({{< ref "/controller/services/manage-gateways.md" >}}) +- [App and Component]({{< ref "/controller/app-delivery/manage-apps.md" >}}) -Initially, the graphs will display `No data yet`, and querying the Metrics API for traffic metrics will result in an empty response. As soon as the Component starts to receive traffic, the traffic-related data will be displayed in the graphs and the [Dashboards]({{< relref "/controller/analytics/dashboards/overview-dashboard.md" >}}) in the NGINX Controller user interface and will be returned in API responses. +Initially, the graphs will display `No data yet`, and querying the Metrics API for traffic metrics will result in an empty response. As soon as the Component starts to receive traffic, the traffic-related data will be displayed in the graphs and the [Dashboards]({{< ref "/controller/analytics/dashboards/overview-dashboard.md" >}}) in the NGINX Controller user interface and will be returned in API responses. {{< note >}} If traffic stops flowing to a resource (for example, an Application or Component), then no traffic metrics will be available for the resource. @@ -55,7 +55,7 @@ If traffic stops flowing to a resource (for example, an Application or Component ``` {{< see-also >}} -Refer to the [Catalogs Reference]({{< relref "/controller/analytics/catalogs/_index.md" >}}) for information about all of the dimensions and metrics collected by NGINX Controller. +Refer to the [Catalogs Reference]({{< ref "/controller/analytics/catalogs/_index.md" >}}) for information about all of the dimensions and metrics collected by NGINX Controller. {{< /see-also >}} ## Example REST API Queries for Traffic Metrics diff --git a/content/controller/analytics/view-app-security-analytics.md b/content/controller/analytics/view-app-security-analytics.md index f029f0667..c26533250 100644 --- a/content/controller/analytics/view-app-security-analytics.md +++ b/content/controller/analytics/view-app-security-analytics.md @@ -14,7 +14,7 @@ type: When App Security flags or blocks a request made to an App Component as a security violation, it generates an App Security event. You can use the F5 NGINX Controller web interface or the REST API to view these events or their related statistics (measures). Metrics reflect the number of requests and bytes flagged or blocked. You can use the Security Violation Dimensions to help understand and interpret the analytics data. -For descriptions of Security Metrics and Events Dimensions, refer to [About App Security]({{< relref "/controller/app-delivery/security/concepts/what-is-waf.md" >}}) page. +For descriptions of Security Metrics and Events Dimensions, refer to [About App Security]({{< ref "/controller/app-delivery/security/concepts/what-is-waf.md" >}}) page. ## View App Security Analytics @@ -265,7 +265,7 @@ This is important if you are using App Security WAF monitoring only mode. You ca ## Related Pages -- [About App Security]({{< relref "/controller/app-delivery/security/concepts/what-is-waf.md" >}}) +- [About App Security]({{< ref "/controller/app-delivery/security/concepts/what-is-waf.md" >}}) {{< versions "3.11" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/api-management/manage-apis.md b/content/controller/api-management/manage-apis.md index c64a0cbaf..a16e213ac 100644 --- a/content/controller/api-management/manage-apis.md +++ b/content/controller/api-management/manage-apis.md @@ -21,7 +21,7 @@ The F5 NGINX Controller API Management module provides full life cycle managemen {{< note >}} - You must have an API Management module license installed to complete the steps in this guide. -- The API Management module is available to users with the predefined [Admin or User Roles]({{< relref "/controller/platform/access-management/manage-roles.md#predefined-roles-and-role-groups" >}}). +- The API Management module is available to users with the predefined [Admin or User Roles]({{< ref "/controller/platform/access-management/manage-roles.md#predefined-roles-and-role-groups" >}}). {{< /note >}} @@ -248,18 +248,18 @@ Take the following steps to **Edit** add your API Version: You need at least one of each of the resources listed below to complete this section. If you haven't already created the required resources, you can do so while configuring the Published API. -- [Environment]({{< relref "/controller/services/manage-environments.md" >}}) +- [Environment]({{< ref "/controller/services/manage-environments.md" >}}) -- [Gateway]({{< relref "/controller/services/manage-gateways.md" >}}) +- [Gateway]({{< ref "/controller/services/manage-gateways.md" >}}) -- [App]({{< relref "/controller/app-delivery/manage-apps.md" >}}) +- [App]({{< ref "/controller/app-delivery/manage-apps.md" >}}) -- [Identity Provider]({{< relref "/controller/services/manage-identity-providers.md" >}}) +- [Identity Provider]({{< ref "/controller/services/manage-identity-providers.md" >}})  (required to add Authentication to the Published API Component). {{< tip >}} -You can connect one or more [Developer Portals]({{< relref "/controller/api-management/manage-dev-portals.md" >}}) to your Published API to host your API documentation. This can be done either when creating or editing your Published API, or independently via the API Quick Actions menu. +You can connect one or more [Developer Portals]({{< ref "/controller/api-management/manage-dev-portals.md" >}}) to your Published API to host your API documentation. This can be done either when creating or editing your Published API, or independently via the API Quick Actions menu. {{< /tip >}} ### Add a Published API @@ -353,7 +353,7 @@ On the **Create Published API** *Routing* page: 8. Select **Next**. {{< see-also >}} - - Refer to the [Manage Locations]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}) topic for more information. + - Refer to the [Manage Locations]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}) topic for more information. - Refer to the [NGINX Plus Admin Guide](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/) for more information about the available options. @@ -379,11 +379,11 @@ On the **Create Published API** *Routing* page: 1. Select **Add Authentication**. - 2. Select an [**Identity Provider**]({{< relref "/controller/services/manage-identity-providers.md" >}}). + 2. Select an [**Identity Provider**]({{< ref "/controller/services/manage-identity-providers.md" >}}). 3. Select a **Credential Location**. - 1. (Optional) Enable [**Conditional Access**]({{< relref "/controller/services/available-policies.md#conditional-access" >}}). + 1. (Optional) Enable [**Conditional Access**]({{< ref "/controller/services/available-policies.md#conditional-access" >}}). 4. Select **Next**. @@ -397,13 +397,13 @@ The **Advanced Security** features require an *NGINX Controller API Management A 1. (Optional) Select **Enable Web Application Firewall (WAF)** to monitor and block suspicious requests or attacks. - 2. (Optional) Select **Monitor Only** to allow traffic to pass without being rejected. Security events are still generated and metrics are still collected. Refer to [About App Security Analytics]({{< relref "/controller/analytics/view-app-security-analytics.md" >}}) for more information. + 2. (Optional) Select **Monitor Only** to allow traffic to pass without being rejected. Security events are still generated and metrics are still collected. Refer to [About App Security Analytics]({{< ref "/controller/analytics/view-app-security-analytics.md" >}}) for more information. 3. (Optional) Add the signature(s) that you want WAF to ignore. You can specify multiple signatures as a comma-separated list. 4. Select **Next** - {{< see-also >}} Refer to the [Default WAF Policy]({{< relref "/controller/app-delivery/security/concepts/app-sec-default-policy-original.md" >}}) topics to learn more about the default protection provided by NGINX App Protect. {{< /see-also >}} + {{< see-also >}} Refer to the [Default WAF Policy]({{< ref "/controller/app-delivery/security/concepts/app-sec-default-policy-original.md" >}}) topics to learn more about the default protection provided by NGINX App Protect. {{< /see-also >}} 7. On the **Create App Component** *Ingress* page: @@ -499,7 +499,7 @@ The **Advanced Security** features require an *NGINX Controller API Management A Once you have created an API Definition and a Published API, you can host your API in a Developer Portal. -From the **API Definitions** page, select **Create Dev Portal** from the Quick Actions menu. Then, follow the steps in [Create a Developer Portal]({{< relref "/controller/api-management/manage-dev-portals.md" >}}) to create, customize, and publish your Dev Portal. +From the **API Definitions** page, select **Create Dev Portal** from the Quick Actions menu. Then, follow the steps in [Create a Developer Portal]({{< ref "/controller/api-management/manage-dev-portals.md" >}}) to create, customize, and publish your Dev Portal. {{< versions "3.0" "3.18" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/api-management/manage-dev-portals.md b/content/controller/api-management/manage-dev-portals.md index 9d2dd388a..3caa8b685 100644 --- a/content/controller/api-management/manage-dev-portals.md +++ b/content/controller/api-management/manage-dev-portals.md @@ -10,7 +10,7 @@ type: ## Overview -You can use F5 NGINX Controller Developer Portals (also called 'Dev Portals') to create and manage beautiful, easy-to-use API reference documentation to support your [Published APIs]({{< relref "/controller/api-management/manage-apis.md#publish-an-api" >}}). +You can use F5 NGINX Controller Developer Portals (also called 'Dev Portals') to create and manage beautiful, easy-to-use API reference documentation to support your [Published APIs]({{< ref "/controller/api-management/manage-apis.md#publish-an-api" >}}). ## About Developer Portals @@ -22,8 +22,8 @@ Each Dev Portal is associated with a Gateway, which defines the URI at which use You must complete the steps below before you can create a Developer Portal. -1. [Create an Environment]({{< relref "/controller/services/manage-environments.md" >}}). -1. [Create a Gateway]({{< relref "/controller/services/manage-gateways.md" >}}) for the Dev Portal. +1. [Create an Environment]({{< ref "/controller/services/manage-environments.md" >}}). +1. [Create a Gateway]({{< ref "/controller/services/manage-gateways.md" >}}) for the Dev Portal. {{< tip >}} You can create multiple Dev Portal Gateways on the same Instance. If you do so, be sure to use a unique hostname and port for each. For example: @@ -35,22 +35,22 @@ You can create multiple Dev Portal Gateways on the same Instance. If you do so, If you create multiple Dev Portal Gateways on the same Instance using the same hostname and port, the Dev Portal configuration will fail. {{< /tip >}} -1. [Create an API Definition]({{< relref "/controller/api-management/manage-apis.md#create-an-api-definition" >}}). +1. [Create an API Definition]({{< ref "/controller/api-management/manage-apis.md#create-an-api-definition" >}}). {{< tip >}} -If you choose to [define your API manually]({{< relref "/controller/api-management/manage-apis.md#define-resources-manually" >}}), be sure to [document your API]({{< relref "/controller/api-management/manage-apis.md#document-your-api" >}}). +If you choose to [define your API manually]({{< ref "/controller/api-management/manage-apis.md#define-resources-manually" >}}), be sure to [document your API]({{< ref "/controller/api-management/manage-apis.md#document-your-api" >}}). {{< /tip >}} -1. [Create a Published API]({{< relref "/controller/api-management/manage-apis.md#publish-an-api" >}}). +1. [Create a Published API]({{< ref "/controller/api-management/manage-apis.md#publish-an-api" >}}). {{< important >}} -You must create an App Component when creating a Published API. You'll [assign routes]({{< relref "/controller/api-management/manage-apis.md#define-the-routing-rules" >}}) from the API Definition to this Component. +You must create an App Component when creating a Published API. You'll [assign routes]({{< ref "/controller/api-management/manage-apis.md#define-the-routing-rules" >}}) from the API Definition to this Component. Both the Published API and the associated App Component must be successfully created before you can create a Dev Portal. -See [Manage Your APIs]({{< relref "/controller/api-management/manage-apis.md" >}}) and the [troubleshooting](#troubleshoot-dev-portal-publication) section below for more information. +See [Manage Your APIs]({{< ref "/controller/api-management/manage-apis.md" >}}) and the [troubleshooting](#troubleshoot-dev-portal-publication) section below for more information. -You also have the option to associate Dev Portal(s) in the *Deployment* page when you [Add a Published API]({{< relref "/controller/api-management/manage-apis.md#add-a-published-api" >}}). If you already have a Published API and you want to create a new Dev Portal to host it, complete the tasks described in this guide. +You also have the option to associate Dev Portal(s) in the *Deployment* page when you [Add a Published API]({{< ref "/controller/api-management/manage-apis.md#add-a-published-api" >}}). If you already have a Published API and you want to create a new Dev Portal to host it, complete the tasks described in this guide. {{< /important >}} @@ -64,7 +64,7 @@ To create a Dev Portal, take the steps below: 4. On the APIs page, select **Create Dev Portal** from the Quick Actions menu. {{< tip >}} -If you want to connect one or more Dev Portals to an existing Published API, you should select the **Edit Published API** option. The API Documentation will be published to the selected Dev Portal(s). Refer to the [Define the Published API Deployment]({{< relref "/controller/api-management/manage-apis.md#define-the-published-api-deployment" >}}) section for more information and instructions. +If you want to connect one or more Dev Portals to an existing Published API, you should select the **Edit Published API** option. The API Documentation will be published to the selected Dev Portal(s). Refer to the [Define the Published API Deployment]({{< ref "/controller/api-management/manage-apis.md#define-the-published-api-deployment" >}}) section for more information and instructions. {{< /tip >}} ### Configure the Developer Portal @@ -131,8 +131,8 @@ If the issue persists, check the other resources for configuration errors. ## What's Next -- [Learn about Policies]({{< relref "available-policies.md" >}}) -- [Manage Your APIs]({{< relref "manage-apis.md" >}}) +- [Learn about Policies]({{< ref "/controller/services/available-policies.md" >}}) +- [Manage Your APIs]({{< relref "./manage-apis.md" >}}) {{< versions "3.7" "3.18" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/api/overview.md b/content/controller/api/overview.md index 70213cd1f..c5812a63e 100644 --- a/content/controller/api/overview.md +++ b/content/controller/api/overview.md @@ -57,13 +57,13 @@ The diagram below shows a sample deployment workflow. In this workflow, the user {{< see-also >}} -- [Managing Roles & Users]({{< relref "/controller/platform/access-management/manage-users.md" >}}) +- [Managing Roles & Users]({{< ref "/controller/platform/access-management/manage-users.md" >}}) {{< /see-also >}} ## Authentication -The NGINX Controller API uses session cookies to authenticate requests. The session cookie is returned in response to a `GET /api/v1/platform/login` request. See the Login endpoint in the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}) documentation for information about session cookie timeouts and invalidation. +The NGINX Controller API uses session cookies to authenticate requests. The session cookie is returned in response to a `GET /api/v1/platform/login` request. See the Login endpoint in the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}) documentation for information about session cookie timeouts and invalidation. {{< tip >}} You can send a GET request to the login endpoint to find the status of the session token. diff --git a/content/controller/app-delivery/about-app-delivery.md b/content/controller/app-delivery/about-app-delivery.md index b87308017..e63b24722 100644 --- a/content/controller/app-delivery/about-app-delivery.md +++ b/content/controller/app-delivery/about-app-delivery.md @@ -10,7 +10,7 @@ weight: 100 In F5 NGINX Controller, an App serves as a container for one or more Components. Components represent the backend services that comprise your application. Together, an App and its Components represent the logical partitioning of your application into its composite parts. For example, a Component might correspond to a particular microservice within your application. Each Component you add to an App represents one or more paths via which traffic can reach that microservice. -All Apps and Components live within an [Environment]({{< relref "/controller/services/manage-environments.md" >}}). This means that in order to have access to a particular App, a User needs to have permission to access its Environment. If you need access to an Environment or App, contact your administrator. +All Apps and Components live within an [Environment]({{< ref "/controller/services/manage-environments.md" >}}). This means that in order to have access to a particular App, a User needs to have permission to access its Environment. If you need access to an Environment or App, contact your administrator. ## Components @@ -18,7 +18,7 @@ A Component is a child object of an App. Components let you partition an App int Each Component contains an ingress definition that includes the fully-qualified domain names (FQDNs) and URIs from clients. These ingress definitions associate incoming requests with a particular path; the certificates that are used for decryption/encryption of HTTPS requests and responses that traverse that path; the backend servers that host the App to which the path delivers the requests; and the rewrites, redirects, and modifications on the requests/responses that occur along the path. -Components can be instantiated on multiple paths corresponding to the placements associated with the Component; these placements are defined within the [Gateway(s)]({{< relref "/controller/services/manage-gateways.md" >}}) referenced in the Component. +Components can be instantiated on multiple paths corresponding to the placements associated with the Component; these placements are defined within the [Gateway(s)]({{< ref "/controller/services/manage-gateways.md" >}}) referenced in the Component. ## Inherited or Independent Resources @@ -28,7 +28,7 @@ When you configure a Component, you can choose to: - create and define new resources and configurations specific to the Component; or - use a combination of inherited and Component-specific configurations. -For example, a Gateway's ingress definition might include the URIs for a Service's FQDN(s) and the associated TLS [certificates]({{< relref "/controller/services/manage-certs.md" >}}), while the Component's ingress definition would contain relative URIs for the FQDN defined in the Gateway: +For example, a Gateway's ingress definition might include the URIs for a Service's FQDN(s) and the associated TLS [certificates]({{< ref "/controller/services/manage-certs.md" >}}), while the Component's ingress definition would contain relative URIs for the FQDN defined in the Gateway: - Gateway Ingress URIs: `www.example.com` - Component Ingress URIs: `/about/`, `/docs/`, `/contact/` diff --git a/content/controller/app-delivery/about-caching.md b/content/controller/app-delivery/about-caching.md index b314231c4..e4b39ef17 100644 --- a/content/controller/app-delivery/about-caching.md +++ b/content/controller/app-delivery/about-caching.md @@ -30,7 +30,7 @@ When you use the UI or the REST API to create a single disk store, NGINX Control - [`proxy_cache_path`](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_path), in the top-level `http` context; - [`proxy_cache`](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache), added to the component's `location` block. -You can include NGINX Controller Caching data when creating [custom dashboards]({{< relref "/controller/analytics/dashboards/custom-dashboards" >}}) and [alerts]({{< relref "/controller/analytics/alerts/manage-alerts" >}}) for your applications. +You can include NGINX Controller Caching data when creating [custom dashboards]({{< ref "/controller/analytics/dashboards/custom-dashboards" >}}) and [alerts]({{< ref "/controller/analytics/alerts/manage-alerts" >}}) for your applications. ## Cache Splitting diff --git a/content/controller/app-delivery/about-snippets.md b/content/controller/app-delivery/about-snippets.md index 17cd6506b..8afb6b974 100644 --- a/content/controller/app-delivery/about-snippets.md +++ b/content/controller/app-delivery/about-snippets.md @@ -385,7 +385,7 @@ For example, if you enable remote logging for errors at the `main` level, and yo You can use Snippets to manage IPv6 addresses for HTTP and TCP/UDP use cases. IPv6 address management is supported in both Gateway and Component Snippets. - Be sure to set the `reuseport` option for all IPv6 listen directives. Failure to do so can cause bind errors. -- NGINX Controller's post-processing logic removes the `reuseport` option in certain cases. This is a [known issue]({{< relref "/controller/releases/adc/adc-release-notes-3.22.md" >}}) when the IPv6 port matches an IPv4 port and the IPv4 listen directive does not specify an IP address (in other words, a wildcard IP). To change the IPv6 listen directive's IP address, remove the Snippet, then re-add the Snippet with a new IPv6 address. +- NGINX Controller's post-processing logic removes the `reuseport` option in certain cases. This is a [known issue]({{< ref "/controller/releases/adc/adc-release-notes-3.22.md" >}}) when the IPv6 port matches an IPv4 port and the IPv4 listen directive does not specify an IP address (in other words, a wildcard IP). To change the IPv6 listen directive's IP address, remove the Snippet, then re-add the Snippet with a new IPv6 address. If you need to support IPv6 addresses for the NGINX listen directive, you can use a snippet similar to the ones shown below to achieve it. @@ -557,8 +557,8 @@ The `reuseport` parameter creates an individual listening socket for each worker ## Extend App Security with Snippets -When adding [NGINX Controller App Security]({{< relref "add-app-security-with-waf" >}}) to your components, you can use Snippets to add NGINX App Protect directives that aren't represented in the NGINX Controller API. You can also use Snippets to [tune your NGINX App Protect WAF performance]({{< relref "/controller/app-delivery/security/tutorials/tune-waf-for-app" >}}). +When adding [NGINX Controller App Security]({{< ref "add-app-security-with-waf" >}}) to your components, you can use Snippets to add NGINX App Protect directives that aren't represented in the NGINX Controller API. You can also use Snippets to [tune your NGINX App Protect WAF performance]({{< ref "/controller/app-delivery/security/tutorials/tune-waf-for-app" >}}). -Refer to [Extend App Security with Snippets]({{< relref "extend-app-security-snippets" >}}) for more information and examples. +Refer to [Extend App Security with Snippets]({{< ref "extend-app-security-snippets" >}}) for more information and examples. {{< versions "3.22" "latest" "adcvers" >}} diff --git a/content/controller/app-delivery/deploy-simple-app.md b/content/controller/app-delivery/deploy-simple-app.md index e6fc7ad8d..999742480 100644 --- a/content/controller/app-delivery/deploy-simple-app.md +++ b/content/controller/app-delivery/deploy-simple-app.md @@ -16,8 +16,8 @@ This topic provides an overview of the steps required to create a simple applica First, you'll need to create an Environment. -- [About Environments]({{< relref "/controller/services/manage-environments.md#about-environments" >}}) -- [Create an Environment]({{< relref "/controller/services/manage-environments.md#create-an-environment" >}}) +- [About Environments]({{< ref "/controller/services/manage-environments.md#about-environments" >}}) +- [Create an Environment]({{< ref "/controller/services/manage-environments.md#create-an-environment" >}}) ## Create a Certificate @@ -27,36 +27,36 @@ If you just want to deploy a simple HTTP application, skip ahead to [Gateways](# {{< tip >}} Make sure that you add the new Cert to the Environment that you created in the previous step.{{< /tip >}} -- [About Certificates]({{< relref "/controller/services/manage-certs.md#about-certificates" >}}) -- [Create a certificate]({{< relref "/controller/services/manage-certs.md#create-a-cert" >}}) +- [About Certificates]({{< ref "/controller/services/manage-certs.md#about-certificates" >}}) +- [Create a certificate]({{< ref "/controller/services/manage-certs.md#create-a-cert" >}}) ## Create a Gateway Next, you'll need to create a Gateway. Be sure to add the Gateway to your Environment. -- [About Gateways]({{< relref "/controller/services/manage-gateways.md#about-gateways" >}}) -- [Create a Gateway]({{< relref "/controller/services/manage-gateways.md#create-a-gateway" >}}) +- [About Gateways]({{< ref "/controller/services/manage-gateways.md#about-gateways" >}}) +- [Create a Gateway]({{< ref "/controller/services/manage-gateways.md#create-a-gateway" >}}) ## Create an Identity Provider If you require authentication for any Component, you need to define an Identity Provider. The provider should be in the same environment as your component. to be in the same environment as your components. -- [Identity Provider]({{< relref "/controller/services/manage-identity-providers.md" >}}) +- [Identity Provider]({{< ref "/controller/services/manage-identity-providers.md" >}}) ## Create an App Create an App. The App needs to be in your Environment and needs to connect to your Gateway. If you created a Cert by following the instructions above and added the Cert to the Gateway, the App will access the Cert via the Gateway. If you didn't add the Cert to the Gateway, you can reference the Cert in the App's definition by choosing the Cert from the Certs list. -- [About Apps]({{< relref "/controller/app-delivery/about-app-delivery.md#apps" >}}) -- [Create an App]({{< relref "/controller/app-delivery/manage-apps.md#create-an-app" >}}) +- [About Apps]({{< ref "/controller/app-delivery/about-app-delivery.md#apps" >}}) +- [Create an App]({{< ref "/controller/app-delivery/manage-apps.md#create-an-app" >}}) ## Create Components for your App Finally, create Components for your App. Components let you partition an App into smaller, self-contained pieces that are each responsible for a particular function of the overall application. For example, a Component could correspond to a microservice that, together with several other microservices, comprises a complete application. -- [About Components]({{< relref "/controller/app-delivery/about-app-delivery.md#components" >}}) -- [Create a Component]({{< relref "/controller/app-delivery/manage-apps.md#create-a-component" >}}) +- [About Components]({{< ref "/controller/app-delivery/about-app-delivery.md#components" >}}) +- [Create a Component]({{< ref "/controller/app-delivery/manage-apps.md#create-a-component" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.20" "latest" "adcvers" >}} diff --git a/content/controller/app-delivery/manage-apps.md b/content/controller/app-delivery/manage-apps.md index 3a34403b9..da56c055d 100644 --- a/content/controller/app-delivery/manage-apps.md +++ b/content/controller/app-delivery/manage-apps.md @@ -12,12 +12,12 @@ type: Follow the steps in this topic to learn how to create and manage Apps and App Components. -{{< tip >}}You can also use the F5 NGINX Controller API to create Apps and Components. See the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}) for details.{{< /tip >}} +{{< tip >}}You can also use the F5 NGINX Controller API to create Apps and Components. See the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}) for details.{{< /tip >}}   ## Before You Begin -You will need to select an [Environment]({{< relref "/controller/services/manage-environments.md#create-an-environment" >}}) and [Gateway]({{< relref "/controller/services/manage-gateways.md#create-a-gateway" >}}) -- or create new Environment and Gateway resources -- when adding a new App. +You will need to select an [Environment]({{< ref "/controller/services/manage-environments.md#create-an-environment" >}}) and [Gateway]({{< ref "/controller/services/manage-gateways.md#create-a-gateway" >}}) -- or create new Environment and Gateway resources -- when adding a new App. {{< note >}}If you do not have permission to create these resources and none are available to select, contact your system administrator.{{< /note >}}   @@ -144,7 +144,7 @@ On the **Create App Component** *Workload Groups* page: The location determines which instances or instance groups the workload group is applied to. If any workload group specifies a location, they all must specify a location. Note: If the associated gateway uses instance groups, the location should refer to the instance group location, not the location(s) of the individual instances that make up that group. - {{< see-also >}}Refer to the [Manage Locations]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}) topic for more information.{{< /see-also >}} + {{< see-also >}}Refer to the [Manage Locations]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}) topic for more information.{{< /see-also >}} 1. Define the backend workload URIs. 1. (Optional) Define the DNS Server. 1. (Optional) Select the Load Balancing Method. The default value is "Round Robin". @@ -288,7 +288,7 @@ On the **Create App Component** *Caching* page: Introduced in NGINX Controller App Delivery module v3.22. {{< /note >}} -Refer to the [About Snippets]({{< relref "/controller/app-delivery/about-snippets.md" >}}) topic to learn more about Snippets and how they impact the NGINX Controller-generated `nginx.conf` file. +Refer to the [About Snippets]({{< ref "/controller/app-delivery/about-snippets.md" >}}) topic to learn more about Snippets and how they impact the NGINX Controller-generated `nginx.conf` file. On the **Create App Component** *Snippets* page: @@ -327,9 +327,9 @@ On the **Create App Component** *Rate Limiting* page: On the **Create App Component** *Authentication* page: 1. Select **Add Authentication**. -1. Select an [**Identity Provider**]({{< relref "/controller/services/manage-identity-providers.md" >}}). +1. Select an [**Identity Provider**]({{< ref "/controller/services/manage-identity-providers.md" >}}). 1. Select a **Credential Location**. -1. (Optional) Enable [**Conditional Access**]({{< relref "/controller/services/available-policies.md#conditional-access" >}}). +1. (Optional) Enable [**Conditional Access**]({{< ref "/controller/services/available-policies.md#conditional-access" >}}). 1. Select **Next**. ### Security @@ -339,12 +339,12 @@ On the **Create App Component** *Security* page: {{< note >}} The following Security settings are applicable only to Web components. {{< /note >}} 1. (Optional) Select **Enable Web Application Firewall (WAF)** to watch for or block suspicious requests or attacks. -1. (Optional) Select **Monitor Only** to allow traffic to pass without being rejected. Security events are still generated and metrics are still collected. Refer to [About App Security Analytics]({{< relref "/controller/analytics/view-app-security-analytics.md#overview" >}}) for more information. +1. (Optional) Select **Monitor Only** to allow traffic to pass without being rejected. Security events are still generated and metrics are still collected. Refer to [About App Security Analytics]({{< ref "/controller/analytics/view-app-security-analytics.md#overview" >}}) for more information. 1. (Optional) the signature(s) that you want the WAF to ignore. You can specify multiple signatures as a comma-separated list. 1. Select **Next**. {{< see-also >}} -Refer to the [Secure Your Apps]({{< relref "/controller/app-delivery/security/_index.md" >}}) topics to learn more about WAF and the default protections provided by NGINX App Protect. +Refer to the [Secure Your Apps]({{< ref "/controller/app-delivery/security/_index.md" >}}) topics to learn more about WAF and the default protections provided by NGINX App Protect. {{< /see-also >}} ## Edit or Delete Apps and Components diff --git a/content/controller/app-delivery/security/concepts/bring-your-own-policy.md b/content/controller/app-delivery/security/concepts/bring-your-own-policy.md index fb97b2a33..2441867ff 100644 --- a/content/controller/app-delivery/security/concepts/bring-your-own-policy.md +++ b/content/controller/app-delivery/security/concepts/bring-your-own-policy.md @@ -28,7 +28,7 @@ With a BYO NGINX App Protect policy, you can also provide customized security by ## Security Strategy for BYO NGINX App Protect Policy -The BYO NGINX App Protect policy uses the concept of a [Security Strategy]({{< relref "/controller/app-delivery/security/concepts/what-is-waf.md#security-policy-and-security-strategy" >}}) +The BYO NGINX App Protect policy uses the concept of a [Security Strategy]({{< ref "/controller/app-delivery/security/concepts/what-is-waf.md#security-policy-and-security-strategy" >}}) With the BYO NGINX App Protect policy feature, you can specify the exact NGINX App Protect policy for the Security Strategy. Then, the Security Strategy can be shared across -- and referenced by -- multiple app components. A Security Strategy can be comprised of various app-security-related Security Policies. NGINX Controller includes a custom NGINX App Protect WAF policy, which can be assigned to a Security Strategy. @@ -38,7 +38,7 @@ You can also add a BYO NGINX App Protect WAF policy in JSON format to NGINX Cont An **App Component** contains a reference to a **Security Strategy**, which, in turn, references a Security Policy. This Security Policy contains the **NGINX App Protect WAF policy**. -Refer to the topic [Enable WAF for a Component Using Your Own NGINX App Protect Policy]({{< relref "/controller/app-delivery/security/tutorials/add-app-security-with-waf.md#enable-waf-for-a-component-using-your-own-nap-policy-beta" >}}) to get started. +Refer to the topic [Enable WAF for a Component Using Your Own NGINX App Protect Policy]({{< ref "/controller/app-delivery/security/tutorials/add-app-security-with-waf.md#enable-waf-for-a-component-using-your-own-nap-policy-beta" >}}) to get started. ## Limitations diff --git a/content/controller/app-delivery/security/concepts/extend-app-security-snippets.md b/content/controller/app-delivery/security/concepts/extend-app-security-snippets.md index c6c2321a6..761e2f779 100644 --- a/content/controller/app-delivery/security/concepts/extend-app-security-snippets.md +++ b/content/controller/app-delivery/security/concepts/extend-app-security-snippets.md @@ -12,9 +12,9 @@ type: ## Overview -F5 NGINX Controller [Snippets]({{< relref "/controller/app-delivery/about-snippets.md" >}}) let you customize your NGINX configuration by adding NGINX directives that aren't represented by the NGINX Controller API. +F5 NGINX Controller [Snippets]({{< ref "/controller/app-delivery/about-snippets.md" >}}) let you customize your NGINX configuration by adding NGINX directives that aren't represented by the NGINX Controller API. -Snippets also let you customize App Security for your Components by adding NGINX App Protect directives that aren't present in the NGINX Controller API. You can use Snippets when [tuning your NGINX App Protect WAF performance]({{< relref "/controller/app-delivery/security/tutorials/tune-waf-for-app" >}}) as well. +Snippets also let you customize App Security for your Components by adding NGINX App Protect directives that aren't present in the NGINX Controller API. You can use Snippets when [tuning your NGINX App Protect WAF performance]({{< ref "/controller/app-delivery/security/tutorials/tune-waf-for-app" >}}) as well. {{< caution >}} When you use Snippets to customize your NGINX configuration, your changes are applied to the `nginx.conf` file *as is*. NGINX Controller does not verify that your configuration is valid before applying the Snippet. @@ -31,7 +31,7 @@ We strongly recommend verifying Snippets in a lab environment before making any ### Define a Backup Location for Security Event Logs -When you [enable WAF on a Component]({{< relref "/controller/app-delivery/security/tutorials/add-app-security-with-waf" >}}), all Security Events are sent to NGINX Controller logs via syslog. The following example uses the `app_protect_security_log` directive in a URI Snippet to define a local backup location for Security Event logs. You can also send Security Events to another syslog server or to `stderr` by inserting an additional URI Snippet with the `app_protect_security_log` directive. +When you [enable WAF on a Component]({{< ref "/controller/app-delivery/security/tutorials/add-app-security-with-waf" >}}), all Security Events are sent to NGINX Controller logs via syslog. The following example uses the `app_protect_security_log` directive in a URI Snippet to define a local backup location for Security Event logs. You can also send Security Events to another syslog server or to `stderr` by inserting an additional URI Snippet with the `app_protect_security_log` directive. {{< caution >}} Using local files as a backup for Security Events may use up disk space and affect your system performance. In production environments, setting up a remote file or a remote syslog server for backup purposes are good alternatives to using a local backup. @@ -92,7 +92,7 @@ Using local files as a backup for Security Events may use up disk space and affe ### Add Location of User-Defined Signature Definition File -When using [Bring Your Own WAF Policy]({{< relref "/controller/app-delivery/security/concepts/bring-your-own-policy" >}}) in NGINX Controller, you can define a URI Snippet for a Gateway API to define the location for your User-Defined Signature Definition file. The User-Defined Signature can then be referenced in the custom NGINX App Protect WAF policy that you use for your Components. +When using [Bring Your Own WAF Policy]({{< ref "/controller/app-delivery/security/concepts/bring-your-own-policy" >}}) in NGINX Controller, you can define a URI Snippet for a Gateway API to define the location for your User-Defined Signature Definition file. The User-Defined Signature can then be referenced in the custom NGINX App Protect WAF policy that you use for your Components. {{< note >}} The file that contains the signature definition must already exist on your NGINX App Protect WAF instances. For more information regarding User-Defined Signatures, refer to the [NGINX App Protect WAF Configuration Guide](https://docs.nginx.com/nginx-app-protect/configuration-guide/configuration/#user-defined-signatures). diff --git a/content/controller/app-delivery/security/tutorials/add-app-security-with-waf.md b/content/controller/app-delivery/security/tutorials/add-app-security-with-waf.md index 79239681a..e2b31f6e4 100644 --- a/content/controller/app-delivery/security/tutorials/add-app-security-with-waf.md +++ b/content/controller/app-delivery/security/tutorials/add-app-security-with-waf.md @@ -19,14 +19,14 @@ You can use the App Security add-on for F5 NGINX Controller ADC to enable Web Ap Before proceeding with this guide, complete the following tasks. {{}}These steps may need to be completed by a user with admin permissions.{{}} -1. [Add an NGINX App Protect instance]({{< relref "/controller/infrastructure/instances/add-nap-instance.md" >}}) to NGINX Controller. +1. [Add an NGINX App Protect instance]({{< ref "/controller/infrastructure/instances/add-nap-instance.md" >}}) to NGINX Controller. In addition, the following resources must exist in order to complete the steps in this topic: -- [Environment]({{< relref "/controller/services/manage-environments.md" >}}) -- [Gateway]({{< relref "/controller/services/manage-gateways.md" >}}) -- [Certs]({{< relref "/controller/services/manage-gateways.md" >}}) (required if your Components use HTTPS) -- [App and Component(s)]({{< relref "/controller/app-delivery/manage-apps.md" >}}) +- [Environment]({{< ref "/controller/services/manage-environments.md" >}}) +- [Gateway]({{< ref "/controller/services/manage-gateways.md" >}}) +- [Certs]({{< ref "/controller/services/manage-gateways.md" >}}) (required if your Components use HTTPS) +- [App and Component(s)]({{< ref "/controller/app-delivery/manage-apps.md" >}}) ## Enable WAF for a Component using the Default Security Strategy @@ -131,7 +131,7 @@ This JSON object should be added to the Component endpoint similar to the follow ## Enable WAF for a Component Using Your Own NGINX App Protect WAF Policy -Instead of using NGINX Controller's default policy for WAF, you can [bring your own NGINX App Protect Policy]({{< relref "/controller/app-delivery/security/concepts/bring-your-own-policy.md" >}}) for use in a Security Strategy to protect your app components. +Instead of using NGINX Controller's default policy for WAF, you can [bring your own NGINX App Protect Policy]({{< ref "/controller/app-delivery/security/concepts/bring-your-own-policy.md" >}}) for use in a Security Strategy to protect your app components. To do so, you first need to upload your NGINX App Protect WAF declarative JSON policy to the Security Policy endpoint and reference it in a Security Strategy. Then, you can reference the Security Strategy in the Component where you are enabling WAF. @@ -250,7 +250,7 @@ The WAF does not begin to emit security events immediately upon activation. We r {{< note >}} -If NGINX Controller isn't logging any Security Violation Events for your app component, check [Security Events Not Available]({{< relref "/controller/support/troubleshooting-controller.md#Security-Events-Not-Available" >}}) for troubleshooting instructions. +If NGINX Controller isn't logging any Security Violation Events for your app component, check [Security Events Not Available]({{< ref "/controller/support/troubleshooting-controller.md#Security-Events-Not-Available" >}}) for troubleshooting instructions. {{< /note >}} diff --git a/content/controller/app-delivery/security/tutorials/set-waf-monitor-mode.md b/content/controller/app-delivery/security/tutorials/set-waf-monitor-mode.md index af051bdb6..aa4788632 100644 --- a/content/controller/app-delivery/security/tutorials/set-waf-monitor-mode.md +++ b/content/controller/app-delivery/security/tutorials/set-waf-monitor-mode.md @@ -11,11 +11,11 @@ type: ## Overview -You can use the [F5 NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to enable or disable monitor-only mode for the App Security WAF policy. +You can use the [F5 NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to enable or disable monitor-only mode for the App Security WAF policy. ## Enable Monitor-Only Mode for App Security WAF -When monitor-only mode is enabled, traffic is allowed to pass without being rejected. However, security events are still generated and metrics are still collected. See [About App Security Analytics]({{< relref "view-app-security-analytics.md#overview" >}}) for more information. +When monitor-only mode is enabled, traffic is allowed to pass without being rejected. However, security events are still generated and metrics are still collected. See [About App Security Analytics]({{< ref "view-app-security-analytics.md#overview" >}}) for more information. To enable monitor-only mode for App Security WAF, send a POST or PUT request to the **Components** endpoint, with a JSON object similar to the following: @@ -41,9 +41,9 @@ To enable monitor-only mode for App Security WAF, send a POST or PUT request to ## Block Traffic Violations with App Security WAF -When monitor-only mode is disabled, traffic is blocked based on the [Violation Rating]({{< relref "/controller/app-delivery/security/concepts/app-sec-default-policy-original.md#use-of-violation-ratings-in-default-policy" >}}) score for the default policy. +When monitor-only mode is disabled, traffic is blocked based on the [Violation Rating]({{< ref "/controller/app-delivery/security/concepts/app-sec-default-policy-original.md#use-of-violation-ratings-in-default-policy" >}}) score for the default policy. -To block traffic violations with App Security WAF, send a POST or PUT request to the `/services/apps/components` [REST API]({{< relref "/controller/api/_index.md" >}}) endpoint, with a JSON object similar to the following: +To block traffic violations with App Security WAF, send a POST or PUT request to the `/services/apps/components` [REST API]({{< ref "/controller/api/_index.md" >}}) endpoint, with a JSON object similar to the following: ```json { diff --git a/content/controller/app-delivery/security/tutorials/tune-waf-for-app.md b/content/controller/app-delivery/security/tutorials/tune-waf-for-app.md index fe4c9e16d..87de7192e 100644 --- a/content/controller/app-delivery/security/tutorials/tune-waf-for-app.md +++ b/content/controller/app-delivery/security/tutorials/tune-waf-for-app.md @@ -54,7 +54,7 @@ To configure the Monitor-Only Mode, take the steps below. {{< note >}} When **Monitor Only** mode is enabled, it will not block traffic. Event violations will be sent according to the policies associated with the referenced strategy. -When **Monitor Only** mode is disabled, traffic is blocked based on the [Violation Rating]({{< relref "/controller/app-delivery/security/concepts/app-sec-default-policy-original.md#use-of-violation-ratings-in-default-policy" >}}) score for the default policy. +When **Monitor Only** mode is disabled, traffic is blocked based on the [Violation Rating]({{< ref "/controller/app-delivery/security/concepts/app-sec-default-policy-original.md#use-of-violation-ratings-in-default-policy" >}}) score for the default policy. {{< /note >}} {{< versions "3.12" "latest" "ctrlvers" >}} diff --git a/content/controller/app-delivery/security/tutorials/using-rbac-with-app-security.md b/content/controller/app-delivery/security/tutorials/using-rbac-with-app-security.md index 658ba0f50..dc043934d 100644 --- a/content/controller/app-delivery/security/tutorials/using-rbac-with-app-security.md +++ b/content/controller/app-delivery/security/tutorials/using-rbac-with-app-security.md @@ -10,13 +10,13 @@ type: Role Based Access Control (RBAC) allows you to define permissions for Apps Security resources. With RBAC, you can specify which role has the permissions to create, read (and reference), update, and delete a Security Strategy or a Security Policy. You can then assign roles to specific users so that the users inherit the permissions. -For more information regarding roles, refer to [Manage Roles and Role Groups]({{< relref "/controller/platform/access-management/manage-roles.md" >}}) +For more information regarding roles, refer to [Manage Roles and Role Groups]({{< ref "/controller/platform/access-management/manage-roles.md" >}}) ## Permissions for App Security To enable security, the app component needs to reference a security strategy. The security strategy in turn references a security policy. When using RBAC with App Security, you need to configure permissions for the app component, the security strategy, and the security policy. -Resources that are deeper in the path hierarchy inherit permissions from their parents unless explicitly overwritten. For more information, refer to [Manage Roles and Role Groups]({{< relref "/controller/platform/access-management/manage-roles.md" >}}). +Resources that are deeper in the path hierarchy inherit permissions from their parents unless explicitly overwritten. For more information, refer to [Manage Roles and Role Groups]({{< ref "/controller/platform/access-management/manage-roles.md" >}}). ## Granting Permissions on App Components @@ -39,7 +39,7 @@ The app component you want to enable WAF for must have `WRITE` permission. Addit ## Granting Permissions on Security Strategies and Security Policies -A security strategy references a security policy. For more information regarding security strategies and security policies, refer to [About App Security]({{< relref "/controller/app-delivery/security/concepts/what-is-waf.md#security-strategy" >}}). +A security strategy references a security policy. For more information regarding security strategies and security policies, refer to [About App Security]({{< ref "/controller/app-delivery/security/concepts/what-is-waf.md#security-strategy" >}}). ### Deny by Default diff --git a/content/controller/app-delivery/security/tutorials/view-app-security-analytics.md b/content/controller/app-delivery/security/tutorials/view-app-security-analytics.md index 680ff7fdd..ae20f8d92 100644 --- a/content/controller/app-delivery/security/tutorials/view-app-security-analytics.md +++ b/content/controller/app-delivery/security/tutorials/view-app-security-analytics.md @@ -14,7 +14,7 @@ type: When App Security flags or blocks a request made to an App Component as a security violation, it generates an App Security event. You can use the F5 F5 NGINX Controller web interface or the REST API to view these events or their related statistics (measures). Metrics reflect the number of requests and bytes flagged or blocked. You can use the Security Violation Dimensions to help understand and interpret the analytics data. -For descriptions of Security Metrics and Events Dimensions, refer to [About App Security]({{< relref "/controller/app-delivery/security/concepts/what-is-waf.md" >}}) page. +For descriptions of Security Metrics and Events Dimensions, refer to [About App Security]({{< ref "/controller/app-delivery/security/concepts/what-is-waf.md" >}}) page. ## View App Security Analytics @@ -265,6 +265,6 @@ This is important if you are using App Security WAF monitoring only mode. You ca ## Related Pages -- [About App Security]({{< relref "/controller/app-delivery/security/concepts/what-is-waf.md" >}}) +- [About App Security]({{< ref "/controller/app-delivery/security/concepts/what-is-waf.md" >}}) {{< versions "3.12" "latest" "ctrlvers" >}} diff --git a/content/controller/infrastructure/instances/add-aws-instance.md b/content/controller/infrastructure/instances/add-aws-instance.md index ba53536f5..1f558cc5a 100644 --- a/content/controller/infrastructure/instances/add-aws-instance.md +++ b/content/controller/infrastructure/instances/add-aws-instance.md @@ -100,7 +100,7 @@ To create a Location, take the following steps: ## Create an Instance Template for AWS NGINX Instances -An [Instance Template]({{< relref "/controller/infrastructure/instances/manage-instance-templates.md" >}}) defines the parameters to use when creating an NGINX instance. Instance templates are ideal for cloud orchestration and make managing your cloud resources easy and quick. +An [Instance Template]({{< ref "/controller/infrastructure/instances/manage-instance-templates.md" >}}) defines the parameters to use when creating an NGINX instance. Instance templates are ideal for cloud orchestration and make managing your cloud resources easy and quick. ### Prerequisites @@ -113,7 +113,7 @@ To create an Instance Template for AWS NGINX instances, take the following steps 1. (Optional) Add a display name. 1. (Optional) Add a description. 1. (Optional) Add tags. -1. Select a Location in the list, or select **Create New** to [create a Location]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}). +1. Select a Location in the list, or select **Create New** to [create a Location]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}). 1. In the Type list, select `AWS_INSTANCE_TEMPLATE`. 1. Add the [Amazon Machine Image ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html). 1. Add the [EC2 Instance Type](https://aws.amazon.com/ec2/instance-types/). @@ -138,7 +138,7 @@ To create an Instance Template for AWS NGINX instances, take the following steps 1. (Optional) Add a display name. 1. (Optional) Add a description. 1. (Optional) Add tags. -1. Select a Location in the list, or select **Create New** to [create a Location]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}). +1. Select a Location in the list, or select **Create New** to [create a Location]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}). 1. In the Type list, select `AWS_INSTANCE_TEMPLATE`. 1. Add the [Amazon Machine Image ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html). 1. Add the [EC2 Instance Type](https://aws.amazon.com/ec2/instance-types/). @@ -188,7 +188,7 @@ Take the following steps to troubleshoot the issue: - Ensure that ports 443 and 8443 are open between NGINX Controller and the network where the NGINX Plus instance is being deployed. - Verify that you can communicate with NGINX Controller from the NGINX Plus instance using the NGINX Controller FQDN that you provided when you installed NGINX Controller. -- If you're [deploying an NGINX Plus instance on Amazon Web Services]({{< relref "/controller/infrastructure/instances/add-aws-instance.md" >}}) using a template, ensure that the Amazon Machine Image (AMI) referenced in the `instance_template` has a cURL version of 7.32 or newer. +- If you're [deploying an NGINX Plus instance on Amazon Web Services]({{< ref "/controller/infrastructure/instances/add-aws-instance.md" >}}) using a template, ensure that the Amazon Machine Image (AMI) referenced in the `instance_template` has a cURL version of 7.32 or newer.   @@ -197,10 +197,10 @@ Take the following steps to troubleshoot the issue: ## What's Next -- [Manage Your NGINX Instances]({{< relref "/controller/infrastructure/instances/manage-instances.md#add-an-existing-instance" >}}) -- [Add, Edit, and Update Locations]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}) -- [View Performance Reports for Your Instances]({{< relref "/controller/infrastructure/instances/analyzer.md" >}}) -- [Deploy an App]({{< relref "/controller/app-delivery/deploy-simple-app.md" >}}) +- [Manage Your NGINX Instances]({{< ref "/controller/infrastructure/instances/manage-instances.md#add-an-existing-instance" >}}) +- [Add, Edit, and Update Locations]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}) +- [View Performance Reports for Your Instances]({{< ref "/controller/infrastructure/instances/analyzer.md" >}}) +- [Deploy an App]({{< ref "/controller/app-delivery/deploy-simple-app.md" >}}) {{< versions "3.6" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/infrastructure/instances/add-azure-instance.md b/content/controller/infrastructure/instances/add-azure-instance.md index e4fdd8ea1..a537cee78 100644 --- a/content/controller/infrastructure/instances/add-azure-instance.md +++ b/content/controller/infrastructure/instances/add-azure-instance.md @@ -74,7 +74,7 @@ To add a client secret to your app registration: Integrations give NGINX Controller permission to deploy and manage NGINX instances on external systems, such as cloud providers like Azure. -To create an Integration for Azure using the [NGINX Controller API]({{< relref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Integrations API endpoint. +To create an Integration for Azure using the [NGINX Controller API]({{< ref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Integrations API endpoint. In the JSON request, provide the `clientID`, `tenantID`, and `clientSecret` that you copied and saved when you [registered an app with Azure](#before-you-begin). @@ -120,7 +120,7 @@ To create a Location, you'll need your Azure resource group name, region, and su ### Create a Location by using the REST API -To create a Location using the [NGINX Controller API]({{< relref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Locations API endpoint. +To create a Location using the [NGINX Controller API]({{< ref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Locations API endpoint. In the JSON request, provide the `resourceGroup` name, `region`, and `subscriptionID` that you copied and saved in the previous steps. @@ -151,11 +151,11 @@ In the JSON request, provide the `resourceGroup` name, `region`, and `subscripti -An [Instance Template]({{< relref "/controller/infrastructure/instances/manage-instance-templates.md" >}}) defines the parameters to use when creating an NGINX instance. Instance Templates are ideal for cloud orchestration and make managing your cloud resources easy and quick. +An [Instance Template]({{< ref "/controller/infrastructure/instances/manage-instance-templates.md" >}}) defines the parameters to use when creating an NGINX instance. Instance Templates are ideal for cloud orchestration and make managing your cloud resources easy and quick. -For the Instance Template, you can provide the details for an NGINX image on the Azure Marketplace, or you can provide the image and network details for your own instance. Refer to the [NGINX Controller Technical Specifications]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) guide for the NGINX Plus requirements. +For the Instance Template, you can provide the details for an NGINX image on the Azure Marketplace, or you can provide the image and network details for your own instance. Refer to the [NGINX Controller Technical Specifications]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) guide for the NGINX Plus requirements. -- To create an Instance Template for an Azure Marketplace image using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Instance Templates API endpoint. You can find descriptions of the instance parameters in the API Reference documentation. +- To create an Instance Template for an Azure Marketplace image using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Instance Templates API endpoint. You can find descriptions of the instance parameters in the API Reference documentation. {{< tip >}}To look up the image details — `publisher`, `offer`, `sku`, and `version` — that you'll need to define the Instance Template, you can attempt to deploy an NGINX instance from the [Azure Marketplace](https://azure.microsoft.com/en-us/marketplace/) and look at the template that Azure creates to get the image details. {{}} @@ -191,7 +191,7 @@ For the Instance Template, you can provide the details for an NGINX image on the } ``` -- To create an Azure Instance Template for your own instance using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}, send a POST request similar to the following example to the Instance Templates API endpoint. +- To create an Azure Instance Template for your own instance using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}, send a POST request similar to the following example to the Instance Templates API endpoint. ```json { @@ -226,7 +226,7 @@ For the Instance Template, you can provide the details for an NGINX image on the Now that you've [defined a Location](#create-a-location) and [made an Instance Template](#create-an-instance-template-for-azure-nginx-instances) for an NGINX instance on Azure, you're ready to add the instance to NGINX Controller. -To add an Azure NGINX instance to NGINX Controller using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Instances API endpoint. For the `templateRef` parameter, use the Instance Template that you created in the previous procedure. +To add an Azure NGINX instance to NGINX Controller using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Instances API endpoint. For the `templateRef` parameter, use the Instance Template that you created in the previous procedure. ```json { @@ -249,10 +249,10 @@ To add an Azure NGINX instance to NGINX Controller using the [NGINX Controller R ## What's Next -- [Manage Your NGINX Instances]({{< relref "/controller/infrastructure/instances/manage-instances.md#add-an-existing-instance" >}}) -- [Add, Edit, and Update Locations]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}) -- [View Performance Reports for Your Instances]({{< relref "/controller/infrastructure/instances/analyzer.md" >}}) -- [Deploy an App]({{< relref "/controller/app-delivery/deploy-simple-app.md" >}}) +- [Manage Your NGINX Instances]({{< ref "/controller/infrastructure/instances/manage-instances.md#add-an-existing-instance" >}}) +- [Add, Edit, and Update Locations]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}) +- [View Performance Reports for Your Instances]({{< ref "/controller/infrastructure/instances/analyzer.md" >}}) +- [Deploy an App]({{< ref "/controller/app-delivery/deploy-simple-app.md" >}}) {{< versions "3.12" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/infrastructure/instances/add-nap-instance.md b/content/controller/infrastructure/instances/add-nap-instance.md index 9b3344d73..6a18eb991 100644 --- a/content/controller/infrastructure/instances/add-nap-instance.md +++ b/content/controller/infrastructure/instances/add-nap-instance.md @@ -17,7 +17,7 @@ Follow the directions in this topic to deploy F5 NGINX App Protect and add the i
-Install NGINX App Protect on a host accessible by your NGINX Controller instance by following the appropriate steps for your operating system in the [Using NGINX App Protect with NGINX Controller]({{< relref "controller/admin-guides/install/install-for-controller.md" >}}) guide. +Install NGINX App Protect on a host accessible by your NGINX Controller instance by following the appropriate steps for your operating system in the [Using NGINX App Protect with NGINX Controller]({{< ref "controller/admin-guides/install/install-for-controller.md" >}}) guide. {{< note >}} If you install NGINX App Protect by using any of the OS-specific install guides, **do not make changes to the `nginx.conf` file**. @@ -34,9 +34,9 @@ Take the steps below to add the NGINX App Protect instance by using the NGINX Co ## What's Next -- [Set up NGINX Controller Agent to emit Security Events]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md#enable-security-events" >}}) -- [Learn about App Security]({{< relref "/controller/app-delivery/security/concepts/what-is-waf.md" >}}) -- [Manage App Security]({{< relref "/controller/app-delivery/security/tutorials/add-app-security-with-waf.md" >}}) +- [Set up NGINX Controller Agent to emit Security Events]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md#enable-security-events" >}}) +- [Learn about App Security]({{< ref "/controller/app-delivery/security/concepts/what-is-waf.md" >}}) +- [Manage App Security]({{< ref "/controller/app-delivery/security/tutorials/add-app-security-with-waf.md" >}}) {{< versions "3.11" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/infrastructure/instances/add-vsphere-instance.md b/content/controller/infrastructure/instances/add-vsphere-instance.md index ef944a55a..1a2ae31eb 100644 --- a/content/controller/infrastructure/instances/add-vsphere-instance.md +++ b/content/controller/infrastructure/instances/add-vsphere-instance.md @@ -73,7 +73,7 @@ You are responsible for securing the connection between the vSphere cloud and an Integrations allow NGINX Controller to deploy and manage NGINX instances on external systems (cloud providers like vSphere). -To create an Integration for vSphere using the [NGINX Controller API]({{< relref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Integrations API endpoint. +To create an Integration for vSphere using the [NGINX Controller API]({{< ref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Integrations API endpoint. In the JSON request, provide the `hostname or IP`, `username`, and `password` for the vSphere instance as mentioned in [this section](#before-you-begin). @@ -111,7 +111,7 @@ To create a Location, you'll need your vSphere datacenter name and a vSphere VM ### Create a Location by using the REST API -To create a Location using the [NGINX Controller API]({{< relref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Locations API endpoint. +To create a Location using the [NGINX Controller API]({{< ref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Locations API endpoint. In the JSON request, provide the `datacenter` name, and `folder` name. @@ -140,11 +140,11 @@ In the JSON request, provide the `datacenter` name, and `folder` name. -An [Instance Template]({{< relref "/controller/infrastructure/instances/manage-instance-templates.md" >}}) defines the parameters to use when creating an NGINX instance. Instance Templates are ideal for cloud orchestration and make managing your cloud resources easy and quick. +An [Instance Template]({{< ref "/controller/infrastructure/instances/manage-instance-templates.md" >}}) defines the parameters to use when creating an NGINX instance. Instance Templates are ideal for cloud orchestration and make managing your cloud resources easy and quick. -For the Instance Template, you need to provide a VM template with NGINX Plus, [cloud-init](https://cloudinit.readthedocs.io/en/latest/) and [cloud-init-vmware-guestinfo](https://github.com/vmware/cloud-init-vmware-guestinfo) installed. Refer to [this](#create-a-nginxplus-vm-template) to create a NGINX Plus VM template. Use this [NGINX Controller Technical Specifications]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) guide for the NGINX Plus requirements. +For the Instance Template, you need to provide a VM template with NGINX Plus, [cloud-init](https://cloudinit.readthedocs.io/en/latest/) and [cloud-init-vmware-guestinfo](https://github.com/vmware/cloud-init-vmware-guestinfo) installed. Refer to [this](#create-a-nginxplus-vm-template) to create a NGINX Plus VM template. Use this [NGINX Controller Technical Specifications]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) guide for the NGINX Plus requirements. -- To create an Instance Template using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Instance Templates API endpoint. You can find descriptions of the instance parameters in the API Reference documentation. +- To create an Instance Template using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a POST request similar to the following example to the Instance Templates API endpoint. You can find descriptions of the instance parameters in the API Reference documentation.   @@ -177,7 +177,7 @@ For the Instance Template, you need to provide a VM template with NGINX Plus, [c Now that you've [defined a Location](#create-a-location) and [created an Instance Template](#create-an-instance-template-for-vsphere-nginx-instances) for an NGINX instance on vSphere, you are ready to add the instance to NGINX Controller. -To add a vSphere NGINX instance to NGINX Controller using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a POST request as shown below to the Instances API endpoint. For the `templateRef` parameter, use the Instance Template that you created in the previous procedure. +To add a vSphere NGINX instance to NGINX Controller using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a POST request as shown below to the Instances API endpoint. For the `templateRef` parameter, use the Instance Template that you created in the previous procedure. ```json { @@ -200,10 +200,10 @@ To add a vSphere NGINX instance to NGINX Controller using the [NGINX Controller ## What's Next -- [Manage Your NGINX Instances]({{< relref "/controller/infrastructure/instances/manage-instances.md#add-an-existing-instance" >}}) -- [Add, Edit, and Update Locations]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}) -- [View Performance Reports for Your Instances]({{< relref "/controller/infrastructure/instances/analyzer.md" >}}) -- [Deploy an App]({{< relref "/controller/app-delivery/deploy-simple-app.md" >}}) +- [Manage Your NGINX Instances]({{< ref "/controller/infrastructure/instances/manage-instances.md#add-an-existing-instance" >}}) +- [Add, Edit, and Update Locations]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}) +- [View Performance Reports for Your Instances]({{< ref "/controller/infrastructure/instances/analyzer.md" >}}) +- [Deploy an App]({{< ref "/controller/app-delivery/deploy-simple-app.md" >}}) {{< versions "3.12" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/infrastructure/instances/analyzer.md b/content/controller/infrastructure/instances/analyzer.md index 827c70f8f..2afeaf0e3 100644 --- a/content/controller/infrastructure/instances/analyzer.md +++ b/content/controller/infrastructure/instances/analyzer.md @@ -24,14 +24,14 @@ To access the **Analyzer** page, take the following steps: When viewing the **Analyzer Overview** page, select a system from the **Systems** pane to see the associated report. -{{< note >}} The Analyzer can only show reports for NGINX instances found by the NGINX Controller Agent. If an instance is missing, check that it is [configured correctly for discovery by the Agent]({{< relref "/controller/support/troubleshooting-controller.md" >}}).{{< /note >}} +{{< note >}} The Analyzer can only show reports for NGINX instances found by the NGINX Controller Agent. If an instance is missing, check that it is [configured correctly for discovery by the Agent]({{< ref "/controller/support/troubleshooting-controller.md" >}}).{{< /note >}} The following information is provided when a report is run against an NGINX config structure: - Build - Path to NGINX config files(s) - Whether the parser failed or not, and the results of `nginx -t` - {{< note >}} Periodic NGINX configuration syntax checking with `nginx -t` is disabled by default. To enable this setting, select the **Enable periodic "nginx -t"** box on the [Default Agent Settings]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md#default-agent-settings" >}}) page.{{< /note >}} + {{< note >}} Periodic NGINX configuration syntax checking with `nginx -t` is disabled by default. To enable this setting, select the **Enable periodic "nginx -t"** box on the [Default Agent Settings]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md#default-agent-settings" >}}) page.{{< /note >}} - Last-modified info - 3rd party modules found - Breakdown of the key configuration elements (servers, locations, upstreams) @@ -53,15 +53,15 @@ The following information is provided when a report is run against an NGINX conf - Key security measures (for example, -stub_status- is unprotected) - Typical errors in configuring locations, especially with -regex- -To parse SSL certificate metadata, the NGINX Controller Agent uses standard `openssl(1)` functions. SSL certificates are parsed and analyzed by default. To change this setting, clear the **Analyze SSL certificates** box on the [**Agent Settings**]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md#default-agent-settings" >}}) page. +To parse SSL certificate metadata, the NGINX Controller Agent uses standard `openssl(1)` functions. SSL certificates are parsed and analyzed by default. To change this setting, clear the **Analyze SSL certificates** box on the [**Agent Settings**]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md#default-agent-settings" >}}) page. Static analysis will only include information about specific issues with the NGINX configuration if those are found in your NGINX setup. ## Troubleshooting -If the **Infrastructure** > **Analyzer** tab doesn't display information, it may be because the current user doesn't belong to one of the [built-in roles]({{< relref "/controller/platform/access-management/manage-roles.md" >}}) and the `/reports/` endpoint hasn't been enabled for a custom role. +If the **Infrastructure** > **Analyzer** tab doesn't display information, it may be because the current user doesn't belong to one of the [built-in roles]({{< ref "/controller/platform/access-management/manage-roles.md" >}}) and the `/reports/` endpoint hasn't been enabled for a custom role. -To enable the `/reports/` endpoint for a custom role, send a POST request to the Roles [API endpoint]({{< relref "/controller/api/_index.md" >}}) similar to the following: +To enable the `/reports/` endpoint for a custom role, send a POST request to the Roles [API endpoint]({{< ref "/controller/api/_index.md" >}}) similar to the following: ```json { diff --git a/content/controller/infrastructure/instances/graphs.md b/content/controller/infrastructure/instances/graphs.md index 694fb56ca..96d4e7440 100644 --- a/content/controller/infrastructure/instances/graphs.md +++ b/content/controller/infrastructure/instances/graphs.md @@ -17,8 +17,8 @@ You can use the F5 NGINX Controller **Graphs** viewer to view key metrics for al ## Before You Begin -- [Install the NGINX Controller Agent on instances that you want to monitor]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) -- [Configure Metrics collection on your NGINX instances]({{< relref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) +- [Install the NGINX Controller Agent on instances that you want to monitor]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) +- [Configure Metrics collection on your NGINX instances]({{< ref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) ## How to View Systems Graphs @@ -61,12 +61,12 @@ Above the graphs, you will find the following: You can also copy a predefined graph to a custom dashboard by selecting the graph and clicking the up arrow that appears in the top-right corner of the graph. -See the [Metrics and Metadata]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) topic to learn more about the displayed metrics. +See the [Metrics and Metadata]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) topic to learn more about the displayed metrics. ## What's Next -- [Overview of Metrics and Metadata]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) -- [Metrics Reference]({{< relref "/controller/analytics/catalogs/metrics.md" >}}) +- [Overview of Metrics and Metadata]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) +- [Metrics Reference]({{< ref "/controller/analytics/catalogs/metrics.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/infrastructure/instances/ha-data-plane.md b/content/controller/infrastructure/instances/ha-data-plane.md index ff0cc762f..7420a7e59 100644 --- a/content/controller/infrastructure/instances/ha-data-plane.md +++ b/content/controller/infrastructure/instances/ha-data-plane.md @@ -129,23 +129,23 @@ Managing the `keepalived.conf` file through third-party configuration management ## Create a High-Availability Gateway -Follow the instructions to [Create a Gateway]({{< relref "/controller/services/manage-gateways.md#create-a-gateway" >}}). +Follow the instructions to [Create a Gateway]({{< ref "/controller/services/manage-gateways.md#create-a-gateway" >}}). 1. Open the NGINX Controller user interface and log in. 1. Select the NGINX Controller menu icon, then select **Services** > **Gateways**. 1. Select **Create Gateway**. 1. Complete each of the configuration sections: - - [General Configuration]({{< relref "#general-configuration" >}}) - - [Add Placements]({{< relref "#add-placements" >}}) - - [Set Hostnames]({{< relref "#set-hostnames" >}}) - - [Additional Settings]({{< relref "#additional-settings" >}}) + - [General Configuration]({{< ref "#general-configuration" >}}) + - [Add Placements]({{< ref "#add-placements" >}}) + - [Set Hostnames]({{< ref "#set-hostnames" >}}) + - [Additional Settings]({{< ref "#additional-settings" >}}) 1. When ready, review the API Spec and then select **Submit** to create the Gateway. In particular, on the **Gateways > Create Gateways > Placements** page, take the steps below: -[Gateways]({{< relref "/controller/services/manage-gateways.md#overview" >}}) include placements that reference NGINX instances or instance groups. Gateway placements can be for multiple instances or instance groups, allowing a gateway to deliver services in multiple data centers and/or clouds. Placements define the physical machines that are used to manifest a particular path associated with an [application component]({{< relref "/controller/app-delivery/about-app-delivery.md#components" >}}). +[Gateways]({{< ref "/controller/services/manage-gateways.md#overview" >}}) include placements that reference NGINX instances or instance groups. Gateway placements can be for multiple instances or instance groups, allowing a gateway to deliver services in multiple data centers and/or clouds. Placements define the physical machines that are used to manifest a particular path associated with an [application component]({{< ref "/controller/app-delivery/about-app-delivery.md#components" >}}). On the **Gateways > Create Gateway > Placements** page: @@ -157,7 +157,7 @@ On the **Gateways > Create Gateway > Placements** page: 1. In the **Instance Refs/Instance Groups Refs** box, select the NGINX instance(s) or instance group(s) on which you want to deploy the gateway. {{< note >}} - If you're enabling **High Availability Mode**, select the [high-availability instances that you prepared]({{< relref "/controller/infrastructure/instances/ha-data-plane.md#prepare-the-high-availability-instances" >}}). NGINX Controller supports up to two high-availability instances. + If you're enabling **High Availability Mode**, select the [high-availability instances that you prepared]({{< ref "/controller/infrastructure/instances/ha-data-plane.md#prepare-the-high-availability-instances" >}}). NGINX Controller supports up to two high-availability instances. {{< /note >}} 1. In the **Listen IPs** box, add the IP address(es) on which the server listens for and accepts requests. If you're creating a placement for a BIG-IP Integration, add the virtual IP (VIP) address for the BIG-IP cluster. diff --git a/content/controller/infrastructure/instances/manage-containerized-instances.md b/content/controller/infrastructure/instances/manage-containerized-instances.md index 7bcbb2c10..83329e067 100644 --- a/content/controller/infrastructure/instances/manage-containerized-instances.md +++ b/content/controller/infrastructure/instances/manage-containerized-instances.md @@ -18,7 +18,7 @@ Instance groups allow an API Gateway to be native in Kubernetes. ## Create an Instance Group -To create an instance group using the web interface, see [Create an Instance Group]({{< relref "/controller/infrastructure/instances/manage-instances.md#create-an-instance-group" >}}). +To create an instance group using the web interface, see [Create an Instance Group]({{< ref "/controller/infrastructure/instances/manage-instances.md#create-an-instance-group" >}}). To create an instance group using the NGINX Controller REST API, send a PUT request similar to the following example to the instance-groups API endpoint. diff --git a/content/controller/infrastructure/instances/manage-instance-templates.md b/content/controller/infrastructure/instances/manage-instance-templates.md index 903356e1e..cb55716d2 100644 --- a/content/controller/infrastructure/instances/manage-instance-templates.md +++ b/content/controller/infrastructure/instances/manage-instance-templates.md @@ -23,10 +23,10 @@ Take the following steps to create an Instance Template: 1. (Optional) Add a display name. 1. (Optional) Add a description. 1. (Optional) Add tags. -1. Select a Location in the list, or select **Create New** to [create a Location]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}). +1. Select a Location in the list, or select **Create New** to [create a Location]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}). 1. Select the Instance Template type. - - Select `AWS_INSTANCE_TEMPLATE` to create a template for NGINX instances on Amazon Web Services. For instructions on how to deploy NGINX instances on AWS, refer to the tutorial [Add an AWS NGINX Instance]({{< relref "/controller/infrastructure/instances/add-aws-instance.md" >}}). + - Select `AWS_INSTANCE_TEMPLATE` to create a template for NGINX instances on Amazon Web Services. For instructions on how to deploy NGINX instances on AWS, refer to the tutorial [Add an AWS NGINX Instance]({{< ref "/controller/infrastructure/instances/add-aws-instance.md" >}}). 1. Specify whether a public IP address should be assigned to the instance. 1. Select **Submit**. @@ -50,9 +50,9 @@ Take the following steps to view or delete an Instance Template: ## What's Next -- [Create an Instance on Amazon Web Services]({{< relref "add-aws-instance.md" >}}) -- [Configure the Controller Agent]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) -- [Set up Metrics Collection]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) +- [Create an Instance on Amazon Web Services]({{< ref "add-aws-instance.md" >}}) +- [Configure the Controller Agent]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) +- [Set up Metrics Collection]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) {{< versions "3.6" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/infrastructure/instances/manage-instances.md b/content/controller/infrastructure/instances/manage-instances.md index 5df6560ed..402215ce1 100644 --- a/content/controller/infrastructure/instances/manage-instances.md +++ b/content/controller/infrastructure/instances/manage-instances.md @@ -12,7 +12,7 @@ type: The **Infrastructure > Instances > Overview** page allows you to check the status of all your F5 NGINX instances at a glance. -When the [Controller Agent is installed]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) on a new system and the system registers with NGINX Controller, the instance is visible on the **Instances** overview page. +When the [Controller Agent is installed]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) on a new system and the system registers with NGINX Controller, the instance is visible on the **Instances** overview page. ## Objective @@ -28,13 +28,13 @@ When the [Controller Agent is installed]({{< relref "/controller/admin-guides/in ## Create an Instance Using a Template -An [Instance Template]({{< relref "/controller/infrastructure/instances/manage-instance-templates.md" >}}) defines the parameters to use when creating a data plane instance. Instance Templates are ideal for cloud orchestration and make managing your cloud resources easy and quick. +An [Instance Template]({{< ref "/controller/infrastructure/instances/manage-instance-templates.md" >}}) defines the parameters to use when creating a data plane instance. Instance Templates are ideal for cloud orchestration and make managing your cloud resources easy and quick. {{< see-also >}} For steps on how to deploy NGINX instances on Amazon Web Services or Microsoft Azure, see the following tutorials: -- [Add an AWS NGINX Instance]({{< relref "/controller/infrastructure/instances/add-aws-instance.md" >}}) -- [Add an Azure NGINX Instance]({{< relref "/controller/infrastructure/instances/add-azure-instance.md" >}}) +- [Add an AWS NGINX Instance]({{< ref "/controller/infrastructure/instances/add-aws-instance.md" >}}) +- [Add an Azure NGINX Instance]({{< ref "/controller/infrastructure/instances/add-azure-instance.md" >}}) {{< /see-also >}} @@ -46,8 +46,8 @@ Take the following steps to create an instance using an Instance Template: 1. On the **Instances** overview page, select **Create**. 1. Select **Create a new instance using a template**. 1. Add a name. -1. Select a **Location** in the list, or select **Create New** to [create a location]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}). -1. Select an **Instance Template** in the list, or select **Create New** to [create an instance template]({{< relref "/controller/infrastructure/instances/manage-instance-templates.md" >}}). +1. Select a **Location** in the list, or select **Create New** to [create a location]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}). +1. Select an **Instance Template** in the list, or select **Create New** to [create an instance template]({{< ref "/controller/infrastructure/instances/manage-instance-templates.md" >}}). 1. Select **Submit**. ## View or Edit an Instance @@ -180,13 +180,13 @@ To edit or delete an instance group, take the following steps: To add an existing instance to an instance group, take the following steps: -1. Make sure that no [gateways]({{< relref "/controller/services/manage-gateways.md" >}}) are using the instance as a placement. Instances that are referenced by a gateway cannot be added to an instance group. -1. [Delete the instance]({{< relref "/controller/infrastructure/instances/manage-instances.md#delete-an-instance" >}}). -1. [Add the instance]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md#install-the-nginx-controller-agent" >}}) back to NGINX Controller. Run the agent install script ([Step 11]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md#install-the-nginx-controller-agent" >}})). +1. Make sure that no [gateways]({{< ref "/controller/services/manage-gateways.md" >}}) are using the instance as a placement. Instances that are referenced by a gateway cannot be added to an instance group. +1. [Delete the instance]({{< ref "/controller/infrastructure/instances/manage-instances.md#delete-an-instance" >}}). +1. [Add the instance]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md#install-the-nginx-controller-agent" >}}) back to NGINX Controller. Run the agent install script ([Step 11]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md#install-the-nginx-controller-agent" >}})). ## Update the NGINX Controller Agent -When you [update NGINX Controller]({{< relref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}), you also need to update the NGINX Controller Agent software on each monitored NGINX Plus instance. +When you [update NGINX Controller]({{< ref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}), you also need to update the NGINX Controller Agent software on each monitored NGINX Plus instance. To update the NGINX Controller Agent, take the following steps: @@ -241,13 +241,13 @@ Take the following steps to troubleshoot the issue: ## What's Next -- [Configure the NGINX Controller Agent]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) -- [Set up Metrics Collection]({{< relref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) -- [Create and Manage Locations for your Instances]({{< relref "/controller/infrastructure/locations/manage-locations.md" >}}) -- [Create and Manage Instance Templates]({{< relref "/controller/infrastructure/instances/manage-instance-templates.md" >}}) -- [Add an AWS NGINX Instance]({{< relref "/controller/infrastructure/instances/add-aws-instance.md" >}}) -- [Add an Azure NGINX Instance]({{< relref "/controller/infrastructure/instances/add-azure-instance.md" >}}) -- [Add a VSphere NGINX Instance]({{< relref "/controller/infrastructure/instances/add-vsphere-instance.md" >}}) +- [Configure the NGINX Controller Agent]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) +- [Set up Metrics Collection]({{< ref "/controller/analytics/metrics/overview-metrics-metadata.md" >}}) +- [Create and Manage Locations for your Instances]({{< ref "/controller/infrastructure/locations/manage-locations.md" >}}) +- [Create and Manage Instance Templates]({{< ref "/controller/infrastructure/instances/manage-instance-templates.md" >}}) +- [Add an AWS NGINX Instance]({{< ref "/controller/infrastructure/instances/add-aws-instance.md" >}}) +- [Add an Azure NGINX Instance]({{< ref "/controller/infrastructure/instances/add-azure-instance.md" >}}) +- [Add a VSphere NGINX Instance]({{< ref "/controller/infrastructure/instances/add-vsphere-instance.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/infrastructure/locations/manage-locations.md b/content/controller/infrastructure/locations/manage-locations.md index 7f06f8167..e9bfa813d 100644 --- a/content/controller/infrastructure/locations/manage-locations.md +++ b/content/controller/infrastructure/locations/manage-locations.md @@ -29,7 +29,7 @@ To create a Location, take the following steps: 1. Select the Location type: - Select `OTHER_LOCATION` to create a Location that's not an orchestrated cloud environment. - - Select `AWS_LOCATION` to create a location for NGINX instances on Amazon Web Services. For instructions on how to deploy NGINX instances on AWS, refer to the tutorial [Add an AWS NGINX Instance]({{< relref "/controller/infrastructure/instances/add-aws-instance.md" >}}). + - Select `AWS_LOCATION` to create a location for NGINX instances on Amazon Web Services. For instructions on how to deploy NGINX instances on AWS, refer to the tutorial [Add an AWS NGINX Instance]({{< ref "/controller/infrastructure/instances/add-aws-instance.md" >}}). 1. (Optional) Add a description. 1. (Optional) Add tags. @@ -50,12 +50,12 @@ Take the following steps to view, edit, or delete a Location: ## What's Next -- [Add an Instance to a Location]({{< relref "/controller/infrastructure/instances/manage-instances.md" >}}) -- [Add an AWS NGINX Instance]({{< relref "/controller/infrastructure/instances/add-aws-instance.md" >}}) -- [Add an Azure NGINX Instance]({{< relref "/controller/infrastructure/instances/add-azure-instance.md" >}}) -- [Add a VSphere NGINX Instance]({{< relref "/controller/infrastructure/instances/add-vsphere-instance.md" >}}) -- [Manage your NGINX Instances]({{< relref "/controller/infrastructure/instances/manage-instances.md" >}}) -- [Manage your NGINX Instance Groups]({{< relref "/controller/infrastructure/instances/manage-instances.md#instance-groups" >}}) +- [Add an Instance to a Location]({{< ref "/controller/infrastructure/instances/manage-instances.md" >}}) +- [Add an AWS NGINX Instance]({{< ref "/controller/infrastructure/instances/add-aws-instance.md" >}}) +- [Add an Azure NGINX Instance]({{< ref "/controller/infrastructure/instances/add-azure-instance.md" >}}) +- [Add a VSphere NGINX Instance]({{< ref "/controller/infrastructure/instances/add-vsphere-instance.md" >}}) +- [Manage your NGINX Instances]({{< ref "/controller/infrastructure/instances/manage-instances.md" >}}) +- [Manage your NGINX Instance Groups]({{< ref "/controller/infrastructure/instances/manage-instances.md#instance-groups" >}}) {{< versions "3.5" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/platform/about/get-controller-version.md b/content/controller/platform/about/get-controller-version.md index 288b74271..32df5daf1 100644 --- a/content/controller/platform/about/get-controller-version.md +++ b/content/controller/platform/about/get-controller-version.md @@ -37,7 +37,7 @@ Running version: 3.14.0 ## Use the NGINX Controller API to Look Up Version Info -To use the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to look up version information, send a GET request to the `/platform/global` endpoint. +To use the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to look up version information, send a GET request to the `/platform/global` endpoint. {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/platform/about/what-is-controller.md b/content/controller/platform/about/what-is-controller.md index 3cec37859..8f3089c4b 100644 --- a/content/controller/platform/about/what-is-controller.md +++ b/content/controller/platform/about/what-is-controller.md @@ -27,7 +27,7 @@ NGINX Controller includes the following key components: - **NGINX Controller Server** - The core server component, installed on your enterprise network. The NGINX Controller server encompasses scalable metrics collection infrastructure, a database, an analytics engine, and a [REST API]({{< relref "/controller/api/overview.md" >}}). + The core server component, installed on your enterprise network. The NGINX Controller server encompasses scalable metrics collection infrastructure, a database, an analytics engine, and a [REST API]({{< ref "/controller/api/overview.md" >}}). - **NGINX Controller User Interface** @@ -35,7 +35,7 @@ NGINX Controller includes the following key components: - **NGINX Controller Agent** - The [Controller Agent]({{< relref "/controller/admin-guides/config-agent/about-controller-agent.md" >}}) is a Golang application that runs on monitored systems. All communications between the NGINX Controller Agent and NGINX Controller are done securely over SSL/TLS. The NGINX Controller Agent always initiates all traffic. + The [Controller Agent]({{< ref "/controller/admin-guides/config-agent/about-controller-agent.md" >}}) is a Golang application that runs on monitored systems. All communications between the NGINX Controller Agent and NGINX Controller are done securely over SSL/TLS. The NGINX Controller Agent always initiates all traffic. {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/platform/access-management/manage-active-directory-auth-provider.md b/content/controller/platform/access-management/manage-active-directory-auth-provider.md index d9eed3e77..b5ef6a79d 100644 --- a/content/controller/platform/access-management/manage-active-directory-auth-provider.md +++ b/content/controller/platform/access-management/manage-active-directory-auth-provider.md @@ -170,7 +170,7 @@ In order to use role-based access control (RBAC) with Microsoft Entra (AD), you You should complete this step immediately after creating the Microsoft Entra authentication provider, before any other changes can be made. {{< /important >}} -1. If you haven't already done so, [create the Role(s) and Role group]({{< relref "manage-roles" >}}) that you want to map the Microsoft Entra permissions to. +1. If you haven't already done so, [create the Role(s) and Role group]({{< ref "manage-roles" >}}) that you want to map the Microsoft Entra permissions to. 1. On the **Platform** menu in the NGINX Controller user interface, select **Auth Providers**, then select the Auth Provider that contains the Microsoft Entra configuration. 1. Set up the Auth Provider *Group Mappings*: @@ -356,7 +356,7 @@ While deletions in the AD are reflected in NGINX Controller immediately, changes In order to use role-based access control (RBAC) with Active Directory (AD), you need to map groups from the AD to NGINX Controller RBAC roles. -1. If you haven't already done so, [create the Role(s) and Role group]({{< relref "manage-roles" >}}) that you want to map the AD permissions to. +1. If you haven't already done so, [create the Role(s) and Role group]({{< ref "manage-roles" >}}) that you want to map the AD permissions to. 1. On the **Platform** menu in the NGINX Controller user interface, select **Auth Providers**, then select the Auth Provider that contains the AD integration. 1. Add the name of the external AD group that you want to map to. diff --git a/content/controller/platform/access-management/manage-roles.md b/content/controller/platform/access-management/manage-roles.md index 885c5cb99..bffb8654e 100644 --- a/content/controller/platform/access-management/manage-roles.md +++ b/content/controller/platform/access-management/manage-roles.md @@ -12,7 +12,7 @@ type: This topic explains how to create and manage Roles and Role Groups. -- **Roles** define a set of permissions that allow or prevent Users from performing operations in F5 NGINX Controller or in an [Environment]({{< relref "/controller/services/manage-environments.md" >}}). +- **Roles** define a set of permissions that allow or prevent Users from performing operations in F5 NGINX Controller or in an [Environment]({{< ref "/controller/services/manage-environments.md" >}}). - **Role Groups** act as a collection of Roles that you can manage as a single resource. All members of a Role Group are assigned the same set of Roles. Role Groups can be mapped only to external auth provider groups; they can not be assigned to local users. @@ -40,7 +40,7 @@ th { | `guest` | `guest_group` | Read-Only | The predefined `guest` Role and `guest_group` Role Group have read-only access to Environments and cannot publish API Definitions. | {{< important >}} -Beginning in NGINX Controller 3.12, users no longer need to have one of the predefined roles. Users are granted a basic set of `READ` permissions for Analytics, Users, Roles, and Licenses. Users without a built-in role no longer have the implicit `READ` permissions for all Environments, Identity Providers, API Definitions, Locations, Providers, and Integrations. You can use the `/platform/roles` endpoint in the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to extend or narrow a role's set of permissions. +Beginning in NGINX Controller 3.12, users no longer need to have one of the predefined roles. Users are granted a basic set of `READ` permissions for Analytics, Users, Roles, and Licenses. Users without a built-in role no longer have the implicit `READ` permissions for all Environments, Identity Providers, API Definitions, Locations, Providers, and Integrations. You can use the `/platform/roles` endpoint in the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to extend or narrow a role's set of permissions. {{< /important >}} ## Permissions @@ -57,12 +57,12 @@ The four permission levels are: By default, all users have `READ` permissions for Analytics, Users, Roles, and Licenses. {{< tip >}} -You can use the `/platform/roles` endpoint in the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to extend this default set of permissions. +You can use the `/platform/roles` endpoint in the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to extend this default set of permissions. {{< /tip >}} ### Example: Inheriting Permissions -Whether for a collection or a specific resource instance, each permission contains a path to a resource and a permission level. Resources that are deeper in the path hierarchy inherit permissions from their parents unless explicitly overwritten. Refer to the [NGINX Controller API Reference Guide]({{< relref "/controller/api/_index.md" >}}) for the resource paths. +Whether for a collection or a specific resource instance, each permission contains a path to a resource and a permission level. Resources that are deeper in the path hierarchy inherit permissions from their parents unless explicitly overwritten. Refer to the [NGINX Controller API Reference Guide]({{< ref "/controller/api/_index.md" >}}) for the resource paths. In this example, all resources under `/services/environments/` inherit `READ` access: @@ -134,9 +134,9 @@ When assigning Roles or Role Groups for users, you should assign the least permi ## Create a Role {{< note >}} -Roles must belong to [Environments]({{< relref "/controller/services/manage-environments.md#about-environments" >}}). If you don't already have an Environment, or you don't want to place your new Role(s) in your existing Environment, you should [create a new Environment]({{< relref "/controller/services/manage-environments.md#create-an-environment" >}}) before you continue. +Roles must belong to [Environments]({{< ref "/controller/services/manage-environments.md#about-environments" >}}). If you don't already have an Environment, or you don't want to place your new Role(s) in your existing Environment, you should [create a new Environment]({{< ref "/controller/services/manage-environments.md#create-an-environment" >}}) before you continue. -The `/platform/roles` endpoint in the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) allows more freedom when creating roles. You can use the Roles API to grant permissions outside of environments, for example to `/reports/`. +The `/platform/roles` endpoint in the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) allows more freedom when creating roles. You can use the Roles API to grant permissions outside of environments, for example to `/reports/`. {{< /note >}} @@ -205,8 +205,8 @@ The predefined Role Groups `admin_group`, `user_group`, and `guest_group` cannot ## What's Next -- [Create a User]({{< relref "/controller/platform/access-management/manage-users.md" >}}) -- [Create an Authentication Provider]({{< relref "/controller/platform/access-management/manage-active-directory-auth-provider.md" >}}) +- [Create a User]({{< ref "/controller/platform/access-management/manage-users.md" >}}) +- [Create an Authentication Provider]({{< ref "/controller/platform/access-management/manage-active-directory-auth-provider.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/platform/access-management/manage-users.md b/content/controller/platform/access-management/manage-users.md index 94825e319..fa3f8b087 100644 --- a/content/controller/platform/access-management/manage-users.md +++ b/content/controller/platform/access-management/manage-users.md @@ -12,9 +12,9 @@ type: This topic explains how to create and manage User resources. -A User resource represents an F5 NGINX Controller User account. [Assign Roles to Users]({{< relref "/controller/platform/access-management/manage-roles.md" >}}) to define what actions Users can perform in NGINX Controller and what [Environment(s)]({{< relref "/controller/services/manage-environments.md" >}}) Users can access. +A User resource represents an F5 NGINX Controller User account. [Assign Roles to Users]({{< ref "/controller/platform/access-management/manage-roles.md" >}}) to define what actions Users can perform in NGINX Controller and what [Environment(s)]({{< ref "/controller/services/manage-environments.md" >}}) Users can access. -By default, all users have `READ` permissions for Analytics, Users, Roles, and Licenses. You can use the `/platform/roles` endpoint in the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to extend or narrow this default set of permissions. +By default, all users have `READ` permissions for Analytics, Users, Roles, and Licenses. You can use the `/platform/roles` endpoint in the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to extend or narrow this default set of permissions. ### Create a User @@ -29,7 +29,7 @@ Take the following steps to create a User: 7. Add an email address. 8. Add a password. 9. (Optional) Add one or more tags. -10. (Optional) Add one or more [Roles]({{< relref "/controller/platform/access-management/manage-roles.md" >}}). The Role specifies the user's permission level. +10. (Optional) Add one or more [Roles]({{< ref "/controller/platform/access-management/manage-roles.md" >}}). The Role specifies the user's permission level. {{< note >}} User account passwords for NGINX Controller must meet the following requirements: @@ -41,7 +41,7 @@ User account passwords for NGINX Controller must meet the following requirements Dictionary words, mangled dictionary words like `p4ssword`, or systematic passwords like `1234567a` are not allowed. -If your organization requires a different password policy, we recommend that you [configure external authentication using Active Directory]({{< relref "/controller/platform/access-management/manage-active-directory-auth-provider.md" >}}) for all users except the primary NGINX Controller admin user. +If your organization requires a different password policy, we recommend that you [configure external authentication using Active Directory]({{< ref "/controller/platform/access-management/manage-active-directory-auth-provider.md" >}}) for all users except the primary NGINX Controller admin user. {{< /note >}} ### Edit or Delete a User @@ -56,8 +56,8 @@ Take the following steps to edit or delete a User: ## What's Next -- [Create a Role or Role Group]({{< relref "/controller/platform/access-management/manage-roles.md" >}}) -- [Create an Authentication Provider]({{< relref "/controller/platform/access-management/manage-active-directory-auth-provider.md" >}}) +- [Create a Role or Role Group]({{< ref "/controller/platform/access-management/manage-roles.md" >}}) +- [Create an Authentication Provider]({{< ref "/controller/platform/access-management/manage-active-directory-auth-provider.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/platform/integrations/aws-integration.md b/content/controller/platform/integrations/aws-integration.md index c2f168445..9d4a2e0e9 100644 --- a/content/controller/platform/integrations/aws-integration.md +++ b/content/controller/platform/integrations/aws-integration.md @@ -43,7 +43,7 @@ To create an AWS Integration, take the following steps: ## What's Next -- [Deploy an Instance on Amazon Web Services]({{< relref "/controller/infrastructure/instances/add-aws-instance.md" >}}) +- [Deploy an Instance on Amazon Web Services]({{< ref "/controller/infrastructure/instances/add-aws-instance.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/platform/integrations/big-ip-self-service.md b/content/controller/platform/integrations/big-ip-self-service.md index 80b82af3d..adb9e1d0b 100644 --- a/content/controller/platform/integrations/big-ip-self-service.md +++ b/content/controller/platform/integrations/big-ip-self-service.md @@ -79,7 +79,7 @@ To add an NGINX instance group to a BIG-IP cluster, take the following steps: 1. In the **HA Type** list, select `BIG-IP`. 1. In the **Integration Reference** list, select the name of your BIG-IP integration. - If you haven't created an integration already, refer to [Create a BIG-IP Integration]({{< relref "/controller/platform/integrations/big-ip-self-service.md#create-a-big-ip-integration" >}}) for instructions. + If you haven't created an integration already, refer to [Create a BIG-IP Integration]({{< ref "/controller/platform/integrations/big-ip-self-service.md#create-a-big-ip-integration" >}}) for instructions. 1. In the **Server Pool IP** box, specify the IP address or CIDR of the NGINX instances to add to the BIG-IP server pool; for example, `198.51.100.0/24`. If using a CIDR, the NGINX instance IP addresses that match the mask will be the member addresses in the BIG-IP server pool. Otherwise, absolute IP addresses are used as pool member addresses. 1. Select **Submit** to create the instance group. @@ -99,10 +99,10 @@ Take the following steps to deploy a gateway with your BIG-IP instance group for 1. Select **Create Gateway**. 1. Complete each of the configuration sections: - - [General Configuration]({{< relref "#general-configuration" >}}) - - [Add Placements]({{< relref "#add-placements" >}}) - - [Set Hostnames]({{< relref "#set-hostnames" >}}) - - [Additional Settings]({{< relref "#additional-settings" >}}) + - [General Configuration]({{< ref "#general-configuration" >}}) + - [Add Placements]({{< ref "#add-placements" >}}) + - [Set Hostnames]({{< ref "#set-hostnames" >}}) + - [Additional Settings]({{< ref "#additional-settings" >}}) 1. When ready, review the API Spec and then select **Submit** to create the Gateway. @@ -120,7 +120,7 @@ On the **Gateways** > **Create Gateway** > **Configuration** page: ### Add Placements -[Gateways]({{< relref "/controller/services/manage-gateways.md#overview" >}}) include placements that reference NGINX instances or instance groups. Gateway placements can be for multiple instances or instance groups, allowing a gateway to deliver services in multiple data centers and/or clouds. Placements define the physical machines that are used to manifest a particular path associated with an [application component]({{< relref "/controller/app-delivery/about-app-delivery.md#components" >}}). +[Gateways]({{< ref "/controller/services/manage-gateways.md#overview" >}}) include placements that reference NGINX instances or instance groups. Gateway placements can be for multiple instances or instance groups, allowing a gateway to deliver services in multiple data centers and/or clouds. Placements define the physical machines that are used to manifest a particular path associated with an [application component]({{< ref "/controller/app-delivery/about-app-delivery.md#components" >}}). On the **Gateways > Create Gateway > Placements** page: @@ -132,7 +132,7 @@ On the **Gateways > Create Gateway > Placements** page: 1. In the **Instance Refs/Instance Groups Refs** box, select the NGINX instance(s) or instance group(s) on which you want to deploy the gateway. {{< note >}} - If you're enabling **High Availability Mode**, select the [high-availability instances that you prepared]({{< relref "/controller/infrastructure/instances/ha-data-plane.md#prepare-the-high-availability-instances" >}}). NGINX Controller supports up to two high-availability instances. + If you're enabling **High Availability Mode**, select the [high-availability instances that you prepared]({{< ref "/controller/infrastructure/instances/ha-data-plane.md#prepare-the-high-availability-instances" >}}). NGINX Controller supports up to two high-availability instances. {{< /note >}} 1. In the **Listen IPs** box, add the IP address(es) on which the server listens for and accepts requests. If you're creating a placement for a BIG-IP Integration, add the virtual IP (VIP) address for the BIG-IP cluster. @@ -179,7 +179,7 @@ On the **Gateways** > **Create Gateway** > **Additional** page: - `Explicitly Enable` - set specific values to use for the keep alive probes. - `Explicitly Disable` - disable keep alive. -1. (Optional) Add [**Config Snippets**]({{< relref "/controller/app-delivery/about-snippets.md" >}}) to customize your NGINX configuration. +1. (Optional) Add [**Config Snippets**]({{< ref "/controller/app-delivery/about-snippets.md" >}}) to customize your NGINX configuration. {{< caution >}} When you use Snippets to customize your NGINX configuration, your changes are applied to the `nginx.conf` file *as is*. NGINX Controller does not verify that your configuration is valid before applying the snippet. diff --git a/content/controller/platform/integrations/datadog-integration.md b/content/controller/platform/integrations/datadog-integration.md index da51b302f..18f41e82b 100644 --- a/content/controller/platform/integrations/datadog-integration.md +++ b/content/controller/platform/integrations/datadog-integration.md @@ -32,6 +32,6 @@ Take the following steps to create an Integration for Datadog: 9. In the **Integration Type** list, select `GENERIC_INTEGRATION`. 10. In the **Endpoint URI** box, add the API endpoint for your Datadog region. For example, `https://api.datadoghq.com/api/v1/series` for metrics or `https://http-intake.logs.datadoghq.com/v1/input` for events. 11. In the **Credential Type** list, select `API_KEY`. -12. In the **API Key** box, add the [Datadog API Key]({{< relref "/controller/analytics/forwarders/forward-analytics-to-datadog.md#generate-datadog-api-token" >}}). +12. In the **API Key** box, add the [Datadog API Key]({{< ref "/controller/analytics/forwarders/forward-analytics-to-datadog.md#generate-datadog-api-token" >}}). 13. Select **Submit**. diff --git a/content/controller/platform/integrations/otlp-integration.md b/content/controller/platform/integrations/otlp-integration.md index 9dd919913..95f66b7a0 100644 --- a/content/controller/platform/integrations/otlp-integration.md +++ b/content/controller/platform/integrations/otlp-integration.md @@ -85,7 +85,7 @@ Take the following steps to create an integration for OpenTelemetry Collector: 7. (Optional) Add a description. 8. (Optional) Add tags. 9. In the **Integration Type** list, select `GENERIC_INTEGRATION`. -10. In the **Endpoint URI** box, add the one of HTTP, HTTPS, gRPC or gRPC+TLS endpoint for your OpenTelemetry Collector. This is the same address that's configured in the OpenTelemetry Collector config in the receivers section. See the [example config]({{< relref "/controller/platform/integrations/otlp-integration.md#example-configuration-for-opentelemetry-collector" >}}): +10. In the **Endpoint URI** box, add the one of HTTP, HTTPS, gRPC or gRPC+TLS endpoint for your OpenTelemetry Collector. This is the same address that's configured in the OpenTelemetry Collector config in the receivers section. See the [example config]({{< ref "/controller/platform/integrations/otlp-integration.md#example-configuration-for-opentelemetry-collector" >}}): - HTTP endpoint should be `http://collector_ip:4319` - HTTPS endpoint should be `https://collector_ip:4318` diff --git a/content/controller/platform/integrations/splunk-integration.md b/content/controller/platform/integrations/splunk-integration.md index 33dce20b6..81bcdd06a 100644 --- a/content/controller/platform/integrations/splunk-integration.md +++ b/content/controller/platform/integrations/splunk-integration.md @@ -44,5 +44,5 @@ Take the following steps to create an Integration for Splunk: 9. In the **Integration Type** list, select `GENERIC_INTEGRATION`. 10. In the **Endpoint URI** box, add the Splunk collector URL. 11. In the **Credential Type** list, select `API_KEY`. -12. In the **API Key** box, add the [Splunk token value]({{< relref "/controller/analytics/forwarders/forward-analytics-to-splunk.md#set-up-splunk-to-monitor-data" >}}). +12. In the **API Key** box, add the [Splunk token value]({{< ref "/controller/analytics/forwarders/forward-analytics-to-splunk.md#set-up-splunk-to-monitor-data" >}}). 13. Select **Submit**. diff --git a/content/controller/platform/licensing-controller.md b/content/controller/platform/licensing-controller.md index 446860c4f..d302723bd 100644 --- a/content/controller/platform/licensing-controller.md +++ b/content/controller/platform/licensing-controller.md @@ -47,7 +47,7 @@ To add or update a license for NGINX Controller, take the following steps: 1. Select **Save license**. -{{< see-also >}}To add a license using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PUT request to the `/platform/license` endpoint. Provide your CAT or NGINX Controller license as a base64-encoded string in the JSON request body.{{< /see-also >}} +{{< see-also >}}To add a license using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PUT request to the `/platform/license` endpoint. Provide your CAT or NGINX Controller license as a base64-encoded string in the JSON request body.{{< /see-also >}}   @@ -61,14 +61,14 @@ To view the details for your NGINX Controller license, take the following steps: 1. On the NGINX Controller menu, select **Platform** > **License** > **Controller License**. 2. On the **Licenses** page, you can view the details for the applied licenses, including license limitations, status, and the expiration date. -{{< see-also >}}To view the details for your license(s) using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a GET request to the `/platform/license` endpoint.{{< /see-also >}} +{{< see-also >}}To view the details for your license(s) using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a GET request to the `/platform/license` endpoint.{{< /see-also >}}   --- ## Delete a License -To delete a license using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a DELETE request to the `/platform/license` endpoint. +To delete a license using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a DELETE request to the `/platform/license` endpoint.   @@ -78,7 +78,7 @@ To delete a license using the [NGINX Controller REST API]({{< relref "/controlle - When you license NGINX Controller, you have full access to all of the features included in the license. -- If you haven't licensed NGINX Controller, or if your license has expired, you can still access the following restricted set of features using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}): +- If you haven't licensed NGINX Controller, or if your license has expired, you can still access the following restricted set of features using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}): - Log in and out of NGINX Controller - Manage licenses @@ -110,11 +110,11 @@ Aggregate data is represented by the total volume of bytes in/out per hour for a To verify your license is compliant, check for the following: -- Make sure your usage is within the capacity that your license allows. Refer to the [View License Details]({{< relref "/controller/platform/licensing-controller.md#view-license-details" >}}) section for instructions. +- Make sure your usage is within the capacity that your license allows. Refer to the [View License Details]({{< ref "/controller/platform/licensing-controller.md#view-license-details" >}}) section for instructions. - Ensure your license has not expired. -- If you are using an Association Token, make sure to allow incoming and outgoing connections on port 443 TCP. If you're running NGINX Controller v3.15 or earlier, also enable incoming and outgoing connections on port 8883 TCP. These ports are used for validating the entitlements for your license. Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#firewallip-settings" >}}) for these and other firewall requirements. +- If you are using an Association Token, make sure to allow incoming and outgoing connections on port 443 TCP. If you're running NGINX Controller v3.15 or earlier, also enable incoming and outgoing connections on port 8883 TCP. These ports are used for validating the entitlements for your license. Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#firewallip-settings" >}}) for these and other firewall requirements.   @@ -124,8 +124,8 @@ To verify your license is compliant, check for the following: If NGINX Controller appears to be unlicensed after a version upgrade, try the following options to resolve the issue. -- [Re-upload your NGINX Controller license]({{< relref "/controller/platform/licensing-controller.md#add-or-update-a-license" >}}). -- [Restore the NGINX Controller database from a backup]({{< relref "/controller/admin-guides/backup-restore/_index.md" >}}). +- [Re-upload your NGINX Controller license]({{< ref "/controller/platform/licensing-controller.md#add-or-update-a-license" >}}). +- [Restore the NGINX Controller database from a backup]({{< ref "/controller/admin-guides/backup-restore/_index.md" >}}).   @@ -133,7 +133,7 @@ If NGINX Controller appears to be unlicensed after a version upgrade, try the fo ## What's Next -- [Download the NGINX Plus Cert and Key Bundle]({{< relref "/controller/admin-guides/install/get-n-plus-cert-and-key.md" >}}) +- [Download the NGINX Plus Cert and Key Bundle]({{< ref "/controller/admin-guides/install/get-n-plus-cert-and-key.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/platform/maintenance/changing-ip-address.md b/content/controller/platform/maintenance/changing-ip-address.md index 56ee9aaa7..5377f8752 100644 --- a/content/controller/platform/maintenance/changing-ip-address.md +++ b/content/controller/platform/maintenance/changing-ip-address.md @@ -16,7 +16,7 @@ This topic explains how to safely update the management IP of F5 NGINX Controlle {{< see-also >}} For instructions on how to deploy NGINX Controller as a multi-node resilient cluster, refer to the following deployment guide: -- [Deploy NGINX Controller as a Resilient Cluster on a Private Cloud]({{< relref "/controller/admin-guides/install/resilient-cluster-private-cloud.md" >}}) +- [Deploy NGINX Controller as a Resilient Cluster on a Private Cloud]({{< ref "/controller/admin-guides/install/resilient-cluster-private-cloud.md" >}}) {{< /see-also >}} @@ -24,11 +24,11 @@ For instructions on how to deploy NGINX Controller as a multi-node resilient clu To change the IP of a multi-node cluster, follow the steps below for each node in the cluster: -- [Remove the node from the cluster]({{< relref "#remove-node">}}) -- [Change the IP address (public and private)]({{< relref "#change-ip">}}) -- [Reboot the node]({{< relref "#reboot-node">}}) -- [Add the node back to the cluster]({{< relref "#add-node">}}) -- [Change the FQDN]({{< relref "#fqdn">}}) +- [Remove the node from the cluster]({{< ref "#remove-node">}}) +- [Change the IP address (public and private)]({{< ref "#change-ip">}}) +- [Reboot the node]({{< ref "#reboot-node">}}) +- [Add the node back to the cluster]({{< ref "#add-node">}}) +- [Change the FQDN]({{< ref "#fqdn">}}) ### 1. Remove node from the cluster @@ -45,7 +45,7 @@ Deleting nodes makes NGINX Controller momentarily unavailable while the cluster 5. Select **Delete** to confirm. {{< see-also >}} - To delete nodes from your cluster using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a DELETE request to the `/platform/nodes` endpoint. + To delete nodes from your cluster using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a DELETE request to the `/platform/nodes` endpoint. {{< /see-also >}} @@ -78,7 +78,7 @@ Refer to your Linux distribution documentation for specific instructions. ``` 1. Upload and extract the `controller-installer-.tar.gz` tarball. - 1. Run the `install.sh` command with the join-key copied in the previous step. If the join-key has expired, you can get a new one by following the steps in this topic to add a node using the web interface or the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}). + 1. Run the `install.sh` command with the join-key copied in the previous step. If the join-key has expired, you can get a new one by following the steps in this topic to add a node using the web interface or the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}). ```bash cd controller-installer @@ -88,12 +88,12 @@ Refer to your Linux distribution documentation for specific instructions. 1. After the installation is complete, the node status in the web interface changes to `Configured`. {{< see-also >}} -To add nodes to your cluster using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a POST request to the `/platform/nodes` endpoint. +To add nodes to your cluster using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a POST request to the `/platform/nodes` endpoint. {{< /see-also >}} ### 5. Change the FQDN -[Change the FQDN]({{< relref "/controller/platform/manage-cluster.md#update-the-fqdn">}}) if it has been affected by the IP change. +[Change the FQDN]({{< ref "/controller/platform/manage-cluster.md#update-the-fqdn">}}) if it has been affected by the IP change. {{< important >}} Repeat the steps for each node in the cluster. @@ -113,7 +113,7 @@ To change the IP of a single node: opt/nginx-controller/helper.sh configsmtp false ``` -1. [Change the FQDN]({{< relref "/controller/platform/manage-cluster.md#update-the-fqdn">}}) if it has been affected by the IP change. +1. [Change the FQDN]({{< ref "/controller/platform/manage-cluster.md#update-the-fqdn">}}) if it has been affected by the IP change. {{< versions "3.12" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/platform/manage-cluster.md b/content/controller/platform/manage-cluster.md index 47b7d8ecc..c187e0c3e 100644 --- a/content/controller/platform/manage-cluster.md +++ b/content/controller/platform/manage-cluster.md @@ -17,7 +17,7 @@ This topic explains how to update your cluster settings and how to manage nodes {{< see-also >}} For instructions on how to deploy NGINX Controller as a multi-node resilient cluster, refer to the following deployment guide: -- [Deploy F5 NGINX Controller as a Resilient Cluster on a Private Cloud]({{< relref "/controller/admin-guides/install/resilient-cluster-private-cloud.md" >}}) +- [Deploy F5 NGINX Controller as a Resilient Cluster on a Private Cloud]({{< ref "/controller/admin-guides/install/resilient-cluster-private-cloud.md" >}}) {{< /see-also >}} @@ -45,7 +45,7 @@ Take the following steps to add a floating IP for your private cloud cluster: 1. Complete the steps to [update the FQDN](#update-the-fqdn) to use the floating IP. {{< see-also >}} -To set a floating IP using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. +To set a floating IP using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. {{< /see-also >}} @@ -77,7 +77,7 @@ To change the FQDN for NGINX Controller using the web interface, take the follow 1. Follow the steps to [update the FQDN for Controller Agents](#update-the-fqdn-for-controller-agents). {{< see-also >}} -To change the FQDN for NGINX Controller using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. +To change the FQDN for NGINX Controller using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. {{< /see-also >}} ### Update the FQDN for Controller Agents @@ -116,7 +116,7 @@ Take the following steps to update the API Gateway SSL certificate: 1. Select **Save**. {{< see-also >}} -To update the API Gateway SSL certificate and key using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. +To update the API Gateway SSL certificate and key using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. {{< /see-also >}} @@ -148,7 +148,7 @@ Take the following steps to add a node to the cluster: ``` 1. Upload and extract the `controller-installer-.tar.gz` tarball. -1. Run the `install.sh` command with the join-key that you copied in the previous step. If you get an error that the join-key has expired, you can get a new one by following the steps in this topic to add a node using the web interface or the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}). +1. Run the `install.sh` command with the join-key that you copied in the previous step. If you get an error that the join-key has expired, you can get a new one by following the steps in this topic to add a node using the web interface or the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}). ```bash cd controller-installer @@ -159,7 +159,7 @@ Take the following steps to add a node to the cluster: 1. Repeat these steps for each node that you want to add to the cluster. {{< see-also >}} -To add nodes to your cluster using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a POST request to the `/platform/nodes` endpoint. +To add nodes to your cluster using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a POST request to the `/platform/nodes` endpoint. {{< /see-also >}} ## View Node Status @@ -167,7 +167,7 @@ To add nodes to your cluster using the [NGINX Controller REST API]({{< relref "/ Take the following steps to view the status for a node: {{< see-also >}} -To view a node's status using the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}), send a GET request to the Nodes endpoint. +To view a node's status using the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}), send a GET request to the Nodes endpoint. {{< /see-also >}} 1. Open the NGINX Controller web interface and log in. @@ -186,7 +186,7 @@ Deleting nodes can cause NGINX Controller to become momentarily unavailable whil {{< /important >}} {{< see-also >}} -To delete nodes from your cluster using the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}), send a DELETE request to the Nodes endpoint. +To delete nodes from your cluster using the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}), send a DELETE request to the Nodes endpoint. {{< /see-also >}} To delete a node from the cluster using the web interface: @@ -206,7 +206,7 @@ To delete a node from the cluster using the web interface: ``` {{< see-also >}} -To delete nodes from your cluster using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a DELETE request to the `/platform/nodes` endpoint. +To delete nodes from your cluster using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a DELETE request to the `/platform/nodes` endpoint. {{< /see-also >}} @@ -234,7 +234,7 @@ Active users will be logged out from NGINX Controller during an update. We recom To update your cluster to a newer version of NGINX Controller, take the following steps: -1. Before updating the cluster, [check each node's status]({{< relref "/controller/platform/manage-cluster.md#view-node-status" >}}) to confirm the nodes are healthy. Resolve any degradations before updating. +1. Before updating the cluster, [check each node's status]({{< ref "/controller/platform/manage-cluster.md#view-node-status" >}}) to confirm the nodes are healthy. Resolve any degradations before updating. 1. Download the new installer package from the [MyF5 Customer Portal](https://my.f5.com/manage/s/downloads). 1. Extract the installer package and save the contents to each node: diff --git a/content/controller/releases/adc/adc-release-notes-3.20.1.md b/content/controller/releases/adc/adc-release-notes-3.20.1.md index 70087b926..3d3d02852 100644 --- a/content/controller/releases/adc/adc-release-notes-3.20.1.md +++ b/content/controller/releases/adc/adc-release-notes-3.20.1.md @@ -55,4 +55,4 @@ The following issues are known to be present in this release. Look for updates t ## Supported NGINX Plus Versions -Check the [NGINX Controller Tech Specs guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Check the [NGINX Controller Tech Specs guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. diff --git a/content/controller/releases/adc/adc-release-notes-3.20.md b/content/controller/releases/adc/adc-release-notes-3.20.md index 076c07f0f..eeb4b45ac 100644 --- a/content/controller/releases/adc/adc-release-notes-3.20.md +++ b/content/controller/releases/adc/adc-release-notes-3.20.md @@ -53,7 +53,7 @@ Take note of the following considerations when upgrading to this version of the - **Bring your own custom NGINX App Protect WAF Policy to configure app security** - Now, you can [use your own custom NGINX App Protect WAF JSON declarative policy]({{< relref "/controller/app-delivery/security/concepts/bring-your-own-policy.md" >}}) as your WAF policy with NGINX Controller, in addition to using the default policy. F5 Advanced WAF and BIG-IP Application Security Module (ASM) customers can convert their standardized WAF policy to an App Protect policy to use with NGINX Controller. + Now, you can [use your own custom NGINX App Protect WAF JSON declarative policy]({{< ref "/controller/app-delivery/security/concepts/bring-your-own-policy.md" >}}) as your WAF policy with NGINX Controller, in addition to using the default policy. F5 Advanced WAF and BIG-IP Application Security Module (ASM) customers can convert their standardized WAF policy to an App Protect policy to use with NGINX Controller. ## NAP Vulnerability Fixes @@ -223,4 +223,4 @@ The following issues are known to be present in this release. Look for updates t ## Supported NGINX Plus Versions -Check the [NGINX Controller Tech Specs guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Check the [NGINX Controller Tech Specs guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. diff --git a/content/controller/releases/adc/adc-release-notes-3.21.md b/content/controller/releases/adc/adc-release-notes-3.21.md index e63c0af3c..1f8fdacc4 100644 --- a/content/controller/releases/adc/adc-release-notes-3.21.md +++ b/content/controller/releases/adc/adc-release-notes-3.21.md @@ -203,4 +203,4 @@ The following issues are known to be present in this release. Look for updates t ## Supported NGINX Plus Versions -Check the [NGINX Controller Tech Specs guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Check the [NGINX Controller Tech Specs guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. diff --git a/content/controller/releases/adc/adc-release-notes-3.22.1.md b/content/controller/releases/adc/adc-release-notes-3.22.1.md index d9cc65174..be4725b06 100644 --- a/content/controller/releases/adc/adc-release-notes-3.22.1.md +++ b/content/controller/releases/adc/adc-release-notes-3.22.1.md @@ -81,4 +81,4 @@ The following issues are known to be present in this release. Look for updates t ## Supported NGINX Plus Versions -Check the [NGINX Controller Tech Specs guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Check the [NGINX Controller Tech Specs guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. diff --git a/content/controller/releases/adc/adc-release-notes-3.22.2.md b/content/controller/releases/adc/adc-release-notes-3.22.2.md index 586c068bc..5c34ef08d 100644 --- a/content/controller/releases/adc/adc-release-notes-3.22.2.md +++ b/content/controller/releases/adc/adc-release-notes-3.22.2.md @@ -21,7 +21,7 @@ March 9, 2022 NGINX Controller App Delivery Module release 3.22.2 supports the latest (at the time of release) following four NGINX Plus versions: R23, R24, R25, and R26. -We recommend you [upgrade the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller App Delivery Module. +We recommend you [upgrade the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller App Delivery Module. If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh` script on each node individually -- the order in which you update the nodes doesn't matter. @@ -179,4 +179,4 @@ The following issues are known to be present in this release. Look for updates t ## Supported NGINX Plus Versions -Check the [NGINX Controller Tech Specs guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Check the [NGINX Controller Tech Specs guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. diff --git a/content/controller/releases/adc/adc-release-notes-3.22.3.md b/content/controller/releases/adc/adc-release-notes-3.22.3.md index ad259a183..2e5b929a0 100644 --- a/content/controller/releases/adc/adc-release-notes-3.22.3.md +++ b/content/controller/releases/adc/adc-release-notes-3.22.3.md @@ -21,7 +21,7 @@ May 12, 2022 NGINX Controller App Delivery Module 3.22.3 supports upgrades from 3.6.0 and newer versions. -We recommend you [upgrade the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. +We recommend you [upgrade the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh` script on each node individually -- the order in which you update the nodes doesn't matter. @@ -141,4 +141,4 @@ The following issues are known to be present in this release. Look for updates t ### Supported NGINX Plus Versions -Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. diff --git a/content/controller/releases/adc/adc-release-notes-3.22.4.md b/content/controller/releases/adc/adc-release-notes-3.22.4.md index fd71f5470..d9a643241 100644 --- a/content/controller/releases/adc/adc-release-notes-3.22.4.md +++ b/content/controller/releases/adc/adc-release-notes-3.22.4.md @@ -21,7 +21,7 @@ August 16, 2022 NGINX Controller App Delivery Module 3.22.4 supports upgrades from 3.17.0 and newer versions. -We recommend you [upgrade the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. +We recommend you [upgrade the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh` script on each node individually -- the order in which you update the nodes doesn't matter. @@ -29,7 +29,7 @@ If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh ### Supported NGINX Plus Versions -Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. ## What's New diff --git a/content/controller/releases/adc/adc-release-notes-3.22.5.md b/content/controller/releases/adc/adc-release-notes-3.22.5.md index 38b8dd89c..1a2d67d64 100644 --- a/content/controller/releases/adc/adc-release-notes-3.22.5.md +++ b/content/controller/releases/adc/adc-release-notes-3.22.5.md @@ -21,7 +21,7 @@ September 12, 2022 NGINX Controller App Delivery Module 3.22.5 supports upgrades from 3.17.0 and newer versions. -We recommend you [upgrade the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. +We recommend you [upgrade the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh` script on each node individually -- the order in which you update the nodes doesn't matter. @@ -29,7 +29,7 @@ If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh ### Supported NGINX Plus Versions -Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. ## What's New diff --git a/content/controller/releases/adc/adc-release-notes-3.22.6.md b/content/controller/releases/adc/adc-release-notes-3.22.6.md index 827c96bb4..75d6bd8ac 100644 --- a/content/controller/releases/adc/adc-release-notes-3.22.6.md +++ b/content/controller/releases/adc/adc-release-notes-3.22.6.md @@ -21,7 +21,7 @@ December 12, 2022 NGINX Controller App Delivery Module 3.22.6 supports upgrades from 3.20.1 and newer versions. -We recommend you [upgrade the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. +We recommend you [upgrade the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh` script on each node individually -- the order in which you update the nodes doesn't matter. @@ -29,7 +29,7 @@ If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh ### Supported NGINX Plus Versions -Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. ## What's New diff --git a/content/controller/releases/adc/adc-release-notes-3.22.7.md b/content/controller/releases/adc/adc-release-notes-3.22.7.md index 36271ea7f..a1883fb55 100644 --- a/content/controller/releases/adc/adc-release-notes-3.22.7.md +++ b/content/controller/releases/adc/adc-release-notes-3.22.7.md @@ -21,7 +21,7 @@ February 13, 2023 NGINX Controller App Delivery Module 3.22.7 supports upgrades from 3.20.1 and newer versions. -We recommend you [upgrade the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. +We recommend you [upgrade the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh` script on each node individually -- the order in which you update the nodes doesn't matter. @@ -31,7 +31,7 @@ If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh ## Supported NGINX Plus Versions -Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release.
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.8.md b/content/controller/releases/adc/adc-release-notes-3.22.8.md index 52885fa05..43d27fea1 100644 --- a/content/controller/releases/adc/adc-release-notes-3.22.8.md +++ b/content/controller/releases/adc/adc-release-notes-3.22.8.md @@ -21,7 +21,7 @@ February 22, 2023 - NGINX Controller App Delivery Module 3.22.8 supports upgrades from 3.20.1 and newer versions. - We recommend you [upgrade the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. + We recommend you [upgrade the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh` script on each node individually -- the order in which you update the nodes doesn't matter. @@ -31,7 +31,7 @@ February 22, 2023 ## Supported NGINX Plus Versions -- Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +- Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release.
diff --git a/content/controller/releases/adc/adc-release-notes-3.22.9.md b/content/controller/releases/adc/adc-release-notes-3.22.9.md index 65df121d2..7a073233a 100644 --- a/content/controller/releases/adc/adc-release-notes-3.22.9.md +++ b/content/controller/releases/adc/adc-release-notes-3.22.9.md @@ -20,7 +20,7 @@ September 06, 2023 - NGINX Controller App Delivery Module 3.22.9 supports upgrades from 3.22.4 and newer versions. - We recommend you [upgrade the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. + We recommend you [upgrade the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent#update-the-nginx-controller-agent" >}}) whenever you upgrade NGINX Controller. If you're upgrading NGINX Controller on a multi-node cluster, run the `update.sh` script on each node individually -- the order in which you update the nodes doesn't matter. diff --git a/content/controller/releases/adc/adc-release-notes-3.22.md b/content/controller/releases/adc/adc-release-notes-3.22.md index f549c3ebc..3aa65aa56 100644 --- a/content/controller/releases/adc/adc-release-notes-3.22.md +++ b/content/controller/releases/adc/adc-release-notes-3.22.md @@ -75,7 +75,7 @@ Take note of the following considerations when upgrading to this version of the - **OIDC Authentication with Microsoft Entra as the IDP** - NGINX Controller ADC Release 3.22 includes [support for OpenID Connect (OIDC) authentication]({{< relref "/controller/platform/access-management/manage-active-directory-auth-provider.md" >}}) when the Identity Provider is Microsoft Entra. + NGINX Controller ADC Release 3.22 includes [support for OpenID Connect (OIDC) authentication]({{< ref "/controller/platform/access-management/manage-active-directory-auth-provider.md" >}}) when the Identity Provider is Microsoft Entra. - **Support for SELinux** @@ -83,7 +83,7 @@ Take note of the following considerations when upgrading to this version of the - **Added Technology Preview of RHEL 8 Support for Controller Hosts** - Support for RHEL 8 is a technology preview. Installing NGINX Controller and agent on RHEL 8 seems to work well in low-scale deployments for testing and proof of concept purposes. Installing NGINX Controller on RHEL 8 for large-scale deployments has not been tested. Possibility of performance or stability issues exist. Therefore, we strongly recommend testing Controller on RHEL 8 for scale in a test environment before deploying to production. See the [Install NGINX Controller on RHEL 8]({{< relref "/controller/admin-guides/install/install-nginx-controller-rhel-8.md" >}}) document to prepare your RHEL 8 system to install NGINX Controller and the NGINX Controller Agent. + Support for RHEL 8 is a technology preview. Installing NGINX Controller and agent on RHEL 8 seems to work well in low-scale deployments for testing and proof of concept purposes. Installing NGINX Controller on RHEL 8 for large-scale deployments has not been tested. Possibility of performance or stability issues exist. Therefore, we strongly recommend testing Controller on RHEL 8 for scale in a test environment before deploying to production. See the [Install NGINX Controller on RHEL 8]({{< ref "/controller/admin-guides/install/install-nginx-controller-rhel-8.md" >}}) document to prepare your RHEL 8 system to install NGINX Controller and the NGINX Controller Agent. - **Adds support for NGINX App Protect v3.7** @@ -387,4 +387,4 @@ The following issues are known to be present in this release. Look for updates t ## Supported NGINX Plus Versions -Check the [NGINX Controller Tech Specs guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Check the [NGINX Controller Tech Specs guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. diff --git a/content/controller/releases/apim/apim-release-notes-3.18.md b/content/controller/releases/apim/apim-release-notes-3.18.md index dc97e3107..4e165a625 100644 --- a/content/controller/releases/apim/apim-release-notes-3.18.md +++ b/content/controller/releases/apim/apim-release-notes-3.18.md @@ -49,7 +49,7 @@ Take note of the following considerations when upgrading to this version of the This release includes the following fixes. To locate the details for an issue when it was first reported, search the NGINX Docs for the issue ID. -- Specifying a URI to a JWK Set file is not supported on instances with multiple gateways ([17124]({{< relref "/controller/releases/release-notes.md#apim-17124" >}})) +- Specifying a URI to a JWK Set file is not supported on instances with multiple gateways ([17124]({{< ref "/controller/releases/release-notes.md#apim-17124" >}})) ## Known Issues @@ -77,11 +77,11 @@ The following issues are known to be present in this release. Look for updates t - **Instructions for restoring external config database may not restore published APIs (26280)** - The commands in the [Back Up & Restore External Config Database]({{< relref "/controller/admin-guides/backup-restore/backup-restore-external-config-db.md" >}}) guide may not restore published APIs from the backup archive. + The commands in the [Back Up & Restore External Config Database]({{< ref "/controller/admin-guides/backup-restore/backup-restore-external-config-db.md" >}}) guide may not restore published APIs from the backup archive. **Workaround:** - Follow the steps in the "Before You Begin" section in the ({{< relref "/controller/admin-guides/backup-restore/backup-restore-external-config-db.md" >}}) guide. + Follow the steps in the "Before You Begin" section in the ({{< ref "/controller/admin-guides/backup-restore/backup-restore-external-config-db.md" >}}) guide. In the section titled "Back Up External Config Database," replace step 2 with the following step, then proceed as per the documentation. diff --git a/content/controller/releases/apim/apim-release-notes-3.19.4.md b/content/controller/releases/apim/apim-release-notes-3.19.4.md index c1a365c6d..a836bb66f 100644 --- a/content/controller/releases/apim/apim-release-notes-3.19.4.md +++ b/content/controller/releases/apim/apim-release-notes-3.19.4.md @@ -49,4 +49,4 @@ The following issues are known to be present in this release. Look for updates t ## Supported NGINX Plus Versions -Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. diff --git a/content/controller/releases/apim/apim-release-notes-3.19.5.md b/content/controller/releases/apim/apim-release-notes-3.19.5.md index e20d43d52..2a8d44b63 100644 --- a/content/controller/releases/apim/apim-release-notes-3.19.5.md +++ b/content/controller/releases/apim/apim-release-notes-3.19.5.md @@ -45,4 +45,4 @@ This release fixes the following issues. To view the history for an issue, searc ## Supported NGINX Plus Versions -Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. +Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by this release. diff --git a/content/controller/releases/apim/apim-release-notes-3.19.6.md b/content/controller/releases/apim/apim-release-notes-3.19.6.md index acf0ae432..caa74a837 100644 --- a/content/controller/releases/apim/apim-release-notes-3.19.6.md +++ b/content/controller/releases/apim/apim-release-notes-3.19.6.md @@ -36,4 +36,4 @@ Take note of the following considerations when upgrading to this version of the NGINX API Management Module 3.19.6 adds support for NGINX Plus R26, R27, R28 and R29. -Refer to the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by every release. +Refer to the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs#nginx-plus-instances" >}}) to learn about the NGINX Plus versions supported by every release. diff --git a/content/controller/releases/apim/apim-release-notes-3.19.md b/content/controller/releases/apim/apim-release-notes-3.19.md index 811f6e123..d443b7f00 100644 --- a/content/controller/releases/apim/apim-release-notes-3.19.md +++ b/content/controller/releases/apim/apim-release-notes-3.19.md @@ -31,7 +31,7 @@ Take note of the following considerations when upgrading to this version of the - **NGINX Controller API Management Advanced Security** - You can use the [App Security add-on]({{< relref "/controller/app-delivery/security/concepts/_index.md" >}})for NGINX Controller APIM to enable Web Application Firewall (WAF) capabilities to protect your APIs. WAF lets you flag or block suspicious requests or attacks. + You can use the [App Security add-on]({{< ref "/controller/app-delivery/security/concepts/_index.md" >}})for NGINX Controller APIM to enable Web Application Firewall (WAF) capabilities to protect your APIs. WAF lets you flag or block suspicious requests or attacks. - **Support added for multiple `API key` identity providers on a component** diff --git a/content/controller/releases/release-notes.md b/content/controller/releases/release-notes.md index e29c60e2e..13feddc5b 100644 --- a/content/controller/releases/release-notes.md +++ b/content/controller/releases/release-notes.md @@ -20,8 +20,8 @@ Technical support is provided for earlier versions of NGINX Controller that were {{< see-also >}} For related installation documentation, refer to the following publications: -- [NGINX Controller Installation Guide]({{< relref "/controller/admin-guides/backup-restore/_index.md" >}}) -- [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) +- [NGINX Controller Installation Guide]({{< ref "/controller/admin-guides/backup-restore/_index.md" >}}) +- [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) {{< /see-also >}}   @@ -124,7 +124,7 @@ NGINX Controller v3.18.0 includes the following new features, improvements, know ### Updates - Bug fixes and improvements. -- Improvements to the [Data Explorer]({{< relref "/controller/analytics/data-explorer/how-to-use.md" >}}) make it easier to see your data's dimensions and preview the discrete values. +- Improvements to the [Data Explorer]({{< ref "/controller/analytics/data-explorer/how-to-use.md" >}}) make it easier to see your data's dimensions and preview the discrete values. - Adds support for NGINX Plus R23 p1 and R24 p1. @@ -338,11 +338,11 @@ These release notes provide general information and describe known issues for NG - **(Beta) Bring your own custom NGINX App Protect Policy to configure WAF** - Now, you can [bring your own custom NGINX App Protect JSON declarative policy]({{< relref "/controller/app-delivery/security/concepts/bring-your-own-policy.md" >}}) to use as your WAF policy with NGINX Controller, in addition to using the default policy. F5 Advanced WAF and BIG-IP Application Security Module (ASM) customers can convert their standardized WAF policy to an App Protect policy to use with NGINX Controller. **Note**: This feature is available only through the NGINX Controller API for this beta release. + Now, you can [bring your own custom NGINX App Protect JSON declarative policy]({{< ref "/controller/app-delivery/security/concepts/bring-your-own-policy.md" >}}) to use as your WAF policy with NGINX Controller, in addition to using the default policy. F5 Advanced WAF and BIG-IP Application Security Module (ASM) customers can convert their standardized WAF policy to an App Protect policy to use with NGINX Controller. **Note**: This feature is available only through the NGINX Controller API for this beta release. - **The new Data Explorer view unlocks an easier way to view metrics** - The new [Data Explorer]({{< relref "/controller/analytics/data-explorer/how-to-use.md" >}}) view gets you to your data faster, so you can understand what's happening in your environment with ease. Effortlessly switch between contexts, metrics, and dimensions; specify a time range; set the aggregation mode; and more. + The new [Data Explorer]({{< ref "/controller/analytics/data-explorer/how-to-use.md" >}}) view gets you to your data faster, so you can understand what's happening in your environment with ease. Effortlessly switch between contexts, metrics, and dimensions; specify a time range; set the aggregation mode; and more. - **Improved user experience working with APIs** @@ -350,7 +350,7 @@ These release notes provide general information and describe known issues for NG - **Easily enable or disable High Availability mode by updating gateways** - Prior to NGINX Controller v3.17, you had to delete and recreate gateways to [enable or disable HA (high availability) mode]({{< relref "/controller/infrastructure/instances/ha-data-plane.md" >}}) . Now, you can enable or disable HA mode on the fly by simply updating the existing gateway. + Prior to NGINX Controller v3.17, you had to delete and recreate gateways to [enable or disable HA (high availability) mode]({{< ref "/controller/infrastructure/instances/ha-data-plane.md" >}}) . Now, you can enable or disable HA mode on the fly by simply updating the existing gateway. - **Adds capability to view the total number of Security Events matching dimensional filters** @@ -442,11 +442,11 @@ These release notes provide general information and describe known issues for NG You no longer need to open port 8883 to license NGINX Controller with an Association Token. You still need to open port 443, however. - See [Licensing NGINX Controller]({{< relref "/controller/platform/licensing-controller.md" >}}) for instructions. + See [Licensing NGINX Controller]({{< ref "/controller/platform/licensing-controller.md" >}}) for instructions. - **Adds support for SSL settings in health checks when multiple virtual hosts are defined per workload group member** - Auto-generated health check location blocks now include any `proxy_ssl` settings that have been defined in the TLS object in the web backend object. For example, using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to set + Auto-generated health check location blocks now include any `proxy_ssl` settings that have been defined in the TLS object in the web backend object. For example, using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to set ```json "tls":{"isServerNameEnabled": true, "name": "$host"} @@ -458,11 +458,11 @@ These release notes provide general information and describe known issues for NG Active Directory integration with NGINX Controller now supports LDAPS and unencrypted LDAP, in addition to StartTLS. - Refer to [Configure Active Directory Integration]({{< relref "/controller/platform/access-management/manage-active-directory-auth-provider.md" >}}) for instructions on how to add an Active Directory provider to NGINX Controller for external authentication. + Refer to [Configure Active Directory Integration]({{< ref "/controller/platform/access-management/manage-active-directory-auth-provider.md" >}}) for instructions on how to add an Active Directory provider to NGINX Controller for external authentication. - **Data Forwarders are no longer restricted** - While in beta, [Data Forwarders]({{< relref "/controller/analytics/forwarders" >}}) had restrictions to limit the number of stream sources that could be defined. These restrictions have been lifted. + While in beta, [Data Forwarders]({{< ref "/controller/analytics/forwarders" >}}) had restrictions to limit the number of stream sources that could be defined. These restrictions have been lifted. @@ -514,7 +514,7 @@ The following issues are known to be present in this release. Look for updates t **Workaround:** - To resolve this error, you'll need to uninstall and then re-install the Controller Agent. Refer to the [NGINX Controller Agent Installation Guide]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) for instructions. + To resolve this error, you'll need to uninstall and then re-install the Controller Agent. Refer to the [NGINX Controller Agent Installation Guide]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) for instructions. @@ -576,9 +576,9 @@ These release notes provide general information and describe known issues for NG The NGINX Controller docs are now using our own Dev Portal user interface to display the NGINX Controller API documentation. Check it out at: - [https://docs.nginx.com/nginx-controller/api/reference/ctlr-v1/]({{< relref "/controller/api/_index.md" >}}) + [https://docs.nginx.com/nginx-controller/api/reference/ctlr-v1/]({{< ref "/controller/api/_index.md" >}}) - Refer to the [API Management documentation]({{< relref "/controller/api-management" >}}) to learn more about using Dev Portals for your APIs. + Refer to the [API Management documentation]({{< ref "/controller/api-management" >}}) to learn more about using Dev Portals for your APIs. @@ -601,11 +601,11 @@ The following issues are known to be present in this release. Look for updates t - **Installing NGINX Controller on a misconfigured NFS server fails with the error "Bundled DB did not start successfully" (22751)** - When installing NGINX Controller on an NFSv3 server, if the [NFS requirements]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-controller-database-requirements" >}}) are not met, the installation may fail with an error similar to the following: "Bundled DB did not start successfully." + When installing NGINX Controller on an NFSv3 server, if the [NFS requirements]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#nginx-controller-database-requirements" >}}) are not met, the installation may fail with an error similar to the following: "Bundled DB did not start successfully." **Workaround:** - See the [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) for the NFS requirements. The `no_root_squash` option must be set for the mount point on the NFS server. If this is not allowed, the owner of the path used for the analytics database must be set to `101:101`, and the owner of the path for the config database must be set to `70:70`. + See the [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) for the NFS requirements. The `no_root_squash` option must be set for the mount point on the NFS server. If this is not allowed, the owner of the path used for the analytics database must be set to `101:101`, and the owner of the path for the config database must be set to `70:70`. After editing the exports file, the directories need to be removed to ensure no files are leftover from the previous installation. Then, enable the `rpc-statd` service and restart the NFS server. @@ -685,7 +685,7 @@ The following issues are known to be present in this release. Look for updates t **Workaround:** - You can access the Catalogs and Dev Portals API overview pages in the NGINX Controller docs online. To do so, go to [https://docs.nginx.com/nginx-controller/api/reference/ctlr-v1]({{< relref "/controller/api/_index.md" >}}) and navigate to the overview page for the desired endpoint. + You can access the Catalogs and Dev Portals API overview pages in the NGINX Controller docs online. To do so, go to [https://docs.nginx.com/nginx-controller/api/reference/ctlr-v1]({{< ref "/controller/api/_index.md" >}}) and navigate to the overview page for the desired endpoint. @@ -720,9 +720,9 @@ These release notes provide general information and describe known issues for NG - **Monitor your apps' metrics with Alert Rules** - Now you can create [Alert Rules]({{< relref "/controller/analytics/alerts/about-alerts#alert-rules" >}}) for app-centric metrics using the NGINX Controller web interface or [REST API]({{< relref "/controller/api/_index.md" >}}). Also, the web interface for Alerts has a new and improved design. + Now you can create [Alert Rules]({{< ref "/controller/analytics/alerts/about-alerts#alert-rules" >}}) for app-centric metrics using the NGINX Controller web interface or [REST API]({{< ref "/controller/api/_index.md" >}}). Also, the web interface for Alerts has a new and improved design. - To create Alert Rules, refer to the [Manage Alerts]({{< relref "/controller/analytics/alerts/manage-alerts" >}}) topic. For information about the metrics that you can monitor, see the [NGINX Controller Metrics Catalog]({{< relref "/controller/analytics/catalogs/metrics" >}}). + To create Alert Rules, refer to the [Manage Alerts]({{< ref "/controller/analytics/alerts/manage-alerts" >}}) topic. For information about the metrics that you can monitor, see the [NGINX Controller Metrics Catalog]({{< ref "/controller/analytics/catalogs/metrics" >}}). - **NGINX Controller with App Security Add-on supports NGINX App Protect 3.0** @@ -731,7 +731,7 @@ These release notes provide general information and describe known issues for NG - **View the percentage of requests that WAF has blocked or flagged** Now, the Security Analytics graphs show the percentage of requests that have been blocked or flagged by the Web Application Firewall (WAF). This allows you to identify spikes or abnormalities based on the proportion of traffic rejected or flagged traffic by the WAF even as traffic increases. - Go to [View App Security Analytics]({{< relref "/controller/app-delivery/security/tutorials/view-app-security-analytics" >}}) to get started. + Go to [View App Security Analytics]({{< ref "/controller/app-delivery/security/tutorials/view-app-security-analytics" >}}) to get started. - **Upgrades to health checking for web apps** @@ -764,7 +764,7 @@ The following issues are known to be present in this release. Look for updates t - **Restoring NGINX Controller from a backup without restoring the config and encryption keys causes the system to become unresponsive (22066)** - When restoring NGINX Controller from a backup, you also need to restore the NGINX config and encryption keys; otherwise, the system may become unresponsive. For instructions, refer to [Back Up & Restore Cluster Config and Encryption Keys]({{< relref "/controller/admin-guides/backup-restore/backup-restore-cluster-config" >}}). + When restoring NGINX Controller from a backup, you also need to restore the NGINX config and encryption keys; otherwise, the system may become unresponsive. For instructions, refer to [Back Up & Restore Cluster Config and Encryption Keys]({{< ref "/controller/admin-guides/backup-restore/backup-restore-cluster-config" >}}). #### Analytics @@ -810,7 +810,7 @@ The following issues are known to be present in this release. Look for updates t **Workaround:** - To restore the embedded config database, follow the instructions in the [Backup & Restore Embedded Config Database]({{< relref "/controller/admin-guides/backup-restore/backup-restore-embedded-config-db#restore-embedded-config-database" >}}) guide that's online. + To restore the embedded config database, follow the instructions in the [Backup & Restore Embedded Config Database]({{< ref "/controller/admin-guides/backup-restore/backup-restore-embedded-config-db#restore-embedded-config-database" >}}) guide that's online. @@ -847,13 +847,13 @@ These release notes provide general information and describe known issues for NG NGINX Controller now supports TCP/UDP load balancing and routing along with the coincident support for data path HA for these protocols. TCP/UDP does not support metrics at this time -- look for metrics support coming soon. - To learn more, check out the [Manage Gateways]({{< relref "/controller/services/manage-gateways.md" >}}) and [About Application Delivery]({{< relref "/controller/app-delivery/about-app-delivery.md" >}}) topics. + To learn more, check out the [Manage Gateways]({{< ref "/controller/services/manage-gateways.md" >}}) and [About Application Delivery]({{< ref "/controller/app-delivery/about-app-delivery.md" >}}) topics. - **Improved experience deploying the NGINX Controller with App Security Add-on** You no longer need to add `security = True` in the *agent.conf* file to get Security Events (WAF violation events) after installing the NGINX App Protect module on the data planes -- NGINX Controller takes care of the configuration for you. **An Agent restart is still needed**. - To begin using NGINX Controller with the Application Security Add-on, follow the steps in the [Trial NGINX Controller with App Security]({{< relref "/controller/admin-guides/install/try-nginx-controller-app-sec.md" >}}) quick start guide. + To begin using NGINX Controller with the Application Security Add-on, follow the steps in the [Trial NGINX Controller with App Security]({{< ref "/controller/admin-guides/install/try-nginx-controller-app-sec.md" >}}) quick start guide. - **NGINX Controller with App Security Add-on supports Ubuntu 18.04 LTS on the data plane** @@ -867,7 +867,7 @@ These release notes provide general information and describe known issues for NG You can now forward all NGINX Controller events -- including system and security events -- to your Splunk HTTP Event Collector(s), similar to log forwarding. - To get started, refer to [Forward Analytics Data to Splunk]({{< relref "/controller/analytics/forwarders/forward-analytics-to-splunk.md" >}}). + To get started, refer to [Forward Analytics Data to Splunk]({{< ref "/controller/analytics/forwarders/forward-analytics-to-splunk.md" >}}). - **The data forwarder output format `SPLUNK_HEC` was renamed to `SPLUNK`** @@ -877,7 +877,7 @@ These release notes provide general information and describe known issues for NG Now when you use the NGINX Controller web interface or the REST API to view licensing information, you'll also be able to view usage details to ensure compliance with your license. - For instructions on how to view and manage your licenses, see [License NGINX Controller]({{< relref "/controller/platform/licensing-controller.md" >}}). + For instructions on how to view and manage your licenses, see [License NGINX Controller]({{< ref "/controller/platform/licensing-controller.md" >}}). @@ -924,7 +924,7 @@ The following issues are known to be present in this release. Look for updates t {{< deprecated >}} As of NGINX Controller v3.13, the following Alerts functionality is deprecated: - - The [ServiceNow Alerts integration]({{< relref "/controller/analytics/alerts/service-now-notifications.md" >}}) is no longer supported. Subscribers of any type other than `email` will be ignored. Alert rules which do not have at least one email subscriber will not be migrated. + - The [ServiceNow Alerts integration]({{< ref "/controller/analytics/alerts/service-now-notifications.md" >}}) is no longer supported. Subscribers of any type other than `email` will be ignored. Alert rules which do not have at least one email subscriber will not be migrated. - The alert rule operator `=` is no longer available. Any existing alert rules with `operator: =` will be ignored. - Alert rules created in versions prior to 3.13 that use the `RATE` aggregation will be removed on upgrade. These rules must be re-created manually. Alert rules that use the following metrics are affected: @@ -1014,7 +1014,7 @@ The following issues are known to be present in this release. Look for updates t **Workaround:** - Use the `/platform/roles` endpoint in the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}) to add the following permissions to the custom role: + Use the `/platform/roles` endpoint in the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}) to add the following permissions to the custom role: ``` json { @@ -1053,13 +1053,13 @@ This hotfix release resolves the known issue affecting version 3.12 described be *Upgrading to NGINX Controller v3.12 fails on systems that don't meet the minimum CPU requirements (20509)*:

-NGINX Controller requires an [8-core CPU @ 2.4 GHz or higher]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#hardware-specifications" >}}). +NGINX Controller requires an [8-core CPU @ 2.4 GHz or higher]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#hardware-specifications" >}}). If you've installed NGINX Controller on a system that does not have an 8-core CPU @ 2.4 GHz or higher, the upgrade to 3.12 may fail. {{< caution >}}Installing or upgrading NGINX Controller on systems that do not meet the minimum hardware requirements may cause NGINX Controller to become unresponsive. -Refer to the [NGINX Controller Tech Specs]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs" >}}) guide for hardware requirements and system recommendations. +Refer to the [NGINX Controller Tech Specs]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs" >}}) guide for hardware requirements and system recommendations. Following the workaround below will restore functionality. However, **running on a system that does not meet the documented minimum requirements is not supported or recommended**. @@ -1122,7 +1122,7 @@ NGINX Controller 3.12.0 includes the following updates:
- Now you can [deploy NGINX Controller as a multi-node cluster on a private cloud]({{< relref "/controller/admin-guides/install/resilient-cluster-private-cloud" >}}) to provide uptime resiliency. A multi-node cluster ensures that NGINX Controller stays up even if one of the control-plane hosts becomes unavailable. + Now you can [deploy NGINX Controller as a multi-node cluster on a private cloud]({{< ref "/controller/admin-guides/install/resilient-cluster-private-cloud" >}}) to provide uptime resiliency. A multi-node cluster ensures that NGINX Controller stays up even if one of the control-plane hosts becomes unavailable.
@@ -1130,7 +1130,7 @@ NGINX Controller 3.12.0 includes the following updates:
- [Configure a high-availability data plane for your apps]({{< relref "/controller/infrastructure/instances/ha-data-plane" >}}) in on-premises deployments using NGINX Controller, NGINX Plus, and keepalived. High-availability data planes help to ensure your apps operate continuously without service interruptions. + [Configure a high-availability data plane for your apps]({{< ref "/controller/infrastructure/instances/ha-data-plane" >}}) in on-premises deployments using NGINX Controller, NGINX Plus, and keepalived. High-availability data planes help to ensure your apps operate continuously without service interruptions. Support for High Availability (HA) mode is limited to two NGINX Plus instances. @@ -1142,19 +1142,19 @@ NGINX Controller 3.12.0 includes the following updates: Now you can use the App Security add-on for the Application Delivery module to protect your apps with a web application firewall (WAF). The WAF protects your apps from various application-layer attacks such as cross-site scripting and SQL injection, among others. Organizations can start out-of-the-box with [OWASP Top 10 protection](https://owasp.org/www-project-top-ten/) with a default protection policy and minimal tuning required. - To get started, check out the [Trial NGINX Controller with App Security]({{< relref "/controller/admin-guides/install/try-nginx-controller-app-sec" >}}) guide. + To get started, check out the [Trial NGINX Controller with App Security]({{< ref "/controller/admin-guides/install/try-nginx-controller-app-sec" >}}) guide.
- **Install NGINX Controller with an embedded config database** - When [installing NGINX Controller]({{< relref "/controller/admin-guides/install" >}}), you can choose to use an embedded, self-hosted config database by default, or you can provide your own external PostgreSQL database. If you use the embedded config database, NGINX Controller will install and configure the database for you, significantly streamlining the installation process. + When [installing NGINX Controller]({{< ref "/controller/admin-guides/install" >}}), you can choose to use an embedded, self-hosted config database by default, or you can provide your own external PostgreSQL database. If you use the embedded config database, NGINX Controller will install and configure the database for you, significantly streamlining the installation process. - **Automated backups for the embedded config database**
- If you install NGINX Controller using the embedded, self-hosted config database, NGINX Controller will back up the database at hourly intervals for you automatically. For more information about these automated backups and how to restore from them, see the [Backup & Restore Guide]({{< relref "/controller/admin-guides/backup-restore/backup-restore-embedded-config-db" >}}). + If you install NGINX Controller using the embedded, self-hosted config database, NGINX Controller will back up the database at hourly intervals for you automatically. For more information about these automated backups and how to restore from them, see the [Backup & Restore Guide]({{< ref "/controller/admin-guides/backup-restore/backup-restore-embedded-config-db" >}}).
@@ -1196,14 +1196,14 @@ The following issues are known to be present in this release. Look for updates t - **Upgrading to NGINX Controller v3.12 fails on systems with less than an 8-core CPU (20509)** - NGINX Controller requires an [8-core CPU @ 2.4 GHz or higher]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md#hardware-specifications" >}}). + NGINX Controller requires an [8-core CPU @ 2.4 GHz or higher]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md#hardware-specifications" >}}). If you've installed NGINX Controller on a system that does not have an 8-core CPU @ 2.4 GHz or higher, **you should not upgrade to v3.12**. {{< caution >}} Installing or upgrading NGINX Controller on systems that do not meet the minimum hardware requirements may cause NGINX Controller to become unresponsive. -Refer to the [NGINX Controller Tech Specs]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) guide for hardware requirements and system recommendations. +Refer to the [NGINX Controller Tech Specs]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) guide for hardware requirements and system recommendations. {{< /caution >}} **Workaround:** @@ -1268,7 +1268,7 @@ Refer to the [NGINX Controller Tech Specs]({{< relref "/controller/admin-guides/ **Workaround:** - When creating a new user, you must assign the `guest` role (or higher) for the user to view Identity Providers and API Definitions. Alternatively, if you're using a custom role, you can use the API to grant explicit permissions for the `/security/identity-providers` and `/services/api-definitions` endpoints. See the [Manage Roles and Role Groups]({{< relref "/controller/platform/access-management/manage-roles" >}}) topic details. + When creating a new user, you must assign the `guest` role (or higher) for the user to view Identity Providers and API Definitions. Alternatively, if you're using a custom role, you can use the API to grant explicit permissions for the `/security/identity-providers` and `/services/api-definitions` endpoints. See the [Manage Roles and Role Groups]({{< ref "/controller/platform/access-management/manage-roles" >}}) topic details. #### App Security @@ -1342,7 +1342,7 @@ Refer to the [NGINX Controller Tech Specs]({{< relref "/controller/admin-guides/ To change the floating IP, take the following steps: - 1. To remove the existing floating IP using the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. Submit an empty string for the `clusterFloatingIP` value. + 1. To remove the existing floating IP using the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}), send a PATCH request to the `/platform/global` endpoint. Submit an empty string for the `clusterFloatingIP` value. 1. To remove the existing floating IP using the web interface: 1. Open the NGINX Controller web interface and log in. @@ -1376,7 +1376,7 @@ Refer to the [NGINX Controller Tech Specs]({{< relref "/controller/admin-guides/ - **API Reference does not specify that TCP/UDP App Components are experimental (20285)** - In the [NGINX Controller API Reference]({{< relref "/controller/api/_index.md" >}}), the schema for App Components includes two objects related to TCP/UDP support that are missing the **x-f5-experimental** extension: `ComponentTcpUdpDesiredState` and `ComponentTcpUdpCurrentState`. TCP/UDP App Components are not supported in NGINX Controller v3.12. + In the [NGINX Controller API Reference]({{< ref "/controller/api/_index.md" >}}), the schema for App Components includes two objects related to TCP/UDP support that are missing the **x-f5-experimental** extension: `ComponentTcpUdpDesiredState` and `ComponentTcpUdpCurrentState`. TCP/UDP App Components are not supported in NGINX Controller v3.12. @@ -1519,7 +1519,7 @@ This release includes the following fixes. Search by the issue ID -- the number **Workaround:** - When you upgrade NGINX Controller, you must upgrade the Controller Agent as well to keep the versions in sync, following the instructions here: [Controller Agent Installation Guide]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}). + When you upgrade NGINX Controller, you must upgrade the Controller Agent as well to keep the versions in sync, following the instructions here: [Controller Agent Installation Guide]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}). To determine the Agent version that's running on an instance, log into the instance and run the following command for your distribution type: diff --git a/content/controller/services/available-policies.md b/content/controller/services/available-policies.md index 81c97b719..e8d81dbea 100644 --- a/content/controller/services/available-policies.md +++ b/content/controller/services/available-policies.md @@ -68,7 +68,7 @@ API keys are convenient for testing and small-scale deployments, while JWTs are {{< see-also >}} -To create an Identity Provider by using a JWK set, see [Add an Identity Provider]({{< relref "/controller/services/manage-identity-providers.md#add-an-identity-provider" >}}). +To create an Identity Provider by using a JWK set, see [Add an Identity Provider]({{< ref "/controller/services/manage-identity-providers.md#add-an-identity-provider" >}}). {{< /see-also >}} diff --git a/content/controller/services/manage-certs.md b/content/controller/services/manage-certs.md index 44c9b835c..32fcf9bc1 100644 --- a/content/controller/services/manage-certs.md +++ b/content/controller/services/manage-certs.md @@ -10,15 +10,15 @@ type: ## Overview -Follow the steps in this topic to create and use Certs with an [Environment]({{< relref "/controller/services/manage-environments.md" >}}). +Follow the steps in this topic to create and use Certs with an [Environment]({{< ref "/controller/services/manage-environments.md" >}}). {{< tip >}} -If you prefer, you can use the F5 NGINX Controller API to create and manage certificates. Refer to the [NGINX Controller API reference guide]({{< relref "/controller/api/_index.md" >}}) (**Services > Certs API**) for details. +If you prefer, you can use the F5 NGINX Controller API to create and manage certificates. Refer to the [NGINX Controller API reference guide]({{< ref "/controller/api/_index.md" >}}) (**Services > Certs API**) for details. {{< /tip >}} ## Before You Begin -- [Create an environment]({{< relref "/controller/services/manage-environments.md#create-an-environment" >}}) +- [Create an environment]({{< ref "/controller/services/manage-environments.md#create-an-environment" >}}) ## Objectives @@ -58,8 +58,8 @@ To view, edit, and delete Certs: ## What's Next -- [Create an app]({{< relref "/controller/app-delivery/manage-apps.md" >}}) -- [Create a gateway]({{< relref "/controller/services/manage-gateways.md" >}}) +- [Create an app]({{< ref "/controller/app-delivery/manage-apps.md" >}}) +- [Create a gateway]({{< ref "/controller/services/manage-gateways.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/services/manage-environments.md b/content/controller/services/manage-environments.md index 07be81760..c381c88b6 100644 --- a/content/controller/services/manage-environments.md +++ b/content/controller/services/manage-environments.md @@ -13,7 +13,7 @@ type: This page contains instructions for creating and managing Environments in the F5 NGINX Controller user interface. {{< tip >}} -If you prefer, you can use the NGINX Controller API to create and manage Environments. See the [NGINX Controller API reference guide]({{< relref "/controller/api/_index.md" >}}) (**Services > Environments**) for details. +If you prefer, you can use the NGINX Controller API to create and manage Environments. See the [NGINX Controller API reference guide]({{< ref "/controller/api/_index.md" >}}) (**Services > Environments**) for details. {{< /tip >}} ## Objective @@ -23,7 +23,7 @@ If you prefer, you can use the NGINX Controller API to create and manage Environ ## About Environments -An **Environment** is a logical container used to group Applications, Gateways, and [Certificates]({{< relref "/controller/services/manage-certs.md" >}}) into a domain associated with common goals, resource needs, usage constraints, and access controls. Environments typically map closely to organizational boundaries. "Dev" and "prod" are a few common Environment examples. +An **Environment** is a logical container used to group Applications, Gateways, and [Certificates]({{< ref "/controller/services/manage-certs.md" >}}) into a domain associated with common goals, resource needs, usage constraints, and access controls. Environments typically map closely to organizational boundaries. "Dev" and "prod" are a few common Environment examples. A **dev** Environment is where developers can build and test an application. Its primary purpose is to allow developers to quickly develop and test new application features. Access to a dev Environment is typically restricted to those who need it--developers and testers. The resources in a dev Environment support the development and debugging of the application and, as such, may not have the same capabilities or requirements as resources in a production, or "prod", Environment. @@ -56,11 +56,11 @@ To view, edit, and delete environments: ## What's Next -- [Give Users and Roles access to your Environment]({{< relref "/controller/platform/access-management/manage-users.md" >}}) -- [Create or Upload Certificates]({{< relref "/controller/services/manage-certs.md#create-a-cert" >}}) -- [Create a Gateway]({{< relref "/controller/services/manage-gateways.md#create-a-gateway" >}}) -- [Create an Application]({{< relref "/controller/app-delivery/manage-apps.md#create-an-app" >}}) -- [Create App Components]({{< relref "/controller/app-delivery/manage-apps.md#create-a-component" >}}) +- [Give Users and Roles access to your Environment]({{< ref "/controller/platform/access-management/manage-users.md" >}}) +- [Create or Upload Certificates]({{< ref "/controller/services/manage-certs.md#create-a-cert" >}}) +- [Create a Gateway]({{< ref "/controller/services/manage-gateways.md#create-a-gateway" >}}) +- [Create an Application]({{< ref "/controller/app-delivery/manage-apps.md#create-an-app" >}}) +- [Create App Components]({{< ref "/controller/app-delivery/manage-apps.md#create-a-component" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/services/manage-gateways.md b/content/controller/services/manage-gateways.md index c0db4e723..2eb87b8ec 100644 --- a/content/controller/services/manage-gateways.md +++ b/content/controller/services/manage-gateways.md @@ -14,7 +14,7 @@ type: A **Gateway** represents the initial network entry point of application and/or API traffic into an F5 NGINX instance in the traffic data path. You can share the same gateway for both application and API traffic. -In a gateway, you define a group of **Ingress URIs** and **Certificates** that can then be used by [Application Components]({{< relref "/controller/app-delivery/about-app-delivery.md#components" >}}). Adding these definitions at the gateway level means you don't have to define the URIs and certificates for each component. Instead, you can inherit these settings from the gateway and only configure each component's relative path(s). Alternatively, you can fully define the URI in the component; doing so will override any settings defined for the gateway. +In a gateway, you define a group of **Ingress URIs** and **Certificates** that can then be used by [Application Components]({{< ref "/controller/app-delivery/about-app-delivery.md#components" >}}). Adding these definitions at the gateway level means you don't have to define the URIs and certificates for each component. Instead, you can inherit these settings from the gateway and only configure each component's relative path(s). Alternatively, you can fully define the URI in the component; doing so will override any settings defined for the gateway. ### Supported Component Types @@ -91,7 +91,7 @@ When multiple placements are defined within a gateway, each placement represents ## Before You Begin -- [Create an Environment for your Gateway]({{< relref "/controller/services/manage-environments.md#create-an-environment" >}}) +- [Create an Environment for your Gateway]({{< ref "/controller/services/manage-environments.md#create-an-environment" >}}) ## Create a Gateway @@ -104,10 +104,10 @@ To create a gateway: 1. Select **Create Gateway**. 1. Complete each of the configuration sections: - - [General Configuration]({{< relref "#general-configuration" >}}) - - [Add Placements]({{< relref "#add-placements" >}}) - - [Set Hostnames]({{< relref "#set-hostnames" >}}) - - [Additional Settings]({{< relref "#additional-settings" >}}) + - [General Configuration]({{< ref "#general-configuration" >}}) + - [Add Placements]({{< ref "#add-placements" >}}) + - [Set Hostnames]({{< ref "#set-hostnames" >}}) + - [Additional Settings]({{< ref "#additional-settings" >}}) 1. When ready, review the API Spec and then select **Submit** to create the Gateway. @@ -125,7 +125,7 @@ On the **Gateways** > **Create Gateway** > **Configuration** page: ### Add Placements -[Gateways]({{< relref "/controller/services/manage-gateways.md#overview" >}}) include placements that reference NGINX instances or instance groups. Gateway placements can be for multiple instances or instance groups, allowing a gateway to deliver services in multiple data centers and/or clouds. Placements define the physical machines that are used to manifest a particular path associated with an [application component]({{< relref "/controller/app-delivery/about-app-delivery.md#components" >}}). +[Gateways]({{< ref "/controller/services/manage-gateways.md#overview" >}}) include placements that reference NGINX instances or instance groups. Gateway placements can be for multiple instances or instance groups, allowing a gateway to deliver services in multiple data centers and/or clouds. Placements define the physical machines that are used to manifest a particular path associated with an [application component]({{< ref "/controller/app-delivery/about-app-delivery.md#components" >}}). On the **Gateways > Create Gateway > Placements** page: @@ -137,7 +137,7 @@ On the **Gateways > Create Gateway > Placements** page: 1. In the **Instance Refs/Instance Groups Refs** box, select the NGINX instance(s) or instance group(s) on which you want to deploy the gateway. {{< note >}} - If you're enabling **High Availability Mode**, select the [high-availability instances that you prepared]({{< relref "/controller/infrastructure/instances/ha-data-plane.md#prepare-the-high-availability-instances" >}}). NGINX Controller supports up to two high-availability instances. + If you're enabling **High Availability Mode**, select the [high-availability instances that you prepared]({{< ref "/controller/infrastructure/instances/ha-data-plane.md#prepare-the-high-availability-instances" >}}). NGINX Controller supports up to two high-availability instances. {{< /note >}} 1. In the **Listen IPs** box, add the IP address(es) on which the server listens for and accepts requests. If you're creating a placement for a BIG-IP Integration, add the virtual IP (VIP) address for the BIG-IP cluster. @@ -182,7 +182,7 @@ On the **Gateways** > **Create Gateway** > **Additional** page: - `Explicitly Enable` - set specific values to use for the keep alive probes. - `Explicitly Disable` - disable keep alive. -1. (Optional) Add [**Config Snippets**]({{< relref "/controller/app-delivery/about-snippets.md" >}}) to customize your NGINX configuration. +1. (Optional) Add [**Config Snippets**]({{< ref "/controller/app-delivery/about-snippets.md" >}}) to customize your NGINX configuration. {{< caution >}} When you use Snippets to customize your NGINX configuration, your changes are applied to the `nginx.conf` file *as is*. NGINX Controller does not verify that your configuration is valid before applying the snippet. @@ -203,7 +203,7 @@ To view, edit, and delete Gateways: 6. To edit a Gateway, choose the Gateway from the list, then select **Edit** (pencil icon). 7. To delete a Gateway, choose the Gateway from the list, then select **Delete** (trash icon). - {{< note >}}If your Gateway has external references, such as Components that reference the Gateway, you'll need to delete or reconfigure the external references before removing the Gateway. Refer to [Manage Apps & Components]({{< relref "/controller/app-delivery/manage-apps.md#edit-or-delete-apps-and-components" >}}) to learn how to edit and delete Components.{{< /note >}} + {{< note >}}If your Gateway has external references, such as Components that reference the Gateway, you'll need to delete or reconfigure the external references before removing the Gateway. Refer to [Manage Apps & Components]({{< ref "/controller/app-delivery/manage-apps.md#edit-or-delete-apps-and-components" >}}) to learn how to edit and delete Components.{{< /note >}} ## Troubleshooting @@ -213,8 +213,8 @@ Timeouts are commonly reported when an instance doesn't report back to NGINX Con ## What's Next -- [Set Up Data Plane High Availability]({{< relref "/controller/infrastructure/instances/ha-data-plane.md" >}}) -- [Create an App and App Component]({{< relref "/controller/app-delivery/manage-apps.md" >}}) +- [Set Up Data Plane High Availability]({{< ref "/controller/infrastructure/instances/ha-data-plane.md" >}}) +- [Create an App and App Component]({{< ref "/controller/app-delivery/manage-apps.md" >}}) {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/services/manage-identity-providers.md b/content/controller/services/manage-identity-providers.md index 71906b06a..3df64f6d7 100644 --- a/content/controller/services/manage-identity-providers.md +++ b/content/controller/services/manage-identity-providers.md @@ -13,7 +13,7 @@ type: The **Identity Providers** page lets you create and manage Identity Providers to control access to your services (APIs for API Management module deployments, and Apps for App Delivery module deployments). {{< tip >}} -If you prefer, you can use the F5 NGINX Controller API to create and manage Identity Providers. See the [NGINX Controller API reference guide]({{< relref "/controller/api/_index.md" >}}) (**Security > Identity Providers**) for details. +If you prefer, you can use the F5 NGINX Controller API to create and manage Identity Providers. See the [NGINX Controller API reference guide]({{< ref "/controller/api/_index.md" >}}) (**Security > Identity Providers**) for details. {{< /tip >}} ## Before You Begin @@ -48,7 +48,7 @@ Take the following steps to create an Identity Provider: 5. Provide a name. -6. Select an Environment, or to [Create an Environment]({{< relref "/controller/services/manage-environments.md" >}}), select **Create New**. +6. Select an Environment, or to [Create an Environment]({{< ref "/controller/services/manage-environments.md" >}}), select **Create New**. 7. Select the option to use an **API key** or a **JWT** (JSON Web Token). diff --git a/content/controller/services/overview.md b/content/controller/services/overview.md index d484fe023..a073c6a04 100644 --- a/content/controller/services/overview.md +++ b/content/controller/services/overview.md @@ -11,7 +11,7 @@ type: ## Introduction -As noted in the F5 NGINX Controller [API Overview]({{< relref "/controller/api/overview.md" >}}), NGINX Controller is organized into four top-level areas: +As noted in the F5 NGINX Controller [API Overview]({{< ref "/controller/api/overview.md" >}}), NGINX Controller is organized into four top-level areas: - **Analytics**: Enables data visualization for NGINX Controller. - **Infrastructure**: Lets you manage your NGINX Plus instances and certain aspects of the host machines on which NGINX Controller and NGINX Plus instances run. @@ -36,15 +36,15 @@ But, before any teams can deploy an App or publish an API, an NGINX Controller A The following are the basic building blocks of any NGINX Controller Service: -1. [Environments]({{< relref "/controller/services/manage-environments.md" >}}) logically group all other Service objects. You can use [Access Management]({{< relref "/controller/platform/access-management/" >}}) to grant Users or User Groups permission to access resources in a specific Environment. -1. [Certs]({{< relref "/controller/services/manage-certs.md" >}}) can be used to secure traffic to and from APIs and Applications. -1. [Gateways]({{< relref "/controller/services/manage-gateways.md" >}}) define how to process incoming (ingress) and outgoing (egress) traffic. +1. [Environments]({{< ref "/controller/services/manage-environments.md" >}}) logically group all other Service objects. You can use [Access Management]({{< ref "/controller/platform/access-management/" >}}) to grant Users or User Groups permission to access resources in a specific Environment. +1. [Certs]({{< ref "/controller/services/manage-certs.md" >}}) can be used to secure traffic to and from APIs and Applications. +1. [Gateways]({{< ref "/controller/services/manage-gateways.md" >}}) define how to process incoming (ingress) and outgoing (egress) traffic. Once these shared resources are in place, the teams in your organization can create the resources they need to manage Apps or publish APIs. -{{< tip >}}Refer to the [App Delivery]({{< relref "/controller/app-delivery/" >}}) section for more information about how to use each module.{{< /tip >}} +{{< tip >}}Refer to the [App Delivery]({{< ref "/controller/app-delivery/" >}}) section for more information about how to use each module.{{< /tip >}} -Finally, to support automation efforts, all of the above and more can be done by using the NGINX Controller REST API. Refer to the [API Reference guide]({{< relref "/controller/api/_index.md" >}}) for more information and examples. +Finally, to support automation efforts, all of the above and more can be done by using the NGINX Controller REST API. Refer to the [API Reference guide]({{< ref "/controller/api/_index.md" >}}) for more information and examples. {{< versions "3.0" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/controller/support/troubleshooting-controller.md b/content/controller/support/troubleshooting-controller.md index 1edc703da..09cf2eac5 100644 --- a/content/controller/support/troubleshooting-controller.md +++ b/content/controller/support/troubleshooting-controller.md @@ -11,11 +11,11 @@ type: ## Overview -If NGINX isn't behaving how you expect, you can take the following steps to troubleshoot issues. If you need to [contact F5 NGINX Support]({{< relref "/controller/support/contact-support.md" >}}), make sure to [create a support package](#create-a-support-package) first. +If NGINX isn't behaving how you expect, you can take the following steps to troubleshoot issues. If you need to [contact F5 NGINX Support]({{< ref "/controller/support/contact-support.md" >}}), make sure to [create a support package](#create-a-support-package) first. ## Fix NGINX Controller Issues by Upgrading -We recommend you [upgrade NGINX Controller]({{< relref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}) as new versions become available. Upgrades include new features, feature improvements, or fixes for known issues. +We recommend you [upgrade NGINX Controller]({{< ref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}) as new versions become available. Upgrades include new features, feature improvements, or fixes for known issues. To look up your version of NGINX Controller: @@ -23,7 +23,7 @@ To look up your version of NGINX Controller: 1. Select the NGINX Controller menu icon, then select **Platform**. 1. On the Platform menu, select **Cluster** > **Overview**. -{{< see-also >}}Refer to the [NGINX Controller release notes]({{< relref "/controller/releases/" >}}) to see what's new in the latest release of NGINX Controller.{{< /see-also >}} +{{< see-also >}}Refer to the [NGINX Controller release notes]({{< ref "/controller/releases/" >}}) to see what's new in the latest release of NGINX Controller.{{< /see-also >}}   @@ -153,7 +153,7 @@ Take the following steps to troubleshoot the issue: - Ensure that ports 443 and 8443 are open between NGINX Controller and the network where the NGINX Plus instance is being deployed. - Verify that you can communicate with NGINX Controller from the NGINX Plus instance using the NGINX Controller FQDN that you provided when you installed NGINX Controller. -- If you're [deploying an NGINX Plus instance on Amazon Web Services]({{< relref "/controller/infrastructure/instances/add-aws-instance.md" >}}) using a template, ensure that the Amazon Machine Image (AMI) referenced in the `instance_template` has a cURL version of 7.32 or newer. +- If you're [deploying an NGINX Plus instance on Amazon Web Services]({{< ref "/controller/infrastructure/instances/add-aws-instance.md" >}}) using a template, ensure that the Amazon Machine Image (AMI) referenced in the `instance_template` has a cURL version of 7.32 or newer.   @@ -187,7 +187,7 @@ For troubleshooting purposes, you can turn on Controller Agent debug logging by {{< /see-also >}} 1. The system DNS resolver is correctly configured, and the NGINX Controller server's fully qualified domain name (FQDN) can be resolved. -1. The controller-agent service can be running as `root` or a different user, chosen during the installation if the Controller Agent was [installed to run as a non-root user]({{< relref "/controller/admin-guides/install/install-agent-non-root.md" >}}). To view the user ID for the controller-agent service, run the following command: +1. The controller-agent service can be running as `root` or a different user, chosen during the installation if the Controller Agent was [installed to run as a non-root user]({{< ref "/controller/admin-guides/install/install-agent-non-root.md" >}}). To view the user ID for the controller-agent service, run the following command: ```bash ps -ef | egrep 'agent' @@ -212,10 +212,10 @@ For troubleshooting purposes, you can turn on Controller Agent debug logging by For more information on installing and configuring the Controller Agent, see the following topics: -- [Installing the NGINX Controller Agent]({{< relref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) -- [Installing the NGINX Controller Agent for non-root users]({{< relref "/controller/admin-guides/install/install-agent-non-root.md" >}}) -- [Configuring the NGINX Controller Agent]({{< relref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) -- [Configuring metrics collection for NGINX Controller]({{< relref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) +- [Installing the NGINX Controller Agent]({{< ref "/controller/admin-guides/install/install-nginx-controller-agent.md" >}}) +- [Installing the NGINX Controller Agent for non-root users]({{< ref "/controller/admin-guides/install/install-agent-non-root.md" >}}) +- [Configuring the NGINX Controller Agent]({{< ref "/controller/admin-guides/config-agent/configure-the-agent.md" >}}) +- [Configuring metrics collection for NGINX Controller]({{< ref "/controller/admin-guides/config-agent/configure-metrics-collection.md" >}}) {{< /see-also >}} @@ -227,8 +227,8 @@ For more information on installing and configuring the Controller Agent, see the If NGINX Controller appears to be unlicensed after a version upgrade, try the following options to resolve the issue. -- [Re-upload your NGINX Controller license]({{< relref "/controller/platform/licensing-controller.md#add-or-update-a-license" >}}). -- [Restore the NGINX Controller database from a backup]({{< relref "/controller/admin-guides/backup-restore/_index.md" >}}). +- [Re-upload your NGINX Controller license]({{< ref "/controller/platform/licensing-controller.md#add-or-update-a-license" >}}). +- [Restore the NGINX Controller database from a backup]({{< ref "/controller/admin-guides/backup-restore/_index.md" >}}).   diff --git a/content/controller/support/troubleshooting-forwarders.md b/content/controller/support/troubleshooting-forwarders.md index 49c56058d..ce2ae120f 100644 --- a/content/controller/support/troubleshooting-forwarders.md +++ b/content/controller/support/troubleshooting-forwarders.md @@ -10,11 +10,11 @@ type: ## Overview -If your Data Forwarders aren't behaving how you expect them to, you can take the following steps to troubleshoot issues. If you need to [contact F5 NGINX Support]({{< relref "/controller/support/contact-support.md" >}}), make sure to [create a support package](#support/create-a-support-package) first. +If your Data Forwarders aren't behaving how you expect them to, you can take the following steps to troubleshoot issues. If you need to [contact F5 NGINX Support]({{< ref "/controller/support/contact-support.md" >}}), make sure to [create a support package](#support/create-a-support-package) first. ## Fix NGINX Controller Issues by Upgrading -We recommend you [upgrade NGINX Controller]({{< relref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}) as new versions become available. Upgrades include new features, feature improvements, or fixes for known issues. +We recommend you [upgrade NGINX Controller]({{< ref "/controller/admin-guides/install/install-nginx-controller.md#update-nginx-controller" >}}) as new versions become available. Upgrades include new features, feature improvements, or fixes for known issues. To look up your version of NGINX Controller: @@ -22,7 +22,7 @@ To look up your version of NGINX Controller: 1. Select the NGINX Controller menu icon, then select **Platform**. 1. On the Platform menu, select **Cluster** > **Overview**. -{{< see-also >}}Refer to the [NGINX Controller release notes]({{< relref "/controller/releases/" >}}) to see what's new in the latest release of NGINX Controller.{{< /see-also >}} +{{< see-also >}}Refer to the [NGINX Controller release notes]({{< ref "/controller/releases/" >}}) to see what's new in the latest release of NGINX Controller.{{< /see-also >}}   @@ -32,7 +32,7 @@ To look up your version of NGINX Controller: You can find error messages emitted by the forwarder by querying the the NGINX Controller REST API -1. Send an HTTP GET request to the `/analytics/forwarders` endpoint in the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}). +1. Send an HTTP GET request to the `/analytics/forwarders` endpoint in the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}). Replace the session cookie, Controller-FQDN, and forwarderName in the example curl command below with the correct values for your environment. @@ -145,7 +145,7 @@ To resolve errors with an Integration: 1. Remove the Forwarder. 1. Re-add the Forwarder. -{{< tip >}}Before you remove the Forwarder, perform an HTTP GET request to capture the Forwarder's settings. Then, you can delete the Forwarder. Use the JSON payload returned in the GET request to re-create the Forwarder by sending an HTTP PUT request to the `/analytics/forwarders` endpoint in the [NGINX Controller REST API]]({{< relref "/controller/api/_index.md" >}}).{{< /tip >}} +{{< tip >}}Before you remove the Forwarder, perform an HTTP GET request to capture the Forwarder's settings. Then, you can delete the Forwarder. Use the JSON payload returned in the GET request to re-create the Forwarder by sending an HTTP PUT request to the `/analytics/forwarders` endpoint in the [NGINX Controller REST API]]({{< ref "/controller/api/_index.md" >}}).{{< /tip >}} ### Error code 440001 -- Integration cannot be found @@ -153,7 +153,7 @@ The `Error 440001` message is returned when the Forwarders module can't find the - Make sure the Integration exists. - If it doesn't, follow the steps in [Forward Analytics Data to Splunk]({{< relref "/controller/analytics/forwarders/forward-analytics-to-splunk.md" >}}) or [Forward Analytics Data to Datadog]({{< relref "/controller/analytics/forwarders/forward-analytics-to-datadog.md" >}}) to create a new one. + If it doesn't, follow the steps in [Forward Analytics Data to Splunk]({{< ref "/controller/analytics/forwarders/forward-analytics-to-splunk.md" >}}) or [Forward Analytics Data to Datadog]({{< ref "/controller/analytics/forwarders/forward-analytics-to-datadog.md" >}}) to create a new one. - Make sure the Integration reference uses the correct path format. All references should use the following relative format: @@ -174,9 +174,9 @@ In NGINX Controller version 3.13, the output format `SPLUNK_HEC` was changed `SP ], ``` -To resolve this error, update the Forwarder to use `SPLUNK` instead of `SPLUNK_HEC`, as described in [Forward Analytics Data to Splunk]({{< relref "/controller/analytics/forwarders/forward-analytics-to-splunk.md" >}}). +To resolve this error, update the Forwarder to use `SPLUNK` instead of `SPLUNK_HEC`, as described in [Forward Analytics Data to Splunk]({{< ref "/controller/analytics/forwarders/forward-analytics-to-splunk.md" >}}). -{{< tip >}}To update the Forwarder settings, you can send an HTTP PUT request that contains the updated `outputFormat` config to the `/analytics/forwarders` endpoint in the [NGINX Controller REST API]({{< relref "/controller/api/_index.md" >}}).{{< /tip >}} +{{< tip >}}To update the Forwarder settings, you can send an HTTP PUT request that contains the updated `outputFormat` config to the `/analytics/forwarders` endpoint in the [NGINX Controller REST API]({{< ref "/controller/api/_index.md" >}}).{{< /tip >}} {{< versions "3.6" "latest" "ctrlvers" >}} {{< versions "3.18" "latest" "apimvers" >}} diff --git a/content/includes/acm/about/api-proxy-policies.md b/content/includes/acm/about/api-proxy-policies.md index 4ce5e4608..3a604af74 100644 --- a/content/includes/acm/about/api-proxy-policies.md +++ b/content/includes/acm/about/api-proxy-policies.md @@ -12,22 +12,22 @@ The following table shows the available API Proxy Policies you can use when crea | Policy Name | HTTP Proxy | gRPC Proxy | Applied On | Description | | --------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- | ----------------------------------------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -| [Access Control Routing]({{< relref "/nms/acm/how-to/policies/access-control-routing" >}}) | | | Inbound | Restrict access to your application servers based on JWT claims or header values. | -| [ACL Consumer Restriction]({{< relref "/nms/acm/how-to/policies/api-access-control-lists#create-acl-consumer-restriction-policy" >}}) | | | Inbound | Protect your upstream TCP application servers by denying/allowing access from certain consumers client IDs or authenticated JWT claims. | -| [ACL IP Restriction]({{< relref "/nms/acm/how-to/policies/api-access-control-lists#create-acl-ip-restriction-policy" >}}) | | | Inbound | Protect your upstream TCP application servers by denying/allowing access from certain client IP addresses or CIDR blocks | -| [Advanced Security]({{< relref "/nms/acm/how-to/policies/advanced-security" >}}) | | | Inbound | Protect your upstream TCP application servers by applying an NGINX App Protect WAF policy to the traffic to your proxy | -| [Allowed HTTP Methods]({{< relref "/nms/acm/how-to/policies/allowed-http-methods" >}}) | | | Inbound | Restrict access to specific request methods and set a custom response code for non-matching requests. | -| [APIKey Authentication]({{< relref "/nms/acm/how-to/policies/apikey-authn" >}}) | | | Inbound | Secure the API gateway proxy by adding an API key. | -| [HTTP Backend Config]({{< relref "/nms/acm/how-to/policies/http-backend-configuration" >}}) | | | Inbound | Customize settings to ensure fault tolerance, maximize throughput, reduce latency, and optimize resource usage. | -| [GRPC Backend Config]({{< relref "/nms/acm/how-to/policies/grpc-policies" >}}) | | | Inbound | Customize settings to ensure fault tolerance, maximize throughput, reduce latency, and optimize resource usage. | -| [Backend Health Check]({{< relref "/nms/acm/how-to/policies/health-check" >}}) | | | Backend | Perform regular health checks to the backend API service to avoid and recover from server issues. Customize the policy with your desired thresholds. | -| [Basic Authentication]({{< relref "/nms/acm/how-to/policies/basic-authn" >}}) | | | Inbound | Restrict access to APIs by requiring a username and password. | -| [CORS]({{< relref "/nms/acm/how-to/policies/cors" >}}) | | | Inbound | Configure cross-origin resource sharing (CORS) to control resource access from outside domains. | -| [JSON Web Token Assertion]({{< relref "/nms/acm/how-to/policies/jwt-assertion" >}}) | | | Inbound | Secure your API gateway proxy with JSON web token verification. | -| [OAuth2 Token Introspection]({{< relref "/nms/acm/how-to/policies/introspection" >}}) | | | Inbound | Secure your API gateway proxy with OAuth2 Tokens. | -| [Proxy Cache]({{< relref "/nms/acm/how-to/policies/proxy-cache" >}}) | | | Outbound | Enable and configure caching to improve the performance of your API gateway proxy. | -| [Proxy Request Headers]({{< relref "/nms/acm/how-to/policies/proxy-request-headers" >}}) | | | Backend | Configure the headers to pass to the backend API service. | -| [Rate Limit]({{< relref "/nms/acm/how-to/policies/rate-limit" >}}) | | | Inbound | Add rate limits to limit incoming requests and secure API workloads. | +| [Access Control Routing]({{< ref "/nms/acm/how-to/policies/access-control-routing" >}}) | | | Inbound | Restrict access to your application servers based on JWT claims or header values. | +| [ACL Consumer Restriction]({{< ref "/nms/acm/how-to/policies/api-access-control-lists#create-acl-consumer-restriction-policy" >}}) | | | Inbound | Protect your upstream TCP application servers by denying/allowing access from certain consumers client IDs or authenticated JWT claims. | +| [ACL IP Restriction]({{< ref "/nms/acm/how-to/policies/api-access-control-lists#create-acl-ip-restriction-policy" >}}) | | | Inbound | Protect your upstream TCP application servers by denying/allowing access from certain client IP addresses or CIDR blocks | +| [Advanced Security]({{< ref "/nms/acm/how-to/policies/advanced-security" >}}) | | | Inbound | Protect your upstream TCP application servers by applying an NGINX App Protect WAF policy to the traffic to your proxy | +| [Allowed HTTP Methods]({{< ref "/nms/acm/how-to/policies/allowed-http-methods" >}}) | | | Inbound | Restrict access to specific request methods and set a custom response code for non-matching requests. | +| [APIKey Authentication]({{< ref "/nms/acm/how-to/policies/apikey-authn" >}}) | | | Inbound | Secure the API gateway proxy by adding an API key. | +| [HTTP Backend Config]({{< ref "/nms/acm/how-to/policies/http-backend-configuration" >}}) | | | Inbound | Customize settings to ensure fault tolerance, maximize throughput, reduce latency, and optimize resource usage. | +| [GRPC Backend Config]({{< ref "/nms/acm/how-to/policies/grpc-policies" >}}) | | | Inbound | Customize settings to ensure fault tolerance, maximize throughput, reduce latency, and optimize resource usage. | +| [Backend Health Check]({{< ref "/nms/acm/how-to/policies/health-check" >}}) | | | Backend | Perform regular health checks to the backend API service to avoid and recover from server issues. Customize the policy with your desired thresholds. | +| [Basic Authentication]({{< ref "/nms/acm/how-to/policies/basic-authn" >}}) | | | Inbound | Restrict access to APIs by requiring a username and password. | +| [CORS]({{< ref "/nms/acm/how-to/policies/cors" >}}) | | | Inbound | Configure cross-origin resource sharing (CORS) to control resource access from outside domains. | +| [JSON Web Token Assertion]({{< ref "/nms/acm/how-to/policies/jwt-assertion" >}}) | | | Inbound | Secure your API gateway proxy with JSON web token verification. | +| [OAuth2 Token Introspection]({{< ref "/nms/acm/how-to/policies/introspection" >}}) | | | Inbound | Secure your API gateway proxy with OAuth2 Tokens. | +| [Proxy Cache]({{< ref "/nms/acm/how-to/policies/proxy-cache" >}}) | | | Outbound | Enable and configure caching to improve the performance of your API gateway proxy. | +| [Proxy Request Headers]({{< ref "/nms/acm/how-to/policies/proxy-request-headers" >}}) | | | Backend | Configure the headers to pass to the backend API service. | +| [Rate Limit]({{< ref "/nms/acm/how-to/policies/rate-limit" >}}) | | | Inbound | Add rate limits to limit incoming requests and secure API workloads. | {{}} diff --git a/content/includes/acm/about/global-policies.md b/content/includes/acm/about/global-policies.md index 1b84ffddb..6d4e66500 100644 --- a/content/includes/acm/about/global-policies.md +++ b/content/includes/acm/about/global-policies.md @@ -16,14 +16,14 @@ The following table shows the available Global Policies you can use when creatin | Policy Name | HTTP Environment | gRPC Environment | Applied On | Description | |-------------------------------------------------------------------|-------------------------------------------------|-------------------------------------------------|-----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [Error Response Format]({{< relref "/nms/acm/how-to/policies/error-response-format.md" >}}) | | | Outbound | Configure the Error Response Format policy to customize the HTTP error codes and error messages. | -| [Log Format]({{< relref "/nms/acm/how-to/policies/log-format.md" >}}) | | | Outbound | Use the Log Format global policy to generate detailed access logs in JSON (default) or syslog format. Among the settings you can select, use the filter to fine-tune what gets logged, set the log destination, and adjust the log severity level to specify the type of errors to log. | -| [OpenID Connect Relying Party]({{< relref "/nms/acm/how-to/policies/openID-connect" >}}) | | | Inbound | Secure access to your APIs with an OpenID Connect (OIDC) policy. This policy configures the API gateway proxy as a relying party for authenticating users with an OIDC provider. | -| [Proxy Response Headers]({{< relref "/nms/acm/how-to/policies/proxy-response-headers.md" >}}) | | | Inbound | Customize the Proxy Response Headers policy to include or exclude headers in the proxy response. By default, the standard headers are included in the response. In addition, you can specify whether the header is always included regardless of the response code. You can also add custom headers and values to include in the response. | -| [Request Body Size Limit]({{< relref "/nms/acm/how-to/policies/request-body-size-limit" >}}) | | | Inbound | Prevent Denial-of-Service (DoS) and other types of attacks by limiting the request body size. Customize the policy to configure the max payload size the API gateway proxy cluster can accept; the default limit is 1 MB. The API gateway proxy blocks requests exceeding the limit, while returning the configured error code. Set the max size to 0 to disable checking the request body size. | -| [Request Correlation ID]({{< relref "/nms/acm/how-to/policies/request-correlation-id.md" >}}) | | | Inbound | Apply the Correlation ID policy to add a unique identifier to each request entering the application. You can use this unique ID to trace end-to-end transactions moving through components in a distributed system. The policy uses `x-correlation-id` as the default HTTP header name, or you can provide a custom header value. | -| [Request Header Specification]({{< relref "/nms/acm/how-to/policies/request-header-specification.md" >}}) | | | Inbound | Configure if headers containing underscores or other special characters are accepted or ignored. | -| [TLS Backend]({{< relref "/nms/acm/how-to/policies/tls-policies" >}}) | | | Backend | Secure the communication between the API gateway proxy and the backend API service by enabling and customizing the TLS backend policy. When mTLS is enabled, the API gateway proxy identifies itself to the backend service using an SSL client certificate. | -| [TLS Inbound]({{< relref "/nms/acm/how-to/policies/tls-policies" >}}) | | | Inbound | Secure inbound connections with the TLS inbound policy. Enable mTLS for secure bidirectional communication. | +| [Error Response Format]({{< ref "/nms/acm/how-to/policies/error-response-format.md" >}}) | | | Outbound | Configure the Error Response Format policy to customize the HTTP error codes and error messages. | +| [Log Format]({{< ref "/nms/acm/how-to/policies/log-format.md" >}}) | | | Outbound | Use the Log Format global policy to generate detailed access logs in JSON (default) or syslog format. Among the settings you can select, use the filter to fine-tune what gets logged, set the log destination, and adjust the log severity level to specify the type of errors to log. | +| [OpenID Connect Relying Party]({{< ref "/nms/acm/how-to/policies/openID-connect" >}}) | | | Inbound | Secure access to your APIs with an OpenID Connect (OIDC) policy. This policy configures the API gateway proxy as a relying party for authenticating users with an OIDC provider. | +| [Proxy Response Headers]({{< ref "/nms/acm/how-to/policies/proxy-response-headers.md" >}}) | | | Inbound | Customize the Proxy Response Headers policy to include or exclude headers in the proxy response. By default, the standard headers are included in the response. In addition, you can specify whether the header is always included regardless of the response code. You can also add custom headers and values to include in the response. | +| [Request Body Size Limit]({{< ref "/nms/acm/how-to/policies/request-body-size-limit" >}}) | | | Inbound | Prevent Denial-of-Service (DoS) and other types of attacks by limiting the request body size. Customize the policy to configure the max payload size the API gateway proxy cluster can accept; the default limit is 1 MB. The API gateway proxy blocks requests exceeding the limit, while returning the configured error code. Set the max size to 0 to disable checking the request body size. | +| [Request Correlation ID]({{< ref "/nms/acm/how-to/policies/request-correlation-id.md" >}}) | | | Inbound | Apply the Correlation ID policy to add a unique identifier to each request entering the application. You can use this unique ID to trace end-to-end transactions moving through components in a distributed system. The policy uses `x-correlation-id` as the default HTTP header name, or you can provide a custom header value. | +| [Request Header Specification]({{< ref "/nms/acm/how-to/policies/request-header-specification.md" >}}) | | | Inbound | Configure if headers containing underscores or other special characters are accepted or ignored. | +| [TLS Backend]({{< ref "/nms/acm/how-to/policies/tls-policies" >}}) | | | Backend | Secure the communication between the API gateway proxy and the backend API service by enabling and customizing the TLS backend policy. When mTLS is enabled, the API gateway proxy identifies itself to the backend service using an SSL client certificate. | +| [TLS Inbound]({{< ref "/nms/acm/how-to/policies/tls-policies" >}}) | | | Inbound | Secure inbound connections with the TLS inbound policy. Enable mTLS for secure bidirectional communication. | {{}} diff --git a/content/includes/acm/how-to/access-acm-api.md b/content/includes/acm/how-to/access-acm-api.md index 0cef49f18..8fa994888 100644 --- a/content/includes/acm/how-to/access-acm-api.md +++ b/content/includes/acm/how-to/access-acm-api.md @@ -1,5 +1,5 @@ -You can use tools such as `curl` or [Postman](https://www.postman.com) to interact with the API Connectivity Manager REST API. The API URL follows the format `https:///api/acm/` and must include authentication information with each call. For more information about authentication options, please refer to the [API Overview]({{< relref "/nms/acm/about/api-overview.md" >}}). +You can use tools such as `curl` or [Postman](https://www.postman.com) to interact with the API Connectivity Manager REST API. The API URL follows the format `https:///api/acm/` and must include authentication information with each call. For more information about authentication options, please refer to the [API Overview]({{< ref "/nms/acm/about/api-overview.md" >}}). diff --git a/content/includes/acm/how-to/policies-intro.md b/content/includes/acm/how-to/policies-intro.md index 3b9f6c394..7583dc3f0 100644 --- a/content/includes/acm/how-to/policies-intro.md +++ b/content/includes/acm/how-to/policies-intro.md @@ -2,7 +2,7 @@ In API Connectivity Manager, you can apply global policies to API Gateways and D When you add policies at the environment level, they will apply to all proxies hosted within that environment. -See the [Learn about Policies]({{< relref "/nms/acm/about/policies-overview.md">}}) topic for an overview of the different policy types and available policies. +See the [Learn about Policies]({{< ref "/nms/acm/about/policies-overview.md">}}) topic for an overview of the different policy types and available policies. \ No newline at end of file diff --git a/content/includes/acm/how-to/policies-proxy-cluster-intro.md b/content/includes/acm/how-to/policies-proxy-cluster-intro.md index 9f5ea03a6..066e5d1bf 100644 --- a/content/includes/acm/how-to/policies-proxy-cluster-intro.md +++ b/content/includes/acm/how-to/policies-proxy-cluster-intro.md @@ -6,4 +6,4 @@ In API Connectivity Manager, you can apply cluster policies to API Gateways and If a proxy cluster is shared between environments, updating cluster policies will effect all the environments. -See the [Learn about Policies]({{< relref "/nms/acm/about/policies-overview.md">}}) topic for an overview of the different policy types and available policies. +See the [Learn about Policies]({{< ref "/nms/acm/about/policies-overview.md">}}) topic for an overview of the different policy types and available policies. diff --git a/content/includes/acm/how-to/policies-proxy-intro.md b/content/includes/acm/how-to/policies-proxy-intro.md index adf731761..79053568f 100644 --- a/content/includes/acm/how-to/policies-proxy-intro.md +++ b/content/includes/acm/how-to/policies-proxy-intro.md @@ -6,4 +6,4 @@ In API Connectivity Manager, you can apply policies to an API Gateway to further Policies added at the proxy level are applied to all routes within that proxy. -For an overview of the different policy types and available policies, refer to the consult the [Learn about Policies]({{< relref "/nms/acm/about/policies-overview.md">}}) topic. +For an overview of the different policy types and available policies, refer to the consult the [Learn about Policies]({{< ref "/nms/acm/about/policies-overview.md">}}) topic. diff --git a/content/includes/controller/adc-rn-preamble.md b/content/includes/controller/adc-rn-preamble.md index d950b6888..b76c38ce5 100644 --- a/content/includes/controller/adc-rn-preamble.md +++ b/content/includes/controller/adc-rn-preamble.md @@ -5,8 +5,8 @@ Technical support is provided for earlier versions that were released within two {{< see-also >}} For related installation documentation, refer to the following publications: -- [NGINX Controller Installation Guide]({{< relref "/controller/admin-guides/backup-restore/_index.md" >}}) -- [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) +- [NGINX Controller Installation Guide]({{< ref "/controller/admin-guides/backup-restore/_index.md" >}}) +- [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) {{< /see-also >}} diff --git a/content/includes/controller/add-existing-instance.md b/content/includes/controller/add-existing-instance.md index e86135477..2c592ef64 100644 --- a/content/includes/controller/add-existing-instance.md +++ b/content/includes/controller/add-existing-instance.md @@ -6,15 +6,15 @@ Take the following steps to add an instance to NGINX Controller: 4. On the **Instances** overview page, select **Create**. 5. On the **Create Instance** page, select **Add an existing instance**. 6. Add a name for the instance. If you don't provide a name, the hostname of the instance is used by default. -7. To add the instance to an existing [Instance Group]({{< relref "/controller/infrastructure/instances/manage-instances.md#instance-groups" >}}), select an Instance Group from the list. Or to create an Instance Group, select **Create New**. +7. To add the instance to an existing [Instance Group]({{< ref "/controller/infrastructure/instances/manage-instances.md#instance-groups" >}}), select an Instance Group from the list. Or to create an Instance Group, select **Create New**. 8. To add the instance to an existing Location, select a Location from the list. Or to create a Location, select **Create New**. {{< important >}} -Once set, the Location for an instance cannot be changed. If you need to change or remove the Location for an instance, you must [remove the instance from NGINX Controller]({{< relref "/controller/infrastructure/instances/manage-instances.md#delete-an-instance" >}}), and then add it back. +Once set, the Location for an instance cannot be changed. If you need to change or remove the Location for an instance, you must [remove the instance from NGINX Controller]({{< ref "/controller/infrastructure/instances/manage-instances.md#delete-an-instance" >}}), and then add it back. {{< /important >}} {{< important >}} -Instances and the instance groups they belong to should specify the same location; however, this requirement is not currently enforced. If different locations are specified, the instance group's location takes precedence. This is important to remember when [assigning locations to workload groups]({{< relref "/controller/app-delivery/manage-apps.md#workload-groups">}}). +Instances and the instance groups they belong to should specify the same location; however, this requirement is not currently enforced. If different locations are specified, the instance group's location takes precedence. This is important to remember when [assigning locations to workload groups]({{< ref "/controller/app-delivery/manage-apps.md#workload-groups">}}). {{< /important >}} 9. (Optional) By default, registration of NGINX Plus instances is performed over a secure connection. To use self-signed certificates with the Controller Agent, select **Allow insecure server connections to NGINX Controller using TLS**. For security purposes, we recommend that you secure the Controller Agent with signed certificates when possible. diff --git a/content/includes/controller/apim-rn-preamble.md b/content/includes/controller/apim-rn-preamble.md index 30b290cde..fbd0ea643 100644 --- a/content/includes/controller/apim-rn-preamble.md +++ b/content/includes/controller/apim-rn-preamble.md @@ -9,8 +9,8 @@ Technical support is provided for earlier versions that were released within two {{< see-also >}} For related installation documentation, refer to the following publications: -- [NGINX Controller Installation Guide]({{< relref "/controller/admin-guides/backup-restore/_index.md" >}}) -- [NGINX Controller Technical Specifications Guide]({{< relref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) +- [NGINX Controller Installation Guide]({{< ref "/controller/admin-guides/backup-restore/_index.md" >}}) +- [NGINX Controller Technical Specifications Guide]({{< ref "/controller/admin-guides/install/nginx-controller-tech-specs.md" >}}) {{< /see-also >}} {{< important >}} diff --git a/content/includes/installation/access-web-ui.md b/content/includes/installation/access-web-ui.md index 4fa5ebacf..4f0199cc7 100644 --- a/content/includes/installation/access-web-ui.md +++ b/content/includes/installation/access-web-ui.md @@ -4,4 +4,4 @@ docs: DOCS-1241 To access the NGINX Instance Manager web interface, open a web browser and go to `https://`, replacing `` with the Fully Qualified Domain Name of your NGINX Instance Manager host. -The default administrator username is `admin`, and the generated password was displayed in the terminal during installation. If you'd like to change this password, refer to the "[Set or Change User Passwords]({{< relref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md#set-basic-passwords-script" >}}) section in the Basic Authentication topic. +The default administrator username is `admin`, and the generated password was displayed in the terminal during installation. If you'd like to change this password, refer to the "[Set or Change User Passwords]({{< ref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md#set-basic-passwords-script" >}}) section in the Basic Authentication topic. diff --git a/content/includes/installation/nms-prerequisites.md b/content/includes/installation/nms-prerequisites.md index 480da5f62..da6a17fd7 100644 --- a/content/includes/installation/nms-prerequisites.md +++ b/content/includes/installation/nms-prerequisites.md @@ -3,7 +3,7 @@ docs: DOCS-1242 --- {{< important >}} -Before you can install this module, you need to have NGINX and ClickHouse installed on your system. Additionally, you will need to add the NGINX Instance Manager repository. The [Prerequisites]({{< relref "/nim/deploy/vm-bare-metal/install.md" >}}) topic has detailed instructions on how to fulfill these requirements. +Before you can install this module, you need to have NGINX and ClickHouse installed on your system. Additionally, you will need to add the NGINX Instance Manager repository. The [Prerequisites]({{< ref "/nim/deploy/vm-bare-metal/install.md" >}}) topic has detailed instructions on how to fulfill these requirements. {{< /important>}} diff --git a/content/includes/installation/optional-installation-steps.md b/content/includes/installation/optional-installation-steps.md index 207e650f6..d8051f7d3 100644 --- a/content/includes/installation/optional-installation-steps.md +++ b/content/includes/installation/optional-installation-steps.md @@ -4,9 +4,9 @@ docs: DOCS-1030 The following steps may be necessary depending on your installation configuration. -- If you used a custom address, username, or password, or enabled TLS when [installing ClickHouse]({{< relref "/nim/deploy/vm-bare-metal/install.md#install-clickhouse" >}}), follow the steps in the [Configure ClickHouse]({{< relref "/nim/system-configuration/configure-clickhouse.md" >}}) guide to update the `/etc/nms/nms.conf` file. If you don't do so, NGINX Instance Manager won't be able to connect to ClickHouse. +- If you used a custom address, username, or password, or enabled TLS when [installing ClickHouse]({{< ref "/nim/deploy/vm-bare-metal/install.md#install-clickhouse" >}}), follow the steps in the [Configure ClickHouse]({{< ref "/nim/system-configuration/configure-clickhouse.md" >}}) guide to update the `/etc/nms/nms.conf` file. If you don't do so, NGINX Instance Manager won't be able to connect to ClickHouse. -- If you use Vault, follow the steps in the [Configure Vault]({{< relref "/nim/system-configuration/configure-vault.md" >}}) guide to update the `/etc/nms/nms.conf` file. If you don't do so, NGINX Instance Manager won't be able to connect to Vault. +- If you use Vault, follow the steps in the [Configure Vault]({{< ref "/nim/system-configuration/configure-vault.md" >}}) guide to update the `/etc/nms/nms.conf` file. If you don't do so, NGINX Instance Manager won't be able to connect to Vault. -- If you use SELinux, follow the steps in the [Configure SELinux]({{< relref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts (`restorecon`) for the files and directories related to NGINX Instance Manager. +- If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts (`restorecon`) for the files and directories related to NGINX Instance Manager. diff --git a/content/includes/licensing-and-reporting/configure-nginx-plus-report-to-nim.md b/content/includes/licensing-and-reporting/configure-nginx-plus-report-to-nim.md index 1e9326ec3..c41123599 100644 --- a/content/includes/licensing-and-reporting/configure-nginx-plus-report-to-nim.md +++ b/content/includes/licensing-and-reporting/configure-nginx-plus-report-to-nim.md @@ -12,7 +12,7 @@ docs: } ``` - {{}}If you use self-signed certificates in your NGINX Instance Manager environment, follow the steps in [Configure SSL verification for usage reporting with self-signed certificates]({{< relref "nim/system-configuration/secure-traffic.md#configure-ssl-verify" >}}).{{}} + {{}}If you use self-signed certificates in your NGINX Instance Manager environment, follow the steps in [Configure SSL verification for usage reporting with self-signed certificates]({{< ref "nim/system-configuration/secure-traffic.md#configure-ssl-verify" >}}).{{}} 3. Reload NGINX: diff --git a/content/includes/nap-waf/concept/grpc-logging.md b/content/includes/nap-waf/concept/grpc-logging.md index 4a3d3c969..b4c7c826d 100644 --- a/content/includes/nap-waf/concept/grpc-logging.md +++ b/content/includes/nap-waf/concept/grpc-logging.md @@ -3,7 +3,7 @@ docs: DOCS-000 --- Security log for gRPC requests has unique fields: `uri`, `grpc_method`, and `grpc_service`. Also, since the content of gRPC requests is binary (Protocol Buffers), it is better transferred in Base64 encoding. Hence, it is recommended to use the `headers` and `request_body_base64` fields instead of the `request` field. A new predefined log format called `grpc` should be used in all gRPC locations that also use policies with gRPC Content Profiles. -The `grpc` format also contains the above new gRPC fields (`grpc_service` and `grpc_method`). See [Available Security Log Attributes]({{< relref "/nap-waf/v5/logging-overview/security-log#available-security-log-attributes" >}}). +The `grpc` format also contains the above new gRPC fields (`grpc_service` and `grpc_method`). See [Available Security Log Attributes]({{< ref "/nap-waf/v5/logging-overview/security-log#available-security-log-attributes" >}}). NGINX App Protect WAF provides three security log bundles for gRPC: `log_grpc_all`, `log_grpc_illegal` and `log_grpc_blocked` using the `grpc` format with three filters: all requests, illegal requests, and blocked requests respectively. Unless you have special logging format requirements, the best practice is to use one of these bundles in all gRPC locations with the `app_protect_security_log` directive. diff --git a/content/includes/nap-waf/config/common/grpc-content-profiles.md b/content/includes/nap-waf/config/common/grpc-content-profiles.md index cd4465505..23f7d711a 100644 --- a/content/includes/nap-waf/config/common/grpc-content-profiles.md +++ b/content/includes/nap-waf/config/common/grpc-content-profiles.md @@ -3,7 +3,7 @@ docs: "DOCS-1616" --- The gRPC Content Profile contains all the definitions for protecting a gRPC service. It is similar in nature to the **JSON and XML profiles** handling JSON and XML traffic respectively. Roughly it includes: -- **The IDL files** of the protected gRPC service. This is essential for App Protect to be able to parse the API messages and determine whether they are legal and what needs to be inspected for security. [For more info regarding including an external file]({{< relref "#including-an-external-json-schema-file" >}}). +- **The IDL files** of the protected gRPC service. This is essential for App Protect to be able to parse the API messages and determine whether they are legal and what needs to be inspected for security. [For more info regarding including an external file]({{< ref "#including-an-external-json-schema-file" >}}). - **Security enforcement**: whether to detect signatures and/or metacharacters and optionally an exception (a.k.a override) list of signatures that need to be disabled in the context of this profile. - **Defense attributes**: special restrictions applied to the gRPC traffic. This includes a size limit for the gRPC messages in the request, and whether to tolerate fields that are not defined in the definition of the Protocol Buffer messages. diff --git a/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md b/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md index 8b8852024..de4214a29 100644 --- a/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md +++ b/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md @@ -161,7 +161,7 @@ The user-defined URL feature allows the user to configure the URL while supporti - Define an Allowed/Disallowed user-defined URL. - Add a user-defined URL to the Signature/Metacharacters override list. -For `urlContentProfiles` default values, see NGINX App Protect WAF [Declarative Policy guide.]({{< relref "/nap-waf/v4/declarative-policy/policy.md" >}}) +For `urlContentProfiles` default values, see NGINX App Protect WAF [Declarative Policy guide.]({{< ref "/nap-waf/v4/declarative-policy/policy.md" >}}) In this example we configure allowed meta-characters in a user-defined URL: diff --git a/content/includes/nap-waf/config/common/user-defined-signatures.md b/content/includes/nap-waf/config/common/user-defined-signatures.md index e0999171b..98c3dc4dc 100644 --- a/content/includes/nap-waf/config/common/user-defined-signatures.md +++ b/content/includes/nap-waf/config/common/user-defined-signatures.md @@ -8,8 +8,8 @@ The process of creating and implementing a user policy that contains user-define - Creating the user-defined signature definitions in separate JSON files. - Adding the relevant references (names, tags, signature sets) to the user-defined signatures in a policy JSON file. -- Referencing user-defined JSON files in a [global settings]({{< relref "/nap-waf/v5/admin-guide/compiler.md#global-settings" >}}) file. -- Compiling a policy bundle using [NGINX App Protect WAF Compiler]({{< relref "/nap-waf/v5/admin-guide/compiler.md" >}}) +- Referencing user-defined JSON files in a [global settings]({{< ref "/nap-waf/v5/admin-guide/compiler.md#global-settings" >}}) file. +- Compiling a policy bundle using [NGINX App Protect WAF Compiler]({{< ref "/nap-waf/v5/admin-guide/compiler.md" >}}) ##### User-Defined Signature Definitions diff --git a/content/includes/nginx-one/add-file/existing-ssl-bundle.md b/content/includes/nginx-one/add-file/existing-ssl-bundle.md index e0c5fa219..e6a8c59a4 100644 --- a/content/includes/nginx-one/add-file/existing-ssl-bundle.md +++ b/content/includes/nginx-one/add-file/existing-ssl-bundle.md @@ -2,7 +2,7 @@ docs: --- -With this option, You can incorporate [Managed certificates]({{< relref "/nginx-one/how-to/certificates/manage-certificates.md#managed-and-unmanaged-certificates" >}}). +With this option, You can incorporate [Managed certificates]({{< ref "/nginx-one/how-to/certificates/manage-certificates.md#managed-and-unmanaged-certificates" >}}). In the **Choose Certificate** drop-down, select the managed certificate of your choice, and select **Add**. You can then: 1. Review details of the certificate. The next steps depend on whether the certificate is a CA bundle or a certificate / key pair. diff --git a/content/includes/nginx-plus/install/back-up-config-and-logs.md b/content/includes/nginx-plus/install/back-up-config-and-logs.md index 73c59c7a4..014c5879a 100644 --- a/content/includes/nginx-plus/install/back-up-config-and-logs.md +++ b/content/includes/nginx-plus/install/back-up-config-and-logs.md @@ -2,4 +2,4 @@ docs: --- -Back up your NGINX Plus configuration and log files if you have an older NGINX Plus package installed. For more information, see [Upgrading NGINX Plus]({{< relref "nginx/admin-guide/installing-nginx/installing-nginx-plus.md#upgrade" >}}). \ No newline at end of file +Back up your NGINX Plus configuration and log files if you have an older NGINX Plus package installed. For more information, see [Upgrading NGINX Plus]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-plus.md#upgrade" >}}). \ No newline at end of file diff --git a/content/includes/nginx-plus/install/check-tech-specs.md b/content/includes/nginx-plus/install/check-tech-specs.md index a3d9889d1..613b76642 100644 --- a/content/includes/nginx-plus/install/check-tech-specs.md +++ b/content/includes/nginx-plus/install/check-tech-specs.md @@ -2,4 +2,4 @@ docs: --- -Check if your operating system and architecture are supported. For a complete list of supported platforms and architectures, see the [Technical Specifications]({{< relref "nginx/technical-specs.md" >}}). +Check if your operating system and architecture are supported. For a complete list of supported platforms and architectures, see the [Technical Specifications]({{< ref "nginx/technical-specs.md" >}}). diff --git a/content/includes/nginx-plus/install/install-nginx-agent-for-nim.md b/content/includes/nginx-plus/install/install-nginx-agent-for-nim.md index 32616eb72..8b5b534d4 100644 --- a/content/includes/nginx-plus/install/install-nginx-agent-for-nim.md +++ b/content/includes/nginx-plus/install/install-nginx-agent-for-nim.md @@ -2,4 +2,4 @@ docs: --- -If you are using [NGINX Instance Manager]({{}}) in your infrastructure, install and enable [NGINX Agent](https://docs.nginx.com/nginx-agent/overview/). See [Install and Configure NGINX Agent](https://github.com/nginx/agent/blob/main/README.md) for details. \ No newline at end of file +If you are using [NGINX Instance Manager]({{}}) in your infrastructure, install and enable [NGINX Agent](https://docs.nginx.com/nginx-agent/overview/). See [Install and Configure NGINX Agent](https://github.com/nginx/agent/blob/main/README.md) for details. \ No newline at end of file diff --git a/content/includes/nginx-plus/install/nim-disconnected-report-usage.md b/content/includes/nginx-plus/install/nim-disconnected-report-usage.md index 5dd9f5ca7..ec522c7f7 100644 --- a/content/includes/nginx-plus/install/nim-disconnected-report-usage.md +++ b/content/includes/nginx-plus/install/nim-disconnected-report-usage.md @@ -2,4 +2,4 @@ docs: --- -In NGINX Instance Manager, prepare and send the usage report to F5 licensing endpoint. For more information, see [Report usage to F5 in a disconnected environment]({{< relref "nim/disconnected/report-usage-disconnected-deployment.md" >}}). \ No newline at end of file +In NGINX Instance Manager, prepare and send the usage report to F5 licensing endpoint. For more information, see [Report usage to F5 in a disconnected environment]({{< ref "nim/disconnected/report-usage-disconnected-deployment.md" >}}). \ No newline at end of file diff --git a/content/includes/nginx-plus/usage-tracking/agentless-reporting.md b/content/includes/nginx-plus/usage-tracking/agentless-reporting.md index e908130a2..0cbdce2f4 100644 --- a/content/includes/nginx-plus/usage-tracking/agentless-reporting.md +++ b/content/includes/nginx-plus/usage-tracking/agentless-reporting.md @@ -2,7 +2,7 @@ docs: DOCS-1408 --- -Since [Release 31]({{< relref "/nginx/releases.md#nginxplusrelease-31-r31" >}}), NGINX Plus provides a built-in support for reporting of your NGINX Plus instances to NGINX Instance Manager without the need of installing NGINX Agent or tuning HTTP Health checks. If you participate in the [F5 Flex Consumption Program](https://www.f5.com/products/get-f5/flex-consumption-program), you will no longer need to manually track your NGINX Plus instances. +Since [Release 31]({{< ref "/nginx/releases.md#nginxplusrelease-31-r31" >}}), NGINX Plus provides a built-in support for reporting of your NGINX Plus instances to NGINX Instance Manager without the need of installing NGINX Agent or tuning HTTP Health checks. If you participate in the [F5 Flex Consumption Program](https://www.f5.com/products/get-f5/flex-consumption-program), you will no longer need to manually track your NGINX Plus instances. Usage reporting is enabled by default. At each startup, NGINX Plus attempts to discover NGINX Instance Manager via a DNS lookup of the `nginx-mgmt.local` hostname. Then NGINX Plus establishes a TLS connection to NGINX Instance Manager and every `30` minutes reports its version number, hostname, and identifier. @@ -23,7 +23,7 @@ Parameters customization can be done with the [`ngx_mgmt_module`](https://nginx. It is highly recommended to secure and authorize NGINX Plus instance with NGINX Instance Manager by using client certificates unique to each endpoint. -1. Obtain a certificate, a key, and a CA certificate on both the NGINX Instance Manager and NGINX Plus instance. See the [Secure Traffic with Certificates]({{< relref "/nim/system-configuration/secure-traffic.md" >}}) for instructions on how to generate keys. +1. Obtain a certificate, a key, and a CA certificate on both the NGINX Instance Manager and NGINX Plus instance. See the [Secure Traffic with Certificates]({{< ref "/nim/system-configuration/secure-traffic.md" >}}) for instructions on how to generate keys. 2. In the configuration file of NGINX Plus instance, on the `main` level, add the [`mgmt`](https://nginx.org/en/docs/ngx_mgmt_module.html#mgmt) block: diff --git a/content/includes/nginx-plus/usage-tracking/http-health-check.md b/content/includes/nginx-plus/usage-tracking/http-health-check.md index 6cecb40ab..0a0e0a90d 100644 --- a/content/includes/nginx-plus/usage-tracking/http-health-check.md +++ b/content/includes/nginx-plus/usage-tracking/http-health-check.md @@ -2,9 +2,9 @@ docs: DOCS-1351 --- -You can track NGINX Plus instances using an [HTTP Health Check]({{< relref "nginx/admin-guide/load-balancer/http-health-check" >}}) without installing NGINX Agent. This involves updating the NGINX Plus configuration file. Follow these steps: +You can track NGINX Plus instances using an [HTTP Health Check]({{< ref "nginx/admin-guide/load-balancer/http-health-check" >}}) without installing NGINX Agent. This involves updating the NGINX Plus configuration file. Follow these steps: -1. Open the NGINX Plus configuration file ([_/etc/nginx/conf.d_]({{< relref "nginx/admin-guide/basic-functionality/managing-configuration-files.md#feature-specific-configuration-files" >}})) and insert the following code within the `http {}` block: +1. Open the NGINX Plus configuration file ([_/etc/nginx/conf.d_]({{< ref "nginx/admin-guide/basic-functionality/managing-configuration-files.md#feature-specific-configuration-files" >}})) and insert the following code within the `http {}` block: ```nginx ### F5 / NGINX Required Configuration Code ### @@ -75,7 +75,7 @@ You can track NGINX Plus instances using an [HTTP Health Check]({{< relref "ngin 2. Modify the configuration to suit your specific NGINX Instance Manager installation: - Update the `NMS_FQDN` variable in the `upstream receiver` block with your Instance Manager hostname or IP address. If using a private DNS, uncomment and update the resolver with your [DNS IP Address](http://nginx.org/en/docs/http/ngx_http_upstream_module.html#resolver). - - If your Instance Manager server requires client SSL certification, specify the locations of the SSL certificate and key in the `map CERT` and `map KEY` blocks. For more details, see [Securing HTTP Traffic to Upstream Servers]({{< relref "nginx/admin-guide/security-controls/securing-http-traffic-upstream" >}}). + - If your Instance Manager server requires client SSL certification, specify the locations of the SSL certificate and key in the `map CERT` and `map KEY` blocks. For more details, see [Securing HTTP Traffic to Upstream Servers]({{< ref "nginx/admin-guide/security-controls/securing-http-traffic-upstream" >}}). - If you're using NGINX App Protect, change `nap=inactive` to `nap=active` in the `location @ngx_usage_https` block. - Optionally, you can limit access to the `/api/nginx-usage` location on your NGINX Instance Manager server based on client network address. For guidance on how to do this, refer to [Module ngx_http_access_module](http://nginx.org/en/docs/http/ngx_http_access_module.html). 3. Save the changes. diff --git a/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md b/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md index 4df09461f..9779c6c38 100644 --- a/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md +++ b/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md @@ -4,7 +4,7 @@ docs: DOCS-1354 When you install NGINX Agent on an NGINX Plus instance, it will establish a connection with Instance Manager and begin transmitting usage data. -1. To install NGINX Agent, [follow these instructions]({{< relref "/nms/nginx-agent/install-nginx-agent.md" >}}). +1. To install NGINX Agent, [follow these instructions]({{< ref "/nms/nginx-agent/install-nginx-agent.md" >}}). 2. (Optional) If you're using Instance Manager primarily for tracking NGINX Plus usage, you can optimize performance by modifying the NGINX Agent configuration. Add this line to _/etc/nginx-agent/nginx-agent.conf_: diff --git a/content/includes/nginx-plus/usage-tracking/install-nim.md b/content/includes/nginx-plus/usage-tracking/install-nim.md index b723e8dc9..b5d048227 100644 --- a/content/includes/nginx-plus/usage-tracking/install-nim.md +++ b/content/includes/nginx-plus/usage-tracking/install-nim.md @@ -4,13 +4,13 @@ docs: DOCS-1355 {{}}A separate license for NGINX Instance Manager is not required to track your NGINX product usage.{{}} -To start reporting on your [NGINX Plus]({{< relref "nginx/" >}}) installations, you'll first need to install [NGINX Instance Manager]({{< relref "nim/" >}}) on a dedicated host. You can choose between two installation options: either on a virtual machine or bare metal server, or by deploying on a Kubernetes cluster. Instructions for both methods are below: +To start reporting on your [NGINX Plus]({{< ref "nginx/" >}}) installations, you'll first need to install [NGINX Instance Manager]({{< ref "nim/" >}}) on a dedicated host. You can choose between two installation options: either on a virtual machine or bare metal server, or by deploying on a Kubernetes cluster. Instructions for both methods are below: #### Virtual Machine or Bare Metal -- [Prerequisites]({{< relref "/nim/deploy/vm-bare-metal/install.md" >}}) -- [Install NGINX Instance Manager]({{< relref "/nim/deploy/vm-bare-metal/install.md" >}}) +- [Prerequisites]({{< ref "/nim/deploy/vm-bare-metal/install.md" >}}) +- [Install NGINX Instance Manager]({{< ref "/nim/deploy/vm-bare-metal/install.md" >}}) #### Kubernetes -- [Deploy Instance Manager on Kubernetes]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}) +- [Deploy Instance Manager on Kubernetes]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}) diff --git a/content/includes/nginx-plus/usage-tracking/overview.md b/content/includes/nginx-plus/usage-tracking/overview.md index 032870794..3a048abf9 100644 --- a/content/includes/nginx-plus/usage-tracking/overview.md +++ b/content/includes/nginx-plus/usage-tracking/overview.md @@ -6,5 +6,5 @@ Start by installing NGINX Instance Manager on a dedicated host. Then, configure {{}} -To set up automatic reporting, [add your JWT-based license to NGINX Instance Manager]({{< relref "/nim/admin-guide/license/add-license.md#apply-jwt-license" >}}). This license can be downloaded from [MyF5](https://account.f5.com/myf5) if needed. +To set up automatic reporting, [add your JWT-based license to NGINX Instance Manager]({{< ref "/nim/admin-guide/license/add-license.md#apply-jwt-license" >}}). This license can be downloaded from [MyF5](https://account.f5.com/myf5) if needed. {{}} diff --git a/content/includes/nginxaas-azure/ssl-tls-prerequisites.md b/content/includes/nginxaas-azure/ssl-tls-prerequisites.md index 68849fbf5..c37a4ac13 100644 --- a/content/includes/nginxaas-azure/ssl-tls-prerequisites.md +++ b/content/includes/nginxaas-azure/ssl-tls-prerequisites.md @@ -16,6 +16,6 @@ docs: "DOCS-000" - If using Access Policies for AKV, ensure that you have *LIST certificates* or higher permissions. - - If public access is disabled on your key vault, [configure Network Security Perimeter]({{< relref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}}) and add an inbound access rule to allow your client IP address. + - If public access is disabled on your key vault, [configure Network Security Perimeter]({{< ref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}}) and add an inbound access rule to allow your client IP address. - If you're unfamiliar with Azure Key Vault, check out the [Azure Key Vault concepts](https://docs.microsoft.com/en-us/azure/key-vault/general/basic-concepts) documentation from Microsoft. \ No newline at end of file diff --git a/content/includes/nginxaas-azure/terraform-prerequisites.md b/content/includes/nginxaas-azure/terraform-prerequisites.md index b529c9b65..a0267168b 100644 --- a/content/includes/nginxaas-azure/terraform-prerequisites.md +++ b/content/includes/nginxaas-azure/terraform-prerequisites.md @@ -2,7 +2,7 @@ docs: "DOCS-000" --- -- Confirm that you meet the [NGINXaaS Prerequisites]({{< relref "/nginxaas-azure/getting-started/prerequisites.md" >}}). +- Confirm that you meet the [NGINXaaS Prerequisites]({{< ref "/nginxaas-azure/getting-started/prerequisites.md" >}}). - [Authenticate Terraform to Azure](https://learn.microsoft.com/en-us/azure/developer/terraform/authenticate-to-azure) - [Install Terraform](https://learn.hashicorp.com/tutorials/terraform/install) diff --git a/content/includes/nginxaas-azure/terraform-resources.md b/content/includes/nginxaas-azure/terraform-resources.md index 727740cc4..f45c36671 100644 --- a/content/includes/nginxaas-azure/terraform-resources.md +++ b/content/includes/nginxaas-azure/terraform-resources.md @@ -2,5 +2,5 @@ docs: "DOCS-000" --- -- [NGINXaaS Managed Identity Documentation]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) -- [NGINXaaS Azure Monitor Documentation]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) \ No newline at end of file +- [NGINXaaS Managed Identity Documentation]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) +- [NGINXaaS Azure Monitor Documentation]({{< ref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) \ No newline at end of file diff --git a/content/includes/nim/admin-guide/auth/basic-auth-api-requests.md b/content/includes/nim/admin-guide/auth/basic-auth-api-requests.md index 7ca8c875c..6e94ced35 100644 --- a/content/includes/nim/admin-guide/auth/basic-auth-api-requests.md +++ b/content/includes/nim/admin-guide/auth/basic-auth-api-requests.md @@ -18,4 +18,4 @@ In this example, replace `` with your NGINX Instance Manager's fully q
-{{< call-out "warning" "Security consideration" >}}While basic authentication is an option for API requests, it comes with security risks: credentials are sent as base64-encoded text, which is not secure encryption. If the data is intercepted, the encoding can be easily reversed. For production environments, where security is critical, we strongly recommend [switching to OpenID Connect (OIDC)]({{< relref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}).{{< /call-out >}} +{{< call-out "warning" "Security consideration" >}}While basic authentication is an option for API requests, it comes with security risks: credentials are sent as base64-encoded text, which is not secure encryption. If the data is intercepted, the encoding can be easily reversed. For production environments, where security is critical, we strongly recommend [switching to OpenID Connect (OIDC)]({{< ref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}).{{< /call-out >}} diff --git a/content/includes/nim/admin-guide/license/connected-install-license-note.md b/content/includes/nim/admin-guide/license/connected-install-license-note.md index bd352da87..251043df4 100644 --- a/content/includes/nim/admin-guide/license/connected-install-license-note.md +++ b/content/includes/nim/admin-guide/license/connected-install-license-note.md @@ -4,4 +4,4 @@ docs: A valid license is required to make full use of all the features in NGINX Instance Manager. -Refer to the [Add a License]({{< relref "nim/admin-guide/license/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license. \ No newline at end of file +Refer to the [Add a License]({{< ref "nim/admin-guide/license/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license. \ No newline at end of file diff --git a/content/includes/nim/how-to-access-nim-api.md b/content/includes/nim/how-to-access-nim-api.md index c2e7ca316..d5af8cac6 100644 --- a/content/includes/nim/how-to-access-nim-api.md +++ b/content/includes/nim/how-to-access-nim-api.md @@ -2,4 +2,4 @@ docs: DOCS-1050 --- -You can use tools like `curl` or [Postman](https://www.postman.com) to interact with the NGINX Instance Manager REST API. The API URL is `https:///api/[nim|platform]/`, and each request requires authentication. For more details on authentication options, see the [API Overview]({{< relref "/nim/fundamentals/api-overview.md" >}}). +You can use tools like `curl` or [Postman](https://www.postman.com) to interact with the NGINX Instance Manager REST API. The API URL is `https:///api/[nim|platform]/`, and each request requires authentication. For more details on authentication options, see the [API Overview]({{< ref "/nim/fundamentals/api-overview.md" >}}). diff --git a/content/includes/nim/kubernetes/access-webui-helm.md b/content/includes/nim/kubernetes/access-webui-helm.md index 3ecc2d3fd..f64a81072 100644 --- a/content/includes/nim/kubernetes/access-webui-helm.md +++ b/content/includes/nim/kubernetes/access-webui-helm.md @@ -23,4 +23,4 @@ You can access the NGINX Instance Manager web interface using the external IP ad For example, `https://10.108.57.167/ui`. - This IP address might not be reachable, depending on how the Kubernetes cluster networking was configured. If so, the `apigw` service type can be changed to a more suitable option, such as `LoadBalancer`, by changing the [Configurable Helm Setting]({{< relref "/nim/deploy/kubernetes/helm-config-settings.md" >}}) value for `apigw.service.type`. + This IP address might not be reachable, depending on how the Kubernetes cluster networking was configured. If so, the `apigw` service type can be changed to a more suitable option, such as `LoadBalancer`, by changing the [Configurable Helm Setting]({{< ref "/nim/deploy/kubernetes/helm-config-settings.md" >}}) value for `apigw.service.type`. diff --git a/content/includes/nim/rbac/assign-roles-to-user-groups.md b/content/includes/nim/rbac/assign-roles-to-user-groups.md index 4e094131d..961de496a 100644 --- a/content/includes/nim/rbac/assign-roles-to-user-groups.md +++ b/content/includes/nim/rbac/assign-roles-to-user-groups.md @@ -2,7 +2,7 @@ docs: DOCS-1301 --- -{{< call-out "important" "User groups require an OIDC identity provider" >}}User groups require an external identity provider configured for OpenID Connect (OIDC) authentication, as described in [Getting started with OIDC]({{< relref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}). Users from an external identity provider cannot be assigned roles directly in NGINX Instance Manager. Instead, they inherit roles based on their group membership.{{< /call-out >}} +{{< call-out "important" "User groups require an OIDC identity provider" >}}User groups require an external identity provider configured for OpenID Connect (OIDC) authentication, as described in [Getting started with OIDC]({{< ref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}). Users from an external identity provider cannot be assigned roles directly in NGINX Instance Manager. Instead, they inherit roles based on their group membership.{{< /call-out >}} To assign roles to a user group, follow these steps: diff --git a/content/includes/nim/rbac/create-roles.md b/content/includes/nim/rbac/create-roles.md index 2a5c3ef71..174ed3057 100644 --- a/content/includes/nim/rbac/create-roles.md +++ b/content/includes/nim/rbac/create-roles.md @@ -2,7 +2,7 @@ docs: DOCS-1028 --- -Roles in NGINX Instance Manager are a critical part of [role-based access control (RBAC)]({{< relref "/nim/admin-guide/rbac/overview-rbac.md" >}}). By creating roles, you define the access levels and permissions for different user groups that correspond to groups in your Identity Provider (IdP). +Roles in NGINX Instance Manager are a critical part of [role-based access control (RBAC)]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}). By creating roles, you define the access levels and permissions for different user groups that correspond to groups in your Identity Provider (IdP). NGINX Instance Manager comes pre-configured with an administrator role called `admin`. Additional roles can be created as needed. @@ -24,7 +24,7 @@ Follow these steps to create a role and set its permissions: 1. Select **Add Permission**. 2. Choose the NGINX Instance Manager module you're creating the permission for from the **Module** list. - 3. Select the feature you're granting permission for from the **Feature** list. To learn more about features, refer to [Get started with RBAC]({{< relref "/nim/admin-guide/rbac/overview-rbac.md" >}}). + 3. Select the feature you're granting permission for from the **Feature** list. To learn more about features, refer to [Get started with RBAC]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}). 4. Select **Add Additional Access** to choose a CRUD (Create, Read, Update, Delete) access level. - Choose the access level(s) you want to grant from the **Access** list. 5. Select **Save**. diff --git a/content/includes/nms/services/platform-services.md b/content/includes/nms/services/platform-services.md index 4ec7f8bb8..33224eeea 100644 --- a/content/includes/nms/services/platform-services.md +++ b/content/includes/nms/services/platform-services.md @@ -9,6 +9,6 @@ docs: DOCS-1186 | Core | The core service configures and sets up the management plane, as well as performs data analysis for metrics, events, and alerts. | | Data Plane Manager (DPM) | The data plane manager (DPM) service is responsible for configuring NGINX instances on the data plane, monitoring the state of data plane resources, and generating reports and event messages. | | Ingestion | The ingestion service collects metrics, security violations, and events that are not sent to the data plane manager service by the NGINX Agent. This information can be forwarded to external data stores. | -| Integrations | The integrations process includes features for interacting with external components, like configuring [NGINX App Protect WAF policies]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md" >}}), managing threat campaigns, and more. | +| Integrations | The integrations process includes features for interacting with external components, like configuring [NGINX App Protect WAF policies]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md" >}}), managing threat campaigns, and more. | {{< /bootstrap-table >}} diff --git a/content/includes/support/how-to-get-support.md b/content/includes/support/how-to-get-support.md index 6ca1db4c2..e03f3a791 100644 --- a/content/includes/support/how-to-get-support.md +++ b/content/includes/support/how-to-get-support.md @@ -4,6 +4,6 @@ docs: DOCS-1225 If you need additional assistance, refer to the following topics for guidance on how to contact Support and create a Support Package: -- [Contact Support]({{< relref "/nms/support/contact-support.md" >}}) -- [Create a Support Package]({{< relref "/nms/support/support-package.md" >}}) +- [Contact Support]({{< ref "/nms/support/contact-support.md" >}}) +- [Create a Support Package]({{< ref "/nms/support/support-package.md" >}}) diff --git a/content/mesh/get-started/install/configuration.md b/content/mesh/get-started/install/configuration.md index 345e9fb4b..4c801a585 100644 --- a/content/mesh/get-started/install/configuration.md +++ b/content/mesh/get-started/install/configuration.md @@ -15,7 +15,7 @@ This document provides an overview of the various options you can configure when {{< tip >}} To manage your configuration after deployment, you can use the NGINX Service Mesh API. -Refer to the [API Usage Guide]( {{< ref "api-usage.md" >}} ) for more information. +Refer to the [API Usage Guide]( {{< ref "/mesh/reference/api-usage.md" >}} ) for more information. {{< /tip >}} {{< note >}} diff --git a/content/mesh/get-started/platform-setup/supported-platforms.md b/content/mesh/get-started/platform-setup/supported-platforms.md index 958606c80..67f5b13a6 100644 --- a/content/mesh/get-started/platform-setup/supported-platforms.md +++ b/content/mesh/get-started/platform-setup/supported-platforms.md @@ -13,9 +13,9 @@ The Kubernetes platforms listed below will work with F5 NGINX Service Mesh using - Azure Kubernetes Service (AKS) - Elastic Kubernetes Service (EKS) -- [Additional setup required]( {{< ref "persistent-storage.md" >}} ) -- Google Kubernetes Engine (GKE) -- [Additional setup required]( {{< ref "gke.md" >}} ) +- Google Kubernetes Engine (GKE) -- [Additional setup required]( {{< relref "./gke.md" >}} ) - Rancher Kubernetes Engine (RKE) -- [Additional setup required]( {{< ref "rke.md" >}} ) -- Kubeadm -- [Additional setup required]( {{< ref "kubeadm.md" >}} ) +- Kubeadm -- [Additional setup required]( {{< relref "./kubeadm.md" >}} ) - Kubespray -- [Additional setup required]( {{< ref "kubespray.md" >}} ) ## OpenShift diff --git a/content/mesh/releases/release-notes-0.5.0.md b/content/mesh/releases/release-notes-0.5.0.md index 96e68d944..4a1f859df 100644 --- a/content/mesh/releases/release-notes-0.5.0.md +++ b/content/mesh/releases/release-notes-0.5.0.md @@ -23,7 +23,7 @@ These release notes provide general information and describe known issues for NG - [Resolved Issues](#resolved-issues) - [Known Issues](#known-issues) - {{< link "nginx-service-mesh/licenses/license-servicemesh-0.5.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}}) diff --git a/content/mesh/releases/release-notes-0.6.0.md b/content/mesh/releases/release-notes-0.6.0.md index 19425adf9..e5cdabf49 100644 --- a/content/mesh/releases/release-notes-0.6.0.md +++ b/content/mesh/releases/release-notes-0.6.0.md @@ -24,7 +24,7 @@ These release notes provide general information and describe known issues for NG - [Known Issues](#known-issues) - [Supported Versions](#supported-versions) - {{< link "nginx-service-mesh/licenses/license-servicemesh-0.6.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}}) diff --git a/content/mesh/releases/release-notes-0.7.0.md b/content/mesh/releases/release-notes-0.7.0.md index e9e84825f..82314c63d 100644 --- a/content/mesh/releases/release-notes-0.7.0.md +++ b/content/mesh/releases/release-notes-0.7.0.md @@ -24,7 +24,7 @@ These release notes provide general information and describe known issues for NG - [Known Issues](#known-issues) - [Supported Versions](#supported-versions) - {{< link "nginx-service-mesh/licenses/license-servicemesh-0.7.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}}) diff --git a/content/mesh/releases/release-notes-0.8.0.md b/content/mesh/releases/release-notes-0.8.0.md index 8f3c07c82..a7e25c1eb 100644 --- a/content/mesh/releases/release-notes-0.8.0.md +++ b/content/mesh/releases/release-notes-0.8.0.md @@ -24,7 +24,7 @@ These release notes provide general information and describe known issues for NG - [Known Issues](#known-issues) - [Supported Versions](#supported-versions) - {{< link "nginx-service-mesh/licenses/license-servicemesh-0.8.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}}) diff --git a/content/mesh/releases/release-notes-0.9.0.md b/content/mesh/releases/release-notes-0.9.0.md index ad5b13ed7..15e672b6e 100644 --- a/content/mesh/releases/release-notes-0.9.0.md +++ b/content/mesh/releases/release-notes-0.9.0.md @@ -24,7 +24,7 @@ These release notes provide general information and describe known issues for NG - [Known Issues](#known-issues) - [Supported Versions](#supported-versions) - {{< link "nginx-service-mesh/licenses/license-servicemesh-0.9.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}}) @@ -241,8 +241,8 @@ There is no workaround at this time, but the configuration can be changed dynami To fix the issue, take one or more of the following actions: -- All load balancing annotations (config.nsm.nginx.com/lb-method) should be removed or updated to another supported algorithm (see [Configuration Options for NGINX Service Mesh]({{< relref "/mesh/get-started/install/configuration.md" >}})). -- The global load balancing algorithm should be set to another supported algorithm (see [Configuration Options for NGINX Service Mesh]({{< relref "/mesh/get-started/install/configuration.md" >}})) . +- All load balancing annotations (config.nsm.nginx.com/lb-method) should be removed or updated to another supported algorithm (see [Configuration Options for NGINX Service Mesh]({{< ref "/mesh/get-started/install/configuration.md" >}})). +- The global load balancing algorithm should be set to another supported algorithm (see [Configuration Options for NGINX Service Mesh]({{< ref "/mesh/get-started/install/configuration.md" >}})) .

**Kubernetes reports warnings on versions >=1.19 (22721)** diff --git a/content/mesh/releases/release-notes-1.0.0.md b/content/mesh/releases/release-notes-1.0.0.md index 6214dd1f0..bb042d2dc 100644 --- a/content/mesh/releases/release-notes-1.0.0.md +++ b/content/mesh/releases/release-notes-1.0.0.md @@ -26,7 +26,7 @@ These release notes provide general information and describe known issues for NG - [Known Issues](#known-issues) - [Supported Versions](#supported-versions) - {{< link "nginx-service-mesh/licenses/license-servicemesh-1.0.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}}) diff --git a/content/mesh/releases/release-notes-1.1.0.md b/content/mesh/releases/release-notes-1.1.0.md index f51b6eb0e..5eb066f52 100644 --- a/content/mesh/releases/release-notes-1.1.0.md +++ b/content/mesh/releases/release-notes-1.1.0.md @@ -26,7 +26,7 @@ These release notes provide general information and describe known issues for NG - [Known Issues](#known-issues) - [Supported Versions](#supported-versions) - {{< link "nginx-service-mesh/licenses/license-servicemesh-1.1.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}}) diff --git a/content/mesh/releases/release-notes-1.2.0.md b/content/mesh/releases/release-notes-1.2.0.md index c84eb50d9..b1cfbb9b0 100644 --- a/content/mesh/releases/release-notes-1.2.0.md +++ b/content/mesh/releases/release-notes-1.2.0.md @@ -27,7 +27,7 @@ These release notes provide general information and describe known issues for NG - [Known Issues](#known-issues) - [Supported Versions](#supported-versions) - {{< link "nginx-service-mesh/licenses/license-servicemesh-1.2.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}})

diff --git a/content/mesh/releases/release-notes-1.3.0.md b/content/mesh/releases/release-notes-1.3.0.md index c207c9b8f..94fd659fd 100644 --- a/content/mesh/releases/release-notes-1.3.0.md +++ b/content/mesh/releases/release-notes-1.3.0.md @@ -27,7 +27,7 @@ These release notes provide general information and describe known issues for NG - [Known Issues](#known-issues) - [Supported Versions](#supported-versions) - {{< link "nginx-service-mesh/licenses/license-servicemesh-1.3.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}})

diff --git a/content/mesh/releases/release-notes-1.4.0.md b/content/mesh/releases/release-notes-1.4.0.md index f2d828bd9..f34791b3c 100644 --- a/content/mesh/releases/release-notes-1.4.0.md +++ b/content/mesh/releases/release-notes-1.4.0.md @@ -27,7 +27,7 @@ These release notes provide general information and describe known issues for NG - [Known Issues](#known-issues) - [Supported Versions](#supported-versions) - {{< link "nginx-service-mesh/licenses/license-servicemesh-1.4.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}})

@@ -39,7 +39,7 @@ NGINX Service Mesh 1.4.0 includes the following updates:
- NGINX Service Mesh has changed its API to follow Kubernetes convention enabling granular controls of the NGINX Service Mesh API using Kubernetes native RBAC. - - [Use the NGINX Service Mesh API]({{< relref "mesh/reference/api-usage.md" >}}) + - [Use the NGINX Service Mesh API]({{< ref "mesh/reference/api-usage.md" >}}) - Support for service-to-service UDP traffic proxying - The addition of OpenTelemetry tracing along side the existing OpenTracing support to provide rich telemetry options - Coupling with the cert-manager project to instantly drop into your existing Certificate Authority issuer workflow @@ -53,10 +53,10 @@ NGINX Service Mesh 1.4.0 includes the following updates: #### **Features** -- [Support for UDP traffic proxying]({{< relref "mesh/about/architecture.md/#udp-and-ebpf" >}}) -- [Support for OpenTelemetry tracing using the OTLP gRPC Exporter]({{< relref "mesh/guides/monitoring-and-tracing.md/#opentelemetry" >}}) -- [Support for cert-manager as an upstream authority]({{< relref "mesh/guides/secure-traffic-mtls.md/#deploy-using-an-upstream-root-ca" >}}) -- [How to access the NGINX Service Mesh API using Kubernetes native RBAC]({{< relref "mesh/reference/api-usage.md" >}}) +- [Support for UDP traffic proxying]({{< ref "mesh/about/architecture.md/#udp-and-ebpf" >}}) +- [Support for OpenTelemetry tracing using the OTLP gRPC Exporter]({{< ref "mesh/guides/monitoring-and-tracing.md/#opentelemetry" >}}) +- [Support for cert-manager as an upstream authority]({{< ref "mesh/guides/secure-traffic-mtls.md/#deploy-using-an-upstream-root-ca" >}}) +- [How to access the NGINX Service Mesh API using Kubernetes native RBAC]({{< ref "mesh/reference/api-usage.md" >}}) #### **Improvements** diff --git a/content/mesh/releases/release-notes-1.5.0.md b/content/mesh/releases/release-notes-1.5.0.md index a1ce1ff5c..a203ae1d2 100644 --- a/content/mesh/releases/release-notes-1.5.0.md +++ b/content/mesh/releases/release-notes-1.5.0.md @@ -24,9 +24,9 @@ These release notes provide general information and describe known issues for NG - [Updates](#updates) - [Resolved Issues](#resolved-issues) - [Known Issues](#known-issues) - - [Supported Versions]({{< relref "mesh/about/mesh-tech-specs.md" >}}) + - [Supported Versions]({{< ref "mesh/about/mesh-tech-specs.md" >}}) - {{< link "nginx-service-mesh/licenses/license-servicemesh-1.5.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}}) diff --git a/content/mesh/releases/release-notes-1.6.0.md b/content/mesh/releases/release-notes-1.6.0.md index a8adb8f60..78269f6ca 100644 --- a/content/mesh/releases/release-notes-1.6.0.md +++ b/content/mesh/releases/release-notes-1.6.0.md @@ -24,9 +24,9 @@ These release notes provide general information and describe known issues for NG - [Updates](#updates) - [Resolved Issues](#resolved-issues) - [Known Issues](#known-issues) - - [Supported Versions]({{< relref "mesh/about/mesh-tech-specs.md" >}}) + - [Supported Versions]({{< ref "mesh/about/mesh-tech-specs.md" >}}) - {{< link "nginx-service-mesh/licenses/license-servicemesh-1.6.0.html" "Open Source Licenses" >}} - - [Open Source Licenses Addendum]({{< relref "oss-dependencies/index.md" >}}) + - [Open Source Licenses Addendum]({{< ref "oss-dependencies/index.md" >}})

diff --git a/content/mesh/releases/release-notes-1.7.0.md b/content/mesh/releases/release-notes-1.7.0.md index dee14a113..83dad0860 100644 --- a/content/mesh/releases/release-notes-1.7.0.md +++ b/content/mesh/releases/release-notes-1.7.0.md @@ -23,7 +23,7 @@ These release notes provide general information and describe known issues for NG - [NGINX Service Mesh Version 1.7.0](#nginx-service-mesh-version-170) - [Updates](#updates) - [Known Issues](#known-issues) - - [Supported Versions]({{< relref "mesh/about/mesh-tech-specs.md" >}}) + - [Supported Versions]({{< ref "mesh/about/mesh-tech-specs.md" >}})

diff --git a/content/mesh/releases/release-notes-2.0.0.md b/content/mesh/releases/release-notes-2.0.0.md index 89e1571f3..d9273f36d 100644 --- a/content/mesh/releases/release-notes-2.0.0.md +++ b/content/mesh/releases/release-notes-2.0.0.md @@ -24,7 +24,7 @@ These release notes provide general information and describe known issues for NG - [Updates](#updates) - [Resolved Issues](#resolved-issues) - [Known Issues](#known-issues) - - [Supported Versions]({{< relref "mesh/about/mesh-tech-specs.md" >}}) + - [Supported Versions]({{< ref "mesh/about/mesh-tech-specs.md" >}})

@@ -35,7 +35,7 @@ These release notes provide general information and describe known issues for NG NGINX Service Mesh 2.0.0 includes the following updates:

-- NGINX Service Mesh global configuration API has been moved to a Kubernetes Custom Resource Definition. The NGINX Service Mesh API server has been removed. See the [API Usage guide]( {{< ref "api-usage.md" >}} ) for details on how to use the new CRD. +- NGINX Service Mesh global configuration API has been moved to a Kubernetes Custom Resource Definition. The NGINX Service Mesh API server has been removed. See the [API Usage guide]( {{< ref "/mesh/reference/api-usage.md" >}} ) for details on how to use the new CRD. - Removed deprecated auto-injection annotations for Pods in favor of labels. - Removed deprecated NGINX Ingress Controller annotations for integrating with NGINX Service Mesh in favor of labels. - Automatic injection is now disabled globally by default, and requires users to opt-in via Namespace or Pod labels. See the [Automatic Injection guide]( {{< ref "/mesh/guides/inject-sidecar-proxy.md#automatic-proxy-injection" >}} ) for more details. diff --git a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging.md b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging.md index 6436a5272..0c0e49a45 100644 --- a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging.md +++ b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-installation-logging.md @@ -20,8 +20,8 @@ This chapter explains how to install the F5 NGINX ModSecurity web application f This chapter explains how to install the NGINX ModSecurity WAF, presents a sample configuration of a simple rule, and sets up logging. For information about rule sets, see: -- [Using the OWASP CRS with the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-owasp-crs.md" >}}) -- [Using the ModSecurity Rules from Trustwave SpiderLabs with the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md" >}}) +- [Using the OWASP CRS with the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-owasp-crs.md" >}}) +- [Using the ModSecurity Rules from Trustwave SpiderLabs with the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md" >}}) @@ -298,8 +298,8 @@ In this chapter, we installed the NGINX ModSecurity WAF for NGINX Plus, created The simple rule works correctly, but doesn’t provide any real protection to an application. See the following chapters for instructions on configuring rules for comprehensive application protection: -- [Using the OWASP CRS with the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-owasp-crs.md" >}}) -- [Using the ModSecurity Rules from Trustwave SpiderLabs with the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md" >}}) +- [Using the OWASP CRS with the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-owasp-crs.md" >}}) +- [Using the ModSecurity Rules from Trustwave SpiderLabs with the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md" >}}) diff --git a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs.md b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs.md index b0dd934b3..9a688eb53 100644 --- a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs.md +++ b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs.md @@ -19,9 +19,9 @@ This chapter explains how to enable and test the Open Web Application Security P This chapter explains how to enable and test the [Open Web Application Security Project Core Rule Set](https://owasp.org/www-project-modsecurity-core-rule-set/) (OWASP CRS) for use with the NGINX ModSecurity WAF. The OWASP CRS includes signatures and patterns that detect many types of generic attacks. The latest version (CRS 3) includes significant improvements, including a reduction in false positives. -This chapter builds on the basic configuration in [Installing the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-installation-logging.md" >}}), showing how the CRS protects the demo web application created in that chapter. Before enabling the CRS, we run a scanning tool that generates attack traffic and reports the vulnerabilities it finds. We then enable the CRS and observe how it blocks most malicious requests, protecting our application against common attacks. +This chapter builds on the basic configuration in [Installing the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-installation-logging.md" >}}), showing how the CRS protects the demo web application created in that chapter. Before enabling the CRS, we run a scanning tool that generates attack traffic and reports the vulnerabilities it finds. We then enable the CRS and observe how it blocks most malicious requests, protecting our application against common attacks. -For information about another supported ModSecurity rule set, see [Using the ModSecurity Rules from Trustwave SpiderLabs with the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md" >}}). +For information about another supported ModSecurity rule set, see [Using the ModSecurity Rules from Trustwave SpiderLabs with the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md" >}}). @@ -29,7 +29,7 @@ For information about another supported ModSecurity rule set, see [Using the Mod The NGINX ModSecurity WAF is available to NGINX Plus customers as a downloaded dynamic module at an additional cost. You can [try the NGINX ModSecurity WAF free for 30 days](https://www.nginx.com/free-trial-request/). To purchase or add the NGINX ModSecurity WAF to an existing NGINX Plus subscription, [contact the NGINX sales team](https://www.nginx.com/contact-sales). -As noted above, this chapter builds on [Installing the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-installation-logging.md" >}}) and assumes you have followed the instructions there to configure the demo application and NGINX Plus as a reverse proxy. +As noted above, this chapter builds on [Installing the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-installation-logging.md" >}}) and assumes you have followed the instructions there to configure the demo application and NGINX Plus as a reverse proxy. It is assumed that the [`git`](https://github.com/git/git) and [`perl`](https://www.perl.org/get.html) command binaries are installed. @@ -37,7 +37,7 @@ It is assumed that the [`git`](https://github.com/git/git) and [`perl`](https:// ## Running the Nikto Scanning Tool -We begin by sending attack traffic to the demo web application created in [Installing the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-installation-logging.md#creating-the-demo-web-application" >}}). Many attackers run vulnerability scanners to identify security vulnerabilities in a target website or app. Once they learn what vulnerabilities are present, they can launch the appropriate attacks. +We begin by sending attack traffic to the demo web application created in [Installing the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-installation-logging.md#creating-the-demo-web-application" >}}). Many attackers run vulnerability scanners to identify security vulnerabilities in a target website or app. Once they learn what vulnerabilities are present, they can launch the appropriate attacks. We’re using the [Nikto](https://github.com/sullo/nikto) scanning tool to generate malicious requests, including probes for the presence of files known to be vulnerable, XSS, and other types of attack. The tool also reports which requests passed through to the application, revealing potential vulnerabilities in the application. @@ -76,7 +76,7 @@ To enable the OWASP CRS, perform the following steps: sudo cp crs-setup.conf.example crs-setup.conf ``` -3. Add `Include` directives in the main NGINX ModSecurity WAF configuration file (**/etc/nginx/modsec/main.conf**, created in Step 4 of [Installing the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-installation-logging.md#protecting-the-demo-web-application" >}}) in the installation chapter, to read in the CRS configuration and rules. Comment out any other rules that might already exist in the file, such as the sample `SecRule` directive created in that step. +3. Add `Include` directives in the main NGINX ModSecurity WAF configuration file (**/etc/nginx/modsec/main.conf**, created in Step 4 of [Installing the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-installation-logging.md#protecting-the-demo-web-application" >}}) in the installation chapter, to read in the CRS configuration and rules. Comment out any other rules that might already exist in the file, such as the sample `SecRule` directive created in that step. ```nginx # Include the recommended configuration @@ -170,7 +170,7 @@ $ perl program/nikto.pl -h localhost + 7531 requests: 0 error(s) and 116 item(s) reported on remote host ``` -Recall that in [Installing the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-installation-logging.md" >}}), we configured our demo application to return status code `200` for every request, without actually ever delivering a file. Nikto is interpreting these `200` status codes to mean that the file it is requesting actually exists, which in the context of our application is a false positive. +Recall that in [Installing the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-installation-logging.md" >}}), we configured our demo application to return status code `200` for every request, without actually ever delivering a file. Nikto is interpreting these `200` status codes to mean that the file it is requesting actually exists, which in the context of our application is a false positive. Now we eliminate such requests so we can better see where actual vulnerabilities might exist. Disable the requests by adding `‑sitefiles` in **program/nikto.conf** as shown: @@ -236,7 +236,7 @@ Inspecting the response body is not supported, so rules that do so have no effec We used the OWASP ModSecurity Core Rule Set to protect our web application against a wide range of generic attacks and saw how the CRS blocks malicious requests generated by the Nikto scanning tool. -For imformation about another supported ModSecurity rule set, see [Using the ModSecurity Rules from Trustwave SpiderLabs with the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md" >}}). +For imformation about another supported ModSecurity rule set, see [Using the ModSecurity Rules from Trustwave SpiderLabs with the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md" >}}). diff --git a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md index a873d4e58..3f29fa1de 100644 --- a/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md +++ b/content/modsec-waf/admin-guide/nginx-plus-modsecurity-waf-trustwave-spiderlabs-rules.md @@ -20,9 +20,9 @@ This chapter explains how to configure the Commercial ModSecurity Rules from Tru The Commercial ModSecurity Rules from Trustwave SpiderLabs (which we refer to as the Trustwave Rules in this chapter) complement the [Open Web Application Security Project Core Rule Set](https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project) (OWASP CRS) with protection against specific attacks for many common applications including ASP.NET, Joomla, and WordPress. Additionally, the Trustwave SpiderLabs Rules provide IP reputation along with other capabilities, and are updated daily. -This chapter builds on the basic configuration created in the [Installing the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-installation-logging.md" >}}) chapter, showing how to configure the Trustwave Rules to protect the demo web application configured in that chapter. +This chapter builds on the basic configuration created in the [Installing the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-installation-logging.md" >}}) chapter, showing how to configure the Trustwave Rules to protect the demo web application configured in that chapter. -The NGINX ModSecurity WAF also supports the OWASP CRS as described in [Using the OWASP CRS with the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-owasp-crs.md" >}}). +The NGINX ModSecurity WAF also supports the OWASP CRS as described in [Using the OWASP CRS with the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-owasp-crs.md" >}}). @@ -32,7 +32,7 @@ The NGINX ModSecurity WAF is available to NGINX Plus customers as a downloaded d You must purchase the Trustwave Rules directly from Trustwave SpiderLabs. -As noted above, this chapter builds on [Installing the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-installation-logging.md" >}}) and assumes you have followed the instructions there to configure both the demo application and NGINX Plus as a reverse proxy. +As noted above, this chapter builds on [Installing the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-installation-logging.md" >}}) and assumes you have followed the instructions there to configure both the demo application and NGINX Plus as a reverse proxy. @@ -66,7 +66,7 @@ To configure the Trustwave Rules for the demo application, perform the followin Here, the `SecRemoteRules` directive configures the NGINX ModSecurity WAF to download rules from the remote server, represented by the ``, using the provided ``. - The Wizard does not provide an interface for adding the directive, so you need to edit **/etc/nginx/modsec/main.conf** manually and add the `SecRemoteRules` directive presented by the Wizard (we created the **main.conf** file in Step 4 of [Protecting the Demo Web Application]({{< relref "nginx-plus-modsecurity-waf-installation-logging.md#protecting-the-demo-web-application" >}}) in the installation chapter). Comment out any other rules that might already exist in the file, such as the `SecRule` directive defined in that step. + The Wizard does not provide an interface for adding the directive, so you need to edit **/etc/nginx/modsec/main.conf** manually and add the `SecRemoteRules` directive presented by the Wizard (we created the **main.conf** file in Step 4 of [Protecting the Demo Web Application]({{< ref "nginx-plus-modsecurity-waf-installation-logging.md#protecting-the-demo-web-application" >}}) in the installation chapter). Comment out any other rules that might already exist in the file, such as the `SecRule` directive defined in that step. ```nginx # Include the recommended configuration @@ -97,7 +97,7 @@ To configure the Trustwave Rules for the demo application, perform the followin ### Testing the Rules -In the [Using the OWASP CRS with the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-owasp-crs.md" >}}) chapter, we use the Nikto scanning tool to test how the CRS blocks malicious requests. You cannot use a similar approach to test the Trustwave Rules, because they are specific rules that do not detect the generic attacks sent by Nikto. +In the [Using the OWASP CRS with the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-owasp-crs.md" >}}) chapter, we use the Nikto scanning tool to test how the CRS blocks malicious requests. You cannot use a similar approach to test the Trustwave Rules, because they are specific rules that do not detect the generic attacks sent by Nikto. The Dashboard describes each Trustwave ModSecurity Rule. You can use that information to test how the rule behaves, by constructing and sending NGINX Plus malicious requests that trigger the rules. @@ -116,7 +116,7 @@ Currently, the only way to download the Trustwave Rules is with the `SecRemoteRu - Downloading the rules takes some time, which delays the reload or restart operation. -- Each `SecRemoteRules` definition leads to a separate download, further increasing the reload/restart time. To avoid that, try to minimize the number of `SecRemoteRules` definitions. Note that even if you define `SecRemoteRules` only in one file (such as the **/etc/nginx/modsec/main.conf** file modified in [Step 3](#waf-trustwave_configure-your-server) above), each time you read this file into NGINX Plus configuration using the [`modsecurity_rules_file`](https://github.com/SpiderLabs/ModSecurity-nginx#modsecurity_rules_file) directive (as in the **/etc/nginx/conf.d/proxy.conf** file created in [Configuring NGINX Plus as a Reverse Proxy]({{< relref "nginx-plus-modsecurity-waf-installation-logging/#configuring-nginx-plus-as-a-reverse-proxy" >}}) in the installation chapter), the NGINX ModSecurity WAF treats it as a separate definition. +- Each `SecRemoteRules` definition leads to a separate download, further increasing the reload/restart time. To avoid that, try to minimize the number of `SecRemoteRules` definitions. Note that even if you define `SecRemoteRules` only in one file (such as the **/etc/nginx/modsec/main.conf** file modified in [Step 3](#waf-trustwave_configure-your-server) above), each time you read this file into NGINX Plus configuration using the [`modsecurity_rules_file`](https://github.com/SpiderLabs/ModSecurity-nginx#modsecurity_rules_file) directive (as in the **/etc/nginx/conf.d/proxy.conf** file created in [Configuring NGINX Plus as a Reverse Proxy]({{< ref "nginx-plus-modsecurity-waf-installation-logging/#configuring-nginx-plus-as-a-reverse-proxy" >}}) in the installation chapter), the NGINX ModSecurity WAF treats it as a separate definition. - Merging rules from different NGINX Plus configuration contexts ([`http {}`](https://nginx.org/en/docs/http/ngx_http_core_module.html#http), [`server {}`](https://nginx.org/en/docs/http/ngx_http_core_module.html#server), [`location {}`](http://nginx.org/en/docs/http/ngx_http_core_module.html#location)) also adds time to the reload/restart operation and consumes a lot of CPU, especially for a huge rule set such as the Trustwave Rules. In addition to minimizing the number of `SecRemoteRules` definitions, try to include all rule definitions in a single context. @@ -134,7 +134,7 @@ Inspecting the response body is not supported, so rules that do so have no effec We configured Commercial ModSecurity Rules from Trustwave SpiderLabs to protect our application against WordPress‑related attacks. We also reviewed caveats for the `SecRemoteRules` directive. -For information about using the OWASP CRS with the NGINX ModSecurity WAF, see [Using the OWASP CRS with the NGINX ModSecurity WAF]({{< relref "nginx-plus-modsecurity-waf-owasp-crs.md" >}}). +For information about using the OWASP CRS with the NGINX ModSecurity WAF, see [Using the OWASP CRS with the NGINX ModSecurity WAF]({{< ref "nginx-plus-modsecurity-waf-owasp-crs.md" >}}). diff --git a/content/nap-dos/deployment-guide/learn-about-deployment.md b/content/nap-dos/deployment-guide/learn-about-deployment.md index bedda6553..1477a8428 100644 --- a/content/nap-dos/deployment-guide/learn-about-deployment.md +++ b/content/nap-dos/deployment-guide/learn-about-deployment.md @@ -192,7 +192,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s sudo semodule -i app-protect-dos.pp; ``` - If you encounter any issues, refer to the [Troubleshooting Guide]({{< relref "/nap-dos/troubleshooting-guide/how-to-troubleshoot.md" >}}). + If you encounter any issues, refer to the [Troubleshooting Guide]({{< ref "/nap-dos/troubleshooting-guide/how-to-troubleshoot.md" >}}). {{< note >}}Additional SELinux configuration may be required to allow NGINX Plus to listen on specific network ports, connect to upstreams, and send syslog entries to remote systems. Refer to the practices outlined in the [Using NGINX and NGINX Plus with SELinux](https://www.nginx.com/blog/using-nginx-plus-with-selinux/) article for details.{{< /note >}} @@ -371,7 +371,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s sudo semodule -i app-protect-dos.pp; ``` - If you encounter any issues, refer to the [Troubleshooting Guide]({{< relref "/nap-dos/troubleshooting-guide/how-to-troubleshoot.md" >}}). + If you encounter any issues, refer to the [Troubleshooting Guide]({{< ref "/nap-dos/troubleshooting-guide/how-to-troubleshoot.md" >}}). {{< note >}}Additional SELinux configuration may be required to allow NGINX Plus to listen on specific network ports, connect to upstreams, and send syslog entries to remote systems. Refer to the practices outlined in the [Using NGINX and NGINX Plus with SELinux](https://www.nginx.com/blog/using-nginx-plus-with-selinux/) article for details.{{< /note >}} @@ -576,7 +576,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s sudo semodule -i app-protect-dos-ebpf-manager.pp; ``` - If you encounter any issues, refer to the [Troubleshooting Guide]({{< relref "/nap-dos/troubleshooting-guide/how-to-troubleshoot.md" >}}). + If you encounter any issues, refer to the [Troubleshooting Guide]({{< ref "/nap-dos/troubleshooting-guide/how-to-troubleshoot.md" >}}). {{< note >}}Additional SELinux configuration may be required to allow NGINX Plus to listen on specific network ports, connect to upstreams, and send syslog entries to remote systems. Refer to the practices outlined in the [Using NGINX and NGINX Plus with SELinux](https://www.nginx.com/blog/using-nginx-plus-with-selinux/) article for details.{{< /note >}} @@ -602,7 +602,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s ``` sudo systemctl start app-protect-dos-ebpf-manager ``` - + ## RHEL 9+ Installation 1. If you already have NGINX packages on your system, back up your configs and logs: @@ -788,7 +788,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s sudo semodule -i app-protect-dos-ebpf-manager.pp; ``` - If you encounter any issues, refer to the [Troubleshooting Guide]({{< relref "/nap-dos/troubleshooting-guide/how-to-troubleshoot.md" >}}). + If you encounter any issues, refer to the [Troubleshooting Guide]({{< ref "/nap-dos/troubleshooting-guide/how-to-troubleshoot.md" >}}). {{< note >}}Additional SELinux configuration may be required to allow NGINX Plus to listen on specific network ports, connect to upstreams, and send syslog entries to remote systems. Refer to the practices outlined in the [Using NGINX and NGINX Plus with SELinux](https://www.nginx.com/blog/using-nginx-plus-with-selinux/) article for details.{{< /note >}} @@ -1007,7 +1007,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s ```shell sudo service app-protect-dos-ebpf-manager start ``` - + ## Alpine 3.15.x / 3.17.x / 3.19.x Installation 1. If you already have NGINX packages in your system, back up your configs and logs: @@ -1136,7 +1136,7 @@ When deploying App Protect DoS on NGINX Plus take the following precautions to s ```shell rc-service nginx-app-protect-dos start ``` - + 17. Start the L4 service: ```shell rc-service app-protect-dos-ebpf-manager start @@ -1238,7 +1238,7 @@ You need root permissions to execute the following steps. keepalive_timeout 65; } ``` - + {{< important >}} Make sure to replace upstream and proxy pass directives in this example with relevant application backend settings. {{< /important >}} @@ -1311,7 +1311,7 @@ You need root permissions to execute the following steps. ```shell docker ps ``` - + 10. L4 Accelerated Mitigation Deployment Options:
There are three different ways to deploy the L4 accelerated mitigation feature:
1. Deploy in a Dedicated Container.
diff --git a/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md b/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md index bc49f731e..39704ee99 100644 --- a/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md +++ b/content/nap-dos/directives-and-policy/learn-about-directives-and-policy.md @@ -277,7 +277,7 @@ Second argument is the destination (the location which the events will be sent t - `stderr` (**default**) - `{absolute_file_path}`, i.e. `/shared/dos_sec_logger.log` -Implemented according to: [NGINX App Protect DoS Security Log]({{< relref "/nap-dos/monitoring/security-log.md" >}}) +Implemented according to: [NGINX App Protect DoS Security Log]({{< ref "/nap-dos/monitoring/security-log.md" >}}) {{< note >}} @@ -402,7 +402,7 @@ This directive is used to enable the App Protect DoS monitoring capability via R The REST API interface provides extended metrics information of the Protected Objects. It can be used by sending REST API requests manually or by using the App Protect DoS dashboard page. -For more information refer to [NGINX App Protect DoS Live Activity Monitoring]({{< relref "/nap-dos/monitoring/live-activity-monitoring.md" >}}) +For more information refer to [NGINX App Protect DoS Live Activity Monitoring]({{< ref "/nap-dos/monitoring/live-activity-monitoring.md" >}}) **Example:** diff --git a/content/nap-dos/monitoring/operation-log.md b/content/nap-dos/monitoring/operation-log.md index 5764cd385..8439995da 100644 --- a/content/nap-dos/monitoring/operation-log.md +++ b/content/nap-dos/monitoring/operation-log.md @@ -18,7 +18,7 @@ The operation logs consists of system operational and health events. The events |Event Type|Level|Meaning| |--------- |-----|------ | -|Configuration Error |error |There were errors in the [directives]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md" >}}) in the `nginx.conf` file.
Configuration error event is produced when one of F5 NGINX App Protect DoS directives is supplied with an incorrect data. An additional information will be added to the message, describing what was incorrect. NGINX will run with default values for this directive.
Please note that if the directive supplied with an incorrect number of arguments then NGINX will issue an error and NGINX will not run. It is a generic NGINX behavior.| +|Configuration Error |error |There were errors in the [directives]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md" >}}) in the `nginx.conf` file.
Configuration error event is produced when one of F5 NGINX App Protect DoS directives is supplied with an incorrect data. An additional information will be added to the message, describing what was incorrect. NGINX will run with default values for this directive.
Please note that if the directive supplied with an incorrect number of arguments then NGINX will issue an error and NGINX will not run. It is a generic NGINX behavior.| {{}} diff --git a/content/nap-dos/monitoring/types-of-logs.md b/content/nap-dos/monitoring/types-of-logs.md index b14dd4d11..ed0345d8b 100644 --- a/content/nap-dos/monitoring/types-of-logs.md +++ b/content/nap-dos/monitoring/types-of-logs.md @@ -25,16 +25,16 @@ NGINX does not have audit logs in the sense of *"**who** did **what**"*. This ca |----|-----------------|-----------------------|-----------------|--------------------| | Debug | Log file name is the redirection in the invocation of the `admd` command line in the start script | Global (not part of `nginx.conf`)|Yes. Log file is in /var/log/adm/admd.log directory. There is currently no file rotation capability available for this log.| No | | Operation | `error_log` directive, part of core NGINX | `nginx.conf` - global | Yes, NGINX error log | Yes, NGINX error log | -|Request |NGINX has two directives for the access log:
- **access_log** - to turn [on\|off]
- **log_format** - to specify the required information regarding each request

NGINX App Protect DoS has several variables that can be added to the log_format directive, such as $app_protect_dos_outcome.

For more information refer to [NGINX App Protect DoS Access Log]({{< relref "/nap-dos/monitoring/access-log.md" >}}) | `nginx.conf` - global| Yes, NGINX access log | Yes, NGINX access log | -| Security | NGINX App Protect DoS has two directives in `nginx.conf`:
- app_protect_dos_security_log_enable to turn logging [on\|off]
- app_protect_dos_security_log to set it's logging configuration and destination

For more information refer:
- **Configuration**: [App Protect DoS - Directives and Policy]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md">}})
- **Usage**: [NGINX App Protect DoS - Security Log]({{< relref "/nap-dos/monitoring/security-log.md" >}}) | `nginx.conf`: http, server, location | Yes, either stderr, or an absolute path to a local file are supported | Yes | +|Request |NGINX has two directives for the access log:
- **access_log** - to turn [on\|off]
- **log_format** - to specify the required information regarding each request

NGINX App Protect DoS has several variables that can be added to the log_format directive, such as $app_protect_dos_outcome.

For more information refer to [NGINX App Protect DoS Access Log]({{< ref "/nap-dos/monitoring/access-log.md" >}}) | `nginx.conf` - global| Yes, NGINX access log | Yes, NGINX access log | +| Security | NGINX App Protect DoS has two directives in `nginx.conf`:
- app_protect_dos_security_log_enable to turn logging [on\|off]
- app_protect_dos_security_log to set it's logging configuration and destination

For more information refer:
- **Configuration**: [App Protect DoS - Directives and Policy]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md">}})
- **Usage**: [NGINX App Protect DoS - Security Log]({{< ref "/nap-dos/monitoring/security-log.md" >}}) | `nginx.conf`: http, server, location | Yes, either stderr, or an absolute path to a local file are supported | Yes | {{}} ## Security Log - The security logs contain information about the status of the protected objects. It gives a general picture about each protected object in terms of traffic intensity, health of the backend server, learning and mitigations. For more information refer to [NGINX App Protect DoS Security Log]({{< relref "/nap-dos/monitoring/security-log.md" >}}) documentation. + The security logs contain information about the status of the protected objects. It gives a general picture about each protected object in terms of traffic intensity, health of the backend server, learning and mitigations. For more information refer to [NGINX App Protect DoS Security Log]({{< ref "/nap-dos/monitoring/security-log.md" >}}) documentation. ## Operation Log - The operation logs consists of system operational and health events. The events are sent to the NGINX error log and are distinguished by the `APP_PROTECT_DOS` prefix followed by JSON body. The log level depends on the event: success is usually indicated by `notice`, while failure is indicated by `error`. The timestamp is inherent in the error log. For more information refer to [App Protect DoS Operation Log]({{< relref "/nap-dos/monitoring/operation-log.md" >}}) documentation. + The operation logs consists of system operational and health events. The events are sent to the NGINX error log and are distinguished by the `APP_PROTECT_DOS` prefix followed by JSON body. The log level depends on the event: success is usually indicated by `notice`, while failure is indicated by `error`. The timestamp is inherent in the error log. For more information refer to [App Protect DoS Operation Log]({{< ref "/nap-dos/monitoring/operation-log.md" >}}) documentation. ## Request Log Access log is NGINX’s request log mechanism. It is controlled by two directives. @@ -46,7 +46,7 @@ NGINX does not have audit logs in the sense of *"**who** did **what**"*. This ca This directive determines the destination of the `access_log` and the name of the format. The default is the file `/var/log/nginx/access.log` using the combined format. In order to use the custom format that includes the NGINX App Protect DoS variables, use this directive with the name of the desired format. ### App Protect DoS Variables -These are the variables added to Access Log. They are a subset of the Security log attributes. The Security log names are prefixed with `$app_protect_dos`.
For more information refer to [NGINX App Protect DoS Access Log]({{< relref "/nap-dos/monitoring/access-log.md" >}}) +These are the variables added to Access Log. They are a subset of the Security log attributes. The Security log names are prefixed with `$app_protect_dos`.
For more information refer to [NGINX App Protect DoS Access Log]({{< ref "/nap-dos/monitoring/access-log.md" >}}) ## Debug Log - NGINX App Protect DoS The NGINX App Protect DoS Debug log is used to troubleshoot the functionality of the product.
diff --git a/content/nap-dos/releases/about-1.0.md b/content/nap-dos/releases/about-1.0.md index 5a00a47b0..f4534665d 100644 --- a/content/nap-dos/releases/about-1.0.md +++ b/content/nap-dos/releases/about-1.0.md @@ -71,6 +71,6 @@ July 6, 2021 - NGINX App Protect DoS does not protect `grpc` and `http2` services. The traffic is bypassed. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Slow POST attack always mitigates with block action while other types of attacks can also be mitigated with redirection or JS challenges. diff --git a/content/nap-dos/releases/about-1.1.0.md b/content/nap-dos/releases/about-1.1.0.md index 69a60952d..8fc5bff2a 100644 --- a/content/nap-dos/releases/about-1.1.0.md +++ b/content/nap-dos/releases/about-1.1.0.md @@ -33,7 +33,7 @@ This release is focused on security and stability. - gRPC and HTTP/2 protection are available only on Debian 10, Ubuntu 18.04, and Ubuntu 20.04 platforms. For the rest of the platforms, NGINX App Protect DoS does not protect gRPC and HTTP/2 services. The traffic is bypassed. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Slow POST attack always mitigates with block action while other types of attacks can also be mitigated with redirection or JS challenges. @@ -44,4 +44,4 @@ This release is focused on security and stability. - `successful_responses` instead of `successful_transactions`
- `unsuccessful_requests` instead of `unsuccessful_requests_count`. -- In the case of an upgrade from the previous `app-protect-dos` version, it's necessary to remove the old `nginx-plus` and install the new `app-protect-dos` that will install a correspondent version of `nginx-plus` as described in the [NGINX App Protect DoS Deployment Guide]({{< relref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}). +- In the case of an upgrade from the previous `app-protect-dos` version, it's necessary to remove the old `nginx-plus` and install the new `app-protect-dos` that will install a correspondent version of `nginx-plus` as described in the [NGINX App Protect DoS Deployment Guide]({{< ref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}). diff --git a/content/nap-dos/releases/about-2.0.md b/content/nap-dos/releases/about-2.0.md index 8425c1b61..76d9385e5 100644 --- a/content/nap-dos/releases/about-2.0.md +++ b/content/nap-dos/releases/about-2.0.md @@ -13,7 +13,7 @@ October 20, 2021 ### New Features -#### [Protection of gRPC services against application layer Denial of Service attacks]({{< relref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}) +#### [Protection of gRPC services against application layer Denial of Service attacks]({{< ref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}) - **Message flood** Attacker supplies multiple gRPC requests that exceed the service capacity. @@ -24,7 +24,7 @@ October 20, 2021 - **HTTP/2 attack on gRPC service** Attacker runs typical DoS HTTP/2 attacks: HTTP flood and slow attacks on gRPC service. -#### [Protection of HTTP/2 services against application layer Denial of Service attacks]({{< relref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}) +#### [Protection of HTTP/2 services against application layer Denial of Service attacks]({{< ref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}) ### Supported Packages @@ -74,7 +74,7 @@ October 20, 2021 - gRPC and HTTP/2 protection are available only on Debian 10, Ubuntu 18.04 and Ubuntu 20.04 platforms. For the rest of the platforms, NGINX App Protect DoS does not protect gRPC and HTTP/2 services. The traffic is bypassed. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Slow POST attack always mitigates with block action while other types of attacks can also be mitigated with redirection or JS challenges. @@ -85,4 +85,4 @@ October 20, 2021 - `successful_responses` instead of `successful_transactions`
- `unsuccessful_requests` instead of `unsuccessful_requests_count`. -- In the case of an upgrade from the previous `app-protect-dos` version, it's necessary to remove the old `nginx-plus` and install the new `app-protect-dos` that will install a correspondent version of `nginx-plus` as described in the [NGINX App Protect DoS Deployment Guide]({{< relref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}). +- In the case of an upgrade from the previous `app-protect-dos` version, it's necessary to remove the old `nginx-plus` and install the new `app-protect-dos` that will install a correspondent version of `nginx-plus` as described in the [NGINX App Protect DoS Deployment Guide]({{< ref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}). diff --git a/content/nap-dos/releases/about-2.1.md b/content/nap-dos/releases/about-2.1.md index 7e4a5fbf7..0590e9624 100644 --- a/content/nap-dos/releases/about-2.1.md +++ b/content/nap-dos/releases/about-2.1.md @@ -13,9 +13,9 @@ December 29, 2021 ### New Features -- [Support for RHEL (7.4.x and above) Virtual Machine (VM) deployment]({{< relref "learn-about-deployment.md#rhel-74-installation" >}}) -- [Support for RHEL 8 and UBI 8]({{< relref "learn-about-deployment.md#rhel-8-installation" >}}) -- [GRPC and HTTP/2 protection support for Centos (7.4.x and above) and RHEL (7.4.x and above)]({{< relref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}) +- [Support for RHEL (7.4.x and above) Virtual Machine (VM) deployment]({{< ref "learn-about-deployment.md#rhel-74-installation" >}}) +- [Support for RHEL 8 and UBI 8]({{< ref "learn-about-deployment.md#rhel-8-installation" >}}) +- [GRPC and HTTP/2 protection support for Centos (7.4.x and above) and RHEL (7.4.x and above)]({{< ref "/nap-dos/deployment-guide/learn-about-deployment.md" >}}) ### Supported Packages @@ -61,7 +61,7 @@ December 29, 2021 - gRPC and HTTP/2 protection require active monitoring of the protected service. The directive `app_protect_dos_monitor` is mandatory for these use cases, otherwise, the attack will not be detected. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Slow POST attack always mitigates with block action while other types of attacks can also be mitigated with redirection or JS challenges. diff --git a/content/nap-dos/releases/about-2.2.md b/content/nap-dos/releases/about-2.2.md index b62f2f96f..d18e23956 100644 --- a/content/nap-dos/releases/about-2.2.md +++ b/content/nap-dos/releases/about-2.2.md @@ -65,7 +65,7 @@ In this release, support for NGINX App Protect DoS is added to NGINX Plus R26. listen 8080; server_name myservice.com; location / { - app_protect_dos_monitor "myservice.com:8080/"; + app_protect_dos_monitor "myservice.com:8080/"; } } ``` @@ -73,7 +73,7 @@ In this release, support for NGINX App Protect DoS is added to NGINX Plus R26. - gRPC and HTTP/2 protection require active monitoring of the protected service. The directive `app_protect_dos_monitor` is mandatory for these use cases, otherwise, the attack will not be detected. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Slow POST attack always mitigates with block action while other types of attacks can also be mitigated with redirection or JS challenges. diff --git a/content/nap-dos/releases/about-2.3.md b/content/nap-dos/releases/about-2.3.md index da857532e..39e5ceb90 100644 --- a/content/nap-dos/releases/about-2.3.md +++ b/content/nap-dos/releases/about-2.3.md @@ -13,9 +13,9 @@ May 9, 2022 ### New Features -- [Support for Alpine 3.15 deployment]({{< relref "learn-about-deployment.md#alpine-315-installation" >}}) -- [DoS Live Activity Monitoring]({{< relref "/nap-dos/monitoring/live-activity-monitoring.md" >}}) -- [New Arbitrator FQDN/IP directive]({{< relref "learn-about-directives-and-policy.md#arbitrator-fqdn-directive-app_protect_dos_arb_fqdn" >}}) +- [Support for Alpine 3.15 deployment]({{< ref "learn-about-deployment.md#alpine-315-installation" >}}) +- [DoS Live Activity Monitoring]({{< ref "/nap-dos/monitoring/live-activity-monitoring.md" >}}) +- [New Arbitrator FQDN/IP directive]({{< ref "learn-about-directives-and-policy.md#arbitrator-fqdn-directive-app_protect_dos_arb_fqdn" >}}) ### Supported Packages @@ -65,7 +65,7 @@ Port configuration should correspond to the port the server listens to. listen 8080; server_name myservice.com; location / { - app_protect_dos_monitor "myservice.com:8080/"; + app_protect_dos_monitor "myservice.com:8080/"; } } ``` @@ -83,7 +83,7 @@ For example: - gRPC and HTTP/2 protection require active monitoring of the protected service. The directive `app_protect_dos_monitor` is mandatory for these use cases, otherwise, the attack will not be detected. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7/UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7/UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Slow POST attack always mitigates with block action while other types of attacks can also be mitigated with redirection or JS challenges. diff --git a/content/nap-dos/releases/about-2.4.md b/content/nap-dos/releases/about-2.4.md index c59ea1996..a594409bd 100644 --- a/content/nap-dos/releases/about-2.4.md +++ b/content/nap-dos/releases/about-2.4.md @@ -13,7 +13,7 @@ June 28, 2022 ### New Features -- [Support for Debian 11]({{< relref "learn-about-deployment.md#debian-10--debian-11-installation" >}}) +- [Support for Debian 11]({{< ref "learn-about-deployment.md#debian-10--debian-11-installation" >}}) - Accelerated bad actors detection when the signatures mitigation is disabled. ### Supported Packages @@ -85,7 +85,7 @@ Port configuration should correspond to the port the server listens to. - gRPC and HTTP/2 protection require active monitoring of the protected service. The directive `app_protect_dos_monitor` is mandatory for these use cases, otherwise, the attack will not be detected. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Slow POST attack always mitigates with block action while other types of attacks can also be mitigated with redirection or JS challenges. diff --git a/content/nap-dos/releases/about-3.0.md b/content/nap-dos/releases/about-3.0.md index 8618a5fc3..c36756554 100644 --- a/content/nap-dos/releases/about-3.0.md +++ b/content/nap-dos/releases/about-3.0.md @@ -87,7 +87,7 @@ Port configuration should correspond to the port the server listens to. - gRPC and HTTP/2 protection require active monitoring of the protected service. The directive `app_protect_dos_monitor` is mandatory for these use cases, otherwise, the attack will not be detected. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Slow POST attack always mitigates with block action while other types of attacks can also be mitigated with redirection or JS challenges. diff --git a/content/nap-dos/releases/about-3.1.md b/content/nap-dos/releases/about-3.1.md index 7ff80d589..e3e7c6842 100644 --- a/content/nap-dos/releases/about-3.1.md +++ b/content/nap-dos/releases/about-3.1.md @@ -18,7 +18,7 @@ In this release, NGINX App Protect DoS supports NGINX Plus R28. - Support for NGINX Plus R28. - NGINX App protect DoS can be deployed behind L4/L7 load balancers when L4 protection is enabled. - Fixed the issue: Installing NGINX App protect DoS with L4 (eBPF) mitigation behind L4/L7 load balancer may result in the load balancer's starvation during an attack. -- Support for [proxy_protocol]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#monitor-directive-app_protect_dos_monitor" >}}) configuration for server health monitoring.
+- Support for [proxy_protocol]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#monitor-directive-app_protect_dos_monitor" >}}) configuration for server health monitoring.
Previously, server health monitoring could not be used when the listen directive of the correspondent server block contained the `proxy_protocol` parameter.
This disallowed using NGINX App protect DoS for Denial of Service (DoS) protection for HTTP2 and gRPC protected objects in the `proxy_protocol` configuration. @@ -89,7 +89,7 @@ Port configuration should correspond to the port the server listens to. - gRPC and HTTP/2 protection require active monitoring of the protected service. The directive `app_protect_dos_monitor` is mandatory for these use cases, otherwise, the attack will not be detected. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Monitor directive (app_protect_monitor) with the `proxy_protocol` parameter can not be configured on Ubuntu 18.04. As a result, gRPC and HTTP/2 DoS protection for `proxy_protocol` configuration is not supported. diff --git a/content/nap-dos/releases/about-4.0.md b/content/nap-dos/releases/about-4.0.md index 3b78940c7..0616d3350 100644 --- a/content/nap-dos/releases/about-4.0.md +++ b/content/nap-dos/releases/about-4.0.md @@ -13,7 +13,7 @@ January 31, 2023 ### New Features -- Distributed Denial of Service (DDoS) protection feature for WebSocket services.
Refer to the [Configuration Example]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#monitor-directive-app_protect_dos_monitor" >}}) for WebSocket services here.
+- Distributed Denial of Service (DDoS) protection feature for WebSocket services.
Refer to the [Configuration Example]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#monitor-directive-app_protect_dos_monitor" >}}) for WebSocket services here.
- DDoS protection against slow attacks has been improved using machine learning algorithm on all types of traffic. - `app_protect_dos_monitor` directive, which monitors the proxied server, supports a new type of protocol - "WebSocket". @@ -82,7 +82,7 @@ January 31, 2023 - gRPC and HTTP/2 protection require active monitoring of the protected service. The directive `app_protect_dos_monitor` is mandatory for the attack to be detected. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Monitor directive `app_protect_dos_monitor` with `proxy_protocol` parameter can not be configured on Ubuntu 18.04. As a result, gRPC and HTTP/2 DoS protection for `proxy_protocol` configuration is not supported. diff --git a/content/nap-dos/releases/about-4.1.md b/content/nap-dos/releases/about-4.1.md index 50c369345..b14bcbd77 100644 --- a/content/nap-dos/releases/about-4.1.md +++ b/content/nap-dos/releases/about-4.1.md @@ -83,7 +83,7 @@ In this release, NGINX App Protect DoS supports NGINX Plus R29. - gRPC and HTTP/2 protection require active monitoring of the protected service. The directive `app_protect_dos_monitor` is mandatory for the attack to be detected. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Monitor directive `app_protect_dos_monitor` with `proxy_protocol` parameter can not be configured on Ubuntu 18.04. As a result, gRPC and HTTP/2 DoS protection for `proxy_protocol` configuration is not supported. @@ -91,4 +91,4 @@ In this release, NGINX App Protect DoS supports NGINX Plus R29. - The recommended option of running NGINX Plus in a Docker Container is with the `daemon off` flag. It's mandatory for UBI 8. -- The package dependencies for NGINX App Protect DoS have changed in this release, replacing the `curl` dependencies with `libcurl` only. For more information, see the [NGINX App Protect DoS Deployment Guide]({{< relref "/nap-dos/deployment-guide/learn-about-deployment.md#prerequisites" >}}). +- The package dependencies for NGINX App Protect DoS have changed in this release, replacing the `curl` dependencies with `libcurl` only. For more information, see the [NGINX App Protect DoS Deployment Guide]({{< ref "/nap-dos/deployment-guide/learn-about-deployment.md#prerequisites" >}}). diff --git a/content/nap-dos/releases/about-4.2.md b/content/nap-dos/releases/about-4.2.md index b3fc4b951..be4ee293b 100644 --- a/content/nap-dos/releases/about-4.2.md +++ b/content/nap-dos/releases/about-4.2.md @@ -16,7 +16,7 @@ In this release, NGINX App Protect DoS supports NGINX Plus R30. ### New Features - Support for Nginx Plus R30 -- [Support for Ubuntu 22.04]({{< relref "learn-about-deployment.md#debian--ubuntu-installation" >}}) +- [Support for Ubuntu 22.04]({{< ref "learn-about-deployment.md#debian--ubuntu-installation" >}}) - Support for HTTP3/QUIC - Improvement of Embedded Server Health mechanism @@ -80,7 +80,7 @@ In this release, NGINX App Protect DoS supports NGINX Plus R30. listen 8080; server_name myservice.com; location / { - app_protect_dos_monitor "myservice.com:8080/"; + app_protect_dos_monitor "myservice.com:8080/"; } } ``` @@ -89,12 +89,12 @@ In this release, NGINX App Protect DoS supports NGINX Plus R30. - gRPC and HTTP/2 protection require active monitoring of the protected service. The directive `app_protect_dos_monitor` is mandatory for the attack to be detected. -- [TLS fingerprint]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. +- [TLS fingerprint]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#policy-directive-app_protect_dos_policy_file" >}}) feature is not used in CentOS 7.4 and RHEL 7 / UBI 7 due to the old OpenSSL version. The required OpenSSL version is 1.1.1 or higher. - Slow POST attack always mitigates with block action while other types of attacks can also be mitigated with redirection or JS challenges. - The recommended option of running NGINX Plus in a Docker Container is with the `daemon off` flag. It's mandatory for UBI 8. -- The package dependencies for NGINX App Protect DoS have changed in this release, replacing the `curl` dependencies with `libcurl` only. For more information, see the [NGINX App Protect DoS Deployment Guide]({{< relref "/nap-dos/deployment-guide/learn-about-deployment.md#prerequisites" >}}). +- The package dependencies for NGINX App Protect DoS have changed in this release, replacing the `curl` dependencies with `libcurl` only. For more information, see the [NGINX App Protect DoS Deployment Guide]({{< ref "/nap-dos/deployment-guide/learn-about-deployment.md#prerequisites" >}}). - Starting with this release, Ubuntu 18.04 support has been deprecated. diff --git a/content/nap-dos/releases/about-4.3.md b/content/nap-dos/releases/about-4.3.md index 3bd1598b3..f571b0f47 100644 --- a/content/nap-dos/releases/about-4.3.md +++ b/content/nap-dos/releases/about-4.3.md @@ -16,7 +16,7 @@ In this release, NGINX App Protect DoS supports NGINX Plus R31. ### New Features - Support for Nginx Plus R31 -- [Support for Alpine 3.17]({{< relref "learn-about-deployment.md#alpine-315x--317x-installation" >}}) +- [Support for Alpine 3.17]({{< ref "learn-about-deployment.md#alpine-315x--317x-installation" >}}) ### Supported Packages diff --git a/content/nap-dos/releases/about-4.4.md b/content/nap-dos/releases/about-4.4.md index db3dc4a97..d15c7b7b2 100644 --- a/content/nap-dos/releases/about-4.4.md +++ b/content/nap-dos/releases/about-4.4.md @@ -18,7 +18,7 @@ In this release, NGINX App Protect DoS supports NGINX Plus R32. - Support for NGINX Plus R32 - Support for Debian 12 - Support for RHEL 9 -- [Allowlisted IPs]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#access-file-directive-app_protect_dos_access_file" >}}) +- [Allowlisted IPs]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md#access-file-directive-app_protect_dos_access_file" >}}) - Support for up to 1000 protected objects, ensuring high scalability and efficient resource utilization. ### Supported Packages diff --git a/content/nap-dos/troubleshooting-guide/how-to-troubleshoot.md b/content/nap-dos/troubleshooting-guide/how-to-troubleshoot.md index 405cc237f..ed5b89c44 100644 --- a/content/nap-dos/troubleshooting-guide/how-to-troubleshoot.md +++ b/content/nap-dos/troubleshooting-guide/how-to-troubleshoot.md @@ -22,10 +22,10 @@ This Troubleshooting Guide is intended to provide guidance to customers in the d |-------|--------| | NGINX is not running (ps -aux)

Reloading NGINX fails| Check the error log at `/var/log/nginx/error.log`.
Fix the problem and re-run NGINX.| | No original source IP in logs|1. XFF is not configured (or not configured correctly)
2. External Load Balancer doesn't forward XFF | -| NGINX App Protect DoS functionality is not as expected| NGINX App Protect DoS has several logs which can be used for troubleshooting.
Usually, it is best to look for any warning or error messages within the logs.
Refer to [Logs Overview]({{< relref "/nap-dos/monitoring/types-of-logs.md">}})| +| NGINX App Protect DoS functionality is not as expected| NGINX App Protect DoS has several logs which can be used for troubleshooting.
Usually, it is best to look for any warning or error messages within the logs.
Refer to [Logs Overview]({{< ref "/nap-dos/monitoring/types-of-logs.md">}})| | `Too many open files` error message | Increase number of file descriptors.
For example: `worker_rlimit_nofile 65535;` in the main context of `nginx.conf` file.
Refer to [worker_rlimit_nofile directive](https://www.nginx.com/blog/using-nginx-plus-with-selinux/) | | `setrlimit ... failed (Permission denied)` error message | Increase the limit using the following command as the root user:
`setsebool -P httpd_setrlimit 1;`
Refer to [Issue 4: Too many files are open Error](https://www.nginx.com/blog/using-nginx-plus-with-selinux/#Issue-4:-%3Ccode%3EToo-many-files-are-open%3C/code%3E-Error) | -| More protected objects than expected | The `app_protect_dos_enable` directive is inherited by all server and location blocks beneath it, each block will be a protected object.
Consider moving this directive from outer to inner block.
Refer to: [NGINX App Protect DoS - Directives and Policy]({{< relref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md" >}}) | +| More protected objects than expected | The `app_protect_dos_enable` directive is inherited by all server and location blocks beneath it, each block will be a protected object.
Consider moving this directive from outer to inner block.
Refer to: [NGINX App Protect DoS - Directives and Policy]({{< ref "/nap-dos/directives-and-policy/learn-about-directives-and-policy.md" >}}) | | `No DOS protection for ngx_worker at idx X` warning message | There are more nginx processes than allowed.
Either decrease the number of nginx processes (ngx_processes directive in `nginx.conf` file) or increase the number of supported workers for NGINX App Protect DoS using the flag `--max-workers NUM` for `/usr/bin/adminstall`. | | `unknown directive 'app_protect_dos_xxx'` error message | App Protect DOS module is not loaded. Add this line to the main (global) context of nginx.conf:
`load_module "/etc/nginx/modules/ngx_http_app_protect_dos_module.so";` | | NGINX struggles handling a high rate of incoming connections | Linux machine should be tuned for optimal performance.
Refer to [Tuning NGINX for Performance](https://www.nginx.com/blog/tuning-nginx/) | @@ -41,7 +41,7 @@ ELK issues are addressed directly in GitHub by posting the issue to Kibana dashb Configure SELinux to allow NGINX App Protect DoS. -The configuration steps are found in the [SELinux configuration]({{< relref "/nap-dos/deployment-guide/learn-about-deployment.md#selinux-configuration" >}}) section of the deployment guide. +The configuration steps are found in the [SELinux configuration]({{< ref "/nap-dos/deployment-guide/learn-about-deployment.md#selinux-configuration" >}}) section of the deployment guide. If SELinux still denies access to something, it means that one of more security exceptions should be enabled. diff --git a/content/nap-waf/v4/admin-guide/install-nms.md b/content/nap-waf/v4/admin-guide/install-nms.md index ca728e7a9..ce95fd9e0 100644 --- a/content/nap-waf/v4/admin-guide/install-nms.md +++ b/content/nap-waf/v4/admin-guide/install-nms.md @@ -11,17 +11,17 @@ type: ## Overview -[F5 NGINX Management Suite Instance Manager]({{< relref "/nms/about.md#instance-manager" >}}) provides a centralized interface where you can create, modify, and publish policies, attack signatures, and threat campaigns for NGINX App Protect WAF. You can use Instance Manager to deploy configuration updates to one, some, or all your NGINX App Protect WAF data plane instances simultaneously. +[F5 NGINX Management Suite Instance Manager]({{< ref "/nms/about.md#instance-manager" >}}) provides a centralized interface where you can create, modify, and publish policies, attack signatures, and threat campaigns for NGINX App Protect WAF. You can use Instance Manager to deploy configuration updates to one, some, or all your NGINX App Protect WAF data plane instances simultaneously. -- Refer to [Manage Your App Protect WAF Configs]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md" >}}) for installation instructions. +- Refer to [Manage Your App Protect WAF Configs]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md" >}}) for installation instructions. --- ## Using Security Monitoring with NGINX Management Suite -[NGINX Management Suite Security Monitoring]({{< relref "/nms/about.md#security-monitoring" >}}) provides a centralized visualization tool that lets you analyze threats, view protection insights, and identify areas for policy tuning. +[NGINX Management Suite Security Monitoring]({{< ref "/nms/about.md#security-monitoring" >}}) provides a centralized visualization tool that lets you analyze threats, view protection insights, and identify areas for policy tuning. -- For more information on how to configure Security Monitoring, see [Set Up App Protect Instances for Security Monitoring]({{< relref "/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md" >}}). +- For more information on how to configure Security Monitoring, see [Set Up App Protect Instances for Security Monitoring]({{< ref "/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md" >}}). --- diff --git a/content/nap-waf/v4/admin-guide/install.md b/content/nap-waf/v4/admin-guide/install.md index 4db108917..fb38d41c1 100644 --- a/content/nap-waf/v4/admin-guide/install.md +++ b/content/nap-waf/v4/admin-guide/install.md @@ -10,7 +10,7 @@ docs: DOCS-646 ## Overview -F5 NGINX App Protect WAF provides web application firewall (WAF) security protection for your web applications, including OWASP Top 10; response inspection; Meta characters check; HTTP protocol compliance; evasion techniques; disallowed file types; JSON & XML well-formedness; sensitive parameters & Data Guard. Refer to [Supported Security Policy Features]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#supported-security-policy-features" >}}) section for a more detailed description. +F5 NGINX App Protect WAF provides web application firewall (WAF) security protection for your web applications, including OWASP Top 10; response inspection; Meta characters check; HTTP protocol compliance; evasion techniques; disallowed file types; JSON & XML well-formedness; sensitive parameters & Data Guard. Refer to [Supported Security Policy Features]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#supported-security-policy-features" >}}) section for a more detailed description. This guide explains how to deploy NGINX App Protect WAF as well as upgrade App Protect and the App Protect signature sets.
@@ -208,7 +208,7 @@ If a user other than **nginx** is to be used, note the following: sudo yum install app-protect-selinux ``` - If you encounter any issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). + If you encounter any issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). 14. To enable the NGINX/App Protect WAF service start at boot, run the command: @@ -338,7 +338,7 @@ If a user other than **nginx** is to be used, note the following: sudo yum install app-protect-selinux ``` - If you encounter any issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). + If you encounter any issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). 15. To enable the NGINX/App Protect WAF service start at boot, run the command: @@ -456,7 +456,7 @@ If a user other than **nginx** is to be used, note the following: sudo dnf install app-protect-selinux ``` - If you encounter any issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). + If you encounter any issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). 15. To enable the NGINX/App Protect WAF service start at boot, run the command: @@ -574,7 +574,7 @@ If a user other than **nginx** is to be used, note the following: sudo dnf install app-protect-selinux ``` - If you encounter any issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). + If you encounter any issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). 15. To enable the NGINX/App Protect WAF service start at boot, run the command: @@ -692,7 +692,7 @@ If a user other than **nginx** is to be used, note the following: sudo dnf install app-protect-selinux ``` - If you encounter any issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). + If you encounter any issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). 15. To enable the NGINX/App Protect WAF service start at boot, run the command: @@ -798,7 +798,7 @@ If a user other than **nginx** is to be used, note the following: sudo yum install app-protect-selinux ``` - If you encounter any issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). + If you encounter any issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). 14. To enable the NGINX/App Protect WAF service start at boot, run the command: @@ -912,7 +912,7 @@ If a user other than **nginx** is to be used, note the following: sudo dnf install app-protect-selinux ``` - If you encounter any issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). + If you encounter any issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). 1. To enable the NGINX/App Protect WAF service start at boot, run the command: @@ -1840,7 +1840,7 @@ CMD ["sh", "/root/entrypoint.sh"] ## Converter Tool Docker Image This section explains how to build a Docker image for the purpose of converting policy files from other F5 WAF products to NGINX App Protect WAF JSON declarative format. -For more details regarding this feature refer to [Converter Tools]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#converter-tools" >}}). +For more details regarding this feature refer to [Converter Tools]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#converter-tools" >}}). ### Converter Docker Deployment Instructions You need root permissions to execute the following steps. @@ -2154,7 +2154,7 @@ RUN wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key # Add NGINX App Protect WAF repositories: RUN printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \ https://pkgs.nginx.com/app-protect/debian `lsb_release -cs` nginx-plus\n" | \ - tee /etc/apt/sources.list.d/nginx-app-protect.list + tee /etc/apt/sources.list.d/nginx-app-protect.list RUN printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] \ https://pkgs.nginx.com/app-protect-security-updates/debian `lsb_release -cs` nginx-plus\n" | \ tee /etc/apt/sources.list.d/app-protect-security-updates.list @@ -2189,8 +2189,8 @@ RUN wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key # Add NGINX App Protect WAF repositories: RUN printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \ https://pkgs.nginx.com/app-protect/ubuntu `lsb_release -cs` nginx-plus\n" | \ - tee /etc/apt/sources.list.d/nginx-app-protect.list -RUN printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] \ + tee /etc/apt/sources.list.d/nginx-app-protect.list +RUN printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] \ https://pkgs.nginx.com/app-protect-security-updates/ubuntu `lsb_release -cs` nginx-plus\n" | \ tee /etc/apt/sources.list.d/app-protect-security-updates.list @@ -2389,7 +2389,7 @@ You can run the following commands to ensure that NGINX App Protect WAF enforcem The number `471859200` should be enough for most use cases, you may need to use a bigger number if the number of profiles is large, or large json/xml schemas are used in the policy. -5. If there are additional problems, refer to the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#app-protect-troubleshooting-overview" >}}). +5. If there are additional problems, refer to the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#app-protect-troubleshooting-overview" >}}). ## Attack Signatures Dependency Change in NGINX App Protect WAF @@ -2693,7 +2693,7 @@ After having updated the Threat Campaigns package you have to reload the configu ## Updating App Protect Threat Campaigns -The Threat Campaigns feature is described [here]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#threat-campaigns" >}}). +The Threat Campaigns feature is described [here]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#threat-campaigns" >}}). The Threat Campaigns package is named: app-protect-threat-campaigns-2022.07.21. The version number for this package reflects the date the package was released. The format is: _YYYY.MM.DD_ where: @@ -2932,7 +2932,7 @@ Example: app-protect-threat-campaigns-2022.07.21 ## Updating App Protect Bot Signatures -The App Protect Bot Signatures feature is described [here]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#bot-signatures" >}}).
+The App Protect Bot Signatures feature is described [here]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#bot-signatures" >}}).
The App Protect Bot Signatures is named: app-protect-bot-signatures and it is a dependency similar to attack signatures and threat campaigns and can be updated more often. The version number for this package reflects the date the package was released. For example: app-protect-bot-signatures-2023.11.14, where the format for app protect bot signatures is: YYYY.MM.DD. @@ -3358,4 +3358,4 @@ Review the syslog ports by entering the following command: semanage port -l | grep syslog ``` -If there are additional problems, refer to the [Troubleshooting Guide]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). +If there are additional problems, refer to the [Troubleshooting Guide]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting#selinux" >}}). diff --git a/content/nap-waf/v4/admin-guide/upgrade-nap-waf.md b/content/nap-waf/v4/admin-guide/upgrade-nap-waf.md index 28ab6c148..c29b4b765 100644 --- a/content/nap-waf/v4/admin-guide/upgrade-nap-waf.md +++ b/content/nap-waf/v4/admin-guide/upgrade-nap-waf.md @@ -10,7 +10,7 @@ docs: DOCS-1198 Learn how to upgrade F5 NGINX App Protect on your managed NGINX instances using NGINX Instance Manager. This guide covers the steps to update both the NGINX Management Suite server and NGINX App Protect on the data plane, ensuring your security policies and configurations are up-to-date. -Before starting, confirm that your data plane has the latest NGINX Agent compatible with NGINX App Protect. Also, verify that your NGINX Management Suite server has the [WAF compiler installed]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}). If you're updating the WAF compiler, simply upload the NGINX App Protect WAF certificate and key to NGINX Management Suite following the instructions to [Automatically Download and Install New WAF Compiler]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md#automatically-download-and-install-new-waf-compiler" >}}). +Before starting, confirm that your data plane has the latest NGINX Agent compatible with NGINX App Protect. Also, verify that your NGINX Management Suite server has the [WAF compiler installed]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}). If you're updating the WAF compiler, simply upload the NGINX App Protect WAF certificate and key to NGINX Management Suite following the instructions to [Automatically Download and Install New WAF Compiler]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#automatically-download-and-install-new-waf-compiler" >}}). ## Upgrade WAF Compiler on NGINX Management Suite @@ -34,7 +34,7 @@ To update NGINX App Protect on an NGINX data plane instance, follow these steps: 4. **Restart NGINX Agent**: Concluding the upgrade, restart the NGINX Agent. -Refer to the [NGINX App Protect WAF Release Notes]({{< relref "/nap-waf/v4/releases" >}}) to determine the correct package version for installation. It's important to adjust the version string in the provided commands to match your specific operating system version. +Refer to the [NGINX App Protect WAF Release Notes]({{< ref "/nap-waf/v4/releases" >}}) to determine the correct package version for installation. It's important to adjust the version string in the provided commands to match your specific operating system version. ### Debian, Ubuntu @@ -74,7 +74,7 @@ For CentOS, RHEL, and Other Systems: sudo systemctl stop nginx-agent ``` -2. Next, upgrade NGINX App Protect. Refer to the [NGINX App Protect WAF Administration Guide]({{< relref "/nap-waf/v4/admin-guide/install.md" >}}) for detailed information on how to deploy and upgrade NGINX App Protect WAF. +2. Next, upgrade NGINX App Protect. Refer to the [NGINX App Protect WAF Administration Guide]({{< ref "/nap-waf/v4/admin-guide/install.md" >}}) for detailed information on how to deploy and upgrade NGINX App Protect WAF. 3. After the upgrade, restart NGINX App Protect: diff --git a/content/nap-waf/v4/configuration-guide/configuration.md b/content/nap-waf/v4/configuration-guide/configuration.md index 01a06e645..025870d05 100644 --- a/content/nap-waf/v4/configuration-guide/configuration.md +++ b/content/nap-waf/v4/configuration-guide/configuration.md @@ -258,7 +258,7 @@ http { ### apreload Events -apreload events use the same format as the current operation log events written in the NGINX error log, namely: `configuration_load_success` or `configuration_load_failure` with the details in JSON format. Refer to the [Operation logs]({{< relref "/nap-waf/v4/logging-overview/operation-logs.md" >}}) for more details. +apreload events use the same format as the current operation log events written in the NGINX error log, namely: `configuration_load_success` or `configuration_load_failure` with the details in JSON format. Refer to the [Operation logs]({{< ref "/nap-waf/v4/logging-overview/operation-logs.md" >}}) for more details. {{< note >}} Note that if any of the configuration files are invalid, apreload will discover that and return the proper error message in the `configuration_load_failure` event. The Enforcer continues to run with the previous configuration.{{< /note >}} @@ -425,7 +425,7 @@ It contains violations related to OpenAPI set to blocking (enforced). {{< include "/nap-waf/concept/graphql-profile.md" >}} -{{< note >}} For GraphQL profile default values and GraphQL violations reference, see NGINX App Protect WAF [Declarative Policy guide.]({{< relref "/nap-waf/v4/declarative-policy/policy.md" >}}) {{< /note >}} +{{< note >}} For GraphQL profile default values and GraphQL violations reference, see NGINX App Protect WAF [Declarative Policy guide.]({{< ref "/nap-waf/v4/declarative-policy/policy.md" >}}) {{< /note >}} ### Define URL settings {{< include "nap-waf/config/common/graphql-define-url-settings.md" >}} @@ -445,7 +445,7 @@ It contains violations related to OpenAPI set to blocking (enforced). ### Condition Syntax Usage -For the full reference of Override Rules condition syntax and usage see the NGINX App Protect WAF [Declarative Policy guide]({{< relref "/nap-waf/v4/declarative-policy/policy.md" >}}/#policy/override-rules). +For the full reference of Override Rules condition syntax and usage see the NGINX App Protect WAF [Declarative Policy guide]({{< ref "/nap-waf/v4/declarative-policy/policy.md" >}}/#policy/override-rules). ### First Match Principle @@ -555,7 +555,7 @@ Refer to the following example where all access profile properties are configure } ``` -{{< note >}} For access profile default values and their related field names, see NGINX App Protect WAF [Declarative Policy guide]({{< relref "/nap-waf/v4/declarative-policy/policy.md" >}}). {{< /note >}} +{{< note >}} For access profile default values and their related field names, see NGINX App Protect WAF [Declarative Policy guide]({{< ref "/nap-waf/v4/declarative-policy/policy.md" >}}). {{< /note >}} #### Access Profile in URL Settings @@ -603,13 +603,13 @@ Here is an example of declarative policy using an `authorizationRules` entity un The `authorizationRules` use a Boolean expression to articulate the conditions for granting access to the URL. The conditions use the same syntax as in [Policy Override Rules](#override-rules) with one additional attribute **"claims"**. #### Claims Attribute -The newly introduced attribute "claims" is a mapping of JSON paths for claims from the JWT to their respective values. Only structure nesting is supported using the "." notation. +The newly introduced attribute "claims" is a mapping of JSON paths for claims from the JWT to their respective values. Only structure nesting is supported using the "." notation. A few points to remember regarding JWT claims: - Please note that at the moment, accessing individual cells within JSON arrays isn't possible. Instead, the entire array gets serialized as a string, and its elements can be evaluated using string operators like "contains". - While it's technically feasible to consolidate all conditions into one with "and" between them, it's not recommended. Dividing them into multiple conditions enhances the readability and clarity of the policy, particularly when explaining the reasons for authorization failure. -For the full reference of authorizationRules condition syntax and usage see the NGINX App Protect WAF [Declarative Policy guide]({{< relref "nap-waf/v4/declarative-policy/policy.md" >}}/#policy/override-rules). +For the full reference of authorizationRules condition syntax and usage see the NGINX App Protect WAF [Declarative Policy guide]({{< ref "nap-waf/v4/declarative-policy/policy.md" >}}/#policy/override-rules). See below example for JWT claims: - + ```json { "scope": "top-level:read", @@ -623,15 +623,15 @@ See below example for JWT claims: "state": "NY", "city": "New York", "street": "888 38th W" - } + } } ``` then the claims can be: ``` -claims['scope'] = "top-level:read" +claims['scope'] = "top-level:read" claims['roles'] = "["inventory-manager", "price-editor]" # the whole array is presented as a string -claims['address.country'] = "US" -claims['company'] = null # does not exist +claims['address.country'] = "US" +claims['company'] = null # does not exist claims['address'] = "{ \"address\": { .... } }" # JSON structs can be accessed using the dot "." notation ``` @@ -656,11 +656,11 @@ claims['address'] = "{ \"address\": { .... } }" # JSON structs can be accessed u ### Overview Brute force attacks are attempts to break in to secured areas of a web application by trying exhaustive, -systematic, username/password combinations to discover legitimate authentication credentials. -To prevent brute force attacks, NGINX App Protect WAF monitors IP addresses, usernames, and the number of failed login attempts beyond a maximum threshold. -When brute force patterns are detected, the NGINX App Protect WAF policy either trigger an alarm or block the attack if the failed +systematic, username/password combinations to discover legitimate authentication credentials. +To prevent brute force attacks, NGINX App Protect WAF monitors IP addresses, usernames, and the number of failed login attempts beyond a maximum threshold. +When brute force patterns are detected, the NGINX App Protect WAF policy either trigger an alarm or block the attack if the failed login attempts reached a maximum threshold for a specific username or coming from a specific IP address. -To enable brute force protection, at least one login page must be created. +To enable brute force protection, at least one login page must be created. The login page entity is created separately and is not included in the brute force configuration block. --- @@ -685,9 +685,9 @@ A login page specifies the login URL that users must pass through to get authent "passwordParameterName": "password" } ] -``` - -{{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< relref "/nap-waf/v4/declarative-policy/policy/#policy/login-pages" >}}). {{< /note >}} +``` + +{{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< ref "/nap-waf/v4/declarative-policy/policy/#policy/login-pages" >}}). {{< /note >}} --- ### Brute force policy example @@ -723,7 +723,7 @@ Example1: A single brute force configuration is applied universally to all login } ``` -Example2: Different brute force configurations can be defined for individual login pages, +Example2: Different brute force configurations can be defined for individual login pages, with each configuration referencing a specific login page. ```json { @@ -760,7 +760,7 @@ Example2: Different brute force configurations can be defined for individual log } } ``` -{{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< relref "/nap-waf/v4/declarative-policy/policy/#policy/brute-force-attack-preventions" >}}). {{< /note >}} +{{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< ref "/nap-waf/v4/declarative-policy/policy/#policy/brute-force-attack-preventions" >}}). {{< /note >}} ## Custom Dimensions Log Entries @@ -1170,7 +1170,7 @@ Note that if the script is run without the required switches and their correspon The Attack Signature Report tool `/opt/app_protect/bin/get-signatures` scans the system for attack signatures and generates a JSON report file that includes information about these signatures. -This tool can be deployed and used independently of the NGINX App Protect WAF deployment, by [installing the compiler package as a standalone]({{< relref "/nap-waf/v4/admin-guide/install#converter-tool-docker-image" >}}), in order to generate a report about either the default signatures included in the package, or signatures included in a signature update package. The latter can be obtained by running the tool on a standalone compiler deployment, after installing a new signature update package on top of the compiler package. These reports can then be compared for greater clarity regarding signature updates. +This tool can be deployed and used independently of the NGINX App Protect WAF deployment, by [installing the compiler package as a standalone]({{< ref "/nap-waf/v4/admin-guide/install#converter-tool-docker-image" >}}), in order to generate a report about either the default signatures included in the package, or signatures included in a signature update package. The latter can be obtained by running the tool on a standalone compiler deployment, after installing a new signature update package on top of the compiler package. These reports can then be compared for greater clarity regarding signature updates. In addition, this report can be used for reporting or troubleshooting purposes or for auditing/tracking changes for signature updates on the NGINX App Protect WAF deployment itself. @@ -1311,7 +1311,7 @@ Note that if the script is run without the required switches and their correspon ## Security Logs -Refer to [Logging Overview]({{< relref "/nap-waf/v4/logging-overview/security-log.md" >}}) section for more details on Security Logs. +Refer to [Logging Overview]({{< ref "/nap-waf/v4/logging-overview/security-log.md" >}}) section for more details on Security Logs. ## NGINX App Protect WAF Terminology diff --git a/content/nap-waf/v4/logging-overview/logs-overview.md b/content/nap-waf/v4/logging-overview/logs-overview.md index 49ecbcf87..9e6ebdc5c 100644 --- a/content/nap-waf/v4/logging-overview/logs-overview.md +++ b/content/nap-waf/v4/logging-overview/logs-overview.md @@ -11,11 +11,11 @@ type: ## Overview There are 3 types of logs that F5 NGINX App Protect on NGINX generates: -- [Security log or Request log]({{< relref "/nap-waf/v4/logging-overview/security-log" >}}): The HTTP requests and how App Protect processed them, including violations and signatures found. -- [Operation logs]({{< relref "/nap-waf/v4/logging-overview/operation-logs" >}}): Events such as startup, shutdown and reconfiguration. -- [Debug logs]({{< relref "/nap-waf/v4/logging-overview/debug-logs" >}}): technical messages at different levels of severity used to debug and resolve incidents and error behaviors. +- [Security log or Request log]({{< ref "/nap-waf/v4/logging-overview/security-log" >}}): The HTTP requests and how App Protect processed them, including violations and signatures found. +- [Operation logs]({{< ref "/nap-waf/v4/logging-overview/operation-logs" >}}): Events such as startup, shutdown and reconfiguration. +- [Debug logs]({{< ref "/nap-waf/v4/logging-overview/debug-logs" >}}): technical messages at different levels of severity used to debug and resolve incidents and error behaviors. -In addition, NGINX App Protect WAF can be configured to add additional data to NGINX [Access log]({{< relref "/nap-waf/v4/logging-overview/access-log" >}}). +In addition, NGINX App Protect WAF can be configured to add additional data to NGINX [Access log]({{< ref "/nap-waf/v4/logging-overview/access-log" >}}). Note that NGINX does not have audit logs in the sense of who did what. This can be done either from the orchestration system controlling NGINX (such as NGINX Controller) or by tracking the configuration files and the systemd invocations using Linux tools. diff --git a/content/nap-waf/v4/releases/about-1.2.md b/content/nap-waf/v4/releases/about-1.2.md index 1e23af684..ec7a3eb72 100644 --- a/content/nap-waf/v4/releases/about-1.2.md +++ b/content/nap-waf/v4/releases/about-1.2.md @@ -11,8 +11,8 @@ June 30, 2020 ### New Features -- [External References]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#external-references" >}}) -- [Threat Campaigns]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#threat-campaigns" >}}) +- [External References]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#external-references" >}}) +- [Threat Campaigns]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#threat-campaigns" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-1.3.md b/content/nap-waf/v4/releases/about-1.3.md index c59b87bef..949b826f0 100644 --- a/content/nap-waf/v4/releases/about-1.3.md +++ b/content/nap-waf/v4/releases/about-1.3.md @@ -11,11 +11,11 @@ July 21, 2020 ### New Features -- [RHEL 7.4+ Support]({{< relref "/nap-waf/v4/admin-guide/install.md#rhel-7-4-installation" >}}) -- [RHEL UBI7 Support]({{< relref "/nap-waf/v4/admin-guide/install.md#rhel-ubi7-docker-deployment-example" >}}) -- [SELinux Configuration]({{< relref "/nap-waf/v4/admin-guide/install.md#selinux-configuration" >}}) -- [New Strict Security Policy]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#the-strict-policy" >}}) -- [Security Log Write To File]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#security-logs" >}}) +- [RHEL 7.4+ Support]({{< ref "/nap-waf/v4/admin-guide/install.md#rhel-7-4-installation" >}}) +- [RHEL UBI7 Support]({{< ref "/nap-waf/v4/admin-guide/install.md#rhel-ubi7-docker-deployment-example" >}}) +- [SELinux Configuration]({{< ref "/nap-waf/v4/admin-guide/install.md#selinux-configuration" >}}) +- [New Strict Security Policy]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#the-strict-policy" >}}) +- [Security Log Write To File]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#security-logs" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-2.0.md b/content/nap-waf/v4/releases/about-2.0.md index e88a88b8d..41d7edf01 100644 --- a/content/nap-waf/v4/releases/about-2.0.md +++ b/content/nap-waf/v4/releases/about-2.0.md @@ -11,13 +11,13 @@ September 08, 2020 ### New Features -- [Ubuntu 18.04 Support]({{< relref "/nap-waf/v4/admin-guide/install.md#ubuntu-18-04-installation" >}}) -- [OpenAPI Support]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#openapi-specification-file-reference" >}}) -- [JSON Schema Validation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#applying-a-json-schema" >}}) -- [User-Defined Signatures]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-signatures" >}}) -- [User-Defined URLs]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-urls" >}}) -- [User-Defined Parameters]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-parameters" >}}) -- [Offline Installation]({{< relref "/nap-waf/v4/admin-guide/install.md#offline-installation" >}}) +- [Ubuntu 18.04 Support]({{< ref "/nap-waf/v4/admin-guide/install.md#ubuntu-18-04-installation" >}}) +- [OpenAPI Support]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#openapi-specification-file-reference" >}}) +- [JSON Schema Validation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#applying-a-json-schema" >}}) +- [User-Defined Signatures]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-signatures" >}}) +- [User-Defined URLs]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-urls" >}}) +- [User-Defined Parameters]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-parameters" >}}) +- [Offline Installation]({{< ref "/nap-waf/v4/admin-guide/install.md#offline-installation" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-2.1.md b/content/nap-waf/v4/releases/about-2.1.md index 7af54d990..1043a365c 100644 --- a/content/nap-waf/v4/releases/about-2.1.md +++ b/content/nap-waf/v4/releases/about-2.1.md @@ -11,8 +11,8 @@ October 28, 2020 ### New Features -- [Bot Signatures & Bot Origin Validation Support]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#bot-signatures" >}}) -- [EPEL Repository Dependency Removal from RHEL]({{< relref "/nap-waf/v4/admin-guide/install.md#rhel-7-4-installation" >}}) +- [Bot Signatures & Bot Origin Validation Support]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#bot-signatures" >}}) +- [EPEL Repository Dependency Removal from RHEL]({{< ref "/nap-waf/v4/admin-guide/install.md#rhel-7-4-installation" >}}) ### Supported Packages @@ -34,7 +34,7 @@ October 28, 2020 - 2357 Fixed - Decoding of unpadded base64 encoded strings fails as invalid base64 encoding. - 2354 Fixed - Positional parameter detected as illegal URL with open-api-files reference. -- 2319 Fixed - [Users permissions for users other than `nginx`]({{< relref "/nap-waf/v4/admin-guide/install.md#user-permissions" >}}). +- 2319 Fixed - [Users permissions for users other than `nginx`]({{< ref "/nap-waf/v4/admin-guide/install.md#user-permissions" >}}). - 2297 Fixed - `Set-Cookie` header discarded on 302 response code. - 2296 Fixed - Large number of configured locations in `nginx.conf` result in long startup and reload times. - 2163 Fixed - `app-protect-compiler` RPM requires `epel-release`. diff --git a/content/nap-waf/v4/releases/about-2.2.md b/content/nap-waf/v4/releases/about-2.2.md index 0f705534f..b62160c1f 100644 --- a/content/nap-waf/v4/releases/about-2.2.md +++ b/content/nap-waf/v4/releases/about-2.2.md @@ -13,8 +13,8 @@ December 09, 2020 In this release support for NGINX App Protect WAF is added to NGINX Plus R23. -- [Detect Base64]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#detect-base64" >}}) -- [Anti Automation Header Anomalies]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#header-anomalies" >}}) +- [Detect Base64]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#detect-base64" >}}) +- [Anti Automation Header Anomalies]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#header-anomalies" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-2.3.md b/content/nap-waf/v4/releases/about-2.3.md index b929210b3..a3b527394 100644 --- a/content/nap-waf/v4/releases/about-2.3.md +++ b/content/nap-waf/v4/releases/about-2.3.md @@ -11,11 +11,11 @@ December 30, 2020 ### New Features -- [Debian 10 Support]({{< relref "/nap-waf/v4/admin-guide/install.md#debian-10-installation" >}}) -- [Alpine 3.10 Support]({{< relref "/nap-waf/v4/admin-guide/install.md#alpine-3-10-installation" >}}) -- [User-defined HTTP Headers]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-http-headers" >}}) -- [Converter Tools]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#converter-tools" >}}) -- [Attack Signature Report Tool]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#attack-signature-report-tool" >}}) +- [Debian 10 Support]({{< ref "/nap-waf/v4/admin-guide/install.md#debian-10-installation" >}}) +- [Alpine 3.10 Support]({{< ref "/nap-waf/v4/admin-guide/install.md#alpine-3-10-installation" >}}) +- [User-defined HTTP Headers]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-http-headers" >}}) +- [Converter Tools]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#converter-tools" >}}) +- [Attack Signature Report Tool]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#attack-signature-report-tool" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-3.0.md b/content/nap-waf/v4/releases/about-3.0.md index ce48bf9fd..d8cb52787 100644 --- a/content/nap-waf/v4/releases/about-3.0.md +++ b/content/nap-waf/v4/releases/about-3.0.md @@ -11,7 +11,7 @@ January 29, 2021 ### New Features -- [Advanced gRPC Protection for Unary Traffic]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#advanced-grpc-protection-for-unary-traffic" >}}) +- [Advanced gRPC Protection for Unary Traffic]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#advanced-grpc-protection-for-unary-traffic" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-3.1.md b/content/nap-waf/v4/releases/about-3.1.md index e3d8a1ed0..543004cba 100644 --- a/content/nap-waf/v4/releases/about-3.1.md +++ b/content/nap-waf/v4/releases/about-3.1.md @@ -11,12 +11,12 @@ March 31, 2021 ### New Features -- [User-Defined Browser Control]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-browser-control" >}}) -- [CSRF Protection Using Origin Validation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#csrf-protection-using-origin-validation" >}}) -- [Clickjacking Protection]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#clickjacking-protection" >}}) -- [Log Rotate]({{< relref "/nap-waf/v4/admin-guide/install.md#log-rotate" >}}) -- [Enforcer Cookie Settings]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#enforcer-cookie-settings" >}}) -- [Ubuntu 20.04 Support]({{< relref "/nap-waf/v4/admin-guide/install.md#ubuntu-20-04-installation" >}}) +- [User-Defined Browser Control]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#user-defined-browser-control" >}}) +- [CSRF Protection Using Origin Validation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#csrf-protection-using-origin-validation" >}}) +- [Clickjacking Protection]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#clickjacking-protection" >}}) +- [Log Rotate]({{< ref "/nap-waf/v4/admin-guide/install.md#log-rotate" >}}) +- [Enforcer Cookie Settings]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#enforcer-cookie-settings" >}}) +- [Ubuntu 20.04 Support]({{< ref "/nap-waf/v4/admin-guide/install.md#ubuntu-20-04-installation" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-3.10.md b/content/nap-waf/v4/releases/about-3.10.md index 7097419e4..76bd2d094 100644 --- a/content/nap-waf/v4/releases/about-3.10.md +++ b/content/nap-waf/v4/releases/about-3.10.md @@ -9,7 +9,7 @@ docs: DOCS-846 May 25, 2022 -This release includes updated signatures for the [Anti Automation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense) feature as follows: +This release includes updated signatures for the [Anti Automation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense) feature as follows: - Added the following Spam Bot bot signatures: MediaControl Rumble, Internet Fuzzer, NEKO - Added the following Service Agent bot signatures: ShadowByte, BackupLand, Virusdie, DropboxPreviewBot, GnowitNewsbot, SiteScoreBot, Hardenize @@ -50,12 +50,12 @@ This release includes updated signatures for the [Anti Automation]({{< relref "/ - 5800 Fixed - Fixed warning message on Attack Signatures or Threat Campaigns removal on debian-based operating systems. - 5946 Fixed - When using custom security policy in transparent mode with bot defense enabled - NGINX App Protect WAF blocks requests without User-Agent. -- 5947 Fixed - When using default security policy - NGINX App Protect WAF reports wrong [outcome_reason]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#available-security-log-attributes" >}})) when sending requests without User-Agent. +- 5947 Fixed - When using default security policy - NGINX App Protect WAF reports wrong [outcome_reason]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#available-security-log-attributes" >}})) when sending requests without User-Agent. - 5780 Fixed - Vulnerability in NGINX App Protect WAF allows a user in some particular circumstances to compose a Security Policy with arbitrary code which will be executed where it is deployed. - 6008 Fixed - Using an external reference `botDefenseReference` for the bot-defense configuration did not correctly take effect on the policy. -- 6196 Fixed - Updated information on changing the [total_xml_memory]({{< relref "/nap-waf/v4/admin-guide/install.md#post-installation-checks" >}}) value in NGINX App Protect WAF Admin guide. +- 6196 Fixed - Updated information on changing the [total_xml_memory]({{< ref "/nap-waf/v4/admin-guide/install.md#post-installation-checks" >}}) value in NGINX App Protect WAF Admin guide. ### **Important Note** When upgrading the NGINX App Protect WAF deployments on Virtual Machines (VM), where the upgrade includes a NGINX Plus release upgrade as well, customers might witness an error message about the upgrade failure.
-Customers are advised to ignore this message and continue with the [upgrade procedure]({{< relref "/nap-waf/v4/admin-guide/install.md#upgrading-app-protect" >}}) as described in the NGINX App Protect WAF Admin guide. +Customers are advised to ignore this message and continue with the [upgrade procedure]({{< ref "/nap-waf/v4/admin-guide/install.md#upgrading-app-protect" >}}) as described in the NGINX App Protect WAF Admin guide. diff --git a/content/nap-waf/v4/releases/about-3.11.md b/content/nap-waf/v4/releases/about-3.11.md index f95a6c508..fd7e40baf 100644 --- a/content/nap-waf/v4/releases/about-3.11.md +++ b/content/nap-waf/v4/releases/about-3.11.md @@ -11,7 +11,7 @@ June 28, 2022 In this release, support for NGINX App Protect WAF is added to NGINX Plus R27. -This release includes updated signatures for the [Anti Automation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense) feature as follows: +This release includes updated signatures for the [Anti Automation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense) feature as follows: - Added the following HTTP Library bot signatures: req - Added the following Exploit Tool bot signatures: spring4shell-scan, DIVD Vulnerability Scanner, JNDI Exploit Bot, D-Link DNS Change Exploiter @@ -21,7 +21,7 @@ This release includes updated signatures for the [Anti Automation]({{< relref "/ ### New Features -- [Oracle Linux 8.1+ Support]({{< relref "/nap-waf/v4/admin-guide/install.md#oracle-linux-81-installation" >}}) +- [Oracle Linux 8.1+ Support]({{< ref "/nap-waf/v4/admin-guide/install.md#oracle-linux-81-installation" >}}) ### Supported Packages @@ -64,5 +64,5 @@ This release includes updated signatures for the [Anti Automation]({{< relref "/ ### **Important Note** When upgrading the NGINX App Protect WAF deployments on Virtual Machines (VM), where the upgrade includes a NGINX Plus release upgrade as well, customers might witness some error messages about the upgrade failure. -Customers are advised to ignore these messages and continue with the [upgrade procedure]({{< relref "/nap-waf/v4/admin-guide/install.md#upgrading-app-protect" >}}) as described in the NGINX App Protect WAF Admin guide. +Customers are advised to ignore these messages and continue with the [upgrade procedure]({{< ref "/nap-waf/v4/admin-guide/install.md#upgrading-app-protect" >}}) as described in the NGINX App Protect WAF Admin guide. Additional NGINX restart might be required in order to complete the upgrade procedure. diff --git a/content/nap-waf/v4/releases/about-3.12.md b/content/nap-waf/v4/releases/about-3.12.md index 9b6b36d93..80d60f15e 100644 --- a/content/nap-waf/v4/releases/about-3.12.md +++ b/content/nap-waf/v4/releases/about-3.12.md @@ -9,7 +9,7 @@ docs: DOCS-943 September 21, 2022 -This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense) feature as follows: +This release includes new signatures for [Anti Automation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense) feature as follows: - Added the following Spam Bot bot signatures: RealStresser, Orbbot, xx032_bo9vs83_2a, Antoine - Added the following Exploit Tool bot signatures: RealityCheats, Mitel MiVoice Exploiter, joxypoxy, nvd0rz, CVE-2019-11043, Anan mal 123 @@ -59,7 +59,7 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ ### **Important Notes** -- This release introduces a change in dependency of [Attack Signatures]({{< relref "/nap-waf/v4/admin-guide/install.md#attack-signatures-dependency-change-in-nginx-app-protect-waf" >}}) and [Threat Campaigns]({{< relref "/nap-waf/v4/admin-guide/install.md#threat-campaigns-dependency-change-in-nginx-app-protect-waf" >}}) packages. From version 3.12, when the user performs the clean install (installing NGINX App Protect WAF for the first time), it will install the latest Attack Signatures/Threat Campaigns package. This will keep the customers up to date with the latest Attack Signatures/Threat Campaigns and provide protection against the latest threats.

+- This release introduces a change in dependency of [Attack Signatures]({{< ref "/nap-waf/v4/admin-guide/install.md#attack-signatures-dependency-change-in-nginx-app-protect-waf" >}}) and [Threat Campaigns]({{< ref "/nap-waf/v4/admin-guide/install.md#threat-campaigns-dependency-change-in-nginx-app-protect-waf" >}}) packages. From version 3.12, when the user performs the clean install (installing NGINX App Protect WAF for the first time), it will install the latest Attack Signatures/Threat Campaigns package. This will keep the customers up to date with the latest Attack Signatures/Threat Campaigns and provide protection against the latest threats.

In case the user has an older version of NGINX App Protect WAF and never installed the Attack Signatures/Threat Campaigns package, upgrading NGINX App Protect will install the latest Attack Signatures/Threat Campaigns. However, if they have installed the Attack Signatures/Threat Campaigns package previously at any point in time, NGINX App Protect WAF will not install the latest Attack Signatures/Threat Campaigns.

The user can upgrade or downgrade the Attack Signature/Threat Campaigns regardless of the installed version of NGINX App Protect WAF. @@ -68,7 +68,7 @@ In NGINX App Protect WAF versions prior to 3.12, the default value for `relax_un For more information, refer to article on [relax_unicode_in_json](https://support.f5.com/csp/article/K58055038). - When upgrading the NGINX App Protect WAF deployments on Virtual Machines (VM), where the upgrade includes a NGINX Plus release upgrade as well, customers might witness some error messages about the upgrade failure.
-Customers are advised to ignore these messages and continue with the [upgrade procedure]({{< relref "/nap-waf/v4/admin-guide/install.md#upgrading-app-protect" >}}) as described in the NGINX App Protect WAF Admin guide. +Customers are advised to ignore these messages and continue with the [upgrade procedure]({{< ref "/nap-waf/v4/admin-guide/install.md#upgrading-app-protect" >}}) as described in the NGINX App Protect WAF Admin guide. Additional NGINX restart might be required in order to complete the upgrade procedure. The issue is fixed as a part of release 3.12 and upgrades from this release onwards should not encounter this issue. - Adaptive Violation Rating (AdVR) capability is offered as Tech Preview for Ubuntu 20.04 (Focal Fossa) Operating System (OS). Customers who wish to evaluate this capability are encouraged to contact their local F5 App Protect WAF representative for more details. diff --git a/content/nap-waf/v4/releases/about-3.2.md b/content/nap-waf/v4/releases/about-3.2.md index 55f31acae..216030019 100644 --- a/content/nap-waf/v4/releases/about-3.2.md +++ b/content/nap-waf/v4/releases/about-3.2.md @@ -13,9 +13,9 @@ April 28, 2021 In this release support for NGINX App Protect WAF is added to NGINX Plus R24, for which Debian 9 support has been deprecated. -- [Multiple Security Logs Support]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#app-protect-security-log" >}}) -- [Default Policy Location Update]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#basic-configuration-and-the-default-policy" >}}) -- [Tighten Default Enforcer Cookie Settings]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#enforcer-cookie-settings" >}}) +- [Multiple Security Logs Support]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#app-protect-security-log" >}}) +- [Default Policy Location Update]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#basic-configuration-and-the-default-policy" >}}) +- [Tighten Default Enforcer Cookie Settings]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#enforcer-cookie-settings" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-3.3.md b/content/nap-waf/v4/releases/about-3.3.md index 1d18e1e1a..1321cf141 100644 --- a/content/nap-waf/v4/releases/about-3.3.md +++ b/content/nap-waf/v4/releases/about-3.3.md @@ -11,10 +11,10 @@ July 7, 2021 ### New Features -- [Amazon Linux 2 LTS Support]({{< relref "/nap-waf/v4/admin-guide/install.md#amazon-linux-2-lts-installation" >}}) -- [Base64 auto-detection applies on JSON content type]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#xml-and-json-content-profiles" >}}) -- [Full security policy export includes the policy base template]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#policy-converter" >}}) -- [FQDNs are now permitted in syslog destinations]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#security-logs" >}}) +- [Amazon Linux 2 LTS Support]({{< ref "/nap-waf/v4/admin-guide/install.md#amazon-linux-2-lts-installation" >}}) +- [Base64 auto-detection applies on JSON content type]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#xml-and-json-content-profiles" >}}) +- [Full security policy export includes the policy base template]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#policy-converter" >}}) +- [FQDNs are now permitted in syslog destinations]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#security-logs" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-3.6.md b/content/nap-waf/v4/releases/about-3.6.md index 41b9ebc12..aff52b5b5 100644 --- a/content/nap-waf/v4/releases/about-3.6.md +++ b/content/nap-waf/v4/releases/about-3.6.md @@ -13,7 +13,7 @@ In this release support for NGINX App Protect WAF is added to NGINX Plus R25. ### New Features -[New configuration setting added for never logging requests from a specified IP address range]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#deny-allow-and-never-log-lists" >}}) +[New configuration setting added for never logging requests from a specified IP address range]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#deny-allow-and-never-log-lists" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-3.7.md b/content/nap-waf/v4/releases/about-3.7.md index 944a2bd98..a9e4e2886 100644 --- a/content/nap-waf/v4/releases/about-3.7.md +++ b/content/nap-waf/v4/releases/about-3.7.md @@ -11,9 +11,9 @@ December 15, 2021 ### New Features -- [Protection of large requests]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#supported-security-policy-features" >}}) - To increase the protection of resources at both the NGINX Plus and upstream application tiers, NGINX App Protect WAF 3.7 contains a change in the default policy behavior that will block requests that are larger than 10 MB in size even if the Violation Rating is less than 4. In previous versions, requests greater than 10 MB would be allowed. When these requests are blocked, a `VIOL_REQUEST_MAX_LENGTH` violation will be logged. +- [Protection of large requests]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#supported-security-policy-features" >}}) - To increase the protection of resources at both the NGINX Plus and upstream application tiers, NGINX App Protect WAF 3.7 contains a change in the default policy behavior that will block requests that are larger than 10 MB in size even if the Violation Rating is less than 4. In previous versions, requests greater than 10 MB would be allowed. When these requests are blocked, a `VIOL_REQUEST_MAX_LENGTH` violation will be logged. -- [New http-protocols violation]({{< relref "/nap-waf/v4/declarative-policy/policy.md" >}}) - **Check maximum number of cookies**. NGINX App Protect WAF policies can now configure and enforce the maximum cookies allowed in a request. +- [New http-protocols violation]({{< ref "/nap-waf/v4/declarative-policy/policy.md" >}}) - **Check maximum number of cookies**. NGINX App Protect WAF policies can now configure and enforce the maximum cookies allowed in a request. ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-3.8.md b/content/nap-waf/v4/releases/about-3.8.md index d4bb100fa..0511b6708 100644 --- a/content/nap-waf/v4/releases/about-3.8.md +++ b/content/nap-waf/v4/releases/about-3.8.md @@ -11,8 +11,8 @@ January 18, 2022 ### New Features -- [RHEL 8.1+ Support]({{< relref "/nap-waf/v4/admin-guide/install.md#rhel-81-installation" >}}) -- [Blocking Observability]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#blocking-observability" >}}) +- [RHEL 8.1+ Support]({{< ref "/nap-waf/v4/admin-guide/install.md#rhel-81-installation" >}}) +- [Blocking Observability]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#blocking-observability" >}}) - [Memory Consumption Improvement](#important-notes) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-3.9.1.md b/content/nap-waf/v4/releases/about-3.9.1.md index 4580080ca..5aa03958c 100644 --- a/content/nap-waf/v4/releases/about-3.9.1.md +++ b/content/nap-waf/v4/releases/about-3.9.1.md @@ -12,7 +12,7 @@ March 9, 2022 Support for NGINX App Protect WAF is added to NGINX Plus R26 starting with release 3.9. -This release includes updated signatures for the [Anti Automation](https://docs.nginx.com{{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense) feature as follows: +This release includes updated signatures for the [Anti Automation](https://docs.nginx.com{{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense) feature as follows: - Added the following Spam Bot bot signatures: meow, ANETInspect, OnlyScans, HonoluluBot, Search engine under construction, browsergetproto1.2 - Added the following Service Agent bot signatures: YandeG, FGX-Web, Detectify, AndroidDownloadManager diff --git a/content/nap-waf/v4/releases/about-4.0.md b/content/nap-waf/v4/releases/about-4.0.md index 6dbd1cd06..61411fd29 100644 --- a/content/nap-waf/v4/releases/about-4.0.md +++ b/content/nap-waf/v4/releases/about-4.0.md @@ -11,7 +11,7 @@ November 29, 2022 In this release, NGINX App Protect WAF supports NGINX Plus R28. -This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): +This release includes new signatures for [Anti Automation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): - Added the following Spam Bot bot signatures: RealStresser, AraTurka, Ocarinabot, A Fake Google Certificates Bridge - Added the following Exploit Tool bot signatures: RealityCheats, Root S, Report Runner, Momentum, 103scUWU @@ -25,9 +25,9 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ ### New Features -- [Debian 11 Support]({{< relref "/nap-waf/v4/admin-guide/install.md#debian-10--debian-11--debian-12-installation" >}}) -- [gRPC Protection for Bidirectional Streaming]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#grpc-protection-for-bidirectional-streaming" >}}) -- [Product Release Info File]({{< relref "/nap-waf/v4/troubleshooting-guide/troubleshooting.md#opening-a-support-ticket" >}}) +- [Debian 11 Support]({{< ref "/nap-waf/v4/admin-guide/install.md#debian-10--debian-11--debian-12-installation" >}}) +- [gRPC Protection for Bidirectional Streaming]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#grpc-protection-for-bidirectional-streaming" >}}) +- [Product Release Info File]({{< ref "/nap-waf/v4/troubleshooting-guide/troubleshooting.md#opening-a-support-ticket" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-4.1.md b/content/nap-waf/v4/releases/about-4.1.md index 4f9294a26..63b806c94 100644 --- a/content/nap-waf/v4/releases/about-4.1.md +++ b/content/nap-waf/v4/releases/about-4.1.md @@ -9,7 +9,7 @@ docs: DOCS-1116 January 31, 2023 -This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation">}}) (bot defense): +This release includes new signatures for [Anti Automation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation">}}) (bot defense): - Added the following Site Monitor bot signatures: OhDear, Cloudflare Monitor, Google Uptime Monitor, NIXStatsbot - Added the following Service Agent bot signatures: semanticbot, Datafeedwatch, W3C_Unicorn @@ -17,8 +17,8 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ ### New Features -- [Alpine 3.16 Support]({{< relref "/nap-waf/v4/admin-guide/install.md#alpine-316--alpine-317-installation" >}}) -- [Apreload - NGINX App Protect WAF Standalone Configuration]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#nginx-app-protect-waf-standalone-configuration" >}}) +- [Alpine 3.16 Support]({{< ref "/nap-waf/v4/admin-guide/install.md#alpine-316--alpine-317-installation" >}}) +- [Apreload - NGINX App Protect WAF Standalone Configuration]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#nginx-app-protect-waf-standalone-configuration" >}}) ### Supported Packages @@ -55,5 +55,5 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ ### Resolved Issues -- 7298 Fixed - [decodeValueAsBase64]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#detect-base64" >}}) feature is now disabled and the default value for `decodeValueAsBase64` is set to `disabled` to avoid high chance of false positive violations. +- 7298 Fixed - [decodeValueAsBase64]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#detect-base64" >}}) feature is now disabled and the default value for `decodeValueAsBase64` is set to `disabled` to avoid high chance of false positive violations. - 7238 Fixed - Hyphen metacharacter is now allowed by default in JSON and XML Profiles. diff --git a/content/nap-waf/v4/releases/about-4.11.md b/content/nap-waf/v4/releases/about-4.11.md index 546a0e475..438bd8c99 100644 --- a/content/nap-waf/v4/releases/about-4.11.md +++ b/content/nap-waf/v4/releases/about-4.11.md @@ -17,7 +17,7 @@ Release 4.8.1 cannot be upgraded to v4.11. You must uninstall 4.8.1 and install ### New features -- [Ubuntu 24.04 support]({{< relref "/nap-waf/v4/admin-guide/install.md#ubuntu-1804--ubuntu-2004--ubuntu-2204--ubuntu-2404-installation" >}}) +- [Ubuntu 24.04 support]({{< ref "/nap-waf/v4/admin-guide/install.md#ubuntu-1804--ubuntu-2004--ubuntu-2204--ubuntu-2404-installation" >}}) --- diff --git a/content/nap-waf/v4/releases/about-4.12.md b/content/nap-waf/v4/releases/about-4.12.md index b0f4b1251..e735023b9 100644 --- a/content/nap-waf/v4/releases/about-4.12.md +++ b/content/nap-waf/v4/releases/about-4.12.md @@ -14,9 +14,9 @@ November 19th, 2024 ### New features - Added support for Amazon Linux 2023 -- NGINX App Protect WAF now supports NGINX Plus R33. +- NGINX App Protect WAF now supports NGINX Plus R33. -Please read the [subscription licenses]({{< relref "/solutions/about-subscription-licenses.md" >}}) topic for information about R33. +Please read the [subscription licenses]({{< ref "/solutions/about-subscription-licenses.md" >}}) topic for information about R33. --- @@ -24,12 +24,12 @@ Please read the [subscription licenses]({{< relref "/solutions/about-subscriptio - Alpine 3.16 is no longer supported. ---- +--- ### Resolved issues - 11973 Fixed - Updated the Go version to 1.23.1 -- 11469 Fixed _apt-get update_ warning for Ubuntu 22.04 +- 11469 Fixed _apt-get update_ warning for Ubuntu 22.04 --- diff --git a/content/nap-waf/v4/releases/about-4.2.md b/content/nap-waf/v4/releases/about-4.2.md index 4ecb61b9e..ef9503d21 100644 --- a/content/nap-waf/v4/releases/about-4.2.md +++ b/content/nap-waf/v4/releases/about-4.2.md @@ -9,7 +9,7 @@ docs: DOCS-1172 March 29, 2023 -This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): +This release includes new signatures for [Anti Automation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): - Added the following Site Monitor bot signatures: 404enemy, Munin Monitor - Added the following Spam Bot bot signatures: 01h4x, AIBOT @@ -23,7 +23,7 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ ### New Features -- [GraphQL Protection]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#securing-graphql-apis-with-nginx-app-protect-waf" >}}) +- [GraphQL Protection]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#securing-graphql-apis-with-nginx-app-protect-waf" >}}) ### Supported Packages diff --git a/content/nap-waf/v4/releases/about-4.3.md b/content/nap-waf/v4/releases/about-4.3.md index 52e39393e..d5f160777 100644 --- a/content/nap-waf/v4/releases/about-4.3.md +++ b/content/nap-waf/v4/releases/about-4.3.md @@ -11,7 +11,7 @@ May 2, 2023 In this release, NGINX App Protect WAF supports NGINX Plus R29. -This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): +This release includes new signatures for [Anti Automation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): - Added the following Crawler bot signatures: YOURLS Crawler, Atomseo broken link checker, proxylist.to Checker, Aspiegel Crawler, digitalshadowsbot, idealo-bot pricevalidator - Added the following Exploit Tool bot signatures: BackDoorBot @@ -64,5 +64,5 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ ### **Important Note** -This release introduces a change in the `json_log` field output for Violation details. Starting with NGINX App Protect WAF release 4.3, the Security Log's `json_log` field will include all available information regarding Violation details in JSON format. Refer [Security Log]({{< relref "/nap-waf/v4/logging-overview/security-log.md#available-security-log-attributes" >}}) document for more details. +This release introduces a change in the `json_log` field output for Violation details. Starting with NGINX App Protect WAF release 4.3, the Security Log's `json_log` field will include all available information regarding Violation details in JSON format. Refer [Security Log]({{< ref "/nap-waf/v4/logging-overview/security-log.md#available-security-log-attributes" >}}) document for more details. diff --git a/content/nap-waf/v4/releases/about-4.4.md b/content/nap-waf/v4/releases/about-4.4.md index 497d2b6db..47c0d4e34 100644 --- a/content/nap-waf/v4/releases/about-4.4.md +++ b/content/nap-waf/v4/releases/about-4.4.md @@ -9,7 +9,7 @@ docs: DOCS-1252 July 5, 2023 -This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): +This release includes new signatures for [Anti Automation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): - Added the following Crawler bot signatures: IAS Crawler, Bing Crawler, DIS Group Crawler, WebBot Scrapper, AddSearch Bot, WPWS bot, iSec_Bot, Newstral Crawler, layoftheland.online Crawler, Quantcastbot, Spiceworks Crawlers, CYRATING Crawler, Jooblebot, YouBot, MetaJobBot, ScooperBot, WebwikiBot, JusProg - Domain Crawler, TinEye-Web, PEER39 Crawler, AMPPARIT Crawler, RuxitSynthetic - Added the following HTTP Library bot signatures: Atoka Logo Fetcher, Zend Http Client Class, Home Assistant API, Probe Image Size, Webpage.rs, Okta Open ID Connect Library, MetadataScraper, node-openid-client, Embed PHP Library, PHP-SOAP @@ -22,7 +22,7 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ ### New Feature -- [Override Rules]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#override-rules" >}}) +- [Override Rules]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#override-rules" >}}) ### Supported Packages @@ -66,6 +66,6 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ ### **Important Notes** -- There is a limitation when using [Override Rules]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#override-rules" >}}) with gRPC. The Override Rules do not provide support for gRPC traffic. If the Override Rules are configured to match gRPC traffic, it will result in the blocking of such traffic. +- There is a limitation when using [Override Rules]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#override-rules" >}}) with gRPC. The Override Rules do not provide support for gRPC traffic. If the Override Rules are configured to match gRPC traffic, it will result in the blocking of such traffic. - Starting with the upcoming release version of NGINX Plus R30, Ubuntu 18.04 will no longer be supported and will be deprecated. diff --git a/content/nap-waf/v4/releases/about-4.5.md b/content/nap-waf/v4/releases/about-4.5.md index 3807c3c5f..4ac361f74 100644 --- a/content/nap-waf/v4/releases/about-4.5.md +++ b/content/nap-waf/v4/releases/about-4.5.md @@ -9,7 +9,7 @@ docs: DOCS-1253 August 15, 2023 -This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): +This release includes new signatures for [Anti Automation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): - Added the following Crawler bot signatures: SEOChecker, ev-crawler, FFZBot ImageGrabber, ConveraCrawler, EveryoneSocialBot, Google Ads Bot - Added the following HTTP Library bot signatures: Airbnb calendar importer @@ -24,7 +24,7 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ In this release, NGINX App Protect WAF supports NGINX Plus R30. -- [Alpine 3.17 Support]({{< relref "/nap-waf/v4/admin-guide/install.md#alpine-316--alpine-317-installation" >}}) +- [Alpine 3.17 Support]({{< ref "/nap-waf/v4/admin-guide/install.md#alpine-316--alpine-317-installation" >}}) ### Supported Packages @@ -70,7 +70,7 @@ In this release, NGINX App Protect WAF supports NGINX Plus R30. - 8312 Fixed - Running the get-signatures utility writes output to a different location. - 8936 Fixed - To reduce potential false positives, user defined Headers and Cookies that do not specify whether their decodeValueAsBase64 value, are now `disabled` instead of `enabled` by default. - 8939 Fixed - The issue with rejected gRPC request support id logged as "Passed" has been fixed. -- 8821 Fixed - The Override Rules now support gRPC traffic. The previous limitation regarding the use of [Override Rules]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#override-rules" >}}) with gRPC traffic has been resolved. +- 8821 Fixed - The Override Rules now support gRPC traffic. The previous limitation regarding the use of [Override Rules]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#override-rules" >}}) with gRPC traffic has been resolved. - 9061 Fixed - Evasions configuration does not work in an Override Rule policy. diff --git a/content/nap-waf/v4/releases/about-4.6.md b/content/nap-waf/v4/releases/about-4.6.md index 2d2a80134..100e4059f 100644 --- a/content/nap-waf/v4/releases/about-4.6.md +++ b/content/nap-waf/v4/releases/about-4.6.md @@ -9,7 +9,7 @@ docs: DOCS-1347 October 17, 2023 -This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): +This release includes new signatures for [Anti Automation]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#anti-automation-bot-mitigation" >}}) (bot defense): - Added the following Crawler bot signature: CheckMarkNetwork, FileHound, ReverseEngineeringBot, University Of Edinburgh, Audisto, crawler eb germany, FAST Enterprise, AASA-Bot, Neticle, newslookup-bot, MYIP.MS, Boomtrain Content Bot, Ads Standards Bot, Seamless Link Tester, CMS detector bot, Aesop, BullsEye, Drip, EyeNetIE Scanner, IIS bot, OWLer, RetrevoPageAnalyzer, criteo-crawler, trafilatura - Added the following HTTP Library bot signatures: libtorrent, Apache-HttpAsyncClient, RobotsTxtParser-VIPnytt, OpenAI Python Library, OpenAPI Generator, ServiceNow Http Client, CarrierWave @@ -24,9 +24,9 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ ### New Features -- [Ubuntu 22.04 Support]({{< relref "/nap-waf/v4/admin-guide/install.md#ubuntu-1804--ubuntu-2004--ubuntu-2204--ubuntu-2404-installation" >}}) -- [JSON Web Token Protection]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#json-web-token-protection" >}}) -- [Custom Dimensions Log Entries]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#custom-dimensions-log-entries" >}}) +- [Ubuntu 22.04 Support]({{< ref "/nap-waf/v4/admin-guide/install.md#ubuntu-1804--ubuntu-2004--ubuntu-2204--ubuntu-2404-installation" >}}) +- [JSON Web Token Protection]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#json-web-token-protection" >}}) +- [Custom Dimensions Log Entries]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#custom-dimensions-log-entries" >}}) ### Supported Packages @@ -76,6 +76,6 @@ This release includes new signatures for [Anti Automation]({{< relref "/nap-waf/ ### **Important Notes** -- Starting with this release, the `app_protect_compressed_requests_action` directive has been deprecated from the nginx configuration. Now by default the enforcer will decompress all the HTTP compressed payload request and will apply the enforcment. See [Handling Compressed Requests]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#handling-compressed-requests" >}}) for more details. +- Starting with this release, the `app_protect_compressed_requests_action` directive has been deprecated from the nginx configuration. Now by default the enforcer will decompress all the HTTP compressed payload request and will apply the enforcment. See [Handling Compressed Requests]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#handling-compressed-requests" >}}) for more details. -- The NGINX App Protect WAF has been enhanced to include response signature checks within the "filetypes" section. You have an option to enable the signature verification in the response by setting the `responseCheck` parameter to true. By default, this parameter is set to false. See [Restrict Response Signatures]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#restrict-response-signatures" >}}) for more details. +- The NGINX App Protect WAF has been enhanced to include response signature checks within the "filetypes" section. You have an option to enable the signature verification in the response by setting the `responseCheck` parameter to true. By default, this parameter is set to false. See [Restrict Response Signatures]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#restrict-response-signatures" >}}) for more details. diff --git a/content/nap-waf/v4/releases/about-4.7.md b/content/nap-waf/v4/releases/about-4.7.md index c53a75c2f..62181c049 100644 --- a/content/nap-waf/v4/releases/about-4.7.md +++ b/content/nap-waf/v4/releases/about-4.7.md @@ -13,7 +13,7 @@ In this release, NGINX App Protect WAF supports NGINX Plus R31. ### New Features -- [RHEL 9+ Support]({{< relref "/nap-waf/v4/admin-guide/install.md#rhel-9-installation" >}}) +- [RHEL 9+ Support]({{< ref "/nap-waf/v4/admin-guide/install.md#rhel-9-installation" >}}) ### Supported Packages @@ -74,6 +74,6 @@ In this release, NGINX App Protect WAF supports NGINX Plus R31. ### **Important Notes** - Starting with this release, the bot signatures list is generated automatically as a part of the **app-protect-bot-signatures** package, which is a dependency of the **app-protect-compiler** package. It resembles a format similar to the README-style text file found in the attack signature. -Refer to the [Bot Signatures Update File]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#bot-signatures-update-file" >}}) for more details. +Refer to the [Bot Signatures Update File]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#bot-signatures-update-file" >}}) for more details. - Starting with the next release version of NGINX App Protect WAF, the existing bot signatures file `included_bot_signatures` which is located at the following path: `/opt/app-protect/var/update_files/included_bot_signatures` will be removed from the **app-protect-compile** package. diff --git a/content/nap-waf/v4/releases/about-4.8.md b/content/nap-waf/v4/releases/about-4.8.md index 21d8000d3..37efe6ae7 100644 --- a/content/nap-waf/v4/releases/about-4.8.md +++ b/content/nap-waf/v4/releases/about-4.8.md @@ -12,10 +12,10 @@ February 6, 2024 ### New Features -- [Debian 12 Support]({{< relref "/nap-waf/v4/admin-guide/install.md#debian-10--debian-11--debian-12-installation" >}}) -- [Actionable Rules in Override Rules Policy]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#override-rules" >}}) -- [Geolocation Enforcement]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#geolocation-support-in-app-protect" >}}) -- [Partial Masking of Data using Data Guard]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#partial-masking-of-data-using-data-guard" >}}) +- [Debian 12 Support]({{< ref "/nap-waf/v4/admin-guide/install.md#debian-10--debian-11--debian-12-installation" >}}) +- [Actionable Rules in Override Rules Policy]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#override-rules" >}}) +- [Geolocation Enforcement]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#geolocation-support-in-app-protect" >}}) +- [Partial Masking of Data using Data Guard]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#partial-masking-of-data-using-data-guard" >}}) ### Supported Packages @@ -71,4 +71,4 @@ February 6, 2024 ### **Important Note** -- Actionable Rules and Geolocation are now supported in [Policy Override Rules]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#override-rules" >}}). +- Actionable Rules and Geolocation are now supported in [Policy Override Rules]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#override-rules" >}}). diff --git a/content/nap-waf/v4/releases/about-4.9.md b/content/nap-waf/v4/releases/about-4.9.md index 0b98850c5..17b2af609 100644 --- a/content/nap-waf/v4/releases/about-4.9.md +++ b/content/nap-waf/v4/releases/about-4.9.md @@ -15,14 +15,14 @@ Release 4.8.1 cannot be upgraded to v4.9. You must uninstall 4.8.1 and install ### New Features -- [Authorization Rules in URLs]({{}}) -- New [JSON Web Token]({{}}) signature signing algorithm support for: +- [Authorization Rules in URLs]({{}}) +- New [JSON Web Token]({{}}) signature signing algorithm support for: - **RSA**: RS256, RS384, RS512 - **PSS**: PS256, PS384, PS512 - **ECDSA**: ES256, ES256K, ES384, ES512 - **EdDSA** -- [Time-Based Signature Staging]({{}}) +- [Time-Based Signature Staging]({{}}) ### Supported Packages diff --git a/content/nap-waf/v4/troubleshooting-guide/troubleshooting.md b/content/nap-waf/v4/troubleshooting-guide/troubleshooting.md index 4adce39c1..f4971a732 100644 --- a/content/nap-waf/v4/troubleshooting-guide/troubleshooting.md +++ b/content/nap-waf/v4/troubleshooting-guide/troubleshooting.md @@ -22,7 +22,7 @@ Refer to the below table for any NGINX App Protect WAF installation or configura |Problem|Solution| |-------|--------| -| Starting version 3.12, installation steps and Docker deployment examples were changed in the [Admin Guide]({{< relref "/nap-waf/v4/admin-guide/install.md" >}}). You may encounter one of the following error messages:

# example of yum installation error when the app-protect-security-updates repository is missing:
`Error: Package: app-protect-compiler-1.234.0-1.el7.ngx.x86_64 (app-protect)`
`Requires: app-protect-attack-signatures`
`Error: Package: app-protect-compiler-1.234.0-1.el7.ngx.x86_64 (app-protect)`
`Requires: app-protect-threat-campaigns`

# example of apt installation error when the app-protect-security-updates repository is missing:
`The following packages have unmet dependencies:`
`app-protect-compiler : Depends: app-protect-attack-signatures`
                       `Depends: app-protect-threat-campaigns`
`Error: Unable to correct problems, you have held broken packages.`
| Enable the [app-protect-security-updates repository]({{< relref "/nap-waf/v4/admin-guide/install.md#updating-app-protect-attack-signatures" >}}). | +| Starting version 3.12, installation steps and Docker deployment examples were changed in the [Admin Guide]({{< ref "/nap-waf/v4/admin-guide/install.md" >}}). You may encounter one of the following error messages:

# example of yum installation error when the app-protect-security-updates repository is missing:
`Error: Package: app-protect-compiler-1.234.0-1.el7.ngx.x86_64 (app-protect)`
`Requires: app-protect-attack-signatures`
`Error: Package: app-protect-compiler-1.234.0-1.el7.ngx.x86_64 (app-protect)`
`Requires: app-protect-threat-campaigns`

# example of apt installation error when the app-protect-security-updates repository is missing:
`The following packages have unmet dependencies:`
`app-protect-compiler : Depends: app-protect-attack-signatures`
                       `Depends: app-protect-threat-campaigns`
`Error: Unable to correct problems, you have held broken packages.`
| Enable the [app-protect-security-updates repository]({{< ref "/nap-waf/v4/admin-guide/install.md#updating-app-protect-attack-signatures" >}}). | {{}} ### Configuration @@ -32,7 +32,7 @@ Refer to the below table for any NGINX App Protect WAF installation or configura |Problem|Solution| |-------|--------| | NGINX is not running (ps -aux)

Reloading NGINX fails| Check the error log at `/var/log/nginx/error.log`
Fix the problem and re-run NGINX. | -| NGINX App Protect WAF functionality is not as expected| NGINX App Protect WAF has several logs which can be used for troubleshooting.
Usually, it is best to look for any warning or error messages within the logs.
Refer to [Logs Overview]({{< relref "/nap-waf/v4/logging-overview/logs-overview.md">}}) | +| NGINX App Protect WAF functionality is not as expected| NGINX App Protect WAF has several logs which can be used for troubleshooting.
Usually, it is best to look for any warning or error messages within the logs.
Refer to [Logs Overview]({{< ref "/nap-waf/v4/logging-overview/logs-overview.md">}}) | | `Too many open files` error message | Increase number of file descriptors.
For example: `worker_rlimit_nofile 65535;` in the main context of `nginx.conf` file.
Refer to [worker_rlimit_nofile directive](https://www.nginx.com/blog/using-nginx-plus-with-selinux/#Issue-4:-%3Ccode%3EToo-many-files-are-open%3C/code%3E-Error)| | `setrlimit ... failed (Permission denied)` error message | Increase the limit using the following command as the root user:
`setsebool -P httpd_setrlimit 1;`
Refer to [Issue 4: Too many files are open Error](https://www.nginx.com/blog/using-nginx-plus-with-selinux/#Issue-4:-%3Ccode%3EToo-many-files-are-open%3C/code%3E-Error) | | unknown directive `app_protect_xxx` error message | App Protect module is not loaded. Add this line to the main (global) context of nginx.conf:
`load_module "/etc/nginx/modules/ngx_http_app_protect_module.so";` | diff --git a/content/nap-waf/v5/admin-guide/compiler.md b/content/nap-waf/v5/admin-guide/compiler.md index d9694a31d..dd0e828e4 100644 --- a/content/nap-waf/v5/admin-guide/compiler.md +++ b/content/nap-waf/v5/admin-guide/compiler.md @@ -13,7 +13,7 @@ The F5 NGINX App Protect WAF v5 Compiler is a tool that compiles security polici ## Use Cases -- Get latest security updates - [Attack Signatures]({{< relref "/nap-waf/v5/configuration-guide/configuration.md#attack-signatures-overview" >}}), [Threat Campaigns]({{< relref "/nap-waf/v5/configuration-guide/configuration.md#threat-campaigns" >}}), [Bot Signatures]({{< relref "/nap-waf/v5/configuration-guide/configuration.md#bot-signatures" >}}). +- Get latest security updates - [Attack Signatures]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#attack-signatures-overview" >}}), [Threat Campaigns]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#threat-campaigns" >}}), [Bot Signatures]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#bot-signatures" >}}). - Apply multiple policy bundle files within the same `nginx.conf`. - Configure global settings such as the cookie seed and user-defined signatures. diff --git a/content/nap-waf/v5/admin-guide/deploy-on-docker.md b/content/nap-waf/v5/admin-guide/deploy-on-docker.md index 27de0c4cc..c5e2a563d 100644 --- a/content/nap-waf/v5/admin-guide/deploy-on-docker.md +++ b/content/nap-waf/v5/admin-guide/deploy-on-docker.md @@ -32,7 +32,7 @@ Choose the appropriate `Dockerfile` example based on your Operating System (OS). {{}} {{%tab name="Alpine Linux"%}} - + {{< include "nap-waf/config/v5/build-nginx-image-oss/build-alpine.md" >}} {{%/tab%}} @@ -118,7 +118,7 @@ You are ready to [Build the image](#build-image-main) {{}} {{%tab name="Alpine Linux"%}} - + {{< include "nap-waf/config/v5/build-nginx-image-plus/build-alpine.md" >}} {{%/tab%}} @@ -337,7 +337,7 @@ volumes: To secure traffic between NGINX and App Protect Enforcer using mTLS, create a `docker-compose.yml` with the following configuration: -{{< note >}} Refer to the [Configuration Guide]({{< relref "/nap-waf/v5/configuration-guide/configuration.md#secure-traffic-between-nginx-and-app-protect-enforcer-using-mtls" >}}) to generate certificates and modify the `nginx.conf` for mTLS. +{{< note >}} Refer to the [Configuration Guide]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#secure-traffic-between-nginx-and-app-protect-enforcer-using-mtls" >}}) to generate certificates and modify the `nginx.conf` for mTLS. {{< /note >}} ```yaml @@ -351,12 +351,12 @@ services: - app_protect_etc_config:/etc/app_protect/conf - /conf/nginx.conf:/etc/nginx/nginx.conf # based on the provided example - /conf/default.conf:/etc/nginx/conf.d/default.conf # based on the provided example - - /path/to/your/certs:/etc/ssl/certs # mount certificates directory + - /path/to/your/certs:/etc/ssl/certs # mount certificates directory networks: - waf_network ports: - "80:80" - + waf-enforcer: container_name: waf-enforcer image: "private-registry.nginx.com/nap/waf-enforcer:" @@ -371,7 +371,7 @@ services: networks: - waf_network restart: always - + waf-config-mgr: container_name: waf-config-mgr image: "private-registry.nginx.com/nap/waf-config-mgr:" @@ -384,11 +384,11 @@ services: depends_on: waf-enforcer: condition: service_started - + networks: waf_network: driver: bridge - + volumes: app_protect_bd_config: app_protect_config: @@ -429,7 +429,7 @@ services: Sometimes, simply restarting the services can resolve transient issues. Use `sudo docker compose down -v` followed by `sudo docker compose up -d` to restart all services. -If you encounter any other issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v5/troubleshooting-guide/troubleshooting#nginx-app-protect-5" >}}). +If you encounter any other issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v5/troubleshooting-guide/troubleshooting#nginx-app-protect-5" >}}). ## Air-Gap Install: Secure Offline Deployment @@ -455,7 +455,7 @@ Proceed, by creating a `Dockerfile` using one of the examples provided below. {{}} {{%tab name="Alpine Linux"%}} - + {{< include "nap-waf/config/v5/build-nginx-image-oss/build-alpine.md" >}} {{%/tab%}} @@ -487,7 +487,7 @@ You are ready to [Build the image](#build-image-sub) {{}} {{%tab name="Alpine Linux"%}} - + {{< include "nap-waf/config/v5/build-nginx-image-plus/build-alpine.md" >}} {{%/tab%}} @@ -522,7 +522,7 @@ You are ready to [Build the image](#build-image-sub) {{< include "nap-waf/setup-docker-registry.md" >}} #### Download Waf-Enforcer and Waf-Config-mgr Images -Pull the `waf-enforcer` and `waf-config-mgr` images. Replace `5.4.0` with the actual release version you are deploying. +Pull the `waf-enforcer` and `waf-config-mgr` images. Replace `5.4.0` with the actual release version you are deploying. ```shell docker pull private-registry.nginx.com/nap/waf-enforcer:5.4.0 @@ -676,4 +676,4 @@ volumes: This guide provides the foundational steps for deploying NGINX App Protect WAF v5 using Docker Compose. You may need to adjust the deployment to fit your specific requirements. -For more detailed configuration options and advanced deployment strategies, refer to the [NGINX App Protect WAF v5 Configuration Guide]({{< relref "/nap-waf/v5/configuration-guide/configuration.md" >}}). +For more detailed configuration options and advanced deployment strategies, refer to the [NGINX App Protect WAF v5 Configuration Guide]({{< ref "/nap-waf/v5/configuration-guide/configuration.md" >}}). diff --git a/content/nap-waf/v5/admin-guide/deploy-on-kubernetes.md b/content/nap-waf/v5/admin-guide/deploy-on-kubernetes.md index 8830cbd56..9e1257ef7 100644 --- a/content/nap-waf/v5/admin-guide/deploy-on-kubernetes.md +++ b/content/nap-waf/v5/admin-guide/deploy-on-kubernetes.md @@ -31,7 +31,7 @@ Proceed, by creating a `Dockerfile` using one of the examples provided below. {{}} {{%tab name="Alpine Linux"%}} - + {{< include "nap-waf/config/v5/build-nginx-image-oss/build-alpine.md" >}} {{%/tab%}} @@ -73,7 +73,7 @@ You are ready to [Build the image](#build-image). {{}} {{%tab name="Alpine Linux"%}} - + {{< include "nap-waf/config/v5/build-nginx-image-plus/build-alpine.md" >}} {{%/tab%}} @@ -359,12 +359,12 @@ spec: NGINX App Protect WAF v5 allows you to enable the `readOnlyRootFilesystem` option in your [Kubernetes Configuration]( https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). This option restricts the root filesystem to read-only mode, which improves security by limiting potential write access in case of compromise. -To enable this feature, you will need a Kubernetes cluster that supports read-only root file systems, and you access to the NGINX and NGINX App Protect WAF configurations. +To enable this feature, you will need a Kubernetes cluster that supports read-only root file systems, and you access to the NGINX and NGINX App Protect WAF configurations. You may need to identify any extra paths that need to be writable by App Protect during runtime: the following steps assume you are using the defaults path. --- - + ### Enable `readOnlyRootFilesystem` and configure writable paths The first step is to add the `readOnlyRootFilesystem` value (as *true*) to your Kubernetes pod security context as follows: @@ -385,7 +385,7 @@ containers: readOnlyRootFilesystem: true ``` -With a read-only root file system, you will likely still require write access for certain directories, such as logs and temporary files. You can add these directories by mounting them as writable volumes in your Kubernetes deployment. +With a read-only root file system, you will likely still require write access for certain directories, such as logs and temporary files. You can add these directories by mounting them as writable volumes in your Kubernetes deployment. In this example, `/tmp` and `/var/log/nginx` are writable directories, essential for NGINX and App Protect operations. @@ -417,7 +417,7 @@ volumes: emptyDir: {} - name: app-protect-bundles persistentVolumeClaim: - claimName: nap5-bundles-pvc + claimName: nap5-bundles-pvc ``` A full example might look like the following: @@ -494,7 +494,7 @@ spec: emptyDir: {} - name: app-protect-bundles persistentVolumeClaim: - claimName: nap5-bundles-pvc + claimName: nap5-bundles-pvc ``` --- @@ -512,9 +512,9 @@ http { ... # Temporary directories for kubernetes "readonlyfilesystem" client_body_temp_path /tmp/nginx-client-body; - proxy_temp_path /tmp/nginx-proxy; - fastcgi_temp_path /tmp/nginx-fastcgi; - uwsgi_temp_path /tmp/nginx-uwsgi; + proxy_temp_path /tmp/nginx-proxy; + fastcgi_temp_path /tmp/nginx-fastcgi; + uwsgi_temp_path /tmp/nginx-uwsgi; scgi_temp_path /tmp/nginx-scgi; ... } @@ -530,7 +530,7 @@ worker_processes auto; load_module modules/ngx_http_app_protect_module.so; error_log /var/log/nginx/error.log debug; -pid /tmp/nginx.pid; +pid /tmp/nginx.pid; events { worker_connections 1024; @@ -567,28 +567,28 @@ http { } ``` ---- - +--- + ### Remediate possible issues - **Permission denied errors**: If you encounter file permission issues, verify that the paths requiring write access are correctly configured as writable volumes in the pod manifest. -- **NGINX App Protect WAF initialization errors**: +- **NGINX App Protect WAF initialization errors**: Check the NGINX and NGINX App Protect Logs to ensure that App Protect can write to necessary files like logs and temporary directories. For general issues, read the [Troubleshooting]({{< ref "/nap-waf/v5/troubleshooting-guide/troubleshooting.md" >}}) topic. --- -## mTLS Deployment +## mTLS Deployment To secure traffic between NGINX and App Protect Enforcer using mTLS, follow the steps below: -{{< note >}} Refer to the [Configuration Guide]({{< relref "/nap-waf/v5/configuration-guide/configuration.md#secure-traffic-between-nginx-and-app-protect-enforcer-using-mtls" >}}) to generate certificates and modify the `nginx.conf` for mTLS. +{{< note >}} Refer to the [Configuration Guide]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#secure-traffic-between-nginx-and-app-protect-enforcer-using-mtls" >}}) to generate certificates and modify the `nginx.conf` for mTLS. {{< /note >}} First, create a Kubernetes Secret that contains the certificate and key files: - + ```shell kubectl create secret generic enforcer-certificates \ --from-file=app_protect_server.crt=/path/to/app_protect_server.crt \ @@ -596,7 +596,7 @@ First, create a Kubernetes Secret that contains the certificate and key files: --from-file=app_protect_client_ca.crt=/path/to/app_protect_client_ca.crt ``` -Next, update or create the `nap5-deployment.yaml` to mount the Secret as a volume and set the environment variables to point to the mounted files: +Next, update or create the `nap5-deployment.yaml` to mount the Secret as a volume and set the environment variables to point to the mounted files: ```yaml apiVersion: apps/v1 @@ -712,7 +712,7 @@ Proceed, by creating a `Dockerfile` using one of the examples provided below. {{}} {{%tab name="Alpine Linux"%}} - + {{< include "nap-waf/config/v5/build-nginx-image-oss/build-alpine.md" >}} {{%/tab%}} @@ -744,7 +744,7 @@ You are ready to [Build the image](#build-image-sub) {{}} {{%tab name="Alpine Linux"%}} - + {{< include "nap-waf/config/v5/build-nginx-image-plus/build-alpine.md" >}} {{%/tab%}} @@ -775,7 +775,7 @@ You are ready to [Build the image](#build-image-sub) {{< include "nap-waf/build-nginx-image-cmd.md" >}} #### Download Waf-Enforcer and Waf-Config-mgr Images - Pull the `waf-enforcer` and `waf-config-mgr` images. Replace `5.2.0` with the actual release version you are deploying. + Pull the `waf-enforcer` and `waf-config-mgr` images. Replace `5.2.0` with the actual release version you are deploying. ```shell docker pull private-registry.nginx.com/nap/waf-enforcer:5.2.0 @@ -812,13 +812,13 @@ docker pull private-registry.nginx.com/nap/waf-config-mgr:5.2.0 ``` #### Local Registry Setup -Set up a local registry for the images on the offline/air-gap machine. +Set up a local registry for the images on the offline/air-gap machine. For the example deployment we will use [Registry](https://www.docker.com/blog/how-to-use-your-own-registry-2/). 1. Set up a local registry on the offline/air-gap machine 2. Add nginx-app-protect-5, waf-enforcer, and waf-config-mgr to the local registry - + ### NGINX Configuration In your nginx configuration: @@ -1003,7 +1003,7 @@ Add `nginx.conf` and `default.conf` to a config map. kubectl create configmap nginx-config \ --from-file=/nginx.conf \ --from-file=/default.conf -``` +``` #### Start Deployment @@ -1093,10 +1093,10 @@ kubectl create configmap nginx-config \ - **Connectivity Issues**: Verify the service and deployment configurations, especially port mappings and selectors. - **Permissions Issues**: By default, the containers `waf-config-mgr` and `waf-enforcer` operate with the user and group IDs set to 101:101. Ensure that the bundle files are accessible to these IDs. -If you encounter any issues, check the [Troubleshooting Guide]({{< relref "/nap-waf/v5/troubleshooting-guide/troubleshooting#nginx-app-protect-5" >}}). +If you encounter any issues, check the [Troubleshooting Guide]({{< ref "/nap-waf/v5/troubleshooting-guide/troubleshooting#nginx-app-protect-5" >}}). ## Conclusion This guide provides the foundational steps for deploying NGINX App Protect WAF v5 on Kubernetes. You may need to adjust the deployment to fit your specific requirements. -For more detailed configuration options and advanced deployment strategies, refer to the [NGINX App Protect WAF v5 configuration guide]({{< relref "/nap-waf/v5/configuration-guide/configuration.md" >}}). +For more detailed configuration options and advanced deployment strategies, refer to the [NGINX App Protect WAF v5 configuration guide]({{< ref "/nap-waf/v5/configuration-guide/configuration.md" >}}). diff --git a/content/nap-waf/v5/admin-guide/install.md b/content/nap-waf/v5/admin-guide/install.md index d7d2315ce..a687f89a0 100644 --- a/content/nap-waf/v5/admin-guide/install.md +++ b/content/nap-waf/v5/admin-guide/install.md @@ -11,7 +11,7 @@ docs: DOCS-1363 - Active F5 NGINX App Protect WAF subscription in [MyF5](https://my.f5.com/) (purchased or trial). - Docker (with Docker Compose) is [installed and running](https://docs.docker.com/engine/install/). -- A [supported operating system]({{< relref "/nginx/technical-specs.md#appprotect" >}}) (OS). +- A [supported operating system]({{< ref "/nginx/technical-specs.md#appprotect" >}}) (OS). ## Install NGINX and NGINX App Protect WAF Module @@ -39,7 +39,7 @@ Please follow these steps before you install either NGINX Open Source or NGINX P {{}} {{%tab name="Alpine Linux 3.16/3.17/3.19"%}} - + {{< include "nap-waf/config/v5/host-based-nginx-instructions/common-steps-with-alpine" >}} {{%/tab%}} @@ -442,7 +442,7 @@ Please follow these steps before you install either NGINX Open Source or NGINX P sudo apt-get update sudo apt-get install app-protect-module-plus ``` - + {{%/tab%}} {{%tab name="Ubuntu 24.04"%}} @@ -455,7 +455,7 @@ Please follow these steps before you install either NGINX Open Source or NGINX P sudo apt-get update sudo apt-get install app-protect-module-plus ``` - + {{%/tab%}} {{}} @@ -590,7 +590,7 @@ In some operating systems, security mechanisms like **SELinux** or **AppArmor** {{< include "nap-waf/bundles-volume-mount.md" >}} -After deploying NGINX App Protect WAF, learn how to utilize the [NGINX App Protect WAF Compiler]({{< relref "/nap-waf/v5/admin-guide/compiler.md" >}}) for applying your custom policies and logging profiles. +After deploying NGINX App Protect WAF, learn how to utilize the [NGINX App Protect WAF Compiler]({{< ref "/nap-waf/v5/admin-guide/compiler.md" >}}) for applying your custom policies and logging profiles. ## Air-Gap Install: Secure Offline Installation @@ -613,7 +613,7 @@ Please follow these steps before you install either NGINX Open Source or NGINX P {{}} {{%tab name="Alpine Linux 3.16/3.17/3.19"%}} - + {{< include "nap-waf/config/v5/host-based-nginx-instructions/common-steps-with-alpine" >}} {{%/tab%}} @@ -741,7 +741,7 @@ Please follow these steps before you install either NGINX Open Source or NGINX P ```shell sudo yum install app-protect-module-oss - sudo apt-get install nginx=1.25.5-1~`lsb_release -cs` app-protect-module-oss + sudo apt-get install nginx=1.25.5-1~`lsb_release -cs` app-protect-module-oss ``` When prompted to accept the GPG key, verify that the fingerprint matches `573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62`, and if so, accept it. @@ -752,13 +752,13 @@ Please follow these steps before you install either NGINX Open Source or NGINX P {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-oss-amzn2023.md" >}} 3. Download all NGINX Open Source packages, including all dependencies: We used `repotrack` for example: - + Install yum-utils ```script sudo dnf install yum-utils ``` - For this test deployment we download the packages inside `/etc/packages/` + For this test deployment we download the packages inside `/etc/packages/` ```script sudo mkdir /etc/packages/ cd /etc/packages/ @@ -799,13 +799,13 @@ Please follow these steps before you install either NGINX Open Source or NGINX P {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-oss-centos-8.md" >}} 3. Download all NGINX Open Source packages, including all dependencies: We used `repotrack` for example: - + Install yum-utils ```script sudo dnf install yum-utils ``` - For this test deployment we download the packages inside `/etc/packages/` + For this test deployment we download the packages inside `/etc/packages/` ```script sudo mkdir /etc/packages/ cd /etc/packages/ @@ -818,13 +818,13 @@ Please follow these steps before you install either NGINX Open Source or NGINX P {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-oss-centos-8.md" >}} 3. Download all NGINX Open Source packages, including all dependencies: We used `repotrack` for example: - + Install yum-utils ```script sudo dnf install yum-utils ``` - For this test deployment we download the packages inside `/etc/packages/` + For this test deployment we download the packages inside `/etc/packages/` ```script sudo mkdir /etc/packages/ cd /etc/packages/ @@ -837,19 +837,19 @@ Please follow these steps before you install either NGINX Open Source or NGINX P {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-oss-centos-9.md" >}} 3. Download all NGINX Open Source packages, including all dependencies: We used `repotrack` for example: - + Install yum-utils ```script sudo dnf install yum-utils ``` - For this test deployment we download the packages inside `/etc/packages/` + For this test deployment we download the packages inside `/etc/packages/` ```script sudo mkdir /etc/packages/ cd /etc/packages/ sudo repotrack --forcearch x86_64 app-protect-module-oss ``` - + {{%/tab%}} {{%tab name="Ubuntu 20.04"%}} @@ -918,13 +918,13 @@ Please follow these steps before you install either NGINX Open Source or NGINX P {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-plus-amzn2023.md" >}} 3. Download all NGINX Plus packages, including all dependencies: We used repotrack for example: - + Install yum-utils ```script sudo dnf install yum-utils ``` - For this test deployment we download the packages inside `/etc/packages/` + For this test deployment we download the packages inside `/etc/packages/` ```script sudo mkdir /etc/packages/ cd /etc/packages/ @@ -965,32 +965,32 @@ Please follow these steps before you install either NGINX Open Source or NGINX P {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-plus-centos-8.md" >}} 3. Download all NGINX Plus packages, including all dependencies: We used repotrack for example: - + Install yum-utils ```script sudo dnf install yum-utils ``` - For this test deployment we download the packages inside `/etc/packages/` + For this test deployment we download the packages inside `/etc/packages/` ```script sudo mkdir /etc/packages/ cd /etc/packages/ sudo repotrack --forcearch x86_64 app-protect-module-plus ``` -{{%/tab%}} +{{%/tab%}} {{%tab name="RHEL 8.1+"%}} {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-plus-centos-8.md" >}} 3. Download all NGINX Plus packages, including all dependencies: We used repotrack for example: - + Install yum-utils ```script sudo dnf install yum-utils ``` - For this test deployment we download the packages inside `/etc/packages/` + For this test deployment we download the packages inside `/etc/packages/` ```script sudo mkdir /etc/packages/ cd /etc/packages/ @@ -1003,13 +1003,13 @@ Please follow these steps before you install either NGINX Open Source or NGINX P {{< include "nap-waf/config/v5/host-based-nginx-instructions/nginx-plus-centos-9.md" >}} 3. Download all NGINX Plus packages, including all dependencies: We used repotrack for example: - + Install yum-utils ```script sudo dnf install yum-utils ``` - For this test deployment we download the packages inside `/etc/packages/` + For this test deployment we download the packages inside `/etc/packages/` ```script sudo mkdir /etc/packages/ cd /etc/packages/ @@ -1043,7 +1043,7 @@ Please follow these steps before you install either NGINX Open Source or NGINX P sudo apt-get update sudo bash -c 'for i in $(apt-cache depends --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances app-protect-module-plus | grep "^\w" | sort -u); do apt-get download $i; done 2>>/etc/packages/errors.txt' ``` - + {{%/tab%}} {{%tab name="Ubuntu 24.04"%}} @@ -1145,7 +1145,7 @@ sudo chown -R 101:101 /opt/app_protect/ {{< include "nap-waf/setup-docker-registry.md" >}} #### Download waf-enforcer and waf-config-mgr Images - Pull the `waf-enforcer` and `waf-config-mgr` images. Replace `5.2.0` with the actual release version you are deploying. + Pull the `waf-enforcer` and `waf-config-mgr` images. Replace `5.2.0` with the actual release version you are deploying. ```shell docker pull private-registry.nginx.com/nap/waf-enforcer:5.2.0 @@ -1255,14 +1255,14 @@ sudo docker compose stop {{}} {{%tab name="Alpine Linux 3.16/3.17/3.19"%}} - + For NGINX Open Source Uninstall the NGINX App Protect WAF v5 package: ```shell sudo apk del app-protect-module-oss ``` - + For NGINX Plus Uninstall the NGINX App Protect WAF v5 package: @@ -1279,7 +1279,7 @@ Uninstall the NGINX App Protect WAF v5 package: ```shell sudo yum remove app-protect-module-oss -sudo apt-get remove nginx=1.25.5-1~`lsb_release -cs` app-protect-module-oss +sudo apt-get remove nginx=1.25.5-1~`lsb_release -cs` app-protect-module-oss ``` For NGINX Plus @@ -1422,7 +1422,7 @@ Uninstall the NGINX App Protect WAF v5 package: ```shell sudo apt-get remove app-protect-module-plus -``` +``` {{%/tab%}} {{%tab name="Ubuntu 22.04"%}} @@ -1439,7 +1439,7 @@ Uninstall the NGINX App Protect WAF v5 package: ```shell sudo apt-get remove app-protect-module-plus -``` +``` {{%/tab%}} {{%tab name="Ubuntu 24.04"%}} @@ -1456,7 +1456,7 @@ Uninstall the NGINX App Protect WAF v5 package: ```shell sudo apt-get remove app-protect-module-plus -``` +``` {{%/tab%}} {{}} diff --git a/content/nap-waf/v5/admin-guide/overview.md b/content/nap-waf/v5/admin-guide/overview.md index b656d2872..af232059e 100644 --- a/content/nap-waf/v5/admin-guide/overview.md +++ b/content/nap-waf/v5/admin-guide/overview.md @@ -9,7 +9,7 @@ docs: DOCS-1362 ## Introduction -F5 NGINX App Protect WAF v5, designed for NGINX Open Source and NGINX Plus environments, offers advanced Web Application Firewall (WAF) capabilities, supporting all features of [NGINX App Protect WAF v4]({{< relref "/nap-waf/v4/admin-guide/install.md" >}}). This solution, available at an additional cost, consists of a dynamic NGINX module and containerized WAF services, providing robust security and scalability. +F5 NGINX App Protect WAF v5, designed for NGINX Open Source and NGINX Plus environments, offers advanced Web Application Firewall (WAF) capabilities, supporting all features of [NGINX App Protect WAF v4]({{< ref "/nap-waf/v4/admin-guide/install.md" >}}). This solution, available at an additional cost, consists of a dynamic NGINX module and containerized WAF services, providing robust security and scalability. ### Key Advantages @@ -46,15 +46,15 @@ NGINX App Protect WAF v5 supports the following operating systems: NGINX App Protect WAF v5 supports a range of deployment scenarios to meet various operational needs: -1. [Docker Compose Deployment]({{< relref "/nap-waf/v5/admin-guide/deploy-on-docker.md" >}}) +1. [Docker Compose Deployment]({{< ref "/nap-waf/v5/admin-guide/deploy-on-docker.md" >}}) - Deploys both NGINX and WAF components within containers. - Suitable for environments across development, testing, and production stages. -2. [Kubernetes Deployment]({{< relref "/nap-waf/v5/admin-guide/deploy-on-kubernetes.md" >}}) +2. [Kubernetes Deployment]({{< ref "/nap-waf/v5/admin-guide/deploy-on-kubernetes.md" >}}) - Integrates both NGINX and WAF components in a single pod. - Ideal for scalable, cloud-native environments. -3. [NGINX on Host/VM with Containerized WAF]({{< relref "/nap-waf/v5/admin-guide/install.md" >}}) +3. [NGINX on Host/VM with Containerized WAF]({{< ref "/nap-waf/v5/admin-guide/install.md" >}}) - NGINX is operated directly on the host system or a virtual machine, with WAF components deployed in containers. - Perfect for situations where NGINX is already in use on host systems, allowing for the addition of WAF components without disrupting the existing NGINX setup. @@ -79,14 +79,14 @@ We recommend that you deploy the NGINX App Protect WAF v5 in a staging environme 1. Back up your NGINX App Protect WAF configuration files, such as NGINX configurations, JSON policies, logging profiles, user-defined signatures, and global settings. 1. Install NGINX App Protect WAF 5 (using either nginx OSS or nginx-plus based on the need of customer's application). - - [Installing NGINX App Protect WAF]({{}}) - - [Deploying NGINX App Protect WAF on Docker]({{}}) - - [Deploying NGINX App Protect WAF on Kubernetes]({{}}) + - [Installing NGINX App Protect WAF]({{}}) + - [Deploying NGINX App Protect WAF on Docker]({{}}) + - [Deploying NGINX App Protect WAF on Kubernetes]({{}}) -1. Compile your `.json` policies and logging profiles to `.tgz` bundles using [compiler-image]({{}}) because NGINX App Protect WAF v5 supports policies and logging profiles in a compiled bundle format only. +1. Compile your `.json` policies and logging profiles to `.tgz` bundles using [compiler-image]({{}}) because NGINX App Protect WAF v5 supports policies and logging profiles in a compiled bundle format only. {{< note >}} - If you were previously using a default [logging profile]({{}}) JSON like `/opt/app_protect/share/defaults/log_all.json`, you can replace it with the default constant such as `log_all`, and then you will not need to explicitly compile the logging profile into a bundle. + If you were previously using a default [logging profile]({{}}) JSON like `/opt/app_protect/share/defaults/log_all.json`, you can replace it with the default constant such as `log_all`, and then you will not need to explicitly compile the logging profile into a bundle. ```nginx app_protect_security_log log_all /log_volume/security.log; @@ -94,7 +94,7 @@ We recommend that you deploy the NGINX App Protect WAF v5 in a staging environme {{< /note >}} -1. Replace the `.json` references in nginx.conf with the above created `.tgz` [bundles]({{}}). +1. Replace the `.json` references in nginx.conf with the above created `.tgz` [bundles]({{}}). 1. Make sure that `.tgz` bundles references are accessible to the `waf-config-mgr` container. @@ -105,6 +105,6 @@ We recommend that you deploy the NGINX App Protect WAF v5 in a staging environme ## Troubleshooting and FAQs -See common deployment challenges and solutions to ensure a smooth setup process in the [Troubleshooting Guide]({{< relref "/nap-waf/v5/troubleshooting-guide/troubleshooting.md#nginx-app-protect-5" >}}). +See common deployment challenges and solutions to ensure a smooth setup process in the [Troubleshooting Guide]({{< ref "/nap-waf/v5/troubleshooting-guide/troubleshooting.md#nginx-app-protect-5" >}}). Docker images for NGINX App Protect WAF v5 are built using Ubuntu 22.04 (Jammy) binaries. diff --git a/content/nap-waf/v5/admin-guide/upgrade-nap-waf.md b/content/nap-waf/v5/admin-guide/upgrade-nap-waf.md index ea6124970..c5d688a9c 100644 --- a/content/nap-waf/v5/admin-guide/upgrade-nap-waf.md +++ b/content/nap-waf/v5/admin-guide/upgrade-nap-waf.md @@ -11,7 +11,7 @@ docs: DOCS-1640 Learn how to upgrade F5 NGINX App Protect WAF on your managed NGINX instances using NGINX Instance Manager. This guide covers the steps to update both the NGINX Management Suite server and NGINX App Protect on the data plane, ensuring your security policies and configurations are up-to-date. -Before starting, confirm that your data plane has the latest NGINX Agent compatible with NGINX App Protect. Also, verify that your NGINX Management Suite server has the [WAF compiler installed]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}). If you're updating the WAF compiler, simply upload the NGINX App Protect WAF certificate and key to NGINX Management Suite following the instructions to [Automatically Download and Install New WAF Compiler]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md#automatically-download-and-install-new-waf-compiler" >}}). The compiler version may not be greater than the enforcer one. +Before starting, confirm that your data plane has the latest NGINX Agent compatible with NGINX App Protect. Also, verify that your NGINX Management Suite server has the [WAF compiler installed]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}). If you're updating the WAF compiler, simply upload the NGINX App Protect WAF certificate and key to NGINX Management Suite following the instructions to [Automatically Download and Install New WAF Compiler]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#automatically-download-and-install-new-waf-compiler" >}}). The compiler version may not be greater than the enforcer one. if you're updating the WAF enforcer, make sure that its major version is the same as of the WAF compiler and the minor version is greater than the compiler's. @@ -21,7 +21,7 @@ Upgrade NGINX App Protect by installing the new version of _nms-nap-compiler_ on Ensure the **nms-integrations** service recognizes both the new and existing _nms-nap-compiler_ versions. Complete this step before upgrading NGINX App Protect on your data planes. -For details on matching NGINX App Protect WAF releases with their WAF compiler versions, refer to the the [WAF Compiler and Supported App Protect Versions]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}) topic. +For details on matching NGINX App Protect WAF releases with their WAF compiler versions, refer to the the [WAF Compiler and Supported App Protect Versions]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}) topic. ## Upgrade NGINX App Protect on the Data Plane @@ -31,13 +31,13 @@ To update NGINX App Protect on an NGINX data plane instance, follow these steps: 1. **Stop the NGINX Agent**: Begin the upgrade process by stopping the NGINX Agent. This action prevents any ongoing processes from interfering with the upgrade. -2. **Upgrade NGINX App Protect**: Proceed to upgrade your NGINX App Protect. For detailed instructions on deployment and upgrading, refer to the [NGINX App Protect WAF Administration Guide]({{< relref "nap-waf/v5/admin-guide/install.md" >}}). This guide provides information essential for a successful upgrade. +2. **Upgrade NGINX App Protect**: Proceed to upgrade your NGINX App Protect. For detailed instructions on deployment and upgrading, refer to the [NGINX App Protect WAF Administration Guide]({{< ref "nap-waf/v5/admin-guide/install.md" >}}). This guide provides information essential for a successful upgrade. 3. **Restart NGINX App Protect**: After upgrading, restart NGINX App Protect to implement the new updates. 4. **Restart NGINX Agent**: Concluding the upgrade, restart the NGINX Agent. -Refer to the [NGINX App Protect WAF Release Notes]({{< relref "/nap-waf/v5/releases" >}}) to determine the correct package version for installation. It's important to adjust the version string in the provided commands to match your specific operating system version. +Refer to the [NGINX App Protect WAF Release Notes]({{< ref "/nap-waf/v5/releases" >}}) to determine the correct package version for installation. It's important to adjust the version string in the provided commands to match your specific operating system version. ## Verify the Upgrade diff --git a/content/nap-waf/v5/configuration-guide/configuration.md b/content/nap-waf/v5/configuration-guide/configuration.md index 44e44d482..33d97dffe 100644 --- a/content/nap-waf/v5/configuration-guide/configuration.md +++ b/content/nap-waf/v5/configuration-guide/configuration.md @@ -71,9 +71,9 @@ See [signature sets](#signature-sets) for configuring the signature sets include ### Policy Configuration Overview -The NGINX App Protect WAF security policy configuration uses the declarative format based on a pre-defined base template. The policy is represented in a JSON file which you can edit to add, modify and remove security capabilities with respect to the base template. The JSON file then should be compiled to a bundle file (`.tgz`) using the [NGINX App Protect WAF Compiler]({{< relref "/nap-waf/v5/admin-guide/compiler.md" >}}). The way the policy is integrated into the NGINX configuration is via referencing the bundle file (using the full path) in the `nginx.conf` file. +The NGINX App Protect WAF security policy configuration uses the declarative format based on a pre-defined base template. The policy is represented in a JSON file which you can edit to add, modify and remove security capabilities with respect to the base template. The JSON file then should be compiled to a bundle file (`.tgz`) using the [NGINX App Protect WAF Compiler]({{< ref "/nap-waf/v5/admin-guide/compiler.md" >}}). The way the policy is integrated into the NGINX configuration is via referencing the bundle file (using the full path) in the `nginx.conf` file. -Refer to the [admin guide]({{< relref "/nap-waf/v5/admin-guide/install.md#using-policy-and-logging-profile-bundles" >}}) for instructions on how to mount bundle files to your deployment. +Refer to the [admin guide]({{< ref "/nap-waf/v5/admin-guide/install.md#using-policy-and-logging-profile-bundles" >}}) for instructions on how to mount bundle files to your deployment. NGINX App Protect WAF provides a [JSON Schema](https://json-schema.org/) which can be used to validate a JSON policy file to ensure file format compliance. The schema file can be generated using a script inside the NGINX App Protect WAF Compiler image: @@ -166,7 +166,7 @@ Example: ### Updating Default Policy Bundles {{< note >}} -This section assumes that you have built a [compiler image]({{< relref "/nap-waf/v5/admin-guide/compiler.md" >}}) named `waf-compiler-1.0.0:custom`. +This section assumes that you have built a [compiler image]({{< ref "/nap-waf/v5/admin-guide/compiler.md" >}}) named `waf-compiler-1.0.0:custom`. {{< /note >}} To generate versions of the default policies that include the latest security updates, use the `-factory-policy` option instead of a source policy file. @@ -275,7 +275,7 @@ app_protect_policy_file /policies_mount/new_default_policy.tgz; ### apreload Events -apreload events use the same format as the current operation log events written in the NGINX error log, namely: `configuration_load_success` or `configuration_load_failure` with the details in JSON format. Refer to the [Operation logs]({{< relref "/nap-waf/v4/logging-overview/operation-logs.md" >}}) for more details. +apreload events use the same format as the current operation log events written in the NGINX error log, namely: `configuration_load_success` or `configuration_load_failure` with the details in JSON format. Refer to the [Operation logs]({{< ref "/nap-waf/v4/logging-overview/operation-logs.md" >}}) for more details. {{< note >}} Note that if any of the configuration files are invalid, apreload will discover that and return the proper error message in the `configuration_load_failure` event. The Enforcer continues to run with the previous configuration.{{< /note >}} @@ -421,7 +421,7 @@ It contains violations related to OpenAPI set to blocking (enforced). {{< include "/nap-waf/concept/graphql-profile.md" >}} -{{< note >}} For GraphQL profile default values and GraphQL violations reference, see NGINX App Protect WAF [Declarative Policy guide.]({{< relref "/nap-waf/v5/declarative-policy/policy.md" >}}) {{< /note >}} +{{< note >}} For GraphQL profile default values and GraphQL violations reference, see NGINX App Protect WAF [Declarative Policy guide.]({{< ref "/nap-waf/v5/declarative-policy/policy.md" >}}) {{< /note >}} ### Define URL settings @@ -443,7 +443,7 @@ It contains violations related to OpenAPI set to blocking (enforced). ### Condition Syntax Usage -For the full reference of Override Rules condition syntax and usage see the NGINX App Protect WAF [Declarative Policy guide]({{< relref "/nap-waf/v5/declarative-policy/policy.md" >}}/#policy/override-rules). +For the full reference of Override Rules condition syntax and usage see the NGINX App Protect WAF [Declarative Policy guide]({{< ref "/nap-waf/v5/declarative-policy/policy.md" >}}/#policy/override-rules). ### First Match Principle @@ -551,7 +551,7 @@ Refer to the following example where all access profile properties are configure } ``` -{{< note >}} For access profile default values and their related field names, see NGINX App Protect WAF [Declarative Policy guide]({{< relref "/nap-waf/v5/declarative-policy/policy.md" >}}). {{< /note >}} +{{< note >}} For access profile default values and their related field names, see NGINX App Protect WAF [Declarative Policy guide]({{< ref "/nap-waf/v5/declarative-policy/policy.md" >}}). {{< /note >}} #### Access Profile in URL Settings @@ -593,18 +593,18 @@ Here is an example of declarative policy using an `authorizationRules` entity un } ] } -``` +``` #### AuthorizationRules Condition Syntax Usage The `authorizationRules` use a Boolean expression to articulate the conditions for granting access to the URL. The conditions use the same syntax as in [Policy Override Rules](#override-rules) with one additional attribute **"claims"**. #### Claims Attribute -The newly introduced attribute "claims" is a mapping of JSON paths for claims from the JWT to their respective values. Only structure nesting is supported using the "." notation. +The newly introduced attribute "claims" is a mapping of JSON paths for claims from the JWT to their respective values. Only structure nesting is supported using the "." notation. A few points to remember regarding JWT claims: - Please note that at the moment, accessing individual cells within JSON arrays isn't possible. Instead, the entire array gets serialized as a string, and its elements can be evaluated using string operators like "contains". - While it's technically feasible to consolidate all conditions into one with "and" between them, it's not recommended. Dividing them into multiple conditions enhances the readability and clarity of the policy, particularly when explaining the reasons for authorization failure. -For the full reference of authorizationRules condition syntax and usage see the NGINX App Protect WAF [Declarative Policy guide]({{< relref "nap-waf/v5/declarative-policy/policy.md" >}}/#policy/override-rules). +For the full reference of authorizationRules condition syntax and usage see the NGINX App Protect WAF [Declarative Policy guide]({{< ref "nap-waf/v5/declarative-policy/policy.md" >}}/#policy/override-rules). See below example for JWT claims: - + ```json { "scope": "top-level:read", @@ -618,15 +618,15 @@ See below example for JWT claims: "state": "NY", "city": "New York", "street": "888 38th W" - } + } } ``` then the claims can be: ``` -claims['scope'] = "top-level:read" +claims['scope'] = "top-level:read" claims['roles'] = "["inventory-manager", "price-editor]" # the whole array is presented as a string -claims['address.country'] = "US" -claims['company'] = null # does not exist +claims['address.country'] = "US" +claims['company'] = null # does not exist claims['address'] = "{ \"address\": { .... } }" # JSON structs can be accessed using the dot "." notation ``` @@ -656,7 +656,7 @@ NGINX App Protect WAF can be secured with mutual TLS (mTLS) connection to provid To enable mTLS in NGINX, you need to perform the following steps: -1. Generate certificates and keys for both components - NGINX (client) and the App Protect Enforcer (server). +1. Generate certificates and keys for both components - NGINX (client) and the App Protect Enforcer (server). Below are the steps for using self-signed certificates: @@ -672,7 +672,7 @@ To enable mTLS in NGINX, you need to perform the following steps: ``` Generate a certificate and key for the App Protect Enforcer (server): - + ```shell openssl genpkey -algorithm RSA -out /etc/ssl/certs/app_protect_server.key openssl req -new -key /etc/ssl/certs/app_protect_server.key -out /etc/ssl/certs/app_protect_server_csr.crt -subj "/O=F5/OU=app-protect/CN=mTLS" @@ -688,16 +688,16 @@ To enable mTLS in NGINX, you need to perform the following steps: ``` 2. Open the NGINX configuration file `nginx.conf` and perform the following steps: - + Create a top‑level [`stream {}`](https://nginx.org/en/docs/stream/ngx_stream_core_module.html#stream) block or modify the existing one and add the following configuration: - + ```nginx stream { upstream enforcer { # Replace with the actual App Protect Enforcer address and port if different server 127.0.0.1:4431; } - + server { listen 5000; proxy_pass enforcer; @@ -709,21 +709,21 @@ To enable mTLS in NGINX, you need to perform the following steps: proxy_ssl_trusted_certificate /etc/ssl/certs/app_protect_server_ca.crt; } ``` - + In the above configuration: - + - The `upstream enforcer` block specifies the App Protect Enforcer server listening on port `4431` - The `proxy_pass` is used to proxy requests to the enforcer upstream - `ssl_certificate` and `ssl_certificate_key` specify the NGINX (client) certificate and key - The `proxy_ssl_trusted_certificate` enables the enforcer (server) certificate verification. - Use this stream server as the `app_protect_enforcer_address` value: - + Use this stream server as the `app_protect_enforcer_address` value: + ```nginx - app_protect_enforcer_address 127.0.0.1:5000; + app_protect_enforcer_address 127.0.0.1:5000; ``` - Configuration Example: + Configuration Example: ```nginx user nginx; @@ -740,7 +740,7 @@ To enable mTLS in NGINX, you need to perform the following steps: upstream enforcer { server 127.0.0.1:4431; } - + server { listen 5000; proxy_pass enforcer; @@ -751,15 +751,15 @@ To enable mTLS in NGINX, you need to perform the following steps: proxy_ssl_certificate_key /etc/ssl/certs/app_protect_client.key; proxy_ssl_trusted_certificate /etc/ssl/certs/app_protect_server_ca.crt; } - + http { include /etc/nginx/mime.types; default_type application/octet-stream; sendfile on; keepalive_timeout 65; - app_protect_enforcer_address 127.0.0.1:5000; - + app_protect_enforcer_address 127.0.0.1:5000; + server { listen 80; server_name localhost; @@ -769,7 +769,7 @@ To enable mTLS in NGINX, you need to perform the following steps: app_protect_policy_file app_protect_default_policy; app_protect_security_log_enable on; app_protect_security_log log_all syslog:server=127.0.0.1:514; - + location / { client_max_body_size 0; default_type text/html; @@ -787,18 +787,18 @@ To enable mTLS in NGINX, you need to perform the following steps: - ENFORCER_SERVER_KEY - ENFORCER_CA_FILE - Refer to the example for mTLS deployment in the admin guide, whether you're using [Docker]({{< relref "/nap-waf/v5/admin-guide/deploy-on-docker.md#docker-compose-file-with-mtls" >}}) or [Kubernetes]({{< relref "/nap-waf/v5/admin-guide/deploy-on-kubernetes.md#mtls-deployment" >}}). - + Refer to the example for mTLS deployment in the admin guide, whether you're using [Docker]({{< ref "/nap-waf/v5/admin-guide/deploy-on-docker.md#docker-compose-file-with-mtls" >}}) or [Kubernetes]({{< ref "/nap-waf/v5/admin-guide/deploy-on-kubernetes.md#mtls-deployment" >}}). + ## Brute Force Attack Preventions ### Overview Brute force attacks are attempts to break in to secured areas of a web application by trying exhaustive, -systematic, username/password combinations to discover legitimate authentication credentials. -To prevent brute force attacks, NGINX App Protect WAF monitors IP addresses, usernames, and the number of failed login attempts beyond a maximum threshold. -When brute force patterns are detected, the NGINX App Protect WAF policy either trigger an alarm or block the attack if the failed +systematic, username/password combinations to discover legitimate authentication credentials. +To prevent brute force attacks, NGINX App Protect WAF monitors IP addresses, usernames, and the number of failed login attempts beyond a maximum threshold. +When brute force patterns are detected, the NGINX App Protect WAF policy either trigger an alarm or block the attack if the failed login attempts reached a maximum threshold for a specific username or coming from a specific IP address. -To enable brute force protection, at least one login page must be created. +To enable brute force protection, at least one login page must be created. The login page entity is created separately and is not included in the brute force configuration block --- @@ -823,9 +823,9 @@ A login page specifies the login URL that users must pass through to get authent "passwordParameterName": "password" } ] -``` - -{{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< relref "/nap-waf/v5/declarative-policy/policy/#policy/login-pages" >}}). {{< /note >}} +``` + +{{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< ref "/nap-waf/v5/declarative-policy/policy/#policy/login-pages" >}}). {{< /note >}} --- @@ -862,7 +862,7 @@ Example1: A single brute force configuration is applied universally to all login } ``` -Example2: Different brute force configurations can be defined for individual login pages, +Example2: Different brute force configurations can be defined for individual login pages, with each configuration referencing a specific login page. ```json { @@ -899,7 +899,7 @@ Example2: Different brute force configurations can be defined for individual log } } ``` -{{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< relref "/nap-waf/v5/declarative-policy/policy/#policy/brute-force-attack-preventions" >}}). {{< /note >}} +{{< note >}} For further configuration details, see NGINX App Protect WAF Declarative Policy Guide [Declarative Policy guide]({{< ref "/nap-waf/v5/declarative-policy/policy/#policy/brute-force-attack-preventions" >}}). {{< /note >}} ## Custom Dimensions Log Entries @@ -1055,7 +1055,7 @@ The XML policy file can be obtained by exporting the policy from the BIG-IP syst Using the tool: ```shell -/opt/app_protect/bin/convert-policy +/opt/app_protect/bin/convert-policy ``` #### Convert Policy using Command Line Interface (CLI Usage) @@ -1075,8 +1075,8 @@ docker run -it --rm \ #### Command Line Options {{}} -|Field Name | Notes | -| ------------| ------| +|Field Name | Notes | +| ------------| ------| | -i | Filename of input WAF or ASM binary policy | | -o | Filename of output declarative policy | | --bot-profile | Filename of JSON Bot Profile (pre-converted to JSON from tmsh syntax) | @@ -1255,7 +1255,7 @@ Note that if the script is run without the required switches and their correspon ## Security Logs -Refer to [Logging Overview]({{< relref "/nap-waf/v5/logging-overview/security-log.md" >}}) section for more details on Security Logs. +Refer to [Logging Overview]({{< ref "/nap-waf/v5/logging-overview/security-log.md" >}}) section for more details on Security Logs. ## NGINX App Protect WAF Terminology diff --git a/content/nap-waf/v5/logging-overview/logs-overview.md b/content/nap-waf/v5/logging-overview/logs-overview.md index 1b41da5d2..4b4c7b590 100644 --- a/content/nap-waf/v5/logging-overview/logs-overview.md +++ b/content/nap-waf/v5/logging-overview/logs-overview.md @@ -14,11 +14,11 @@ Logs in F5 NGINX App Protect WAF v5 can be accessed and configured similarly to ### NGINX Access Log -NGINX App Protect WAF v5 can be configured to add additional data to NGINX [Access log]({{< relref "/nap-waf/v5/logging-overview/access-log" >}}). +NGINX App Protect WAF v5 can be configured to add additional data to NGINX [Access log]({{< ref "/nap-waf/v5/logging-overview/access-log" >}}). ### Security Logs -A key change in configuring [Security logs]({{< relref "/nap-waf/v5/logging-overview/security-log" >}}) is the requirement to [compile JSON logging profiles]({{< relref "/nap-waf/v5/configuration-guide/configuration.md#logging-profile-compilation" >}}) into a bundle file before applying them. +A key change in configuring [Security logs]({{< ref "/nap-waf/v5/logging-overview/security-log" >}}) is the requirement to [compile JSON logging profiles]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#logging-profile-compilation" >}}) into a bundle file before applying them. #### Default Logging Profile Bundles @@ -51,7 +51,7 @@ For instance: #### Security Log Destination -Please refer to [Security logs]({{< relref "/nap-waf/v5/logging-overview/security-log" >}}) page for details. +Please refer to [Security logs]({{< ref "/nap-waf/v5/logging-overview/security-log" >}}) page for details. #### WAF Enforcer Container Logs diff --git a/content/nap-waf/v5/logging-overview/security-log.md b/content/nap-waf/v5/logging-overview/security-log.md index 24b085c84..d0af14d78 100644 --- a/content/nap-waf/v5/logging-overview/security-log.md +++ b/content/nap-waf/v5/logging-overview/security-log.md @@ -77,7 +77,7 @@ app_protect_security_log /shared_volume/logging_profile_02.tgz syslog:server=my. ### Security Log Configuration File -Before applying, the log configuration file (JSON) should be [compiled]({{< relref "/nap-waf/v5/admin-guide/compiler.md#logging-profile-compilation" >}}) into a logging profile bundle (tgz). +Before applying, the log configuration file (JSON) should be [compiled]({{< ref "/nap-waf/v5/admin-guide/compiler.md#logging-profile-compilation" >}}) into a logging profile bundle (tgz). The file is in JSON format and consists of two parts: 1. **filter:** which requests are to be logged. @@ -123,7 +123,7 @@ This is the content of `log_default.json`. It is pre-compield (built-in) and is "filter": { "request_type": "illegal" }, - + "content": { "format": "default", "max_request_size": "2k", diff --git a/content/nap-waf/v5/releases/about-5.0.md b/content/nap-waf/v5/releases/about-5.0.md index 347ac6bde..b27436767 100644 --- a/content/nap-waf/v5/releases/about-5.0.md +++ b/content/nap-waf/v5/releases/about-5.0.md @@ -21,8 +21,8 @@ These features are only available in F5 NGINX App Protect WAF version 5.0 and ab In this release, NGINX App Protect WAF supports NGINX Open Source 1.25.4 and NGINX Plus R31 P1. -- [New deployment types]({{< relref "/nap-waf/v5/admin-guide/overview.md#deployment-types" >}}) -- [Security policy and logging profile bundles]({{< relref "/nap-waf/v5/admin-guide/compiler.md" >}}) +- [New deployment types]({{< ref "/nap-waf/v5/admin-guide/overview.md#deployment-types" >}}) +- [Security policy and logging profile bundles]({{< ref "/nap-waf/v5/admin-guide/compiler.md" >}}) --- diff --git a/content/nap-waf/v5/releases/about-5.1.md b/content/nap-waf/v5/releases/about-5.1.md index b1defe39c..77e5348f5 100644 --- a/content/nap-waf/v5/releases/about-5.1.md +++ b/content/nap-waf/v5/releases/about-5.1.md @@ -17,14 +17,14 @@ April 18, 2024 In this release, F5 NGINX App Protect WAF supports NGINX Open Source 1.25.4 and NGINX Plus R31 P1. -- [Authorization Rules in URLs]({{< relref "nap-waf/v5/configuration-guide/configuration.md#authorization-rules-in-urls" >}}) -- New [JSON Web Token]({{< relref "nap-waf/v5/configuration-guide/configuration.md#json-web-token-protection" >}}) signature signing algorithm support for: +- [Authorization Rules in URLs]({{< ref "nap-waf/v5/configuration-guide/configuration.md#authorization-rules-in-urls" >}}) +- New [JSON Web Token]({{< ref "nap-waf/v5/configuration-guide/configuration.md#json-web-token-protection" >}}) signature signing algorithm support for: - **RSA**: RS256, RS384, RS512 - **PSS**: PS256, PS384, PS512 - **ECDSA**: ES256, ES256K, ES384, ES512 - **EdDSA** -- [Time-Based Signature Staging]({{< relref "nap-waf/v5/configuration-guide/configuration.md#time-based-signature-staging" >}}) +- [Time-Based Signature Staging]({{< ref "nap-waf/v5/configuration-guide/configuration.md#time-based-signature-staging" >}}) --- diff --git a/content/nap-waf/v5/releases/about-5.2.md b/content/nap-waf/v5/releases/about-5.2.md index 2e1e7a427..388397e9b 100644 --- a/content/nap-waf/v5/releases/about-5.2.md +++ b/content/nap-waf/v5/releases/about-5.2.md @@ -17,7 +17,7 @@ May 29, 2024 In this release, F5 NGINX App Protect WAF supports NGINX Open Source 1.25.5 and NGINX Plus R32. -- [Apreload support]({{}}) +- [Apreload support]({{}}) --- diff --git a/content/nap-waf/v5/releases/about-5.3.md b/content/nap-waf/v5/releases/about-5.3.md index f824c1ee7..4b5bb044d 100644 --- a/content/nap-waf/v5/releases/about-5.3.md +++ b/content/nap-waf/v5/releases/about-5.3.md @@ -15,8 +15,8 @@ September 25, 2024 ### New features -- [Ubuntu 24.04 support]({{< relref "nap-waf/v5/admin-guide/install.md#common-steps-for-nginx-open-source-and-nginx-plus" >}}) -- [Secure Traffic Between NGINX and App Protect Enforcer]({{< relref "/nap-waf/v5/configuration-guide/configuration.md#secure-traffic-between-nginx-and-app-protect-enforcer-using-mtls" >}}) +- [Ubuntu 24.04 support]({{< ref "nap-waf/v5/admin-guide/install.md#common-steps-for-nginx-open-source-and-nginx-plus" >}}) +- [Secure Traffic Between NGINX and App Protect Enforcer]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#secure-traffic-between-nginx-and-app-protect-enforcer-using-mtls" >}}) --- diff --git a/content/nap-waf/v5/releases/about-5.4.md b/content/nap-waf/v5/releases/about-5.4.md index ab2c409cc..326be4d66 100644 --- a/content/nap-waf/v5/releases/about-5.4.md +++ b/content/nap-waf/v5/releases/about-5.4.md @@ -16,11 +16,11 @@ November 19th, 2024 ## New features - Added support for Amazon Linux 2023 -- Added support for [readOnlyFileSystem in Kubernetes deployments]({{< relref "/nap-waf/v5/admin-guide/deploy-on-kubernetes.md#configure-read-only-file-systems" >}}) -- Added a [a policy converter to the compiler]({{< relref "/nap-waf/v5/configuration-guide/configuration.md#policy-converter">}}) +- Added support for [readOnlyFileSystem in Kubernetes deployments]({{< ref "/nap-waf/v5/admin-guide/deploy-on-kubernetes.md#configure-read-only-file-systems" >}}) +- Added a [a policy converter to the compiler]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#policy-converter">}}) - NGINX App Protect WAF now supports NGINX Plus R33 -Please read the [subscription licenses]({{< relref "/solutions/about-subscription-licenses.md" >}}) topic for information about R33. +Please read the [subscription licenses]({{< ref "/solutions/about-subscription-licenses.md" >}}) topic for information about R33. --- @@ -33,7 +33,7 @@ Please read the [subscription licenses]({{< relref "/solutions/about-subscriptio ## Resolved issues - 11973 Fixed - Updated the Go version to 1.23.1 -- 11469 Fixed _apt-get update_ warning for Ubuntu 22.04 +- 11469 Fixed _apt-get update_ warning for Ubuntu 22.04 --- @@ -74,7 +74,7 @@ sudo service nginx restart | RHEL 9 | _app-protect-module-oss-1.27.2+5.210.0-1.el9.ngx.x86_64.rpm_ | | Oracle Linux 8.1 | _app-protect-module-oss-1.27.2+5.210.0-1.el8.ngx.x86_64.rpm_ | ---- +--- ### NGINX Plus diff --git a/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md b/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md index fb483e6f7..69bf4a8fc 100644 --- a/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md +++ b/content/nap-waf/v5/troubleshooting-guide/troubleshooting.md @@ -22,7 +22,7 @@ Refer to the below table for any NGINX App Protect WAF installation or configura |Problem|Solution| |-------|--------| | NGINX is not running (ps -aux)

Reloading NGINX fails| Check the error log at `/var/log/nginx/error.log`
Fix the problem and re-run NGINX. | -| NGINX App Protect WAF functionality is not as expected| NGINX App Protect WAF has several logs which can be used for troubleshooting.
Usually, it is best to look for any warning or error messages within the logs.
Refer to [Logs Overview]({{< relref "/nap-waf/v5/logging-overview/logs-overview.md">}}) | +| NGINX App Protect WAF functionality is not as expected| NGINX App Protect WAF has several logs which can be used for troubleshooting.
Usually, it is best to look for any warning or error messages within the logs.
Refer to [Logs Overview]({{< ref "/nap-waf/v5/logging-overview/logs-overview.md">}}) | | `Too many open files` error message | Increase number of file descriptors.
For example: `worker_rlimit_nofile 65535;` in the main context of `nginx.conf` file.
Refer to [worker_rlimit_nofile directive](https://www.nginx.com/blog/using-nginx-plus-with-selinux/#Issue-4:-%3Ccode%3EToo-many-files-are-open%3C/code%3E-Error)| | `setrlimit ... failed (Permission denied)` error message | Increase the limit using the following command as the root user:
`setsebool -P httpd_setrlimit 1;`
Refer to [Issue 4: Too many files are open Error](https://www.nginx.com/blog/using-nginx-plus-with-selinux/#Issue-4:-%3Ccode%3EToo-many-files-are-open%3C/code%3E-Error) | | unknown directive `app_protect_xxx` error message | App Protect module is not loaded. Add this line to the main (global) context of nginx.conf:
`load_module "/etc/nginx/modules/ngx_http_app_protect_module.so";` | diff --git a/content/ngf/how-to/monitoring/tracing.md b/content/ngf/how-to/monitoring/tracing.md index ed7635670..34a0dfc60 100644 --- a/content/ngf/how-to/monitoring/tracing.md +++ b/content/ngf/how-to/monitoring/tracing.md @@ -349,5 +349,5 @@ The trace includes the attribute from the global NginxProxy resource as well as ## See also -- [Custom policies]({{< relref "/ngf/overview/custom-policies.md" >}}): learn about how NGINX Gateway Fabric custom policies work. -- [API reference]({{< relref "/ngf/reference/api.md" >}}): all configuration fields for the policies mentioned in this guide +- [Custom policies]({{< ref "/ngf/overview/custom-policies.md" >}}): learn about how NGINX Gateway Fabric custom policies work. +- [API reference]({{< ref "/ngf/reference/api.md" >}}): all configuration fields for the policies mentioned in this guide diff --git a/content/ngf/how-to/monitoring/troubleshooting.md b/content/ngf/how-to/monitoring/troubleshooting.md index e0ebc0277..119d69867 100644 --- a/content/ngf/how-to/monitoring/troubleshooting.md +++ b/content/ngf/how-to/monitoring/troubleshooting.md @@ -288,7 +288,7 @@ The configuration may change in future releases. This configuration is valid for #### Metrics for troubleshooting -Metrics can be useful to identify performance bottlenecks and pinpoint areas of high resource consumption within NGINX Gateway Fabric. To set up metrics collection, refer to the [Prometheus Metrics guide]({{< relref "prometheus.md" >}}). The metrics dashboard will help you understand problems with the way NGINX Gateway Fabric is set up or potential issues that could show up with time. +Metrics can be useful to identify performance bottlenecks and pinpoint areas of high resource consumption within NGINX Gateway Fabric. To set up metrics collection, refer to the [Prometheus Metrics guide]({{< ref "prometheus.md" >}}). The metrics dashboard will help you understand problems with the way NGINX Gateway Fabric is set up or potential issues that could show up with time. For example, metrics `nginx_reloads_total` and `nginx_reload_errors_total` offer valuable insights into the system's stability and reliability. A high `nginx_reloads_total` value indicates frequent updates or configuration changes, while a high `nginx_reload_errors_total` value suggests issues with the configuration or other problems preventing successful reloads. Monitoring these metrics helps identify and resolve configuration errors, ensuring consistent service reliability. @@ -299,7 +299,7 @@ In such situations, it's advisable to review the logs of both NGINX and NGINX Ga #### Access the NGINX Plus Dashboard If you have NGINX Gateway Fabric installed with NGINX Plus, you can access the NGINX Plus dashboard at `http://localhost:8080/dashboard.html`. -Verify that the port number (for example, `8080`) matches the port number you have port-forwarded to your NGINX Gateway Fabric Pod. For further details, see the [dashboard guide]({{< relref "dashboard.md" >}}) +Verify that the port number (for example, `8080`) matches the port number you have port-forwarded to your NGINX Gateway Fabric Pod. For further details, see the [dashboard guide]({{< ref "dashboard.md" >}}) --- diff --git a/content/ngf/how-to/traffic-management/tls-passthrough.md b/content/ngf/how-to/traffic-management/tls-passthrough.md index b71dbf73a..92f1c5385 100644 --- a/content/ngf/how-to/traffic-management/tls-passthrough.md +++ b/content/ngf/how-to/traffic-management/tls-passthrough.md @@ -27,7 +27,7 @@ In this guide, we will show how to configure TLS passthrough for your applicatio ## Before you begin -- [Install]({{< relref "/ngf/installation/" >}}) NGINX Gateway Fabric with experimental features enabled. +- [Install]({{< ref "/ngf/installation/" >}}) NGINX Gateway Fabric with experimental features enabled. - Save the public IP address and port of NGINX Gateway Fabric into shell variables: ```text diff --git a/content/ngf/how-to/traffic-management/upstream-settings.md b/content/ngf/how-to/traffic-management/upstream-settings.md index 08c815cc0..6fd92b620 100644 --- a/content/ngf/how-to/traffic-management/upstream-settings.md +++ b/content/ngf/how-to/traffic-management/upstream-settings.md @@ -24,17 +24,17 @@ The settings in `UpstreamSettingsPolicy` correspond to the following NGINX direc `UpstreamSettingsPolicy` is a [Direct Policy Attachment](https://gateway-api.sigs.k8s.io/reference/policy-attachment/) that can be applied to one or more services in the same namespace as the policy. `UpstreamSettingsPolicies` can only be applied to HTTP or gRPC services, in other words, services that are referenced by an HTTPRoute or GRPCRoute. -See the [custom policies]({{< relref "/ngf/overview/custom-policies.md" >}}) document for more information on policies. +See the [custom policies]({{< ref "/ngf/overview/custom-policies.md" >}}) document for more information on policies. This guide will show you how to use the `UpstreamSettingsPolicy` API to configure the upstream zone size and keepalives for your applications. -For all the possible configuration options for `UpstreamSettingsPolicy`, see the [API reference]({{< relref "/ngf/reference/api.md" >}}). +For all the possible configuration options for `UpstreamSettingsPolicy`, see the [API reference]({{< ref "/ngf/reference/api.md" >}}). --- ## Before you begin -- [Install]({{< relref "/ngf/installation/" >}}) NGINX Gateway Fabric. +- [Install]({{< ref "/ngf/installation/" >}}) NGINX Gateway Fabric. - Save the public IP address and port of NGINX Gateway Fabric into shell variables: ```text @@ -393,5 +393,5 @@ upstream default_tea_80 { ## Further reading -- [Custom policies]({{< relref "/ngf/overview/custom-policies.md" >}}): learn about how NGINX Gateway Fabric custom policies work. -- [API reference]({{< relref "/ngf/reference/api.md" >}}): all configuration fields for the `UpstreamSettingsPolicy` API. +- [Custom policies]({{< ref "/ngf/overview/custom-policies.md" >}}): learn about how NGINX Gateway Fabric custom policies work. +- [API reference]({{< ref "/ngf/reference/api.md" >}}): all configuration fields for the `UpstreamSettingsPolicy` API. diff --git a/content/ngf/overview/resource-validation.md b/content/ngf/overview/resource-validation.md index 5e883dca0..547ce8b55 100644 --- a/content/ngf/overview/resource-validation.md +++ b/content/ngf/overview/resource-validation.md @@ -61,7 +61,7 @@ More information on CEL in Kubernetes can be found [here](https://kubernetes.io/ This step catches the following cases of invalid values: -- Valid values from the Gateway API perspective but not supported by NGINX Gateway Fabric yet. For example, a feature in an HTTPRoute routing rule. For the list of supported features see [Gateway API Compatibility]({{< relref "gateway-api-compatibility.md" >}}) doc. +- Valid values from the Gateway API perspective but not supported by NGINX Gateway Fabric yet. For example, a feature in an HTTPRoute routing rule. For the list of supported features see [Gateway API Compatibility]({{< relref "./gateway-api-compatibility.md" >}}) doc. - Valid values from the Gateway API perspective, but invalid for NGINX, because NGINX has stricter validation requirements for certain fields. These values will cause NGINX to fail to reload or operate erroneously. - Invalid values (both from the Gateway API and NGINX perspectives) that were not rejected because Step 1 was bypassed. Similar to the previous case, these values will cause NGINX to fail to reload or operate erroneously. - Malicious values that inject unrestricted NGINX config into the NGINX configuration (similar to an SQL injection attack). diff --git a/content/nginx-one/about.md b/content/nginx-one/about.md index 5b52046f8..f20c40bea 100644 --- a/content/nginx-one/about.md +++ b/content/nginx-one/about.md @@ -22,4 +22,4 @@ NGINX One offers the following key benefits: ## Legal notice: Licensing agreements for NGINX products -Using NGINX One is subject to our End User Service Agreement (EUSA). For [NGINX Plus]({{< relref "/nginx" >}}), usage is governed by the End User License Agreement (EULA). Open source projects, including [NGINX Agent](https://github.com/nginx/agent) and [NGINX OSS](https://github.com/nginx/nginx), are covered under their respective licenses. For more details on these licenses, follow the provided links. +Using NGINX One is subject to our End User Service Agreement (EUSA). For [NGINX Plus]({{< ref "/nginx" >}}), usage is governed by the End User License Agreement (EULA). Open source projects, including [NGINX Agent](https://github.com/nginx/agent) and [NGINX OSS](https://github.com/nginx/nginx), are covered under their respective licenses. For more details on these licenses, follow the provided links. diff --git a/content/nginx-one/api/authentication.md b/content/nginx-one/api/authentication.md index 062f9824d..101c0d81d 100644 --- a/content/nginx-one/api/authentication.md +++ b/content/nginx-one/api/authentication.md @@ -21,7 +21,7 @@ Before you begin, make sure you have either an API Token or API Certificate for You can authenticate API requests in two ways: using an API Token or an API Certificate. Below are examples of how to do this with curl, but you can also use other tools like Postman. {{}} -For definitions of terms such as _'tenant'_ and _'namespace'_ used in the following examples, refer to the [NGINX One Glossary]({{}}). +For definitions of terms such as _'tenant'_ and _'namespace'_ used in the following examples, refer to the [NGINX One Glossary]({{}}). {{}}
@@ -70,5 +70,5 @@ curl https://.console.ves.volterra.io/api/nginx/one/namespaces/default/d ## Further reading -- [NGINX One API Reference]({{< relref "/nginx-one/api/api-reference-guide.md" >}}) +- [NGINX One API Reference]({{< ref "/nginx-one/api/api-reference-guide.md" >}}) - [F5 Distributed Cloud API Documentation](https://docs.cloud.f5.com/docs/api) diff --git a/content/nginx-one/changelog.md b/content/nginx-one/changelog.md index 20c63c2cb..841a99445 100644 --- a/content/nginx-one/changelog.md +++ b/content/nginx-one/changelog.md @@ -44,7 +44,7 @@ It allows you to: ### Manage certificates with Config Sync Groups -With the NGINX One Console, you can now manage certificate deployment in Config Sync Groups. +With the NGINX One Console, you can now manage certificate deployment in Config Sync Groups. You can: @@ -52,7 +52,7 @@ You can: - Remove a deployed certificate from a Config Sync Group For more information, including warnings about risks, see our documentation on how you can: -- [Add a file]({{< ref "/nginx-one/how-to/nginx-configs/add-file.md" >}}) +- [Add a file]({{< ref "/nginx-one/how-to/nginx-configs/add-file.md" >}}) - [Manage certificates]({{< ref "/nginx-one/how-to/certificates/manage-certificates.md" >}}) ### Revert a configuration @@ -77,7 +77,7 @@ From the NGINX One Console you can now: - Ensure that your certificates are current and correct. - Manage your certificates from a central location. This can help you simplify operations and remotely update, rotate, and deploy those certificates. -For more information, see the full documentation on how you can [Manage Certificates]({{< relref "/nginx-one/how-to/certificates/manage-certificates.md" >}}). +For more information, see the full documentation on how you can [Manage Certificates]({{< ref "/nginx-one/how-to/certificates/manage-certificates.md" >}}). ## August 22, 2024 @@ -85,7 +85,7 @@ For more information, see the full documentation on how you can [Manage Certific Config Sync Groups are now available in the F5 NGINX One Console. This feature allows you to manage and synchronize NGINX configurations across multiple instances as a single entity, ensuring consistency and simplifying the management of your NGINX environment. -For more information, see the full documentation on [Managing Config Sync Groups]({{< relref "/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md" >}}). +For more information, see the full documentation on [Managing Config Sync Groups]({{< ref "/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md" >}}). ## August 8, 2024 @@ -105,7 +105,7 @@ Select the link for each CVE to see the details, including the CVE's publish dat ### Edit NGINX configurations -You can now make configuration changes to your NGINX instances. For more details, see [View and edit NGINX configurations]({{< relref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}). +You can now make configuration changes to your NGINX instances. For more details, see [View and edit NGINX configurations]({{< ref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}). ## May 28, 2024 @@ -132,4 +132,4 @@ We've updated the **Instance Details** and **Data Plane Keys** pages to make it We're thrilled to introduce NGINX One, an exciting addition to our suite of NGINX products. Designed with efficiency and ease of use in mind, NGINX One offers an innovative approach to managing your NGINX instances. -To help you get started, take a look at the [Getting Started Guide]({{< relref "/nginx-one/getting-started.md" >}}). This guide will walk you through the initial setup and key features so you can start using NGINX One right away. +To help you get started, take a look at the [Getting Started Guide]({{< ref "/nginx-one/getting-started.md" >}}). This guide will walk you through the initial setup and key features so you can start using NGINX One right away. diff --git a/content/nginx-one/getting-started.md b/content/nginx-one/getting-started.md index 7bbe242cd..789580da1 100644 --- a/content/nginx-one/getting-started.md +++ b/content/nginx-one/getting-started.md @@ -43,9 +43,9 @@ To generate a data plane key: {{}} Data plane keys are displayed only once and cannot be retrieved later. Be sure to copy and store this key securely. -Data plane keys expire after one year. You can change this expiration date later by [editing the key]({{< relref "nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md#change-expiration-date" >}}). +Data plane keys expire after one year. You can change this expiration date later by [editing the key]({{< ref "nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md#change-expiration-date" >}}). -[Revoking a data plane key]({{< relref "nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md#revoke-data-plane-key" >}}) disconnects all instances that were registered with that key. +[Revoking a data plane key]({{< ref "nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md#revoke-data-plane-key" >}}) disconnects all instances that were registered with that key. {{}} @@ -144,7 +144,7 @@ In order for NGINX One Console to show specific traffic and system metrics, you ### Enable NGINX Open Source Stub Status API -{{< include "/use-cases/monitoring/enable-nginx-oss-stub-status.md" >}} +{{< include "/use-cases/monitoring/enable-nginx-oss-stub-status.md" >}} --- diff --git a/content/nginx-one/glossary.md b/content/nginx-one/glossary.md index f0d220bb0..68e8498ee 100644 --- a/content/nginx-one/glossary.md +++ b/content/nginx-one/glossary.md @@ -14,9 +14,9 @@ This glossary defines terms used in the F5 NGINX One Console and F5 Distributed {{}} | Term | Definition | |-------------|-------------| -| **Config Sync Group** | A group of NGINX systems (or instances) with identical configurations. They may also share the same certificates. However, the instances in a Config Sync Group could belong to different systems and even different clusters. For more information, see this explanation of [Important considerations]({{< relref "/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md#important-considerations" >}}) | +| **Config Sync Group** | A group of NGINX systems (or instances) with identical configurations. They may also share the same certificates. However, the instances in a Config Sync Group could belong to different systems and even different clusters. For more information, see this explanation of [Important considerations]({{< ref "/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md#important-considerations" >}}) | | **Data Plane** | The data plane is the part of a network architecture that carries user traffic. It handles tasks like forwarding data packets between devices and managing network communication. In the context of NGINX, the data plane is responsible for tasks such as load balancing, caching, and serving web content. | -| **Instance** | An instance is an individual system with NGINX installed. You can group the instances of your choice in a Config Sync Group. When you add an instance to NGINX One, you need to use a data plane key. | +| **Instance** | An instance is an individual system with NGINX installed. You can group the instances of your choice in a Config Sync Group. When you add an instance to NGINX One, you need to use a data plane key. | | **Namespace** | In F5 Distributed Cloud, a namespace groups a tenant’s configuration objects, similar to administrative domains. Every object in a namespace must have a unique name, and each namespace must be unique to its tenant. This setup ensures isolation, preventing cross-referencing of objects between namespaces. | | **Staged Configurations** | Also known as **Staged Configs**. Allows you to save "work in progress." You can create it from scratch, an Instance, another Staged Config, or a Config Sync Group. It does _not_ have to be a working configuration until you publish it to an instance or a Config Sync Group. You can even manage your **Staged Configurations** through our [API]({{< ref "/nginx-one/api/api-reference-guide/#tag/StagedConfigs" >}}). | | **Tenant** | A tenant in F5 Distributed Cloud is an entity that owns a specific set of configuration and infrastructure. It is fundamental for isolation, meaning a tenant cannot access objects or infrastructure of other tenants. Tenants can be either individual or enterprise, with the latter allowing multiple users with role-based access control (RBAC). | diff --git a/content/nginx-one/how-to/certificates/manage-certificates.md b/content/nginx-one/how-to/certificates/manage-certificates.md index 1ac565793..07a4f56e2 100644 --- a/content/nginx-one/how-to/certificates/manage-certificates.md +++ b/content/nginx-one/how-to/certificates/manage-certificates.md @@ -9,9 +9,9 @@ type: ## Overview -This guide explains how you can manage SSL/TLS certificates with the F5 NGINX One Console. Valid certificates support encrypted connections between NGINX and your users. +This guide explains how you can manage SSL/TLS certificates with the F5 NGINX One Console. Valid certificates support encrypted connections between NGINX and your users. -You may have separate sets of SSL/TLS certificates, as described in the following table: +You may have separate sets of SSL/TLS certificates, as described in the following table: {{}} | Functionality | Typical file names | Notes | @@ -21,7 +21,7 @@ You may have separate sets of SSL/TLS certificates, as described in the followin | NGINX Licensing | /etc/ssl/nginx/server.crt
/etc/ssl/nginx/server.key | Supports access to repositories. Based on licenses downloaded from https://my.f5.com/ | {{}} -Allowed directories depend on the [NGINX Agent]({{< relref "/nginx-one/getting-started/#install-nginx-agent" >}}). Look for the `/etc/nginx-agent/nginx-agent.conf` file. +Allowed directories depend on the [NGINX Agent]({{< ref "/nginx-one/getting-started/#install-nginx-agent" >}}). Look for the `/etc/nginx-agent/nginx-agent.conf` file. Find the `config_dirs` parameter in that file, as described in the NGINX Agent [Basic configuration](https://docs.nginx.com/nginx-agent/configuration/configuration-overview/#cli-flags--environment-variables). You may need to add a directory like `/etc/ssl` to that parameter. @@ -33,8 +33,8 @@ From the NGINX One Console you can: You can manage the certificates for: -- [Unique instances]({{< relref "/nginx-one/how-to/nginx-configs/add-file.md#new-ssl-certificate-or-ca-bundle" >}}) -- For all instances that are members of a [Config Sync Group]({{< relref "/nginx-one/how-to/config-sync-groups/manage-config-sync-groups/#configuration-management" >}}) +- [Unique instances]({{< ref "/nginx-one/how-to/nginx-configs/add-file.md#new-ssl-certificate-or-ca-bundle" >}}) +- For all instances that are members of a [Config Sync Group]({{< ref "/nginx-one/how-to/config-sync-groups/manage-config-sync-groups/#configuration-management" >}}) {{< tip >}} @@ -48,7 +48,7 @@ If you are managing the certificate from NGINX One Console, we recommend that yo Before you add and manage certificates with the NGINX One Console make sure: - You have access to the NGINX One Console -- You have access through the F5 Distributed Cloud role, as described in the [Authentication]({{< relref "/nginx-one/api/authentication.md" >}}) guide, to manage SSL/TLS certificates +- You have access through the F5 Distributed Cloud role, as described in the [Authentication]({{< ref "/nginx-one/api/authentication.md" >}}) guide, to manage SSL/TLS certificates - You have the `f5xc-nginx-one-user` role for your account - Your SSL/TLS certificates and keys match @@ -106,7 +106,7 @@ In such cases, you may get websites that present "Your connection is not private ## Review existing certificates -Follow these steps to review existing certificates for your instances. +Follow these steps to review existing certificates for your instances. On the left-hand pane, select **Certificates**. In the window that appears, you see: @@ -118,7 +118,7 @@ On the left-hand pane, select **Certificates**. In the window that appears, you | **Expires Soon (<31 days)** | Number of certificates that expire in less than 31 days | | **Expired** | Number of exprired certificates | | **Not Ready** | Certificates with a start date in the future | -| **Managed** | Managed by and stored in the NGINX One Console | +| **Managed** | Managed by and stored in the NGINX One Console | | **Unmanaged** | Detected by, and not managed by NGINX One Console. To convert to managed, you may need to upload the certificate and key during the process. | {{}} @@ -133,7 +133,7 @@ The Export option supports exports of basic certification file information to a ## Add a new certificate or bundle -To add a new certificate, select **Add Certificate**. +To add a new certificate, select **Add Certificate**. In the screen that appears, you can add a certificate name. If you don't add a name, NGINX One will add a name for you, based on the expiration date for the certificate. @@ -145,7 +145,7 @@ You can add certificates in the following formats: In each case, you can upload files directly, or enter the content of the certificates in a text box. Once you upload these certificates, you'll see: -- **Certificate Details**, with the Subject Name, start and end dates. +- **Certificate Details**, with the Subject Name, start and end dates. - **Key Details**, with the encryption key size and algorithm, such as RSA @@ -161,7 +161,7 @@ You can remove a deployed certificate from an independent instance or from a Con Every instance with a deployed certificate includes paths to certificates in their configuration files. If you remove the deployed file path to one certificate, that change is limited to that one instance. -Every Config Sync Group also includes paths to certificates in its configuration files. If you remove the deployed path to one certificate, that change affects all instances which belong to that Config Sync Group. +Every Config Sync Group also includes paths to certificates in its configuration files. If you remove the deployed path to one certificate, that change affects all instances which belong to that Config Sync Group. ## Delete a deployed certificate @@ -173,7 +173,7 @@ If that certificate is managed and is part of a Config Sync Group, that change a ## Managed and unmanaged certificates -If you register an instance to NGINX One Console, as described in [Add your NGINX instances to NGINX One]({{< relref "/nginx-one/getting-started.md#add-your-nginx-instances-to-nginx-one" >}}), and the associated SSL/TLS certificates: +If you register an instance to NGINX One Console, as described in [Add your NGINX instances to NGINX One]({{< ref "/nginx-one/getting-started.md#add-your-nginx-instances-to-nginx-one" >}}), and the associated SSL/TLS certificates: - Are used in their NGINX configuration - Do _not_ match an existing managed SSL certificate/CA bundle @@ -192,6 +192,6 @@ To convert these cerificates to managed, start with the Certificates menu, and s ## See also -- [Create and manage data plane keys]({{< relref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) -- [View and edit NGINX configurations]({{< relref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}) -- [Add a file in a configuration]({{< relref "/nginx-one/how-to/nginx-configs/add-file.md" >}}) +- [Create and manage data plane keys]({{< ref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) +- [View and edit NGINX configurations]({{< ref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}) +- [Add a file in a configuration]({{< ref "/nginx-one/how-to/nginx-configs/add-file.md" >}}) diff --git a/content/nginx-one/how-to/config-sync-groups/add-file-csg.md b/content/nginx-one/how-to/config-sync-groups/add-file-csg.md index e6db05447..ad8d31ca0 100644 --- a/content/nginx-one/how-to/config-sync-groups/add-file-csg.md +++ b/content/nginx-one/how-to/config-sync-groups/add-file-csg.md @@ -20,7 +20,7 @@ Before you add files in your configuration, ensure: ## Important considerations -This page applies when you want to add a file to a Config Sync Group. Any changes you make here apply to all [Instances]({{< relref "/nginx-one/glossary.md" >}}) of that Config Sync Group. +This page applies when you want to add a file to a Config Sync Group. Any changes you make here apply to all [Instances]({{< ref "/nginx-one/glossary.md" >}}) of that Config Sync Group. ## Add a file @@ -58,10 +58,10 @@ Enter the name of the desired configuration file, such as `abc.conf` and select ### Existing SSL Certificate or CA Bundle {{< include "nginx-one/add-file/existing-ssl-bundle.md" >}} -With this option, You can incorporate [Managed certificates]({{< relref "/nginx-one/how-to/certificates/manage-certificates.md#managed-and-unmanaged-certificates" >}}). +With this option, You can incorporate [Managed certificates]({{< ref "/nginx-one/how-to/certificates/manage-certificates.md#managed-and-unmanaged-certificates" >}}). ## See also -- [Create and manage data plane keys]({{< relref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) -- [View and edit NGINX configurations]({{< relref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}) -- [Manage certificates]({{< relref "/nginx-one/how-to/certificates/manage-certificates.md" >}}) +- [Create and manage data plane keys]({{< ref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) +- [View and edit NGINX configurations]({{< ref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}) +- [Manage certificates]({{< ref "/nginx-one/how-to/certificates/manage-certificates.md" >}}) diff --git a/content/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md b/content/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md index a888fa52f..11d717b75 100644 --- a/content/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md +++ b/content/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md @@ -13,11 +13,11 @@ If you work with several instances of NGINX, it can help to organize these insta This guide explains how to create and manage Config Sync Groups in the F5 NGINX One Console. Config Sync Groups synchronize NGINX configurations across multiple NGINX instances, ensuring consistency and ease of management. -If you’ve used [instance groups in NGINX Instance Manager]({{< relref "/nim/nginx-instances/manage-instance-groups.md" >}}), you’ll find Config Sync Groups in NGINX One similar, though the steps and terminology differ slightly. +If you’ve used [instance groups in NGINX Instance Manager]({{< ref "/nim/nginx-instances/manage-instance-groups.md" >}}), you’ll find Config Sync Groups in NGINX One similar, though the steps and terminology differ slightly. Config Sync Groups are functionally different from syncing instances in a cluster. They let you to manage and synchronize configurations across multiple NGINX instances, all at once. -This is particularly useful when your NGINX instances are load-balanced by an external load balancer, as it ensures consistency across all instances. In contrast, cluster syncing, like [zone syncing]({{< relref "nginx/admin-guide/high-availability/zone_sync_details.md" >}}), ensures data consistency and high availability across NGINX instances in a cluster. While Config Sync Groups focus on configuration management, cluster syncing supports failover and data consistency. +This is particularly useful when your NGINX instances are load-balanced by an external load balancer, as it ensures consistency across all instances. In contrast, cluster syncing, like [zone syncing]({{< ref "nginx/admin-guide/high-availability/zone_sync_details.md" >}}), ensures data consistency and high availability across NGINX instances in a cluster. While Config Sync Groups focus on configuration management, cluster syncing supports failover and data consistency. ## Before you start @@ -35,7 +35,7 @@ Config Sync Groups support configuration inheritance and persistance. If you've - When you add the first instance to a group, that instance defines the configuration for that Config Sync Group. - Afterwards, you can modify the configuration of the Config Sync Group. That modifies the configuration of all member instances. Future members of that group inherit that modified configuration. -On the other hand, if you remove all instances from a Config Sync Group, the original configuration persists. In other words, the group retains the configuration from that first instance (or the original configuration). Any new instance that you add later still inherits that configuration. +On the other hand, if you remove all instances from a Config Sync Group, the original configuration persists. In other words, the group retains the configuration from that first instance (or the original configuration). Any new instance that you add later still inherits that configuration. {{< tip >}}You can use _unmanaged_ certificates. Your actions can affect the [Config Sync Group status](#config-sync-group-status). For future instances on the data plane, if it: @@ -47,12 +47,12 @@ On the other hand, if you remove all instances from a Config Sync Group, the ori ### Risk when adding multiple instances to a Config Sync Group -If you add multiple instances to a single Config Sync Group, simultaneously (with automation), there's a risk that the instance selects a random configuration. To prevent this problem, you should: - +If you add multiple instances to a single Config Sync Group, simultaneously (with automation), there's a risk that the instance selects a random configuration. To prevent this problem, you should: + 1. Create a Config Sync Group. 1. Add a configuration to the Config Sync Group, so all instances inherit it. 1. Add the instances in a separate operation. - + Your instances should synchronize with your desired configuration within 30 seconds. ### Use an instance to define the Config Sync Group configuration @@ -116,7 +116,7 @@ You can add existing NGINX instances that are already registered with NGINX One ``` shell sudo systemctl restart nginx-agent - ``` + ``` ### Add a new instance to a Config Sync Group {#add-a-new-instance-to-a-config-sync-group} @@ -162,13 +162,13 @@ When adding a new NGINX instance that is not yet registered with NGINX One, you - From the **OS Type** list, choose the appropriate operating system for your Docker image. - After selecting the OS, run the provided command to pull the Docker image. - **Note**: Subject to availability, you can modify the `agent: ` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< relref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}). + **Note**: Subject to availability, you can modify the `agent: ` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}). - From the **OS Type** list, choose the appropriate operating system for your Docker image. - After selecting the OS, run the provided command to pull the Docker image. - **Note**: Subject to availability, you can modify the `agent: ` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< relref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}). + **Note**: Subject to availability, you can modify the `agent: ` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}). 10. Run the provided command, which includes the data plane key, in your NGINX instance terminal to start the Docker container. @@ -180,9 +180,9 @@ When adding a new NGINX instance that is not yet registered with NGINX One, you {{}} -Data plane keys are required for registering NGINX instances with the NGINX One Console. These keys serve as secure tokens, ensuring that only authorized instances can connect and communicate with NGINX One. +Data plane keys are required for registering NGINX instances with the NGINX One Console. These keys serve as secure tokens, ensuring that only authorized instances can connect and communicate with NGINX One. -For more details on creating and managing data plane keys, see [Create and manage data plane keys]({{}}). +For more details on creating and managing data plane keys, see [Create and manage data plane keys]({{}}). {{}} @@ -204,7 +204,7 @@ If you need to move an NGINX instance to a different Config Sync Group, follow t sudo systemctl restart nginx-agent ``` -If you move an instance with certificates from one Config Sync Group to another, NGINX One adds or removes those certificates from the data plane, to synchronize with the deployed certificates of the group. +If you move an instance with certificates from one Config Sync Group to another, NGINX One adds or removes those certificates from the data plane, to synchronize with the deployed certificates of the group. ### Remove an instance from a Config Sync Group @@ -234,7 +234,7 @@ After the Config Sync Group is created, you can modify and publish the group's c 2. Select the Config Sync Group in the list. 3. Select the **Configuration** tab to view the group's NGINX configuration. 4. To modify the group's configuration, select **Edit Configuration**. -5. Make the necessary changes to the configuration. +5. Make the necessary changes to the configuration. 6. When you're finished, select **Next**. A split view displays the changes. 7. If you're satisfied with the changes, select **Save and Publish**. @@ -257,5 +257,5 @@ Monitor the **Config Sync Status** column. It can help you ensure that your conf ## See also -- [Create and manage data plane keys]({{< relref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) -- [View and edit NGINX configurations]({{< relref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}) +- [Create and manage data plane keys]({{< ref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) +- [View and edit NGINX configurations]({{< ref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}) diff --git a/content/nginx-one/how-to/containers/connect-nginx-plus-container-images-to-nginx-one.md b/content/nginx-one/how-to/containers/connect-nginx-plus-container-images-to-nginx-one.md index ba645dd20..daae3af88 100644 --- a/content/nginx-one/how-to/containers/connect-nginx-plus-container-images-to-nginx-one.md +++ b/content/nginx-one/how-to/containers/connect-nginx-plus-container-images-to-nginx-one.md @@ -19,7 +19,7 @@ This guide explains how to set up an F5 NGINX Plus Docker container with NGINX A Before you start, make sure you have: - A valid JSON Web Token (JWT) for your NGINX subscription. -- [A data plane key from NGINX One]({{< relref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}). +- [A data plane key from NGINX One]({{< ref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}). - Docker installed and running on your system. #### Download your JWT license from MyF5 @@ -48,7 +48,7 @@ Pull the NGINX Plus image from the private registry. Replace `VERSION_TAG` with sudo docker pull private-registry.nginx.com/nginx-plus/agent:VERSION_TAG ``` -You must specify a version tag. The `latest` tag is not supported. Learn more in the [Deploying NGINX and NGINX Plus on Docker]({{< relref "/nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}) guide. +You must specify a version tag. The `latest` tag is not supported. Learn more in the [Deploying NGINX and NGINX Plus on Docker]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}) guide.
@@ -68,7 +68,7 @@ Start the Docker container to connect it to NGINX One. Replace `YOUR_NGINX_ONE_D - Use the `NGINX_LICENSE_JWT` variable to pass your JWT license. Replace `YOUR_JWT_HERE` with your JWT. -For more details, see [About subscription licenses]({{< relref "solutions/about-subscription-licenses.md" >}}). +For more details, see [About subscription licenses]({{< ref "solutions/about-subscription-licenses.md" >}}). ```sh sudo docker run \ diff --git a/content/nginx-one/how-to/nginx-configs/add-file.md b/content/nginx-one/how-to/nginx-configs/add-file.md index 56f58f0ae..7b654d86e 100644 --- a/content/nginx-one/how-to/nginx-configs/add-file.md +++ b/content/nginx-one/how-to/nginx-configs/add-file.md @@ -21,7 +21,7 @@ Before you add files in your configuration, ensure: ## Important considerations If your instance is a member of a Config Sync Group, changes that you make may be synchronized to other instances in that group. -For more information, see how you can [Manage Config Sync Groups]({{< relref "/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md" >}}). +For more information, see how you can [Manage Config Sync Groups]({{< ref "/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md" >}}). ## Add a file @@ -62,6 +62,6 @@ Enter the name of the desired configuration file, such as `abc.conf` and select ## See also -- [Create and manage data plane keys]({{< relref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) -- [View and edit NGINX configurations]({{< relref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}) -- [Manage certificates]({{< relref "/nginx-one/how-to/certificates/manage-certificates.md" >}}) +- [Create and manage data plane keys]({{< ref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) +- [View and edit NGINX configurations]({{< ref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}) +- [Manage certificates]({{< ref "/nginx-one/how-to/certificates/manage-certificates.md" >}}) diff --git a/content/nginx-one/how-to/nginx-configs/add-instance.md b/content/nginx-one/how-to/nginx-configs/add-instance.md index e1b814c2d..884df0c15 100644 --- a/content/nginx-one/how-to/nginx-configs/add-instance.md +++ b/content/nginx-one/how-to/nginx-configs/add-instance.md @@ -9,7 +9,7 @@ type: ## Overview -This guide explains how to add an F5 NGINX instance in F5 NGINX One Console. You can add an instance from the NGINX One Console individually, or as part of a [Config Sync Group]({{< relref "/nginx-one/glossary.md" >}}). In either case, you need +This guide explains how to add an F5 NGINX instance in F5 NGINX One Console. You can add an instance from the NGINX One Console individually, or as part of a [Config Sync Group]({{< ref "/nginx-one/glossary.md" >}}). In either case, you need to set up a data plane key to connect your instances to NGINX One. ## Before you start @@ -21,7 +21,7 @@ Before you add an instance to NGINX One Console, ensure: - You have or are ready to configure a data plane key. - You have or are ready to set up managed certificates. -{{< note >}}If this is the first time an instance is being added to a Config Sync Group, and you have not yet defined the configuration for that Config Sync Group, that instance provides the template for that group. For more information, see [Configuration management]({{< relref "nginx-one/how-to/config-sync-groups/manage-config-sync-groups#configuration-management" >}}).{{< /note >}} +{{< note >}}If this is the first time an instance is being added to a Config Sync Group, and you have not yet defined the configuration for that Config Sync Group, that instance provides the template for that group. For more information, see [Configuration management]({{< ref "nginx-one/how-to/config-sync-groups/manage-config-sync-groups#configuration-management" >}}).{{< /note >}} ## Add an instance @@ -37,7 +37,7 @@ In either case, NGINX One Console gives you a choice for data plane keys: NGINX One Console takes the option you use, and adds the data plane key to a command that you'd use to register your target instance. You should see the command in the **Add Instance** screen in the console. -Connect to the host where your NGINX instance is running. Run the provided command to [install NGINX Agent]({{< relref "/nginx-one/getting-started#install-nginx-agent" >}}) dependencies and packages on that host. +Connect to the host where your NGINX instance is running. Run the provided command to [install NGINX Agent]({{< ref "/nginx-one/getting-started#install-nginx-agent" >}}) dependencies and packages on that host. ```bash curl https://agent.connect.nginx.com/nginx-agent/install | DATA_PLANE_KEY="" sh -s -- -y @@ -51,7 +51,7 @@ If you add an instance with SSL/TLS certificates, those certificates can match a ### If the certificate is already managed -If you add an instance with a managed certificate, as described in [Add your NGINX instances to NGINX One], these certificates are added to your list of **Managed Certificates**. +If you add an instance with a managed certificate, as described in [Add your NGINX instances to NGINX One], these certificates are added to your list of **Managed Certificates**. NGINX One Console can manage your instances along with those certificates. @@ -71,5 +71,5 @@ Once you've completed the process, NGINX One reassigns this as a managed certifi ## Add an instance to a Config Sync Group -When you [Manage Config Sync Group membership]({{< relref "nginx-one/how-to/config-sync-groups/manage-config-sync-groups#manage-config-sync-group-membership" >}}), you can add an existing or new instance to the group of your choice. +When you [Manage Config Sync Group membership]({{< ref "nginx-one/how-to/config-sync-groups/manage-config-sync-groups#manage-config-sync-group-membership" >}}), you can add an existing or new instance to the group of your choice. That instance inherits the setup of that Config Sync Group. diff --git a/content/nginx-one/how-to/nginx-configs/manage-config-sync-groups.md b/content/nginx-one/how-to/nginx-configs/manage-config-sync-groups.md index 0ba98165d..8bc10cce6 100644 --- a/content/nginx-one/how-to/nginx-configs/manage-config-sync-groups.md +++ b/content/nginx-one/how-to/nginx-configs/manage-config-sync-groups.md @@ -11,7 +11,7 @@ type: This guide explains how to create and manage config sync groups in the F5 NGINX One Console. Config sync groups synchronize NGINX configurations across multiple NGINX instances, ensuring consistency and ease of management. -If you’ve used [instance groups in NGINX Instance Manager]({{< relref "/nim/nginx-instances/manage-instance-groups.md" >}}), you’ll find config sync groups in NGINX One similar, though the steps and terminology differ slightly. +If you’ve used [instance groups in NGINX Instance Manager]({{< ref "/nim/nginx-instances/manage-instance-groups.md" >}}), you’ll find config sync groups in NGINX One similar, though the steps and terminology differ slightly. ## Before you start @@ -31,19 +31,19 @@ Before you create and manage config sync groups, ensure: - **Configuration inheritance**: If the config sync group already has a configuration defined, that configuration will be pushed to instances when they join. -- **Using an instance's configuration for the group configuration**: If an instance is the first to join a config sync group and the group's configuration hasn't been defined, the instance’s configuration will become the group’s configuration. Any instances added later will automatically inherit this configuration. +- **Using an instance's configuration for the group configuration**: If an instance is the first to join a config sync group and the group's configuration hasn't been defined, the instance’s configuration will become the group’s configuration. Any instances added later will automatically inherit this configuration. {{< note >}} If you add multiple instances to a single config sync group, simultaneously (with automation), follow these steps. Your instances will inherit your desired configuration: - + 1. Create a config sync group. 1. Add a configuration to the config sync group, so all instances inherit it. 1. Add the instances in a separate operation. - + Your instances should synchronize with your desired configuration within 30 seconds. {{< /note >}} - **Persistence of a config sync group's configuration**: The configuration for a config sync group persists until you delete the group. Even if you remove all instances, the group's configuration stays intact. Any new instances that join later will automatically inherit this configuration. -- **Config sync groups vs. cluster syncing**: Config sync groups are not the same as cluster syncing. Config sync groups let you to manage and synchronize configurations across multiple NGINX instances as a single entity. This is particularly useful when your NGINX instances are load-balanced by an external load balancer, as it ensures consistency across all instances. In contrast, cluster syncing, like [zone syncing]({{< relref "nginx/admin-guide/high-availability/zone_sync_details.md" >}}), ensures data consistency and high availability across NGINX instances in a cluster. While config sync groups focus on configuration management, cluster syncing supports failover and data consistency. +- **Config sync groups vs. cluster syncing**: Config sync groups are not the same as cluster syncing. Config sync groups let you to manage and synchronize configurations across multiple NGINX instances as a single entity. This is particularly useful when your NGINX instances are load-balanced by an external load balancer, as it ensures consistency across all instances. In contrast, cluster syncing, like [zone syncing]({{< ref "nginx/admin-guide/high-availability/zone_sync_details.md" >}}), ensures data consistency and high availability across NGINX instances in a cluster. While config sync groups focus on configuration management, cluster syncing supports failover and data consistency. ## Create a config sync group @@ -72,7 +72,7 @@ You can add existing NGINX instances that are already registered with NGINX One ``` shell sudo systemctl restart nginx-agent - ``` + ``` ### Add a new instance to a config sync group {#add-a-new-instance-to-a-config-sync-group} @@ -118,7 +118,7 @@ When adding a new NGINX instance that is not yet registered with NGINX One, you - From the **OS Type** list, choose the appropriate operating system for your Docker image. - After selecting the OS, run the provided command to pull the Docker image. - **Note**: Subject to availability, you can modify the `agent: ` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< relref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}). + **Note**: Subject to availability, you can modify the `agent: ` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pulling-the-image" >}}). 10. Run the provided command, which includes the data plane key, in your NGINX instance terminal to start the Docker container. @@ -130,9 +130,9 @@ When adding a new NGINX instance that is not yet registered with NGINX One, you {{}} -Data plane keys are required for registering NGINX instances with the NGINX One Console. These keys serve as secure tokens, ensuring that only authorized instances can connect and communicate with NGINX One. +Data plane keys are required for registering NGINX instances with the NGINX One Console. These keys serve as secure tokens, ensuring that only authorized instances can connect and communicate with NGINX One. -For more details on creating and managing data plane keys, see [Create and manage data plane keys]({{}}). +For more details on creating and managing data plane keys, see [Create and manage data plane keys]({{}}). {{}} @@ -212,7 +212,7 @@ After the config sync group is created, you can modify and publish the group's c 2. Select the config sync group in the list. 3. Select the **Configuration** tab to view the group's NGINX configuration. 4. To modify the group's configuration, select **Edit Configuration**. -5. Make the necessary changes to the configuration. +5. Make the necessary changes to the configuration. 6. When you're finished, select **Next**. A split view displays the changes. 7. If you're satisfied with the changes, select **Save and Publish**. @@ -235,5 +235,5 @@ Monitoring the **Config Sync Status** helps ensure that your configurations are ## See also -- [Create and manage data plane keys]({{< relref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) -- [View and edit NGINX configurations]({{< relref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}) +- [Create and manage data plane keys]({{< ref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) +- [View and edit NGINX configurations]({{< ref "/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md" >}}) diff --git a/content/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md b/content/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md index 2a4b308f7..37d4fb6f5 100644 --- a/content/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md +++ b/content/nginx-one/how-to/nginx-configs/view-edit-nginx-configurations.md @@ -14,7 +14,7 @@ product: NGINX One ## Overview -This guide explains how to add a **Instances** to your NGINX One Console. +This guide explains how to add a **Instances** to your NGINX One Console. ## Before you start @@ -34,8 +34,8 @@ To view and edit an NGINX configuration, follow these steps: 6. When you are satisfied with the changes, select **Next**. 7. Compare and verify your changes before selecting **Save and Publish** to publish the edited configuration. -Alternatively, you can select **Save Changes As**. In the window that appears, you can set up this instance as a [**Staged Configuration**]({{< relref "/nginx-one/how-to/staged-configs/_index.md" >}}). +Alternatively, you can select **Save Changes As**. In the window that appears, you can set up this instance as a [**Staged Configuration**]({{< ref "/nginx-one/how-to/staged-configs/_index.md" >}}). ## See also -- [Manage Config Sync Groups]({{< relref "/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md" >}}) +- [Manage Config Sync Groups]({{< ref "/nginx-one/how-to/config-sync-groups/manage-config-sync-groups.md" >}}) diff --git a/content/nginx-one/how-to/proxy-setup/set-up-nginx-proxy-for-nginx-one.md b/content/nginx-one/how-to/proxy-setup/set-up-nginx-proxy-for-nginx-one.md index edf54faec..974f7851c 100644 --- a/content/nginx-one/how-to/proxy-setup/set-up-nginx-proxy-for-nginx-one.md +++ b/content/nginx-one/how-to/proxy-setup/set-up-nginx-proxy-for-nginx-one.md @@ -16,8 +16,8 @@ This guide explains how to set up NGINX as a proxy for other NGINX instances to ## Before you start -- [Install NGINX Open Source or NGINX Plus]({{< relref "/nginx/admin-guide/installing-nginx/" >}}). -- [Get a Data Plane Key from NGINX One]({{< relref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}). +- [Install NGINX Open Source or NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/" >}}). +- [Get a Data Plane Key from NGINX One]({{< ref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}). --- @@ -95,7 +95,7 @@ To set up your other NGINX instances to use the proxy instance to connect to NGI For more information, refer to the following resources: -- [Installing NGINX and NGINX Plus]({{< relref "/nginx/admin-guide/installing-nginx/" >}}) -- [Create and manage data plane keys]({{< relref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) +- [Installing NGINX and NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/" >}}) +- [Create and manage data plane keys]({{< ref "/nginx-one/how-to/data-plane-keys/create-manage-data-plane-keys.md" >}}) - [NGINX Agent Installation and upgrade](https://docs.nginx.com/nginx-agent/installation-upgrade/) - [NGINX Agent Configuration](https://docs.nginx.com/nginx-agent/configuration/) \ No newline at end of file diff --git a/content/nginx-one/how-to/staged-configs/api-staged-config.md b/content/nginx-one/how-to/staged-configs/api-staged-config.md index 122b8728c..8eadfdb55 100644 --- a/content/nginx-one/how-to/staged-configs/api-staged-config.md +++ b/content/nginx-one/how-to/staged-configs/api-staged-config.md @@ -13,8 +13,8 @@ product: NGINX One You can use F5 NGINX One Console API to manage your Staged Configurations. With our API, you can: -- [Create an NGINX Staged Configuration]({{< relref "/nginx-one/api/api-reference-guide/#operation/createStagedConfig" >}}) +- [Create an NGINX Staged Configuration]({{< ref "/nginx-one/api/api-reference-guide/#operation/createStagedConfig" >}}) - The details allow you to add existing configuration files. -- [Get a list of existing Staged Configurations]({{< relref "/nginx-one/api/api-reference-guide/#operation/listStagedConfigs" >}}) +- [Get a list of existing Staged Configurations]({{< ref "/nginx-one/api/api-reference-guide/#operation/listStagedConfigs" >}}) - Be sure to record the `object_id` of your target Staged Configuration for your analysis report. -- [Get an analysis report for an existing Staged Configuration]({{< relref "/nginx-one/api/api-reference-guide/#operation/getStagedConfigReport" >}}) +- [Get an analysis report for an existing Staged Configuration]({{< ref "/nginx-one/api/api-reference-guide/#operation/getStagedConfigReport" >}}) diff --git a/content/nginx-one/rbac/rbac-api.md b/content/nginx-one/rbac/rbac-api.md index 9b6e2127b..79d17c7c7 100644 --- a/content/nginx-one/rbac/rbac-api.md +++ b/content/nginx-one/rbac/rbac-api.md @@ -7,7 +7,7 @@ product: NGINX One docs: DOCS-000 --- -Beyond the [Default roles]({{< relref "/nginx-one/rbac/roles.md" >}}) for NGINX One Console access, you can create [custom roles](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt/roles#custom-roles) with more precisely defined access permissions. +Beyond the [Default roles]({{< ref "/nginx-one/rbac/roles.md" >}}) for NGINX One Console access, you can create [custom roles](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt/roles#custom-roles) with more precisely defined access permissions. You can assign custom roles to users or service accounts. You can associate these roles with specific namespaces, to help facilitate the principle of least privilege across your tenant. For this use-case, we include a list of API groups that you can use to specify permissions for custom roles with more granular access controls to NGINX One Console APIs. diff --git a/content/nginx/admin-guide/basic-functionality/managing-configuration-files.md b/content/nginx/admin-guide/basic-functionality/managing-configuration-files.md index 24cbed237..9cea36401 100644 --- a/content/nginx/admin-guide/basic-functionality/managing-configuration-files.md +++ b/content/nginx/admin-guide/basic-functionality/managing-configuration-files.md @@ -91,6 +91,6 @@ In general, a _child_ context – one contained within another context (its _pa ## Reloading Configuration -For changes to the configuration file to take effect, it must be reloaded. You can either restart the `nginx` process or send the `reload` signal to upgrade the configuration without interrupting the processing of current requests. For details, see [Controlling NGINX Processes at Runtime]({{< relref "runtime-control.md" >}}). +For changes to the configuration file to take effect, it must be reloaded. You can either restart the `nginx` process or send the `reload` signal to upgrade the configuration without interrupting the processing of current requests. For details, see [Controlling NGINX Processes at Runtime]({{< ref "runtime-control.md" >}}). -With NGINX Plus, you can dynamically reconfigure [load balancing]({{< relref "/nginx/admin-guide/load-balancer/dynamic-configuration-api.md" >}}) across the servers in an upstream group without reloading the configuration. You can also use the NGINX Plus API and key‑value store to dynamically control access, for example [based on client IP address]({{< relref "/nginx/admin-guide/security-controls/denylisting-ip-addresses.md" >}}). +With NGINX Plus, you can dynamically reconfigure [load balancing]({{< ref "/nginx/admin-guide/load-balancer/dynamic-configuration-api.md" >}}) across the servers in an upstream group without reloading the configuration. You can also use the NGINX Plus API and key‑value store to dynamically control access, for example [based on client IP address]({{< ref "/nginx/admin-guide/security-controls/denylisting-ip-addresses.md" >}}). diff --git a/content/nginx/admin-guide/dynamic-modules/brotli.md b/content/nginx/admin-guide/dynamic-modules/brotli.md index 9e0eea7b9..29b9171b8 100644 --- a/content/nginx/admin-guide/dynamic-modules/brotli.md +++ b/content/nginx/admin-guide/dynamic-modules/brotli.md @@ -114,6 +114,6 @@ After installation you will need to enable and configure Brotli modules in NGINX - [NGINX Module for Brotli Compression Reference](https://github.com/google/ngx_brotli) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/cookie-flag.md b/content/nginx/admin-guide/dynamic-modules/cookie-flag.md index f2761770e..26d1f3636 100644 --- a/content/nginx/admin-guide/dynamic-modules/cookie-flag.md +++ b/content/nginx/admin-guide/dynamic-modules/cookie-flag.md @@ -62,6 +62,6 @@ type: - [NGINX Module Reference for Adding Cookie Flag](https://github.com/AirisX/nginx_cookie_flag_module) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md b/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md index 53785e3da..6a3a06414 100644 --- a/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md +++ b/content/nginx/admin-guide/dynamic-modules/dynamic-modules.md @@ -12,7 +12,7 @@ type: ## Overview -F5 NGINX Plus uses a modular architecture. New features and functionality can be added with software modules, which can be plugged into a running NGINX Plus instance on demand. Dynamic modules add functionality to NGINX Plus such as [geolocating users by IP address]({{< relref "geoip2.md" >}}), [resizing images]({{< relref "image-filter.md" >}}), and embedding [NGINX JavaScript njs]({{< relref "nginscript.md" >}}) or [Lua]({{< relref "lua.md" >}}) scripts into the NGINX Plus event‑processing model. Modules are created both by NGINX and third‑party developers. +F5 NGINX Plus uses a modular architecture. New features and functionality can be added with software modules, which can be plugged into a running NGINX Plus instance on demand. Dynamic modules add functionality to NGINX Plus such as [geolocating users by IP address]({{< relref "./geoip2.md" >}}), [resizing images]({{< ref "image-filter.md" >}}), and embedding [NGINX JavaScript njs]({{< ref "nginscript.md" >}}) or [Lua]({{< relref "./lua.md" >}}) scripts into the NGINX Plus event‑processing model. Modules are created both by NGINX and third‑party developers. NGINX Plus allows features to be plugged in on demand @@ -43,28 +43,28 @@ load_module modules/ngx_stream_js_module.so; For module‑specific instructions, see the list of modules in the same section of the NGINX Plus Admin Guide as this article: -- [Brotli]({{< relref "brotli.md" >}}) -- [Cookie-Flag]({{< relref "cookie-flag.md" >}}) -- [Encrypted-Session]({{< relref "encrypted-session.md" >}}) -- [FIPS Status Check]({{< relref "fips.md" >}}) -- [GeoIP]({{< relref "geoip.md" >}}) -- [GeoIP2]({{< relref "geoip2.md" >}}) -- [Headers-More]({{< relref "headers-more.md" >}}) -- [HTTP Substitutions Filter]({{< relref "http-substitutions-filter.md" >}}) -- [Image-Filter]({{< relref "image-filter.md" >}}) -- [Lua]({{< relref "lua.md" >}}) -- [njs Scripting Language]({{< relref "nginscript.md" >}}) -- [NGINX ModSecurity WAF]({{< relref "nginx-waf.md" >}}) -- [NGINX Developer Kit]({{< relref "ndk.md" >}}) -- [OpenTelemetry]({{< relref "opentelemetry.md" >}}) -- [OpenTracing]({{< relref "opentracing.md" >}}) -- [Phusion Passenger Open Source]({{< relref "passenger-open-source.md" >}}) -- [Perl]({{< relref "perl.md" >}}) -- [Prometheus-njs]({{< relref "prometheus-njs.md" >}}) -- [RTMP]({{< relref "rtmp.md" >}}) -- [Set-Misc]({{< relref "set-misc.md" >}}) -- [SPNEGO]({{< relref "spnego.md" >}}) -- [XSLT]({{< relref "xslt.md" >}}) +- [Brotli]({{< ref "brotli.md" >}}) +- [Cookie-Flag]({{< relref "./cookie-flag.md" >}}) +- [Encrypted-Session]({{< ref "encrypted-session.md" >}}) +- [FIPS Status Check]({{< relref "./fips.md" >}}) +- [GeoIP]({{< relref "./geoip.md" >}}) +- [GeoIP2]({{< relref "./geoip2.md" >}}) +- [Headers-More]({{< ref "headers-more.md" >}}) +- [HTTP Substitutions Filter]({{< ref "http-substitutions-filter.md" >}}) +- [Image-Filter]({{< ref "image-filter.md" >}}) +- [Lua]({{< relref "./lua.md" >}}) +- [njs Scripting Language]({{< ref "nginscript.md" >}}) +- [NGINX ModSecurity WAF]({{< ref "nginx-waf.md" >}}) +- [NGINX Developer Kit]({{< ref "ndk.md" >}}) +- [OpenTelemetry]({{< ref "opentelemetry.md" >}}) +- [OpenTracing]({{< ref "opentracing.md" >}}) +- [Phusion Passenger Open Source]({{< ref "passenger-open-source.md" >}}) +- [Perl]({{< ref "perl.md" >}}) +- [Prometheus-njs]({{< ref "prometheus-njs.md" >}}) +- [RTMP]({{< ref "rtmp.md" >}}) +- [Set-Misc]({{< relref "./set-misc.md" >}}) +- [SPNEGO]({{< ref "spnego.md" >}}) +- [XSLT]({{< relref "./xslt.md" >}}) @@ -121,7 +121,7 @@ To compile your own dynamic modules, please see our [blog](https://www.f5.com/co ## Uninstalling a Dynamic Module -To uninstall a dynamic module, please follow the [Uninstalling a dynamic module]({{< relref "uninstall.md" >}}) article. +To uninstall a dynamic module, please follow the [Uninstalling a dynamic module]({{< ref "uninstall.md" >}}) article. diff --git a/content/nginx/admin-guide/dynamic-modules/encrypted-session.md b/content/nginx/admin-guide/dynamic-modules/encrypted-session.md index 04f007d70..ec7710be9 100644 --- a/content/nginx/admin-guide/dynamic-modules/encrypted-session.md +++ b/content/nginx/admin-guide/dynamic-modules/encrypted-session.md @@ -16,7 +16,7 @@ The Encrypted Session dynamic module provides encryption and decryption support 1. Check the [Technical Specifications]({{< relref "../../technical-specs.md" >}}) page to verify that the module is supported by your operating system. -2. Prior to installing the module, verify that the [NDK]({{< relref "ndk.md" >}}) module is already installed. +2. Prior to installing the module, verify that the [NDK]({{< ref "ndk.md" >}}) module is already installed. @@ -88,6 +88,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [NGINX encrypted-session-nginx-module Module Reference](https://github.com/openresty/encrypted-session-nginx-module) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/fips.md b/content/nginx/admin-guide/dynamic-modules/fips.md index ff7a52260..55dad8716 100644 --- a/content/nginx/admin-guide/dynamic-modules/fips.md +++ b/content/nginx/admin-guide/dynamic-modules/fips.md @@ -83,6 +83,6 @@ After installation you will need to enable and configure the module in NGINX Plu - [NGINX FIPS Status Check Module Reference](https://github.com/ogarrett/nginx-fips-check-module) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/geoip.md b/content/nginx/admin-guide/dynamic-modules/geoip.md index 3ec6a924b..8825674a4 100644 --- a/content/nginx/admin-guide/dynamic-modules/geoip.md +++ b/content/nginx/admin-guide/dynamic-modules/geoip.md @@ -9,7 +9,7 @@ type: - how-to --- -{{< note >}} MaxMind GeoLite Legacy databases are currently [discontinued](https://blog.maxmind.com/2018/01/discontinuation-of-the-geolite-legacy-databases), MaxMind GeoIP2 or Geolite2 databases and F5 NGINX Plus [GeoIP2 module]({{< relref "geoip2.md" >}}) should be used instead. {{< /note >}} +{{< note >}} MaxMind GeoLite Legacy databases are currently [discontinued](https://blog.maxmind.com/2018/01/discontinuation-of-the-geolite-legacy-databases), MaxMind GeoIP2 or Geolite2 databases and F5 NGINX Plus [GeoIP2 module]({{< relref "./geoip2.md" >}}) should be used instead. {{< /note >}} @@ -74,7 +74,7 @@ After installation you will need to enable and configure the module in NGINX Plu ## More Info -- [GeoIP2 Dynamic Module Installation Instructions]({{< relref "geoip2.md" >}}) +- [GeoIP2 Dynamic Module Installation Instructions]({{< relref "./geoip2.md" >}}) - [Restricting Access by Geographical Location]({{< relref "../security-controls/controlling-access-by-geoip.md" >}}) @@ -82,6 +82,6 @@ After installation you will need to enable and configure the module in NGINX Plu - [ngx_stream_geoip_module Module Reference](https://nginx.org/en/docs/stream/ngx_stream_geoip_module.html) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/geoip2.md b/content/nginx/admin-guide/dynamic-modules/geoip2.md index 34b2f38da..6aa7e31da 100644 --- a/content/nginx/admin-guide/dynamic-modules/geoip2.md +++ b/content/nginx/admin-guide/dynamic-modules/geoip2.md @@ -89,6 +89,6 @@ After installation you will need to enable and configure the module in NGINX Plu - [MaxMind Geolite2 Free Downloadable Databases](https://dev.maxmind.com/geoip/geoip2/geolite2/) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/headers-more.md b/content/nginx/admin-guide/dynamic-modules/headers-more.md index 9f2f5b0fb..51d34ea05 100644 --- a/content/nginx/admin-guide/dynamic-modules/headers-more.md +++ b/content/nginx/admin-guide/dynamic-modules/headers-more.md @@ -77,6 +77,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [NGINX ngx_headers_more Module Reference](https://github.com/openresty/headers-more-nginx-module) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md b/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md index 48f7dc557..e14d55948 100644 --- a/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md +++ b/content/nginx/admin-guide/dynamic-modules/http-substitutions-filter.md @@ -71,6 +71,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [NGINX Substitution Filter Module Reference](https://github.com/yaoweibin/ngx_http_substitutions_filter_module) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/image-filter.md b/content/nginx/admin-guide/dynamic-modules/image-filter.md index a11f49f36..ef058c6c0 100644 --- a/content/nginx/admin-guide/dynamic-modules/image-filter.md +++ b/content/nginx/admin-guide/dynamic-modules/image-filter.md @@ -78,6 +78,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [NGINX Image Filter Module Reference](https://nginx.org/en/docs/http/ngx_http_image_filter_module.html) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/lua.md b/content/nginx/admin-guide/dynamic-modules/lua.md index 133da9267..42cc5ab63 100644 --- a/content/nginx/admin-guide/dynamic-modules/lua.md +++ b/content/nginx/admin-guide/dynamic-modules/lua.md @@ -15,7 +15,7 @@ Integrate Lua co-routines into the NGINX event-processing model with the communi 1. Check the [Technical Specifications]({{< relref "../../technical-specs.md" >}}) page to verify that the module is supported by your operating system. -2. Prior to installing the module, verify that the [NGINX Developer Kit (NDK)]({{< relref "nginx/admin-guide/dynamic-modules/ndk.md" >}}) module is already installed. +2. Prior to installing the module, verify that the [NGINX Developer Kit (NDK)]({{< ref "nginx/admin-guide/dynamic-modules/ndk.md" >}}) module is already installed. @@ -94,6 +94,6 @@ After installation, enable and configure the modules in NGINX Plus configuration - [The NDK Module Reference](https://github.com/vision5/ngx_devel_kit) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/ndk.md b/content/nginx/admin-guide/dynamic-modules/ndk.md index 31d9f8ef8..5431006fd 100644 --- a/content/nginx/admin-guide/dynamic-modules/ndk.md +++ b/content/nginx/admin-guide/dynamic-modules/ndk.md @@ -10,7 +10,7 @@ type: The NGINX Developer Kit (NDK) module makes it easier for module developers to develop NGINX modules. -The NDK module is also a prerequisite for [Encrypted Session]({{< relref "encrypted-session.md" >}}), [Lua]({{< relref "lua.md" >}}), and [Set-Misc]({{< relref "set-misc.md" >}}) modules. +The NDK module is also a prerequisite for [Encrypted Session]({{< ref "encrypted-session.md" >}}), [Lua]({{< relref "./lua.md" >}}), and [Set-Misc]({{< relref "./set-misc.md" >}}) modules. @@ -82,6 +82,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [NDK Module Reference](https://github.com/vision5/ngx_devel_kit) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/nginscript.md b/content/nginx/admin-guide/dynamic-modules/nginscript.md index fc6d71046..67393f1e3 100644 --- a/content/nginx/admin-guide/dynamic-modules/nginscript.md +++ b/content/nginx/admin-guide/dynamic-modules/nginscript.md @@ -81,6 +81,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [njs Scripting Language Reference and Examples](https://nginx.org/en/docs/njs/) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/nginx-waf.md b/content/nginx/admin-guide/dynamic-modules/nginx-waf.md index da056d42b..59e625696 100644 --- a/content/nginx/admin-guide/dynamic-modules/nginx-waf.md +++ b/content/nginx/admin-guide/dynamic-modules/nginx-waf.md @@ -92,4 +92,4 @@ After installation you will need to enable and configure the module in NGINX Plu - [Using the OWASP CRS with the NGINX ModSecurity WAF](https://docs.nginx.com/nginx-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs/) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/opentelemetry.md b/content/nginx/admin-guide/dynamic-modules/opentelemetry.md index 0ddab8dca..c53adb9c3 100644 --- a/content/nginx/admin-guide/dynamic-modules/opentelemetry.md +++ b/content/nginx/admin-guide/dynamic-modules/opentelemetry.md @@ -308,6 +308,6 @@ http { - [NGINX OpenTelemetry module on GitHub](https://github.com/nginxinc/nginx-otel) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/opentracing.md b/content/nginx/admin-guide/dynamic-modules/opentracing.md index 9416804c4..dd89c65e1 100644 --- a/content/nginx/admin-guide/dynamic-modules/opentracing.md +++ b/content/nginx/admin-guide/dynamic-modules/opentracing.md @@ -12,7 +12,7 @@ type: - how-to --- -{{< note >}} The module is deprecated since F5 NGINX Plus Release 32. The [OpenTelemetry]({{< relref "opentelemetry.md" >}}) module is available since NGINX Plus Release 29 that incorporates the features of the OpenTracing module.{{< /note >}} +{{< note >}} The module is deprecated since F5 NGINX Plus Release 32. The [OpenTelemetry]({{< ref "opentelemetry.md" >}}) module is available since NGINX Plus Release 29 that incorporates the features of the OpenTracing module.{{< /note >}} @@ -89,6 +89,6 @@ After installation you will need to enable and configure the module in NGINX Plu - [NGINX plugin for OpenTracing Reference](https://github.com/opentracing-contrib/nginx-opentracing) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md b/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md index 35fe17e62..a3390e95d 100644 --- a/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md +++ b/content/nginx/admin-guide/dynamic-modules/passenger-open-source.md @@ -80,6 +80,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [Passenger Documentation](https://www.phusionpassenger.com/library/install/nginx/) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/perl.md b/content/nginx/admin-guide/dynamic-modules/perl.md index a5cdc285d..2c71de798 100644 --- a/content/nginx/admin-guide/dynamic-modules/perl.md +++ b/content/nginx/admin-guide/dynamic-modules/perl.md @@ -80,6 +80,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [NGINX Perl Module Reference](https://nginx.org/en/docs/http/ngx_http_perl_module.html) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md b/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md index 301927052..ce3d2a3d3 100644 --- a/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md +++ b/content/nginx/admin-guide/dynamic-modules/prometheus-njs.md @@ -98,7 +98,7 @@ Install the `nginx-plus-module-prometheus` module. pkg install nginx-plus-module-prometheus ``` -{{< note >}} The [`nginx-plus-module-njs`]({{< relref "nginscript.md" >}}) module will also be installed together with the module. {{< /note >}} +{{< note >}} The [`nginx-plus-module-njs`]({{< ref "nginscript.md" >}}) module will also be installed together with the module. {{< /note >}} @@ -106,7 +106,7 @@ Install the `nginx-plus-module-prometheus` module. After module installation, perform the following steps in NGINX Plus configuration file (**nginx.conf**): -1. Enable the [`nginx-plus-module-njs`]({{< relref "nginscript.md" >}}) module in the top‑level context: +1. Enable the [`nginx-plus-module-njs`]({{< ref "nginscript.md" >}}) module in the top‑level context: ```nginx load_module modules/ngx_http_js_module.so; @@ -370,6 +370,6 @@ stream { ## More Info -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/rtmp.md b/content/nginx/admin-guide/dynamic-modules/rtmp.md index 8b0dc7c97..b54ee5c9b 100644 --- a/content/nginx/admin-guide/dynamic-modules/rtmp.md +++ b/content/nginx/admin-guide/dynamic-modules/rtmp.md @@ -79,6 +79,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [NGINX RTMP Module Reference](https://github.com/arut/nginx-rtmp-module) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/set-misc.md b/content/nginx/admin-guide/dynamic-modules/set-misc.md index a1f08b188..1ffe56f77 100644 --- a/content/nginx/admin-guide/dynamic-modules/set-misc.md +++ b/content/nginx/admin-guide/dynamic-modules/set-misc.md @@ -15,7 +15,7 @@ type: 1. Check the [Technical Specifications]({{< relref "../../technical-specs.md" >}}) page to verify that the module is supported by your operating system. -2. Prior to installing the module, verify that the [NDK]({{< relref "ndk.md" >}}) module is already installed. +2. Prior to installing the module, verify that the [NDK]({{< ref "ndk.md" >}}) module is already installed. @@ -89,6 +89,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [NGINX `ngx_set_misc` Module Reference](https://github.com/openresty/set-misc-nginx-module) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/spnego.md b/content/nginx/admin-guide/dynamic-modules/spnego.md index b6876b8e7..c3bdd4538 100644 --- a/content/nginx/admin-guide/dynamic-modules/spnego.md +++ b/content/nginx/admin-guide/dynamic-modules/spnego.md @@ -79,7 +79,7 @@ After installation you will need to enable and configure the module in F5 NGINX - [NGINX Module for HTTP SPNEGO Auth Reference](https://github.com/stnoonan/spnego-http-auth-nginx-module) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/uninstall.md b/content/nginx/admin-guide/dynamic-modules/uninstall.md index f85370339..761e61ba6 100644 --- a/content/nginx/admin-guide/dynamic-modules/uninstall.md +++ b/content/nginx/admin-guide/dynamic-modules/uninstall.md @@ -66,7 +66,7 @@ After uninstalling the package, you will need to disable the module in F5 NGINX - [NGINX Module Reference](https://nginx.org/en/docs/) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/dynamic-modules/xslt.md b/content/nginx/admin-guide/dynamic-modules/xslt.md index e12f93c02..e6c94511a 100644 --- a/content/nginx/admin-guide/dynamic-modules/xslt.md +++ b/content/nginx/admin-guide/dynamic-modules/xslt.md @@ -79,6 +79,6 @@ After installation you will need to enable and configure the module in F5 NGINX - [NGINX ngx_http_xslt_module Reference](https://nginx.org/en/docs/http/ngx_http_xslt_module.html) -- [NGINX Dynamic Modules]({{< relref "dynamic-modules.md" >}}) +- [NGINX Dynamic Modules]({{< ref "dynamic-modules.md" >}}) - [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}) diff --git a/content/nginx/admin-guide/high-availability/ha-keepalived-nodes.md b/content/nginx/admin-guide/high-availability/ha-keepalived-nodes.md index b80a3d3cc..56ac9fb63 100644 --- a/content/nginx/admin-guide/high-availability/ha-keepalived-nodes.md +++ b/content/nginx/admin-guide/high-availability/ha-keepalived-nodes.md @@ -13,7 +13,7 @@ type: ## Introduction -F5 NGINX Plus utilizes [keepalived](http://www.keepalived.org/) to provide high availability (HA) in a standard active‑passive fashion. This provides failover redundancy in the event of a problem on the primary NGINX Plus node. We can extend this functionality with additional nodes and changes to the `keepalived` configuration, providing additional redundancy and scalability options. This guide assumes that you have already configured NGINX Plus in an active‑passive implementation with [the NGINX HA solution]({{< relref "ha-keepalived.md" >}}). +F5 NGINX Plus utilizes [keepalived](http://www.keepalived.org/) to provide high availability (HA) in a standard active‑passive fashion. This provides failover redundancy in the event of a problem on the primary NGINX Plus node. We can extend this functionality with additional nodes and changes to the `keepalived` configuration, providing additional redundancy and scalability options. This guide assumes that you have already configured NGINX Plus in an active‑passive implementation with [the NGINX HA solution]({{< relref "./ha-keepalived.md" >}}). **NOTE:** In a public cloud deployment we recommend using a Layer 4 or TCP load‑balancing service offered by the cloud provider to distribute traffic to NGINX Plus for active‑active functionality. @@ -94,7 +94,7 @@ To configure an additional passive node for your existing NGINX Plus active‑p 4. Restart `keepalived` on all nodes. 5. Test by stopping NGINX Plus on the first two nodes. -All NGINX Plus nodes must have the identical configuration and SSL certificates. For information about synchronizing NGINX Plus configuration, see [Synchronizing NGINX Configuration in a Cluster]({{< relref "configuration-sharing.md" >}}). +All NGINX Plus nodes must have the identical configuration and SSL certificates. For information about synchronizing NGINX Plus configuration, see [Synchronizing NGINX Configuration in a Cluster]({{< ref "configuration-sharing.md" >}}). ## Configuring keepalived for Active-Active HA diff --git a/content/nginx/admin-guide/high-availability/ha-keepalived.md b/content/nginx/admin-guide/high-availability/ha-keepalived.md index 1a1f3c1ec..af3909706 100644 --- a/content/nginx/admin-guide/high-availability/ha-keepalived.md +++ b/content/nginx/admin-guide/high-availability/ha-keepalived.md @@ -11,7 +11,7 @@ type: This article explains how to configure high availability of NGINX Plus instances in on‑premises deployment with a solution based on [keepalived](https://www.keepalived.org/). -> **Note:** This solution is designed to work in environments where IP addresses can be controlled through standard operating system calls, and often does not work in cloud environments where IP addresses are controlled through interfacing with the cloud infrastructure. For information about making NGINX Plus highly available in cloud environments, see the [Deployment Guides]({{< relref "/nginx/deployment-guides/_index.md" >}}). +> **Note:** This solution is designed to work in environments where IP addresses can be controlled through standard operating system calls, and often does not work in cloud environments where IP addresses are controlled through interfacing with the cloud infrastructure. For information about making NGINX Plus highly available in cloud environments, see the [Deployment Guides]({{< ref "/nginx/deployment-guides/_index.md" >}}). ## High Availability Support Based on keepalived @@ -335,7 +335,7 @@ Several fields in the output are useful for debugging: ## Keeping F5 NGINX Plus Configuration Files in Sync -The NGINX Plus configuration files on the nodes must both define the services that are being made highly available. For information about synchronizing NGINX Plus configuration, see [Synchronizing NGINX Configuration in a Cluster]({{< relref "configuration-sharing.md" >}}). +The NGINX Plus configuration files on the nodes must both define the services that are being made highly available. For information about synchronizing NGINX Plus configuration, see [Synchronizing NGINX Configuration in a Cluster]({{< ref "configuration-sharing.md" >}}). diff --git a/content/nginx/admin-guide/high-availability/zone_sync.md b/content/nginx/admin-guide/high-availability/zone_sync.md index 1dbf43c50..bd224a616 100644 --- a/content/nginx/admin-guide/high-availability/zone_sync.md +++ b/content/nginx/admin-guide/high-availability/zone_sync.md @@ -314,7 +314,7 @@ server { } ``` -See [Dynamic Denylisting of IP Addresses]({{< relref "/nginx/admin-guide/security-controls/denylisting-ip-addresses.md" >}}) for information how to configure and manage the key-value storage. +See [Dynamic Denylisting of IP Addresses]({{< ref "/nginx/admin-guide/security-controls/denylisting-ip-addresses.md" >}}) for information how to configure and manage the key-value storage. @@ -347,7 +347,7 @@ In order to get access to API metrics, you will need to configure the API: } ``` -2. It is highly recommended to [restrict access]({{< relref "/nginx/admin-guide/security-controls/controlling-access-proxied-http.md" >}}) to this location, for example by allowing access only from localhost (`127.0.0.1`), and by restricting access to `PATCH`, `POST`, and `DELETE` methods to some users with HTTP basic authentication: +2. It is highly recommended to [restrict access]({{< ref "/nginx/admin-guide/security-controls/controlling-access-proxied-http.md" >}}) to this location, for example by allowing access only from localhost (`127.0.0.1`), and by restricting access to `PATCH`, `POST`, and `DELETE` methods to some users with HTTP basic authentication: ```nginx # ... diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md index c948b9f45..5ad9f0a1d 100644 --- a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md +++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md @@ -42,6 +42,6 @@ See [NGINX Plus on the AWS Cloud Quick Start](https://aws.amazon.com/quickstart ## What If I Need Help? -If you encounter any problems with NGINX Plus configuration, documentation is available at [nginx.org](https://nginx.org/en/docs/) and in the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/installing-nginx/" >}}). +If you encounter any problems with NGINX Plus configuration, documentation is available at [nginx.org](https://nginx.org/en/docs/) and in the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/installing-nginx/" >}}). Customers who purchase an NGINX Plus AMI at the AWS Marketplace are eligible for the AWS support provided by the NGINX, Inc. engineering team. To activate support, submit the [AMI Support Activation](https://www.nginx.com/ami-support-activation/) form (you need your AWS account number). When you request support, we’ll ask you to provide the AWS account number that you registered, along with the IDs of your EC2 instances in some cases. diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-google-cloud-platform.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-google-cloud-platform.md index 96bd1221f..c6a7a066a 100644 --- a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-google-cloud-platform.md +++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-google-cloud-platform.md @@ -47,7 +47,7 @@ You can also check the status of the NGINX Plus server by logging into the VM a ## What If I Need Help? -If you encounter any problems with NGINX Plus configuration, documentation is available at [nginx.org](https://nginx.org/en/docs/) and in the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/installing-nginx/" >}}). +If you encounter any problems with NGINX Plus configuration, documentation is available at [nginx.org](https://nginx.org/en/docs/) and in the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/installing-nginx/" >}}). Customers who purchase an NGINX Plus VM image on the Google Cloud Platform are eligible for the Google Cloud Platform VM support provided by the NGINX, Inc. engineering team. To activate support, submit the [Google Cloud Platform Support Activation](https://www.nginx.com/gcp-support-activation/) form. diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-microsoft-azure.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-microsoft-azure.md index 1496e9791..b4b21afdd 100644 --- a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-microsoft-azure.md +++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-microsoft-azure.md @@ -32,6 +32,6 @@ To quickly set up an NGINX Plus environment on Microsoft Azure: ## What If I Need Help? -If you encounter any problems with NGINX Plus configuration, documentation is available at [nginx.org](https://nginx.org/en/docs/) and in the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/installing-nginx/" >}}). +If you encounter any problems with NGINX Plus configuration, documentation is available at [nginx.org](https://nginx.org/en/docs/) and in the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/installing-nginx/" >}}). Customers who purchase an NGINX Plus VM image at the Azure Marketplace are eligible for the Azure VM support provided by the NGINX, Inc. engineering team. To activate support, submit the [Azure support activation](https://www.nginx.com/azure-support-activation/) form (you need your Azure subscription ID). When you request support, we’ll ask you to provide the Azure subscription ID that you registered, along with the deployment IDs of your Azure virtual machines in some cases. diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus.md index d12205f85..8b5d30c99 100644 --- a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus.md +++ b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus.md @@ -15,13 +15,13 @@ This article explains how to install NGINX Plus on different operating systems, - An NGINX Plus subscription (purchased or trial) - Credentials to the [MyF5 Customer Portal](https://account.f5.com/myf5), provided by email from F5, Inc. -- A [supported operating system]({{< relref "nginx/technical-specs.md" >}}) +- A [supported operating system]({{< ref "nginx/technical-specs.md" >}}) - `root` privilege ## Install NGINX Plus on Amazon Linux 2023 {#install_amazon2023} 1. {{< include "nginx-plus/install/check-tech-specs.md" >}} - + 1. {{< include "nginx-plus/install/back-up-config-and-logs.md" >}} 1. {{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}} @@ -81,7 +81,7 @@ This article explains how to install NGINX Plus on different operating systems, ## Install NGINX Plus on RHEL 7.4+, CentOS 7.4+, and Oracle Linux 7.4+ {#install_rhel_centos} {{< call-out "important" "Deprecation notice" "" >}} -CentOS 7.4, RHEL 7.4, and Oracle Linux 7.4 are deprecated as of NGINX Plus Release 32 (R32) and are not supported in Release 33 (R33) or later. For the list of supported distributions, refer to the [NGINX Plus Tech Specs]({{< relref "nginx/technical-specs.md" >}}). +CentOS 7.4, RHEL 7.4, and Oracle Linux 7.4 are deprecated as of NGINX Plus Release 32 (R32) and are not supported in Release 33 (R33) or later. For the list of supported distributions, refer to the [NGINX Plus Tech Specs]({{< ref "nginx/technical-specs.md" >}}). {{}} 1. {{< include "nginx-plus/install/back-up-config-and-logs.md" >}} @@ -158,7 +158,7 @@ CentOS 7.4, RHEL 7.4, and Oracle Linux 7.4 are deprecated as of NGINX Plus Relea ## Install NGINX Plus on RHEL 9.0+, Oracle Linux 9, AlmaLinux 9, Rocky Linux 9 {#install_rhel} 1. {{< include "nginx-plus/install/check-tech-specs.md" >}} - + 1. {{< include "nginx-plus/install/back-up-config-and-logs.md" >}} 1. {{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}} @@ -197,7 +197,7 @@ CentOS 7.4, RHEL 7.4, and Oracle Linux 7.4 are deprecated as of NGINX Plus Relea NGINX Plus can be installed on the following versions of Debian or Ubuntu: 1. {{< include "nginx-plus/install/check-tech-specs.md" >}} - + 1. {{< include "nginx-plus/install/back-up-config-and-logs.md" >}} 1. {{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}} @@ -281,7 +281,7 @@ NGINX Plus can be installed on the following versions of Debian or Ubuntu: ## Install NGINX Plus on FreeBSD {#install_freebsd} 1. {{< include "nginx-plus/install/check-tech-specs.md" >}} - + 1. {{< include "nginx-plus/install/back-up-config-and-logs.md" >}} 1. {{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}} @@ -332,7 +332,7 @@ NGINX Plus can be installed on the following versions of Debian or Ubuntu: ## Install NGINX Plus on SUSE Linux Enterprise Server {#install_suse} 1. {{< include "nginx-plus/install/check-tech-specs.md" >}} - + 1. {{< include "nginx-plus/install/back-up-config-and-logs.md" >}} 1. {{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}} @@ -389,7 +389,7 @@ NGINX Plus can be installed on the following versions of Debian or Ubuntu: ## Install NGINX Plus on Alpine Linux {#install_alpine} 1. {{< include "nginx-plus/install/check-tech-specs.md" >}} - + 1. {{< include "nginx-plus/install/back-up-config-and-logs.md" >}} 1. {{< include "licensing-and-reporting/download-jwt-crt-from-myf5.md" >}} @@ -434,29 +434,29 @@ NGINX Plus can be installed on the following versions of Debian or Ubuntu: NGINX Plus functionality can be extended with dynamically loadable modules that are not included in the prebuilt packages: - NGINX-authored dynamic modules – Modules developed and maintained by F5 NGINX. These modules can be installed directly from the official repository: - - [GeoIP]({{< relref "nginx/admin-guide/dynamic-modules/geoip.md" >}}) - - [Image-Filter]({{< relref "nginx/admin-guide/dynamic-modules/image-filter.md" >}}) - - [njs Scripting Language]({{< relref "nginx/admin-guide/dynamic-modules/nginscript.md" >}}) - - [OTel]({{< relref "nginx/admin-guide/dynamic-modules/opentelemetry.md" >}}) - - [Perl]({{< relref "nginx/admin-guide/dynamic-modules/perl.md" >}}) - - [XSLT]({{< relref "nginx/admin-guide/dynamic-modules/xslt.md" >}}) + - [GeoIP]({{< ref "nginx/admin-guide/dynamic-modules/geoip.md" >}}) + - [Image-Filter]({{< ref "nginx/admin-guide/dynamic-modules/image-filter.md" >}}) + - [njs Scripting Language]({{< ref "nginx/admin-guide/dynamic-modules/nginscript.md" >}}) + - [OTel]({{< ref "nginx/admin-guide/dynamic-modules/opentelemetry.md" >}}) + - [Perl]({{< ref "nginx/admin-guide/dynamic-modules/perl.md" >}}) + - [XSLT]({{< ref "nginx/admin-guide/dynamic-modules/xslt.md" >}}) - NGINX-certified community dynamic modules – Popular third‑party modules tested and distributed by F5 NGINX, with installation and basic configuration support provided. These modules are also available directly from the official repository: - - [Brotli]({{< relref "nginx/admin-guide/dynamic-modules/brotli.md" >}}) - - [Encrypted-Session]({{< relref "nginx/admin-guide/dynamic-modules/encrypted-session.md" >}}) - - [FIPS Status Check]({{< relref "nginx/admin-guide/dynamic-modules/fips.md" >}}) - - [GeoIP2]({{< relref "nginx/admin-guide/dynamic-modules/geoip2.md" >}}) - - [Headers-More]({{< relref "nginx/admin-guide/dynamic-modules/headers-more.md" >}}) - - [HTTP Substitutions Filter]({{< relref "nginx/admin-guide/dynamic-modules/http-substitutions-filter.md" >}}) - - [Lua]({{< relref "nginx/admin-guide/dynamic-modules/lua.md" >}}) - - [NGINX Developer Kit]({{< relref "nginx/admin-guide/dynamic-modules/ndk.md" >}}) - - [OpenTelemetry]({{< relref "nginx/admin-guide/dynamic-modules/opentelemetry.md" >}}) - - [OpenTracing]({{< relref "nginx/admin-guide/dynamic-modules/opentracing.md" >}}) - - [Phusion Passenger]({{< relref "nginx/admin-guide/dynamic-modules/passenger-open-source.md" >}}) - - [Prometheus-njs]({{< relref "nginx/admin-guide/dynamic-modules/prometheus-njs.md" >}}) - - [RTMP]({{< relref "nginx/admin-guide/dynamic-modules/rtmp.md" >}}) - - [Set-Misc]({{< relref "nginx/admin-guide/dynamic-modules/set-misc.md" >}}) - - [SPNEGO]({{< relref "nginx/admin-guide/dynamic-modules/spnego.md" >}}) + - [Brotli]({{< ref "nginx/admin-guide/dynamic-modules/brotli.md" >}}) + - [Encrypted-Session]({{< ref "nginx/admin-guide/dynamic-modules/encrypted-session.md" >}}) + - [FIPS Status Check]({{< ref "nginx/admin-guide/dynamic-modules/fips.md" >}}) + - [GeoIP2]({{< ref "nginx/admin-guide/dynamic-modules/geoip2.md" >}}) + - [Headers-More]({{< ref "nginx/admin-guide/dynamic-modules/headers-more.md" >}}) + - [HTTP Substitutions Filter]({{< ref "nginx/admin-guide/dynamic-modules/http-substitutions-filter.md" >}}) + - [Lua]({{< ref "nginx/admin-guide/dynamic-modules/lua.md" >}}) + - [NGINX Developer Kit]({{< ref "nginx/admin-guide/dynamic-modules/ndk.md" >}}) + - [OpenTelemetry]({{< ref "nginx/admin-guide/dynamic-modules/opentelemetry.md" >}}) + - [OpenTracing]({{< ref "nginx/admin-guide/dynamic-modules/opentracing.md" >}}) + - [Phusion Passenger]({{< ref "nginx/admin-guide/dynamic-modules/passenger-open-source.md" >}}) + - [Prometheus-njs]({{< ref "nginx/admin-guide/dynamic-modules/prometheus-njs.md" >}}) + - [RTMP]({{< ref "nginx/admin-guide/dynamic-modules/rtmp.md" >}}) + - [Set-Misc]({{< ref "nginx/admin-guide/dynamic-modules/set-misc.md" >}}) + - [SPNEGO]({{< ref "nginx/admin-guide/dynamic-modules/spnego.md" >}}) - Community dynamic modules – Modules written and distributed by third‑party members of the NGINX community. To use these modules, download the source code from the author's repository and [compile it against the NGINX Open Source version](#install_modules_oss) corresponding to your NGINX Plus version. These modules are not available in the official repository but can be found in different community resources such as [awesome-nginx GitHub project](https://github.com/agile6v/awesome-nginx#third-party-modules). @@ -506,9 +506,9 @@ NGINX‑authored and NGINX‑certified dynamic modules can be installed directly sudo apk add ``` -See [NGINX Plus Dynamic Modules]({{< relref "nginx/admin-guide/dynamic-modules/dynamic-modules.md" >}}) for detailed installation instructions for each dynamic module. +See [NGINX Plus Dynamic Modules]({{< ref "nginx/admin-guide/dynamic-modules/dynamic-modules.md" >}}) for detailed installation instructions for each dynamic module. -Note that some modules may not be available for certain OS versions because of operating system limitations. For details and descriptions of the modules, see the [NGINX Plus Technical Specifications]({{< relref "nginx/technical-specs.md" >}}). +Note that some modules may not be available for certain OS versions because of operating system limitations. For details and descriptions of the modules, see the [NGINX Plus Technical Specifications]({{< ref "nginx/technical-specs.md" >}}). After installing the module, you need to enable it in the NGINX Plus configuration file. For more information, see [Enabling Dynamic Modules](#enable_dynamic). @@ -544,7 +544,7 @@ For a community dynamic module to work with NGINX Plus, it must be compiled alo 1. Obtain NGINX Open Source. - - Identify the NGINX Open Source version that corresponds to your version of NGINX Plus. See [NGINX Plus Releases]({{< relref "nginx/releases.md" >}}). + - Identify the NGINX Open Source version that corresponds to your version of NGINX Plus. See [NGINX Plus Releases]({{< ref "nginx/releases.md" >}}). - Download the sources for the appropriate NGINX Open Source mainline version, in this case 1.27.2: @@ -696,7 +696,7 @@ With this script, you can also upgrade an existing unprivileged installation of ## NGINX Plus Offline Installation {#offline_install} -This section explains how to install NGINX Plus and its [dynamic modules]({{< relref "/nginx/admin-guide/dynamic-modules/dynamic-modules.md" >}}) on a server with limited or no Internet access. +This section explains how to install NGINX Plus and its [dynamic modules]({{< ref "/nginx/admin-guide/dynamic-modules/dynamic-modules.md" >}}) on a server with limited or no Internet access. To install NGINX Plus offline, you will need a machine connected to the Internet to get the NGINX Plus package, JWT license, SSL certificate and key. Then your can transfer these files to the target server for offline installation. @@ -800,13 +800,13 @@ To upgrade your NGINX Plus installation to the newest version: 1. Create the **/etc/nginx/** directory for Linux or the **/usr/local/etc/nginx** directory for FreeBSD: - **For Linux**: - + ```shell sudo mkdir -p /etc/nginx ``` - **For FreeBSD**: - + ```shell sudo mkdir -p /usr/local/etc/nginx ``` @@ -816,7 +816,7 @@ To upgrade your NGINX Plus installation to the newest version: 1. After downloading the JWT file, copy it to the **/etc/nginx/** directory for Linux, or to the **/usr/local/etc/nginx** directory for FreeBSD, and make sure it's named **license.jwt**: - **For Linux**: - + ```shell sudo cp .jwt /etc/nginx/license.jwt ``` @@ -903,4 +903,4 @@ The upgrade procedure depends on how the module was supplied and installed. ### Install NGINX App Protect -To install NGINX App Protect, follow the steps in the [NGINX App Protect installation guide]({{< relref "nap-waf/v5/admin-guide/install.md" >}}). +To install NGINX App Protect, follow the steps in the [NGINX App Protect installation guide]({{< ref "nap-waf/v5/admin-guide/install.md" >}}). diff --git a/content/nginx/admin-guide/load-balancer/dynamic-configuration-api.md b/content/nginx/admin-guide/load-balancer/dynamic-configuration-api.md index 3d068b44f..ad327a68b 100644 --- a/content/nginx/admin-guide/load-balancer/dynamic-configuration-api.md +++ b/content/nginx/admin-guide/load-balancer/dynamic-configuration-api.md @@ -30,8 +30,8 @@ These changes are made with the NGINX Plus REST API interface with API commands. Prior to using the dynamic configuration feature, make sure that you have the following environment: 1. NGINX Plus R13 or later -2. You have created upstream groups of application or web servers, as described in [HTTP Load Balancing]({{< relref "http-load-balancer.md" >}}) and [TCP/UDP Load Balancing]({{< relref "tcp-udp-load-balancer.md" >}}) -3. Upstream server groups reside in the shared memory zone, as described in [Sharing Data with Multiple Worker Processes]({{< relref "http-load-balancer.md" >}}) +2. You have created upstream groups of application or web servers, as described in [HTTP Load Balancing]({{< ref "http-load-balancer.md" >}}) and [TCP/UDP Load Balancing]({{< ref "tcp-udp-load-balancer.md" >}}) +3. Upstream server groups reside in the shared memory zone, as described in [Sharing Data with Multiple Worker Processes]({{< ref "http-load-balancer.md" >}}) diff --git a/content/nginx/admin-guide/load-balancer/http-health-check.md b/content/nginx/admin-guide/load-balancer/http-health-check.md index 850b504e5..1ff8a0642 100644 --- a/content/nginx/admin-guide/load-balancer/http-health-check.md +++ b/content/nginx/admin-guide/load-balancer/http-health-check.md @@ -20,7 +20,7 @@ NGINX and F5 NGINX Plus can continually test your upstream servers, avoid the se - For passive health checks, [NGINX Open Source](https://nginx.org/en/) or [NGINX Plus](https://www.nginx.com/products/nginx) - For active health checks and the [live activity monitoring dashboard]({{< relref "../monitoring/live-activity-monitoring.md" >}}), NGINX Plus -- A load‑balanced group of [HTTP upstream servers]({{< relref "http-load-balancer.md" >}}) +- A load‑balanced group of [HTTP upstream servers]({{< ref "http-load-balancer.md" >}}) @@ -106,7 +106,7 @@ To enable active health checks: } ``` - The zone is shared among all worker processes and stores the configuration of the upstream group. This [enables]({{< relref "/nginx/admin-guide/load-balancer/http-load-balancer.md#sharing-data-with-multiple-worker-processes" >}}) the worker processes to use the same set of counters to keep track of responses from the servers in the group. + The zone is shared among all worker processes and stores the configuration of the upstream group. This [enables]({{< ref "/nginx/admin-guide/load-balancer/http-load-balancer.md#sharing-data-with-multiple-worker-processes" >}}) the worker processes to use the same set of counters to keep track of responses from the servers in the group. The defaults for active health checks can be overridden with parameters to the `health_check` directive: diff --git a/content/nginx/admin-guide/load-balancer/http-load-balancer.md b/content/nginx/admin-guide/load-balancer/http-load-balancer.md index c6baaf03b..e3ef4ddb4 100644 --- a/content/nginx/admin-guide/load-balancer/http-load-balancer.md +++ b/content/nginx/admin-guide/load-balancer/http-load-balancer.md @@ -290,7 +290,7 @@ Note that the `max_conns` limit is ignored if there are idle [`keepalive`](https NGINX can continually test your HTTP upstream servers, avoid the servers that have failed, and gracefully add the recovered servers into the load‑balanced group. -See [HTTP Health Checks]({{< relref "http-health-check.md" >}}) for instructions how to configure health checks for HTTP. +See [HTTP Health Checks]({{< relref "./http-health-check.md" >}}) for instructions how to configure health checks for HTTP. @@ -300,7 +300,7 @@ If an [`upstream`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html# When the `zone` directive is included in an `upstream` block, the configuration of the upstream group is kept in a memory area shared among all worker processes. This scenario is dynamically configurable, because the worker processes access the same copy of the group configuration and utilize the same related counters. -The `zone` directive is mandatory for [active health checks](#health_active) and [dynamic reconfiguration]({{< relref "dynamic-configuration-api.md" >}}) of the upstream group. However, other features of upstream groups can benefit from the use of this directive as well. +The `zone` directive is mandatory for [active health checks](#health_active) and [dynamic reconfiguration]({{< ref "dynamic-configuration-api.md" >}}) of the upstream group. However, other features of upstream groups can benefit from the use of this directive as well. For example, if the configuration of a group is not shared, each worker process maintains its own counter for failed attempts to pass a request to a server (set by the [max_fails](#health_passive) parameter). In this case, each request gets to only one worker process. When the worker process that is selected to process a request fails to transmit the request to a server, other worker processes don’t know anything about it. While some worker process can consider a server unavailable, others might still send requests to this server. For a server to be definitively considered unavailable, the number of failed attempts during the timeframe set by the `fail_timeout` parameter must equal `max_fails` multiplied by the number of worker processes. On the other hand, the `zone` directive guarantees the expected behavior. @@ -438,10 +438,10 @@ http { } ``` -For more information about configuring Microsoft Exchange and NGINX Plus, see the [Load Balancing Microsoft Exchange Servers with NGINX Plus]({{< relref "/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md" >}}) deployment guide. +For more information about configuring Microsoft Exchange and NGINX Plus, see the [Load Balancing Microsoft Exchange Servers with NGINX Plus]({{< ref "/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md" >}}) deployment guide. ## Dynamic Configuration Using the NGINX Plus API -With NGINX Plus, the configuration of an upstream server group can be modified dynamically using the NGINX Plus API. A configuration command can be used to view all servers or a particular server in a group, modify parameter for a particular server, and add or remove servers. For more information and instructions, see [Configuring Dynamic Load Balancing with the NGINX Plus API]({{< relref "dynamic-configuration-api.md" >}}). +With NGINX Plus, the configuration of an upstream server group can be modified dynamically using the NGINX Plus API. A configuration command can be used to view all servers or a particular server in a group, modify parameter for a particular server, and add or remove servers. For more information and instructions, see [Configuring Dynamic Load Balancing with the NGINX Plus API]({{< ref "dynamic-configuration-api.md" >}}). diff --git a/content/nginx/admin-guide/load-balancer/tcp-udp-load-balancer.md b/content/nginx/admin-guide/load-balancer/tcp-udp-load-balancer.md index 4e4823a38..258a5cf87 100644 --- a/content/nginx/admin-guide/load-balancer/tcp-udp-load-balancer.md +++ b/content/nginx/admin-guide/load-balancer/tcp-udp-load-balancer.md @@ -18,7 +18,7 @@ In F5 NGINX Plus Release 5 and later, NGINX In NGINX Plus Release 9 and later, NGINX Plus can proxy and load balance UDP traffic. UDP (User Datagram Protocol) is the protocol for many popular non-transactional applications, such as DNS, syslog, and RADIUS. -To load balance HTTP traffic, refer to the [HTTP Load Balancing]({{< relref "http-load-balancer.md" >}}) article. +To load balance HTTP traffic, refer to the [HTTP Load Balancing]({{< ref "http-load-balancer.md" >}}) article. ## Prerequisites @@ -255,9 +255,9 @@ stream { NGINX can continually test your TCP or UDP upstream servers, avoid the servers that have failed, and gracefully add the recovered servers into the load‑balanced group. -See [TCP Health Checks]({{< relref "tcp-health-check.md" >}}) for instructions how to configure health checks for TCP. +See [TCP Health Checks]({{< relref "./tcp-health-check.md" >}}) for instructions how to configure health checks for TCP. -See [UDP Health Checks]({{< relref "udp-health-check.md" >}}) for instructions how to configure health checks for UDP. +See [UDP Health Checks]({{< relref "./udp-health-check.md" >}}) for instructions how to configure health checks for UDP. ## On-the-Fly Configuration diff --git a/content/nginx/admin-guide/monitoring/live-activity-monitoring.md b/content/nginx/admin-guide/monitoring/live-activity-monitoring.md index 2966173e5..0715c089a 100644 --- a/content/nginx/admin-guide/monitoring/live-activity-monitoring.md +++ b/content/nginx/admin-guide/monitoring/live-activity-monitoring.md @@ -74,7 +74,7 @@ In order to collect data from virtual servers, upstream server groups, or cache } ``` -- To make health checks appear in statistics, make sure that health checks are enabled with the [`health_check`](https://nginx.org/en/docs/http/ngx_http_upstream_hc_module.html) directive and the server group resides in the [shared memory](https://nginx.org/en/docs/http/ngx_http_api_module.html#status_zone). See [HTTP Health Checks]({{< relref "../load-balancer/http-health-check.md" >}}) and [TCP Health Checks]({{< relref "/nginx/admin-guide/load-balancer/tcp-health-check.md" >}}) for more information. +- To make health checks appear in statistics, make sure that health checks are enabled with the [`health_check`](https://nginx.org/en/docs/http/ngx_http_upstream_hc_module.html) directive and the server group resides in the [shared memory](https://nginx.org/en/docs/http/ngx_http_api_module.html#status_zone). See [HTTP Health Checks]({{< relref "../load-balancer/http-health-check.md" >}}) and [TCP Health Checks]({{< ref "/nginx/admin-guide/load-balancer/tcp-health-check.md" >}}) for more information. ```nginx server { @@ -137,7 +137,7 @@ To enable the API: } ``` -- In order to make changes with the API, such as [resetting statistics counters](#json_delete), managing [upstream servers on-the-fly]({{< relref "../load-balancer/dynamic-configuration-api.md" >}}) or [key-value storage]({{< relref "/nginx/admin-guide/security-controls/denylisting-ip-addresses.md" >}}), managing upstream servers from the [Dashboard](#dashboard_upstream), enable the read-write mode for the API by specifying the `write=on` parameter for the [`api`](https://nginx.org/en/docs/http/ngx_http_api_module.html#api) directive: +- In order to make changes with the API, such as [resetting statistics counters](#json_delete), managing [upstream servers on-the-fly]({{< relref "../load-balancer/dynamic-configuration-api.md" >}}) or [key-value storage]({{< ref "/nginx/admin-guide/security-controls/denylisting-ip-addresses.md" >}}), managing upstream servers from the [Dashboard](#dashboard_upstream), enable the read-write mode for the API by specifying the `write=on` parameter for the [`api`](https://nginx.org/en/docs/http/ngx_http_api_module.html#api) directive: ```nginx http { diff --git a/content/nginx/admin-guide/monitoring/logging.md b/content/nginx/admin-guide/monitoring/logging.md index 06092477f..80da2d832 100644 --- a/content/nginx/admin-guide/monitoring/logging.md +++ b/content/nginx/admin-guide/monitoring/logging.md @@ -205,6 +205,6 @@ The `severity=` parameter sets the severity level of syslog messages for access ## Live Activity Monitoring -NGINX Plus provides a real-time live activity monitoring interface that shows key load and performance metrics of your [HTTP]({{< relref "../load-balancer/http-load-balancer.md" >}}) and [TCP]({{< relref "../load-balancer/tcp-udp-load-balancer.md" >}}) upstream servers. See the [Live Activity Monitoring]({{< relref "live-activity-monitoring.md" >}}) article for more information. +NGINX Plus provides a real-time live activity monitoring interface that shows key load and performance metrics of your [HTTP]({{< relref "../load-balancer/http-load-balancer.md" >}}) and [TCP]({{< relref "../load-balancer/tcp-udp-load-balancer.md" >}}) upstream servers. See the [Live Activity Monitoring]({{< ref "live-activity-monitoring.md" >}}) article for more information. To learn more about NGINX Plus, please visit the [Products](https://www.nginx.com/products/) page. diff --git a/content/nginx/admin-guide/security-controls/configuring-http-basic-authentication.md b/content/nginx/admin-guide/security-controls/configuring-http-basic-authentication.md index e8b4ec1b9..7474c6281 100644 --- a/content/nginx/admin-guide/security-controls/configuring-http-basic-authentication.md +++ b/content/nginx/admin-guide/security-controls/configuring-http-basic-authentication.md @@ -14,7 +14,7 @@ type: You can restrict access to your website or some parts of it by implementing a username/password authentication. Usernames and passwords are taken from a file created and populated by a password file creation tool, for example, `apache2-utils`. -HTTP Basic authentication can also be combined with other access restriction methods, for example restricting access by [IP address]({{< relref "denylisting-ip-addresses.md" >}}) or [geographical location]({{< relref "controlling-access-by-geoip.md" >}}). +HTTP Basic authentication can also be combined with other access restriction methods, for example restricting access by [IP address]({{< ref "denylisting-ip-addresses.md" >}}) or [geographical location]({{< ref "controlling-access-by-geoip.md" >}}). ## Prerequisites diff --git a/content/nginx/admin-guide/security-controls/controlling-access-by-geoip.md b/content/nginx/admin-guide/security-controls/controlling-access-by-geoip.md index 6133140ca..1533c497b 100644 --- a/content/nginx/admin-guide/security-controls/controlling-access-by-geoip.md +++ b/content/nginx/admin-guide/security-controls/controlling-access-by-geoip.md @@ -392,7 +392,7 @@ In this example, the IP address will be checked in the `GeoLite2-Country.mmdb` d ## More Info -- [GeoIP2 Dynamic Module Installation Instructions]({{< relref "/nginx/admin-guide/dynamic-modules/geoip2.md" >}}) +- [GeoIP2 Dynamic Module Installation Instructions]({{< ref "/nginx/admin-guide/dynamic-modules/geoip2.md" >}}) - [MaxMind GeoIP2 Databases](https://www.maxmind.com/en/geoip2-databases) diff --git a/content/nginx/admin-guide/security-controls/denylisting-ip-addresses.md b/content/nginx/admin-guide/security-controls/denylisting-ip-addresses.md index a4823f1bc..fc4373fa7 100644 --- a/content/nginx/admin-guide/security-controls/denylisting-ip-addresses.md +++ b/content/nginx/admin-guide/security-controls/denylisting-ip-addresses.md @@ -69,7 +69,7 @@ First, enable the database for storing the list of denylisted and allowlisted IP } ``` - We strongly recommend [restricting access]({{< relref "/nginx/admin-guide/security-controls/controlling-access-proxied-http.md" >}}) to this location, for example by allowing access only from `localhost` (`127.0.0.1`), and by using HTTP basic authentication to restrict use of the `PATCH`, `POST`, and `DELETE` methods to a specified set of users: + We strongly recommend [restricting access]({{< ref "/nginx/admin-guide/security-controls/controlling-access-proxied-http.md" >}}) to this location, for example by allowing access only from `localhost` (`127.0.0.1`), and by using HTTP basic authentication to restrict use of the `PATCH`, `POST`, and `DELETE` methods to a specified set of users: ```nginx # ... diff --git a/content/nginx/deployment-guides/amazon-web-services/ec2-instances-for-nginx.md b/content/nginx/deployment-guides/amazon-web-services/ec2-instances-for-nginx.md index 197c4043c..0b1b05f2b 100644 --- a/content/nginx/deployment-guides/amazon-web-services/ec2-instances-for-nginx.md +++ b/content/nginx/deployment-guides/amazon-web-services/ec2-instances-for-nginx.md @@ -11,14 +11,14 @@ docs: DOCS-444 This guide explains how to create instances in the Amazon Elastic Compute Cloud (EC2) that can run NGINX Open Source and F5 NGINX Plus. -For NGINX Plus, you can buy a prebuilt Amazon Machine Image (AMI) from the AWS Marketplace for a faster option. You can find AMIs for various operating systems, such as Amazon Linux, Red Hat Enterprise Linux, and Ubuntu. For instructions, see [Installing NGINX Plus AMIs on Amazon EC2]({{< relref "/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md" >}}). +For NGINX Plus, you can buy a prebuilt Amazon Machine Image (AMI) from the AWS Marketplace for a faster option. You can find AMIs for various operating systems, such as Amazon Linux, Red Hat Enterprise Linux, and Ubuntu. For instructions, see [Installing NGINX Plus AMIs on Amazon EC2]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md" >}}). ## Before you begin To complete this guide, you need the following: - An [AWS account](http://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/AboutAWSAccounts.html). -- Basic Linux system administration skills, including installing software, managing files and folders, and using the command line, to follow the [Ansible instructions]({{< relref "#automate-ansible" >}}). +- Basic Linux system administration skills, including installing software, managing files and folders, and using the command line, to follow the [Ansible instructions]({{< ref "#automate-ansible" >}}). - A paid or trial subscription for NGINX Plus. - Root privileges on the hosts where NGINX Open Source or NGINX Plus will be installed, with `sudo` access as needed. @@ -43,19 +43,19 @@ To complete this guide, you need the following: 1. In the **Key pair (login)** section, select an existing key pair or create a new one. If you choose **Create new key pair**, a window appears, allowing you to download the key pair. {{}} It's best practice — and necessary in production — to create a separate key for each EC2 instance. This way, if a key is compromised, only that one instance is at risk.{{}} -1. Scroll to the **Network settings** section. You can keep the default **VPC** and **Subnet** settings. Under **Firewall (Security Groups),** either create a new security group or use an existing one. - - If this is your first setup, keep **Create security group** selected. - - Select **Allow HTTP traffic from the internet.** +1. Scroll to the **Network settings** section. You can keep the default **VPC** and **Subnet** settings. Under **Firewall (Security Groups),** either create a new security group or use an existing one. + - If this is your first setup, keep **Create security group** selected. + - Select **Allow HTTP traffic from the internet.** - (Optional) Select **Allow HTTPS traffic from the internet** if needed. This creates the following inbound security group rules: - 1. Accept SSH connections from all sources + 1. Accept SSH connections from all sources - **Type** – SSH - **Protocol** – TCP - **Port Range** – 22 - **Source** – Custom `0.0.0.0/0` - 1. Accept unencrypted HTTP connections from all sources + 1. Accept unencrypted HTTP connections from all sources - **Type** – HTTP - **Protocol** – TCP - **Port Range** – 80 @@ -94,14 +94,14 @@ To complete this guide, you need the following: - Open the **Outbound** tab and select **Edit outbound rules** to create a rule for outbound traffic. The rules depend on the ports used for traffic handled by NGINX Open Source or NGINX Plus instances: - By default, AWS adds an outbound rule that allows all traffic to all destinations. You can remove this rule by selecting **Delete**. - - If you use port 80 for client traffic and health checks from a load balancer, like [AWS Network Load Balancer]({{< relref "high-availability-network-load-balancer.md" >}}), you only need one rule. + - If you use port 80 for client traffic and health checks from a load balancer, like [AWS Network Load Balancer]({{< ref "high-availability-network-load-balancer.md" >}}), you only need one rule. - If you set up different ports for various tasks, or if you use ports like 443 for HTTPS, adjust them accordingly. In the **Destination** field, start typing your security group's name or ID. It should appear under **Security Groups**. The example below shows **sg-0dd4d3c5284052f99**. {{< img src="/img/aws/aws-generic-instance-security-outbound.png" alt="Screenshot of the EC2 Security Group outbound rules page">}} -1. To install NGINX software on the instance, first [connect]({{< relref "#connect-to-an-ec2-instance" >}}) to it. Then follow the instructions in the NGINX Plus Admin Guide for [NGINX Open Source]({{< relref "/nginx/admin-guide/installing-nginx/installing-nginx-open-source#prebuilt" >}}) and [NGINX Plus]({{< relref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). +1. To install NGINX software on the instance, first [connect]({{< ref "#connect-to-an-ec2-instance" >}}) to it. Then follow the instructions in the NGINX Plus Admin Guide for [NGINX Open Source]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-open-source#prebuilt" >}}) and [NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). --- @@ -109,27 +109,27 @@ To complete this guide, you need the following: To install and configure NGINX Open Source or NGINX Plus on an instance, open a terminal window and connect to the instance over SSH. 1. Navigate to the **Instances** tab on the EC2 Dashboard if you are not there already. -1. Select the row for an instance to highlight it. -1. Select **Connect** above the list of instances. You are redirected to the **Connect to Instance** page, with the **SSH client** tab selected by default. +1. Select the row for an instance to highlight it. +1. Select **Connect** above the list of instances. You are redirected to the **Connect to Instance** page, with the **SSH client** tab selected by default. 1. Follow the instructions on the page, which are customized for the selected instance. A sample `ssh` command includes the key file name and the instance hostname. - + {{< img src="/img/aws/aws-nlb-instance-connect.png" alt="Screenshot of the EC2 Instance Connect with SSH page">}} --- ## Install NGINX software -Once you have established a connection with an instance, you can install the NGINX software on it. Follow the instructions in the NGINX Plus Admin Guide for [NGINX Open Source]({{< relref "/nginx/admin-guide/installing-nginx/installing-nginx-open-source#prebuilt" >}}) and [NGINX Plus]({{< relref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). The [Admin Guide]({{< relref "/nginx/admin-guide/_index.md" >}}) also provides instructions for many maintenance tasks. +Once you have established a connection with an instance, you can install the NGINX software on it. Follow the instructions in the NGINX Plus Admin Guide for [NGINX Open Source]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-open-source#prebuilt" >}}) and [NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). The [Admin Guide]({{< ref "/nginx/admin-guide/_index.md" >}}) also provides instructions for many maintenance tasks. ### Automate installation with a configuration manager -You can automate the installation of NGINX Open Source and NGINX Plus. Instructions for Ansible are provided below. +You can automate the installation of NGINX Open Source and NGINX Plus. Instructions for Ansible are provided below. #### Automate installation with Ansible {#automate-ansible} NGINX, Inc. releases a combined Ansible role for NGINX Open Source and NGINX Plus on [Ansible Galaxy](https://galaxy.ansible.com/nginxinc/nginx/) and [GitHub](https://github.com/nginxinc/ansible-role-nginx). Perform these steps to install and run it. -1. [Connect to the EC2 instance]({{< relref "#connect-instance" >}}). +1. [Connect to the EC2 instance]({{< ref "#connect-instance" >}}). 1. Install Ansible following the [instructions](https://docs.ansible.com/ansible/latest/installation_guide/installation_distros.html) for the operating system on your EC2 instance. @@ -164,7 +164,7 @@ NGINX, Inc. releases a combined Ansible role for NGINX Open Source and NGINX P To simplify installing NGINX Open Source on several instances, create an AMI from an existing NGINX instance. You can then create additional virtual instances based on the AMI. -1. Follow the instructions in [Create Amazon EC2 Instance]({{< relref "#create-ec2-instances" >}}) and [Install NGINX software]({{< relref "#install-nginx-software" >}}). +1. Follow the instructions in [Create Amazon EC2 Instance]({{< ref "#create-ec2-instances" >}}) and [Install NGINX software]({{< ref "#install-nginx-software" >}}). 1. Go to the **Instances** tab on the Amazon EC2 Dashboard. @@ -180,6 +180,6 @@ To simplify installing NGINX Open Source on several instances, create an AMI fro ### Revision History -- Version 3 (February 2025) - Update guide to match new AWS instance creation flow, update screenshots, and links. +- Version 3 (February 2025) - Update guide to match new AWS instance creation flow, update screenshots, and links. - Version 2 (July 2018) – Substitute links to NGINX Plus Admin Guide for sample installation instructions. - Version 1 (April 2018) – Initial version (NGINX Plus Release 14) diff --git a/content/nginx/deployment-guides/amazon-web-services/high-availability-keepalived.md b/content/nginx/deployment-guides/amazon-web-services/high-availability-keepalived.md index a17836533..18bf2d378 100644 --- a/content/nginx/deployment-guides/amazon-web-services/high-availability-keepalived.md +++ b/content/nginx/deployment-guides/amazon-web-services/high-availability-keepalived.md @@ -11,7 +11,7 @@ type: This guide explains how to create a highly available (HA) active‑passive deployment of F5 NGINX Plus in the [Amazon Web Services](https://aws.amazon.com/) (AWS) cloud. It combines the `keepalived`‑based solution for high availability (provided by NGINX for on‑premises HA deployments) with the AWS Elastic IP address feature. -NGINX also provides a [solution for active‑active HA of NGINX Plus in AWS]({{< relref "high-availability-network-load-balancer.md" >}}), using AWS Network Load Balancer. +NGINX also provides a [solution for active‑active HA of NGINX Plus in AWS]({{< ref "high-availability-network-load-balancer.md" >}}), using AWS Network Load Balancer. ## Overview @@ -35,7 +35,7 @@ As an alternative to ELB, you can use Route 53 to distribute traffic among NGIN - We have successfully tested the instructions on Ubuntu 16.04 LTS (Xenial Xerus) and CentOS 7, with `keepalived` installed from the respective OS vendor repositories. - Except as noted, perform all steps on both the primary and backup instance. - The solution is not covered by your NGINX Plus support contract. -- In addition to the [active‑active HA solution]({{< relref "high-availability-network-load-balancer.md" >}}) mentioned above, NGINX offers a solution based on [AWS Lambda](https://aws.amazon.com/lambda/) which does not require installation of any additional software on the NGINX Plus instances. The [NGINX Professional Services](https://www.nginx.com/services/) team can deploy and configure the Lambda‑based solution for you and provide support. +- In addition to the [active‑active HA solution]({{< ref "high-availability-network-load-balancer.md" >}}) mentioned above, NGINX offers a solution based on [AWS Lambda](https://aws.amazon.com/lambda/) which does not require installation of any additional software on the NGINX Plus instances. The [NGINX Professional Services](https://www.nginx.com/services/) team can deploy and configure the Lambda‑based solution for you and provide support. ## Step 1 – Launch Two NGINX Plus Instances diff --git a/content/nginx/deployment-guides/amazon-web-services/high-availability-network-load-balancer.md b/content/nginx/deployment-guides/amazon-web-services/high-availability-network-load-balancer.md index d9da52aad..3e36914ea 100644 --- a/content/nginx/deployment-guides/amazon-web-services/high-availability-network-load-balancer.md +++ b/content/nginx/deployment-guides/amazon-web-services/high-availability-network-load-balancer.md @@ -54,7 +54,7 @@ Together, these provide an HA, all-active NGINX and NGINX Plus solution. -AWS NLB uses a flow hash routing algorithm to balance traffic and handle Layer 4 TCP connections. AWS NLB listens for incoming connections as defined by its listeners. Each listener forwards a new connection to one of the available instances in a target group. AWS NLB uses the flow hash routing algorithm to chose an available instance. +AWS NLB uses a flow hash routing algorithm to balance traffic and handle Layer 4 TCP connections. AWS NLB listens for incoming connections as defined by its listeners. Each listener forwards a new connection to one of the available instances in a target group. AWS NLB uses the flow hash routing algorithm to chose an available instance. {{< note >}} By default, an AWS NLB uses a DNS name with a dynamic IP address. As an option, you can attach an Elastic IP address to the AWS NLB. This ensures that the AWS NLB is always reachable at the same IP address. {{< /note >}} @@ -68,8 +68,8 @@ These instructions assume you have the following: - Familiarity with NGINX and NGINX Plus configuration syntax. - [An AWS account](http://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/AboutAWSAccounts.html). - Six EC2 instances running a version of NGINX: - - Four running NGINX Open Source - - Two running NGINX Plus + - Four running NGINX Open Source + - Two running NGINX Plus - You need a paid or trial subscription for each NGINX Plus instance. Refer to the [Appendix](#appendix) to create EC2 instances with names used in these instructions. There you can also find instructions to install and configure NGINX software on EC2. @@ -77,7 +77,7 @@ These instructions assume you have the following: ## Configure an AWS Network Load Balancer -Once you install and configure NGINX Open Source and NGINX Plus on the EC2 instances you are ready to set up AWS NLB. Refer to the [Appendix](#appendix) for more installation and set up instructions. +Once you install and configure NGINX Open Source and NGINX Plus on the EC2 instances you are ready to set up AWS NLB. Refer to the [Appendix](#appendix) for more installation and set up instructions. The steps to set up an AWS NLB for an HA, all‑active NGINX Plus deployment include: @@ -201,7 +201,7 @@ In this step you use the **Step 4: Review** window to verify settings and launch 3. Observe the values in the **State** column of the table. When a value changes to *active*, you can display details about the provisioned AWS NLB. Select the button in an AWS NLB row to display its details. - + 4. Next, verify that the AWS NLB is working. Open a new browser window and navigate to the AWS NLB's public DNS name. You can find the **DNS name** field in the **Basic Configuration** section of the **Load Balancers** dashboard. **Note:** If you copy and paste the DNS name, be sure to exclude the parenthesized words at the end, for example, *(A Record)*. @@ -248,7 +248,7 @@ The deployed solution in these instructions uses six EC2 instances. Two instance *Step‑by‑step* instructions for creating EC2 instances and installing NGINX Open Source and NGINX Plus are available. Refer to our deployment guide, [Creating Amazon EC2 Instances for NGINX Open Source and NGINX Plus]({{< ref "/nginx/deployment-guides/amazon-web-services/ec2-instances-for-nginx.md" >}}). -{{< note >}} When installing NGINX Open Source or NGINX Plus, you connect to each instance over SSH. To save time, leave the SSH connection to each instance open after installing the software. This way, you can reuse the connection when configuring the instance. {{< /note >}} +{{< note >}} When installing NGINX Open Source or NGINX Plus, you connect to each instance over SSH. To save time, leave the SSH connection to each instance open after installing the software. This way, you can reuse the connection when configuring the instance. {{< /note >}} Assign the following names to the instances, then install the indicated NGINX software. The screenshot below shows the resulting **Instances** table. @@ -298,7 +298,7 @@ Repeat the instructions on both }}). +Step‑by‑step instructions for creating EC2 instances and installing NGINX software are provided in our deployment guide, [Creating Amazon EC2 Instances for NGINX Open Source and NGINX Plus]({{< ref "ec2-instances-for-nginx.md" >}}). **Note:** When installing NGINX Open Source or NGINX Plus, you connect to each instance over SSH. To save time, leave the SSH connection to each instance open after installing the software, for reuse when you configure it with the instructions in the sections below. diff --git a/content/nginx/deployment-guides/google-cloud-platform/high-availability-all-active.md b/content/nginx/deployment-guides/google-cloud-platform/high-availability-all-active.md index a9ef50b07..1f8134ed5 100644 --- a/content/nginx/deployment-guides/google-cloud-platform/high-availability-all-active.md +++ b/content/nginx/deployment-guides/google-cloud-platform/high-availability-all-active.md @@ -32,7 +32,7 @@ The deployment combines the following technologies: Topology of the all‑active deployment of NGINX Plus as the Google Cloud Platform load balancer. -[Session persistence](https://www.nginx.com/products/nginx/load-balancing/#session-persistence) is managed at the network layer by the GCE network load balancer (based on client IP address). The NGINX Plus LB instance also manages it at the application layer (with a session cookie). +[Session persistence](https://www.nginx.com/products/nginx/load-balancing/#session-persistence) is managed at the network layer by the GCE network load balancer (based on client IP address). The NGINX Plus LB instance also manages it at the application layer (with a session cookie). The GCE network LB assigns each new client to a specific NGINX Plus LB. This association persists as long as the LB instance is up and functional. @@ -40,7 +40,7 @@ NGINX Plus LB uses the round-robin algorithm to forward requests to specific app This deployment guide uses two groups of app instances: – app-1 and app-2. It demonstrates [load balancing](https://www.nginx.com/products/nginx/load-balancing/) between different app types. But both groups have the same app configurations. -You can adapt the deployment to distribute unique connections to different groups of app instances. This can be done by creating discrete upstream blocks and routing content based on the URI. +You can adapt the deployment to distribute unique connections to different groups of app instances. This can be done by creating discrete upstream blocks and routing content based on the URI. Please see the reference docs for details on configuring multiple [upstream server groups](https://nginx.org/en/docs/http/ngx_http_upstream_module.html). diff --git a/content/nginx/deployment-guides/load-balance-third-party/apache-tomcat.md b/content/nginx/deployment-guides/load-balance-third-party/apache-tomcat.md index d28ee116d..7ea597997 100644 --- a/content/nginx/deployment-guides/load-balance-third-party/apache-tomcat.md +++ b/content/nginx/deployment-guides/load-balance-third-party/apache-tomcat.md @@ -76,7 +76,7 @@ There are several ways to obtain a server certificate, including the following. - Generate a self‑signed certificate as outlined in [Generating a Self‑Signed Certificate](#certificate-self-signed) below. This is sufficient for testing scenarios, but clients of production deployments generally require a certificate signed by a certificate authority (CA). - Request a new certificate from a CA or your organization's security group, as described in [Generating a Certificate Request](#certificate-request) below. -For more details on SSL/TLS termination, see the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/_index.md" >}}). +For more details on SSL/TLS termination, see the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/_index.md" >}}). @@ -273,7 +273,7 @@ These directives define virtual servers for HTTP and HTTPS traffic in separate ` Directive documentation: [location](https://nginx.org/en/docs/http/ngx_http_core_module.html#location), [return](https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return) -For more information about configuring SSL/TLS, see the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/security-controls/terminating-ssl-http.md" >}}) and the reference documentation for the HTTP [SSL/TLS](https://nginx.org/en/docs/http/ngx_http_ssl_module.html) module. +For more information about configuring SSL/TLS, see the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/security-controls/terminating-ssl-http.md" >}}) and the reference documentation for the HTTP [SSL/TLS](https://nginx.org/en/docs/http/ngx_http_ssl_module.html) module. ### Configuring Basic Load Balancing @@ -963,7 +963,7 @@ server { ## Resources - [NGINX Plus Overview](https://www.nginx.com/products/nginx) -- [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/_index.md" >}}) +- [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/_index.md" >}}) - [NGINX Wiki](https://www.nginx.com/resources/wiki/) ### Revision History diff --git a/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md b/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md index d5f9e2745..df907bd34 100644 --- a/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md +++ b/content/nginx/deployment-guides/load-balance-third-party/microsoft-exchange.md @@ -25,7 +25,7 @@ This deployment guide explains how to use F5 NGINX Plus to load balance traffic - [Advanced activity monitoring available via a dashboard or API](https://www.nginx.com/products/nginx/live-activity-monitoring/) - [Management and real‑time configuration changes with DevOps‑friendly tools](https://www.nginx.com/products/nginx/load-balancing/#load-balancing-api) -[NGINX Plus Release 6 R6](https://www.nginx.com/blog/nginx-plus-r6-released/#tcp-load-balancing) introduced full‑featured load balancing of TCP traffic, with support extended to UDP in [NGINX Plus R9](https://www.nginx.com/blog/nginx-plus-r9-released/#udp-lb) and continuing enhancements for both protocols included in subsequent releases (for details, see [NGINX Plus Releases]({{< relref "/nginx/releases.md" >}}). Because NGINX Plus load balances TCP, HTTP, and HTTPS traffic, it's ideal for Microsoft Exchange deployments, which use all three protocols. +[NGINX Plus Release 6 R6](https://www.nginx.com/blog/nginx-plus-r6-released/#tcp-load-balancing) introduced full‑featured load balancing of TCP traffic, with support extended to UDP in [NGINX Plus R9](https://www.nginx.com/blog/nginx-plus-r9-released/#udp-lb) and continuing enhancements for both protocols included in subsequent releases (for details, see [NGINX Plus Releases]({{< ref "/nginx/releases.md" >}}). Because NGINX Plus load balances TCP, HTTP, and HTTPS traffic, it's ideal for Microsoft Exchange deployments, which use all three protocols. ## Using This Guide @@ -1122,7 +1122,7 @@ The quickest way to configure the module and the built‑in dashboard is to down When you reload the NGINX Plus configuration file, for example by running the `nginx -s reload` command, the NGINX Plus dashboard is available immediately at **http://_nginx-plus-server-address_:8080**. -For more information about live activity monitoring, see the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/monitoring/live-activity-monitoring.md" >}}). +For more information about live activity monitoring, see the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/monitoring/live-activity-monitoring.md" >}}). ### Full Configuration for Enhanced Load Balancing diff --git a/content/nginx/deployment-guides/load-balance-third-party/node-js.md b/content/nginx/deployment-guides/load-balance-third-party/node-js.md index 78f205659..8cecf6bde 100644 --- a/content/nginx/deployment-guides/load-balance-third-party/node-js.md +++ b/content/nginx/deployment-guides/load-balance-third-party/node-js.md @@ -44,7 +44,7 @@ The information in this deployment guide applies equally to open source Node.js - A Node.js application server installed and configured on a physical or virtual system. - A Linux system to host NGINX Open Source or NGINX Plus. To avoid potential conflicts with other applications, we recommend you install NGINX Plus on a fresh physical or virtual system. For the list of Linux distributions supported by NGINX Plus, see [NGINX Plus Technical Specifications]({{< relref "../../technical-specs.md" >}}). -- NGINX Open Source or NGINX Plus installed on the physical or virtual system. Some features are available only with [NGINX Plus](#enhanced), including sophisticated session persistence, application health checks, live activity monitoring, and dynamic reconfiguration of upstream groups. For installation instructions for both products, see the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/installing-nginx/_index.md" >}}). +- NGINX Open Source or NGINX Plus installed on the physical or virtual system. Some features are available only with [NGINX Plus](#enhanced), including sophisticated session persistence, application health checks, live activity monitoring, and dynamic reconfiguration of upstream groups. For installation instructions for both products, see the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/installing-nginx/_index.md" >}}). The instructions assume you have basic Linux system administration skills, including the following. Full instructions are not provided for these tasks. @@ -873,7 +873,7 @@ server { ## Resources - [NGINX Plus Overview](https://www.nginx.com/products/nginx) -- [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/_index.md" >}}) +- [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/_index.md" >}}) - [NGINX Wiki](https://www.nginx.com/resources/wiki/) _[NodeSource](https://nodesource.com/), developers of N|Solid, contributed to this deployment guide._ diff --git a/content/nginx/deployment-guides/load-balance-third-party/oracle-e-business-suite.md b/content/nginx/deployment-guides/load-balance-third-party/oracle-e-business-suite.md index 5d144e498..c95cf5a07 100644 --- a/content/nginx/deployment-guides/load-balance-third-party/oracle-e-business-suite.md +++ b/content/nginx/deployment-guides/load-balance-third-party/oracle-e-business-suite.md @@ -123,7 +123,7 @@ There are several ways to obtain a server certificate, including the following. - Request a new certificate from a CA or your organization's security group, as described in [Generating a Certificate Request with the openssl Command](#certificate-request). - If you already have an SSL/TLS certificate on a Windows system, see [Exporting and Converting an SSL/TLS Certificate from an IIS Server](#certificate-iis). -For more details on SSL/TLS termination, see the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/security-controls/terminating-ssl-http" >}}). +For more details on SSL/TLS termination, see the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/security-controls/terminating-ssl-http" >}}). ### Generating a Self-Signed Certificate with the openssl Command @@ -798,7 +798,7 @@ You can then use a DNS‑based global load‑balancing solution to secure agains To increase the reliability of your EBS deployment even more, configure a higly available (HA) deployment of NGINX Plus. -For configuration instructions for on‑premises deployments of NGINX Plus, see the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/high-availability/" >}}). +For configuration instructions for on‑premises deployments of NGINX Plus, see the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/high-availability/" >}}). For configuration instructions for cloud‑based deployments of NGINX Plus, see our deployment guides: @@ -1171,7 +1171,7 @@ http { ## Resources - [NGINX Plus Overview](https://www.nginx.com/products/nginx) -- [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/_index.md" >}}) +- [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/_index.md" >}}) - [NGINX Wiki](https://www.nginx.com/resources/wiki/) ### Revision History diff --git a/content/nginx/deployment-guides/load-balance-third-party/oracle-weblogic-server.md b/content/nginx/deployment-guides/load-balance-third-party/oracle-weblogic-server.md index bb25d62f3..d3a334cb2 100644 --- a/content/nginx/deployment-guides/load-balance-third-party/oracle-weblogic-server.md +++ b/content/nginx/deployment-guides/load-balance-third-party/oracle-weblogic-server.md @@ -919,7 +919,7 @@ server { ## Resources - [NGINX Plus Overview](https://www.nginx.com/products/nginx) -- [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/_index.md" >}}) +- [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/_index.md" >}}) - [NGINX Wiki](https://www.nginx.com/resources/wiki/) ### Revision History diff --git a/content/nginx/deployment-guides/load-balance-third-party/wildfly.md b/content/nginx/deployment-guides/load-balance-third-party/wildfly.md index b7767b429..8067d98ac 100644 --- a/content/nginx/deployment-guides/load-balance-third-party/wildfly.md +++ b/content/nginx/deployment-guides/load-balance-third-party/wildfly.md @@ -886,7 +886,7 @@ server { ## Resources - [NGINX Plus Overview](https://www.nginx.com/products/nginx) -- [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/_index.md" >}}) +- [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/_index.md" >}}) - [NGINX Wiki](https://www.nginx.com/resources/wiki/) ### Revision History diff --git a/content/nginx/deployment-guides/microsoft-azure/high-availability-standard-load-balancer.md b/content/nginx/deployment-guides/microsoft-azure/high-availability-standard-load-balancer.md index fb64d68a8..4e97c90dd 100644 --- a/content/nginx/deployment-guides/microsoft-azure/high-availability-standard-load-balancer.md +++ b/content/nginx/deployment-guides/microsoft-azure/high-availability-standard-load-balancer.md @@ -268,7 +268,7 @@ After completing the instructions, you have completed the prerequisites for this The deployment in this guide uses six VMs: two VMs running NGINX Plus that load balance traffic to four VMs running NGINX Open Source as a web server. The four NGINX Open Source VMs are deployed in two pairs, each pair running a different app. -Step-by-step instructions for creating VMs and installing NGINX Open Source and NGINX Plus are provided in our deployment guide, [Creating Microsoft Azure Virtual Machines for NGINX Open Source and NGINX Plus]({{< relref "virtual-machines-for-nginx.md" >}}). +Step-by-step instructions for creating VMs and installing NGINX Open Source and NGINX Plus are provided in our deployment guide, [Creating Microsoft Azure Virtual Machines for NGINX Open Source and NGINX Plus]({{< ref "virtual-machines-for-nginx.md" >}}). **Note:** When installing NGINX Open Source or NGINX Plus, you connect to each instance over SSH. To save time, leave the SSH connection to each instance open after installing the software, for reuse when you configure it using the instructions referenced in the sections below. @@ -286,7 +286,7 @@ Assign the following names to the VMs, and then install the indicated NGINX soft - ngx-plus-1 - ngx-plus-2 -**Note:** The two NGINX Plus VMs must have a public IP address with same SKU type as the Standard Load Balancer you are creating (in this guide, **Standard**). Instructions are included in our deployment guide, [Creating Microsoft Azure Virtual Machines for NGINX Open Source and NGINX Plus]({{< relref "virtual-machines-for-nginx.md" >}}). +**Note:** The two NGINX Plus VMs must have a public IP address with same SKU type as the Standard Load Balancer you are creating (in this guide, **Standard**). Instructions are included in our deployment guide, [Creating Microsoft Azure Virtual Machines for NGINX Open Source and NGINX Plus]({{< ref "virtual-machines-for-nginx.md" >}}). ### Configuring NGINX Open Source on the Web Servers diff --git a/content/nginx/deployment-guides/microsoft-azure/virtual-machines-for-nginx.md b/content/nginx/deployment-guides/microsoft-azure/virtual-machines-for-nginx.md index 6733e8687..961d7927f 100644 --- a/content/nginx/deployment-guides/microsoft-azure/virtual-machines-for-nginx.md +++ b/content/nginx/deployment-guides/microsoft-azure/virtual-machines-for-nginx.md @@ -12,7 +12,7 @@ type: These instructions explain how to create virtual machines (VMs) in the Microsoft Azure environment that are suitable for running NGINX Open Source and NGINX Plus. -The names and other settings used in this guide are appropriate for the high‑availability deployment described in [Active-Active HA for NGINX Plus on Microsoft Azure Using the Azure Standard Load Balancer]({{< relref "high-availability-standard-load-balancer.md" >}}), but the VMs can be used for any purpose. +The names and other settings used in this guide are appropriate for the high‑availability deployment described in [Active-Active HA for NGINX Plus on Microsoft Azure Using the Azure Standard Load Balancer]({{< ref "high-availability-standard-load-balancer.md" >}}), but the VMs can be used for any purpose. For NGINX Plus, a faster alternative is to purchase a prebuilt VM in the [Microsoft Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps?search=NGINX%20Plus) (several current operating systems are available). For instructions, see [Installing NGINX Plus on Microsoft Azure]({{< relref "../../admin-guide/installing-nginx/installing-nginx-plus-microsoft-azure.md" >}}). @@ -52,7 +52,7 @@ In addition, to install NGINX software by following the linked instructions, you - **Resource group** – NGINX-Plus-HA - **Virtual machine name** – ngx-plus-1 - The value ngx-plus-1 is one of the six used for VMs in [Active-Active HA for NGINX Plus on Microsoft Azure Using the Azure Standard Load Balancer]({{< relref "high-availability-standard-load-balancer.md" >}}). See Step 7 below for the other instance names. + The value ngx-plus-1 is one of the six used for VMs in [Active-Active HA for NGINX Plus on Microsoft Azure Using the Azure Standard Load Balancer]({{< ref "high-availability-standard-load-balancer.md" >}}). See Step 7 below for the other instance names. - **Region** – (US) West US 2 - **Availability options** – No infrastructure redundancy required @@ -71,7 +71,7 @@ In addition, to install NGINX software by following the linked instructions, you screenshot of 'Basics' tab on Azure 'Create a virtual machine' page -5. If you are creating VMs to use in [Active-Active HA for NGINX Plus on Microsoft Azure Using the Azure Standard Load Balancer]({{< relref "high-availability-standard-load-balancer.md" >}}), the two NGINX Plus VMs in that deployment must have public IP addresses with SKU type **Standard** instead of the default **Basic**. +5. If you are creating VMs to use in [Active-Active HA for NGINX Plus on Microsoft Azure Using the Azure Standard Load Balancer]({{< ref "high-availability-standard-load-balancer.md" >}}), the two NGINX Plus VMs in that deployment must have public IP addresses with SKU type **Standard** instead of the default **Basic**. For simplicity, we recommend allocating **Standard** public IP addresses for all six VMs used in the deployment. At the time of initial publication of this guide, the hourly cost for six such VMs was only $0.008 more than for six VMs with Basic addresses; for current pricing, see the [Microsoft documentation](https://azure.microsoft.com/en-us/pricing/details/ip-addresses/). @@ -96,7 +96,7 @@ In addition, to install NGINX software by following the linked instructions, you screenshot of Azure 'CreateVM-Canonical' page -7. If you are following these instructions to create the six VMs used in [Active-Active HA for NGINX Plus on Microsoft Azure Using the Azure Standard Load Balancer]({{< relref "high-availability-standard-load-balancer.md" >}}), their names are as follows: +7. If you are following these instructions to create the six VMs used in [Active-Active HA for NGINX Plus on Microsoft Azure Using the Azure Standard Load Balancer]({{< ref "high-availability-standard-load-balancer.md" >}}), their names are as follows: - ngx-plus-1 - ngx-plus-2 @@ -137,7 +137,7 @@ To install and configure NGINX Open Source or NGINX Plus on a VM, you need to o ## Installing NGINX Software -Once you have established a connection with an instance, you can install the NGINX software on it. Follow the instructions in the NGINX Plus Admin Guide for NGINX Open Source and [NGINX Plus]({{< relref "../../admin-guide/installing-nginx/installing-nginx-plus.md" >}}). The [Admin Guide]({{< relref "/nginx/admin-guide/" >}}) also provides instructions for many maintenance tasks. +Once you have established a connection with an instance, you can install the NGINX software on it. Follow the instructions in the NGINX Plus Admin Guide for NGINX Open Source and [NGINX Plus]({{< relref "../../admin-guide/installing-nginx/installing-nginx-plus.md" >}}). The [Admin Guide]({{< ref "/nginx/admin-guide/" >}}) also provides instructions for many maintenance tasks. ### Automating Installation with a Configuration Manager diff --git a/content/nginx/deployment-guides/migrate-hardware-adc/citrix-adc-configuration.md b/content/nginx/deployment-guides/migrate-hardware-adc/citrix-adc-configuration.md index fa527f09e..41ef9b58b 100644 --- a/content/nginx/deployment-guides/migrate-hardware-adc/citrix-adc-configuration.md +++ b/content/nginx/deployment-guides/migrate-hardware-adc/citrix-adc-configuration.md @@ -342,7 +342,7 @@ Logging and monitoring are important supporting functionality for load balancing Citrix ADC logs errors in its _event log_ and NGINX Plus in its [_error log_](https://nginx.org/en/docs/ngx_core_module.html#error_log). By default, Citrix ADC does not log individual requests, but can be configured to do so, using a separate weblog client. NGINX Plus has an [_access log_](https://nginx.org/en/docs/http/ngx_http_log_module.html) for which you can define customized formats to log many metrics (as captured in [variables](https://nginx.org/en/docs/varindex.html)) from both requests and responses. -The [NGINX Plus API](https://nginx.org/en/docs/http/ngx_http_api_module.html) module collects numerous statistics, which you can access via the API, display on the built‑in live activity monitoring dashboard, or pass to third‑party monitoring tools. For more detail on logging and monitoring see the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/monitoring/_index.md" >}}). +The [NGINX Plus API](https://nginx.org/en/docs/http/ngx_http_api_module.html) module collects numerous statistics, which you can access via the API, display on the built‑in live activity monitoring dashboard, or pass to third‑party monitoring tools. For more detail on logging and monitoring see the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/monitoring/_index.md" >}}). ### Revision History diff --git a/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md b/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md index d8feb030b..9dba53893 100644 --- a/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md +++ b/content/nginx/deployment-guides/migrate-hardware-adc/f5-big-ip-configuration.md @@ -444,7 +444,7 @@ The following configuration includes three additional directives which weren't d - The [proxy_http_version](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_http_version) directive sets the HTTP version to 1.1 for the connection to the backend server. - The `proxy_set_header Connection ""` directive clears the `Connection` header sent by the client, enabling NGINX Plus to keep encrypted keepalive connections open to the upstream servers. -We are also enabling [live activity monitoring](https://www.nginx.com/products/nginx/live-activity-monitoring) in the final `server` block. Live activity monitoring is implemented in the [NGINX Plus API](https://nginx.org/en/docs/http/ngx_http_api_module.html) module and is exclusive to NGINX Plus. The wide range of statistics reported by the API is displayed on the built‑in dashboard and can also be exported to any application performance management (APM) or monitoring tool that can consume JSON‑formatted messages. For more detail on logging and monitoring see the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/monitoring/_index.md" >}}). +We are also enabling [live activity monitoring](https://www.nginx.com/products/nginx/live-activity-monitoring) in the final `server` block. Live activity monitoring is implemented in the [NGINX Plus API](https://nginx.org/en/docs/http/ngx_http_api_module.html) module and is exclusive to NGINX Plus. The wide range of statistics reported by the API is displayed on the built‑in dashboard and can also be exported to any application performance management (APM) or monitoring tool that can consume JSON‑formatted messages. For more detail on logging and monitoring see the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/monitoring/_index.md" >}}). ```nginx upstream test_pool { diff --git a/content/nginx/deployment-guides/setting-up-nginx-demo-environment.md b/content/nginx/deployment-guides/setting-up-nginx-demo-environment.md index fcc69a0b6..a7c86da12 100644 --- a/content/nginx/deployment-guides/setting-up-nginx-demo-environment.md +++ b/content/nginx/deployment-guides/setting-up-nginx-demo-environment.md @@ -14,7 +14,7 @@ The instructions in this guide explain how to set up a simple demo environment t ## Prerequisites -This guide assumes you have already provisioned a number of host systems (physical servers, virtual machines, containers, or cloud instances) required for a deployment guide (if applicable) and installed NGINX Open Source or NGINX Plus on each instance as appropriate. For installation instructions, see the [NGINX Plus Admin Guide]({{< relref "/nginx/admin-guide/installing-nginx/_index.md" >}}). +This guide assumes you have already provisioned a number of host systems (physical servers, virtual machines, containers, or cloud instances) required for a deployment guide (if applicable) and installed NGINX Open Source or NGINX Plus on each instance as appropriate. For installation instructions, see the [NGINX Plus Admin Guide]({{< ref "/nginx/admin-guide/installing-nginx/_index.md" >}}). Some commands require `root` privilege. If appropriate for your environment, prefix commands with the `sudo` command. diff --git a/content/nginx/releases.md b/content/nginx/releases.md index 31e90afd6..25b8d2802 100644 --- a/content/nginx/releases.md +++ b/content/nginx/releases.md @@ -30,9 +30,9 @@ NGINX Plus R33 is a feature release: - NGINX usage reporting: Usage report is sent to F5 licensing endpoint [every hour](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) using the [secure](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_verify) connection. The initial usage report should be sent once NGINX Plus starts after installation or upgrade to R33. If the initial usage report is not received by the endpoint, NGINX Plus will stop processing traffic. A 180-day grace period can be [enabled](https://nginx.org/en/docs/ngx_mgmt_module.html#enforce_initial_report) to submit the initial usage report. - Optionally, for network-restricted environments, reporting can be [configured](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) to [NGINX Instance Manager]({{< relref "nim/index.md" >}}) from which the report can be sent to F5 licensing endpoint. + Optionally, for network-restricted environments, reporting can be [configured](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) to [NGINX Instance Manager]({{< ref "nim/index.md" >}}) from which the report can be sent to F5 licensing endpoint. - For more information about licensing and usage reporting, see [About subscription licenses]({{< relref "solutions/about-subscription-licenses.md" >}}) article and [`ngx_mgmt_module`](https://nginx.org/en/docs/ngx_mgmt_module.html) module documentation. + For more information about licensing and usage reporting, see [About subscription licenses]({{< ref "solutions/about-subscription-licenses.md" >}}) article and [`ngx_mgmt_module`](https://nginx.org/en/docs/ngx_mgmt_module.html) module documentation. - OCSP stapling support and client certificate validation with OCSP in the [stream](https://nginx.org/en/docs/stream/ngx_stream_ssl_module.html) module with the @@ -49,7 +49,7 @@ The argument is a file name in the `SSLKEYLOGFILE` format compatible with Wiresh - Response trailers support in proxy with the [`proxy_pass_trailers`](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass_trailers) directive that allows passing trailer fields from a proxied server to a client. -- The [NGINX JavaScript]({{< relref "nginx/admin-guide/dynamic-modules/nginscript.md" >}}) module was updated to version [0.8.7](https://nginx.org/en/docs/njs/changes.html#njs0.8.7), featuring QuickJS [runtime support](https://nginx.org/en/docs/njs/engine.html). +- The [NGINX JavaScript]({{< ref "nginx/admin-guide/dynamic-modules/nginscript.md" >}}) module was updated to version [0.8.7](https://nginx.org/en/docs/njs/changes.html#njs0.8.7), featuring QuickJS [runtime support](https://nginx.org/en/docs/njs/engine.html). - Added initial support for Post Quantum Cryptography. @@ -76,7 +76,7 @@ NGINX Plus R33 is supported on: - Oracle Linux 7.4+ is removed - SUSE Linux Enterprise Server 12 is deprecated - support for s390x architecture removed -- the [Lua]({{< relref "nginx/admin-guide/dynamic-modules/lua.md" >}}) module is no longer available for SUSE Linux Enterprise Server 12 +- the [Lua]({{< ref "nginx/admin-guide/dynamic-modules/lua.md" >}}) module is no longer available for SUSE Linux Enterprise Server 12 More information: [Announcing NGINX Plus R33](https://community.f5.com/kb/technicalarticles/announcing-nginx-plus-r33-release/336403) diff --git a/content/nginx/technical-specs.md b/content/nginx/technical-specs.md index 18a1e313b..7ee616da0 100644 --- a/content/nginx/technical-specs.md +++ b/content/nginx/technical-specs.md @@ -54,13 +54,13 @@ Dynamic modules are supported on the [same distributions as NGINX Plus](#support ## Supported SSL/TLS versions -NGINX Plus supports the following SSL/TLS protocols: -- SSLv2 -- SSLv3 -- TLSv1 -- TLSv1.1 -- TLSv1.2 -- TLSv1.3 +NGINX Plus supports the following SSL/TLS protocols: +- SSLv2 +- SSLv3 +- TLSv1 +- TLSv1.1 +- TLSv1.2 +- TLSv1.3 You can configure which protocols to enable or disable with the [ssl_protocols](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) directive. @@ -182,7 +182,7 @@ See [Sizing Guide for Deploying NGINX Plus on Bare Metal Servers](https://www.ng - [NGINX Plus API](https://nginx.org/en/docs/http/ngx_http_api_module.html) – Provide REST API for accessing metrics, configuring upstream server groups dynamically, and managing key-value pairs, without the need to reload NGINX configuration - [Key-Value Store](https://nginx.org/en/docs/http/ngx_http_keyval_module.html) – Create variables with values taken from key-value pairs managed by the [NGINX Plus API](https://nginx.org/en/docs/http/ngx_http_api_module.html#http_keyvals_) -- [Management](https://nginx.org/en/docs/ngx_mgmt_module.html) – Configure licensing and usage reporting of NGINX Plus installation to F5 licensing endpoint or [NGINX Instance Manager]({{< relref "nim/index.md" >}}) +- [Management](https://nginx.org/en/docs/ngx_mgmt_module.html) – Configure licensing and usage reporting of NGINX Plus installation to F5 licensing endpoint or [NGINX Instance Manager]({{< ref "nim/index.md" >}}) ### TCP and UDP Proxying and Load Balancing diff --git a/content/nginxaas-azure/app-protect/configure-waf.md b/content/nginxaas-azure/app-protect/configure-waf.md index 10ec762a6..18f2b0e57 100644 --- a/content/nginxaas-azure/app-protect/configure-waf.md +++ b/content/nginxaas-azure/app-protect/configure-waf.md @@ -105,4 +105,4 @@ To view the contents of the available security policies, navigate to the azure p ## What's next -[Enable App Protect WAF Logs]({{< relref "/nginxaas-azure/app-protect/enable-logging.md" >}}) +[Enable App Protect WAF Logs]({{< ref "/nginxaas-azure/app-protect/enable-logging.md" >}}) diff --git a/content/nginxaas-azure/app-protect/enable-logging.md b/content/nginxaas-azure/app-protect/enable-logging.md index 9fb34306d..8c4f80fe6 100644 --- a/content/nginxaas-azure/app-protect/enable-logging.md +++ b/content/nginxaas-azure/app-protect/enable-logging.md @@ -13,11 +13,11 @@ F5 NGINX as a Service for Azure (NGINXaaS) supports exporting NGINX App Protect ## Setting up operational logs -NGINX App Protect operational logs are sent to the NGINX error logs. See [Enable NGINX Logs]({{< relref "/nginxaas-azure/monitoring/enable-logging/">}}) to configure error logs. +NGINX App Protect operational logs are sent to the NGINX error logs. See [Enable NGINX Logs]({{< ref "/nginxaas-azure/monitoring/enable-logging/">}}) to configure error logs. ## Setting up security logs -1. Enable the NGINX Security Logs category in **Diagnostic Settings**. For more information on logging, see [Enable NGINX Logs]({{< relref "/nginxaas-azure/monitoring/enable-logging/">}}). +1. Enable the NGINX Security Logs category in **Diagnostic Settings**. For more information on logging, see [Enable NGINX Logs]({{< ref "/nginxaas-azure/monitoring/enable-logging/">}}). {{< img src="nginxaas-azure/security-diagnostic-setting.png" alt="Screenshot of the NGINXaaS WAF security logs diagnostic settings" >}} diff --git a/content/nginxaas-azure/app-protect/enable-waf.md b/content/nginxaas-azure/app-protect/enable-waf.md index 3df41538f..65e0a0a22 100644 --- a/content/nginxaas-azure/app-protect/enable-waf.md +++ b/content/nginxaas-azure/app-protect/enable-waf.md @@ -12,7 +12,7 @@ type: This guide explains how to enable F5 NGINX App Protect WAF on a F5 NGINX as a Service for Azure (NGINXaaS) deployment. [F5 NGINX App Protect WAF](https://docs.nginx.com/nginx-app-protect-waf/v5) provides web application firewall (WAF) security protection for your web applications, including OWASP Top 10; response inspection; Meta characters check; HTTP protocol compliance; evasion techniques; disallowed file types; JSON & XML well-formedness; sensitive parameters & Data Guard. ## Before you start -- NGINX App Protect WAF can only be enabled on NGINXaaS for Azure deployments with the **Standard v2** [plan]({{< relref "/nginxaas-azure/billing/overview.md" >}}) +- NGINX App Protect WAF can only be enabled on NGINXaaS for Azure deployments with the **Standard v2** [plan]({{< ref "/nginxaas-azure/billing/overview.md" >}}) ## Enable NGINX App Protect (Preview) NGINX App Protect is disabled by default and needs to be explicitly enabled on an NGINXaaS deployment. Follow these steps: @@ -29,4 +29,4 @@ Access the [Microsoft Azure portal](https://portal.azure.com) ## What's next -[Configure App Protect WAF]({{< relref "/nginxaas-azure/app-protect/configure-waf.md" >}}) +[Configure App Protect WAF]({{< ref "/nginxaas-azure/app-protect/configure-waf.md" >}}) diff --git a/content/nginxaas-azure/billing/overview.md b/content/nginxaas-azure/billing/overview.md index aed741000..4eaa5d4b4 100644 --- a/content/nginxaas-azure/billing/overview.md +++ b/content/nginxaas-azure/billing/overview.md @@ -58,8 +58,8 @@ Each NCU provisioned (not consumed) is billed at the rate specified on the [Azur * Total: `100 NCU·hours * 0.05$/NCU/hour = $5.00`. {{< note >}}Further guidance: -* For how many NCUs should you provision and how to scale to match workload, see the [Scaling Guidance]({{< relref "/nginxaas-azure/quickstart/scaling.md" >}}) -* To learn more about metrics related to NCUs, see the [NGINXaaS Statistics namespace]({{< relref "/nginxaas-azure/monitoring/metrics-catalog.md#nginxaas-statistics" >}}) +* For how many NCUs should you provision and how to scale to match workload, see the [Scaling Guidance]({{< ref "/nginxaas-azure/quickstart/scaling.md" >}}) +* To learn more about metrics related to NCUs, see the [NGINXaaS Statistics namespace]({{< ref "/nginxaas-azure/monitoring/metrics-catalog.md#nginxaas-statistics" >}}) {{< /note >}} diff --git a/content/nginxaas-azure/changelog-archive/changelog-2022.md b/content/nginxaas-azure/changelog-archive/changelog-2022.md index 5bf5bb79b..8556e99f6 100644 --- a/content/nginxaas-azure/changelog-archive/changelog-2022.md +++ b/content/nginxaas-azure/changelog-archive/changelog-2022.md @@ -7,9 +7,9 @@ url: /nginxaas/azure/changelog-archive/changelog-2022/ Learn about the updates, new features, and resolved bugs in F5 NGINX as a Service for Azure during the year 2022. -To see the latest changes, visit the [Changelog]({{< relref "/nginxaas-azure/changelog" >}}) page. +To see the latest changes, visit the [Changelog]({{< ref "/nginxaas-azure/changelog" >}}) page. -To see a list of currently active issues, visit the [Known issues]({{< relref "/nginxaas-azure/known-issues.md" >}}) page. +To see a list of currently active issues, visit the [Known issues]({{< ref "/nginxaas-azure/known-issues.md" >}}) page. ## December 14, 2022 @@ -27,24 +27,24 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ - {{% icon-resolved %}} **Absolute paths may now be used with the `js_import` directive.** - NGINXaaS for Azure has new restrictions on file paths for certificate files, njs files, etc. See the [NGINX Filesystem Restrictions table]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) for more information. Existing configurations will not be affected unless they need to be updated. + NGINXaaS for Azure has new restrictions on file paths for certificate files, njs files, etc. See the [NGINX Filesystem Restrictions table]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) for more information. Existing configurations will not be affected unless they need to be updated. ## November 22, 2022 - {{% icon-feature %}} **Logging support is now available** - Please visit the [Logging Support]({{< relref "/nginxaas-azure/monitoring/enable-logging/" >}}) documentation for more information on exporting NGINX logs with NGINXaaS for Azure. + Please visit the [Logging Support]({{< ref "/nginxaas-azure/monitoring/enable-logging/" >}}) documentation for more information on exporting NGINX logs with NGINXaaS for Azure. - {{% icon-resolved %}} **NGINXaaS for Azure ARM API schema supports previously unused fields `protectedFiles` and `logging`.** ## November 14, 2022 -- {{% icon-feature %}} NGINX deployment can be configured to send [metrics-based alerts]({{< relref "/nginxaas-azure/monitoring/configure-alerts.md" >}}). +- {{% icon-feature %}} NGINX deployment can be configured to send [metrics-based alerts]({{< ref "/nginxaas-azure/monitoring/configure-alerts.md" >}}). ## November 7, 2022 - {{% icon-feature %}} New deployments utilize [Availability Zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview) to ensure data planes are highly available. -- {{% icon-feature %}} Files containing sensitive data can be uploaded as a "Protected File", see: [NGINX Configuration]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) +- {{% icon-feature %}} Files containing sensitive data can be uploaded as a "Protected File", see: [NGINX Configuration]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) ## October 24, 2022 @@ -57,7 +57,7 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ - Central US - North Central US - See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of supported regions. + See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of supported regions. ## October 11, 2022 @@ -90,17 +90,17 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ - {{% icon-feature %}} **Basic caching is now supported** - For more information on caching with NGINXaaS for Azure, please visit the [Basic Caching]({{< relref "/nginxaas-azure/quickstart/basic-caching.md" >}}) documentation. + For more information on caching with NGINXaaS for Azure, please visit the [Basic Caching]({{< ref "/nginxaas-azure/quickstart/basic-caching.md" >}}) documentation. - {{% icon-feature %}} **Rate Limiting is now supported** - For information on rate limiting with NGINXaaS for Azure, please visit the [Rate Limiting]({{< relref "/nginxaas-azure/quickstart/rate-limiting.md" >}}) documentation. + For information on rate limiting with NGINXaaS for Azure, please visit the [Rate Limiting]({{< ref "/nginxaas-azure/quickstart/rate-limiting.md" >}}) documentation. ## May 24, 2022 ### Welcome to the NGINXaaS Public Preview -NGINXaaS for Azure is now available for public preview. Give it a try! If you find any issues please let us know by [raising a support ticket]({{< relref "/nginxaas-azure/troubleshooting/troubleshooting.md" >}}). +NGINXaaS for Azure is now available for public preview. Give it a try! If you find any issues please let us know by [raising a support ticket]({{< ref "/nginxaas-azure/troubleshooting/troubleshooting.md" >}}). -Visit the [Known issues]({{< relref "/nginxaas-azure/known-issues.md" >}}) section to learn about the issues present in this release. +Visit the [Known issues]({{< ref "/nginxaas-azure/known-issues.md" >}}) section to learn about the issues present in this release. diff --git a/content/nginxaas-azure/changelog-archive/changelog-2023.md b/content/nginxaas-azure/changelog-archive/changelog-2023.md index 11b408ebb..b1f778f43 100644 --- a/content/nginxaas-azure/changelog-archive/changelog-2023.md +++ b/content/nginxaas-azure/changelog-archive/changelog-2023.md @@ -7,9 +7,9 @@ url: /nginxaas/azure/changelog-archive/changelog-2023/ Learn about the updates, new features, and resolved bugs in F5 NGINX as a Service for Azure during the year 2023. -To see the latest changes, visit the [Changelog]({{< relref "/nginxaas-azure/changelog" >}}) page. +To see the latest changes, visit the [Changelog]({{< ref "/nginxaas-azure/changelog" >}}) page. -To see a list of currently active issues, visit the [Known issues]({{< relref "/nginxaas-azure/known-issues.md" >}}) page. +To see a list of currently active issues, visit the [Known issues]({{< ref "/nginxaas-azure/known-issues.md" >}}) page. ## December 19, 2023 @@ -25,26 +25,26 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ API version 9: - Per-worker connection statistics including accepted, dropped, active and idle connections, total and current requests - For a complete catalog of metrics, see the [Metrics Catalog]({{< relref "/nginxaas-azure/monitoring/metrics-catalog.md">}}). + For a complete catalog of metrics, see the [Metrics Catalog]({{< ref "/nginxaas-azure/monitoring/metrics-catalog.md">}}). ## December 6, 2023 - {{% icon-feature %}} **NGINXaaS for Azure now supports NGINX config dry-run** - NGINXaaS now supports the NGINX config dry-run. See the [Config Validation]({{< relref "/nginxaas-azure/getting-started/nginx-configuration#nginx-configuration-validation" >}}) documentation for instructions on how to use it. + NGINXaaS now supports the NGINX config dry-run. See the [Config Validation]({{< ref "/nginxaas-azure/getting-started/nginx-configuration#nginx-configuration-validation" >}}) documentation for instructions on how to use it. ## November 2, 2023 - {{% icon-feature %}} **NGINXaaS for Azure now supports the Image-Filter dynamic module** - NGINXaaS now supports the [Image-Filter](http://nginx.org/en/docs/http/ngx_http_image_filter_module.html) dynamic module. For a complete list of allowed directives, see the [Configuration Directives List]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). + NGINXaaS now supports the [Image-Filter](http://nginx.org/en/docs/http/ngx_http_image_filter_module.html) dynamic module. For a complete list of allowed directives, see the [Configuration Directives List]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). - {{% icon-feature %}} **NGINXaaS for Azure is now generally available in more regions** NGINXaaS for Azure is now available in Japan East. - See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. + See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. ## October 31, 2023 @@ -70,9 +70,9 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ To get started using HTTP/3 and NGINXaaS: - Update the [network security group](https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic#create-security-rules) associated with the NGINXaaS deployment’s subnet to allow inbound traffic for HTTP/3 UDP ports in the NGINX configuration. - See our [FAQ]({{< relref "/nginxaas-azure/faq" >}}), for limits on how many unique ports may be specified in a configuration and a list of restricted ports. + See our [FAQ]({{< ref "/nginxaas-azure/faq" >}}), for limits on how many unique ports may be specified in a configuration and a list of restricted ports. - - Additionally, add a [Managed Identity]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) to your deployment and create [SSL/TLS Certificates]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/" >}}). For more information on using NGINX with HTTP/3, see the [HTTP/3 module](https://nginx.org/en/docs/http/ngx_http_v3_module.html). + - Additionally, add a [Managed Identity]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) to your deployment and create [SSL/TLS Certificates]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/" >}}). For more information on using NGINX with HTTP/3, see the [HTTP/3 module](https://nginx.org/en/docs/http/ngx_http_v3_module.html). ## October 25, 2023 @@ -80,7 +80,7 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ NGINXaaS for Azure is now available in North Europe. - See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. + See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. ## October 15, 2023 @@ -100,15 +100,15 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ The maximum capacity of NGINXaaS for Azure has been increased from 160 NCUs to **500 NCUs** under the **Standard** plan. Existing deployments can also benefit from this new limit if users choose to scale up. - To adjust capacity, refer to [Adjusting Capacity]({{< relref "/nginxaas-azure/quickstart/scaling.md#adjusting-capacity" >}}). + To adjust capacity, refer to [Adjusting Capacity]({{< ref "/nginxaas-azure/quickstart/scaling.md#adjusting-capacity" >}}). - To learn more about capacity restrictions, refer to [Capacity Restrictions]({{< relref "/nginxaas-azure/quickstart/scaling.md#capacity-restrictions" >}}). + To learn more about capacity restrictions, refer to [Capacity Restrictions]({{< ref "/nginxaas-azure/quickstart/scaling.md#capacity-restrictions" >}}). ## September 13, 2023 - {{% icon-feature %}} **NGINXaaS for Azure now supports serving static content** - An NGINXaaS deployment can now serve static content. See [Hosting Static Content]({{< relref "/nginxaas-azure/quickstart/hosting-static-content.md" >}}) for details. + An NGINXaaS deployment can now serve static content. See [Hosting Static Content]({{< ref "/nginxaas-azure/quickstart/hosting-static-content.md" >}}) for details. ## August 23, 2023 @@ -122,11 +122,11 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ NGINXaaS new deployments will now include a default configuration, providing a smoother setup experience compared to the previous empty configuration. - To learn more about configuration, refer to [Upload an NGINX Configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}). + To learn more about configuration, refer to [Upload an NGINX Configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}). - {{% icon-feature %}} **NGINXaaS for Azure now supports more directives** - NGINXaaS now supports new directives. For a complete list of allowed directives, see the [Configuration Directives List]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). + NGINXaaS now supports new directives. For a complete list of allowed directives, see the [Configuration Directives List]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). ## July 27, 2023 @@ -134,15 +134,15 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ NGINXaaS for Azure allowed users to create deployments with a maximum capacity of 80 NCUs under the **Standard** plan. A recent change now allows users to deploy up to **160 NCUs**. Existing NGINXaaS deployments should also scale up to 160 NCUs. - To adjust capacity, refer [Adjusting Capacity]({{< relref "/nginxaas-azure/quickstart/scaling.md#adjusting-capacity" >}}). + To adjust capacity, refer [Adjusting Capacity]({{< ref "/nginxaas-azure/quickstart/scaling.md#adjusting-capacity" >}}). - To learn more about capacity restrictions, refer to [Capacity Restrictions]({{< relref "/nginxaas-azure/quickstart/scaling.md#capacity-restrictions" >}}). + To learn more about capacity restrictions, refer to [Capacity Restrictions]({{< ref "/nginxaas-azure/quickstart/scaling.md#capacity-restrictions" >}}). ## July 13, 2023 - {{% icon-feature %}} **NGINXaaS for Azure automatically rotates SSL/TLS certificates** - NGINXaaS for Azure now automatically retrieves renewed certificates from Azure Key Vault and applies them to your NGINX deployment. To learn more about this new feature, refer to [Certificate Rotation]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md#certificate-rotation" >}}). + NGINXaaS for Azure now automatically retrieves renewed certificates from Azure Key Vault and applies them to your NGINX deployment. To learn more about this new feature, refer to [Certificate Rotation]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md#certificate-rotation" >}}). ## July 7, 2023 @@ -180,7 +180,7 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ - {{% icon-feature %}} **NGINXaaS for Azure supports new directives** - NGINXaaS now allows the `ssl_preread` directive and most directives from the `ngx_http_fastcgi_module` module. For a complete list of allowed directives, see the [Configuration Directives List]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). + NGINXaaS now allows the `ssl_preread` directive and most directives from the `ngx_http_fastcgi_module` module. For a complete list of allowed directives, see the [Configuration Directives List]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). ## May 31, 2023 @@ -190,7 +190,7 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ - West US 3 - See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of supported regions. + See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of supported regions. ## May 17, 2023 @@ -234,7 +234,7 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ } ``` - To get started using HTTP/2 and NGINXaaS, add a [Managed Identity]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) to your deployment and create [SSL/TLS Certificates]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/" >}}). For more information on using NGINX with HTTP/2, see the [HTTP/2 module](https://nginx.org/en/docs/http/ngx_http_v2_module.html). + To get started using HTTP/2 and NGINXaaS, add a [Managed Identity]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) to your deployment and create [SSL/TLS Certificates]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/" >}}). For more information on using NGINX with HTTP/2, see the [HTTP/2 module](https://nginx.org/en/docs/http/ngx_http_v2_module.html). - {{% icon-resolved %}} NGINXaaS can now serve static files with the `error_page` directive. @@ -244,7 +244,7 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ NGINXaaS now accepts NGINX directives to secure traffic between NGINX and upstream using SSL/TLS certificates. - Refer to [Securing Upstream Traffic]({{< relref "/nginxaas-azure/quickstart/security-controls/securing-upstream-traffic.md">}}) for more details on how to configure NGINXaaS with these directives. + Refer to [Securing Upstream Traffic]({{< ref "/nginxaas-azure/quickstart/security-controls/securing-upstream-traffic.md">}}) for more details on how to configure NGINXaaS with these directives. ## April 7, 2023 @@ -265,7 +265,7 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ Update the [network security group's inbound security rules](https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic#create-security-rules) associated with the NGINXaaS deployment's subnet to allow inbound traffic for all listen ports in the NGINX configuration. - See our [FAQ]({{< relref "/nginxaas-azure/faq" >}}), for limits on how many unique ports may be specified in a configuration and a list of restricted ports. + See our [FAQ]({{< ref "/nginxaas-azure/faq" >}}), for limits on how many unique ports may be specified in a configuration and a list of restricted ports. ## March 16, 2023 @@ -298,16 +298,16 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ NGINXaaS, powered by [NGINX Plus](https://www.nginx.com/products/nginx/), is a fully managed service that removes the burden of deploying your own NGINX Plus cluster, installing libraries, upgrading, and managing it. - NGINXaaS simplifies the process of moving your [existing NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration#add-nginx-configuration" >}}) to the Azure cloud. Once your configurations are moved to Azure, [securely manage SSL/TLS certificates and keys stored in Azure Key Vault and reference them within your NGINX configurations]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}). You can [watch your application's traffic in real time]({{< relref "/nginxaas-azure/monitoring/enable-monitoring" >}}) with Azure monitoring and alerts, and scale your deployment to fit your needs, maximizing cost efficiency. - You can create, update, and delete your NGINXaaS deployment using the [Azure Resource Manager]({{< relref "/nginxaas-azure/client-tools/templates.md" >}}), the [Azure SDK]({{< relref "/nginxaas-azure/client-tools/sdk" >}}), [CLI]({{< relref "/nginxaas-azure/getting-started/create-deployment/deploy-azure-cli.md" >}}), and [Terraform]({{< relref "/nginxaas-azure/getting-started/create-deployment/deploy-terraform.md" >}}) in addition to the [Azure portal]({{< relref "/nginxaas-azure/getting-started/create-deployment/" >}}). + NGINXaaS simplifies the process of moving your [existing NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration#add-nginx-configuration" >}}) to the Azure cloud. Once your configurations are moved to Azure, [securely manage SSL/TLS certificates and keys stored in Azure Key Vault and reference them within your NGINX configurations]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}). You can [watch your application's traffic in real time]({{< ref "/nginxaas-azure/monitoring/enable-monitoring" >}}) with Azure monitoring and alerts, and scale your deployment to fit your needs, maximizing cost efficiency. + You can create, update, and delete your NGINXaaS deployment using the [Azure Resource Manager]({{< ref "/nginxaas-azure/client-tools/templates.md" >}}), the [Azure SDK]({{< ref "/nginxaas-azure/client-tools/sdk" >}}), [CLI]({{< ref "/nginxaas-azure/getting-started/create-deployment/deploy-azure-cli.md" >}}), and [Terraform]({{< ref "/nginxaas-azure/getting-started/create-deployment/deploy-terraform.md" >}}) in addition to the [Azure portal]({{< ref "/nginxaas-azure/getting-started/create-deployment/" >}}). Our new "Standard" plan is ready for production workloads. To learn more, refer to the following NGINXaaS documentation: - - [NGINXaaS for Azure overview]({{< relref "/nginxaas-azure/overview/overview.md" >}}) - - [NGINXaaS, NGINX Plus, and NGINX Open Source feature comparison]({{< relref "/nginxaas-azure/overview/feature-comparison.md" >}}) - - [NGINXaaS billing details]({{< relref "/nginxaas-azure/billing/overview.md" >}}) + - [NGINXaaS for Azure overview]({{< ref "/nginxaas-azure/overview/overview.md" >}}) + - [NGINXaaS, NGINX Plus, and NGINX Open Source feature comparison]({{< ref "/nginxaas-azure/overview/feature-comparison.md" >}}) + - [NGINXaaS billing details]({{< ref "/nginxaas-azure/billing/overview.md" >}}) ## January 10, 2023 diff --git a/content/nginxaas-azure/changelog-archive/changelog-2024.md b/content/nginxaas-azure/changelog-archive/changelog-2024.md index b2f54c8ad..525f990e7 100644 --- a/content/nginxaas-azure/changelog-archive/changelog-2024.md +++ b/content/nginxaas-azure/changelog-archive/changelog-2024.md @@ -7,22 +7,22 @@ url: /nginxaas/azure/changelog-archive/changelog-2024/ Learn about the updates, new features, and resolved bugs in F5 NGINX as a Service for Azure during the year 2024. -To see the latest changes, visit the [Changelog]({{< relref "/nginxaas-azure/changelog" >}}) page. +To see the latest changes, visit the [Changelog]({{< ref "/nginxaas-azure/changelog" >}}) page. -To see a list of currently active issues, visit the [Known issues]({{< relref "/nginxaas-azure/known-issues.md" >}}) page. +To see a list of currently active issues, visit the [Known issues]({{< ref "/nginxaas-azure/known-issues.md" >}}) page. ## December 17, 2024 - {{% icon-feature %}} **NGINXaaS for Azure can integrate with Azure Network Security Perimeter** - NGINXaaS can now integrate with [Azure Network Security Perimeter](https://learn.microsoft.com/en-us/azure/private-link/network-security-perimeter-concepts). This integration allows users to set up access rules, so their NGINXaaS deployment can retrieve certificates from Azure Key Vault, while blocking all other public access to the key vault. For more information, please refer to the [Configure Network Security Perimeter]({{< relref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}}) documentation. + NGINXaaS can now integrate with [Azure Network Security Perimeter](https://learn.microsoft.com/en-us/azure/private-link/network-security-perimeter-concepts). This integration allows users to set up access rules, so their NGINXaaS deployment can retrieve certificates from Azure Key Vault, while blocking all other public access to the key vault. For more information, please refer to the [Configure Network Security Perimeter]({{< ref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}}) documentation. ## December 3, 2024 - {{% icon-feature %}} **NGINXaaS for Azure now supports the GeoIP2 dynamic module** - NGINXaaS now supports the [GeoIP2](https://github.com/leev/ngx_http_geoip2_module) dynamic module. For more information, see [GeoIP2 quickstart]({{< relref "/nginxaas-azure/quickstart/geoip2.md">}}). For a complete list of allowed directives, see the [Configuration Directives List]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview/#configuration-directives-list" >}}). + NGINXaaS now supports the [GeoIP2](https://github.com/leev/ngx_http_geoip2_module) dynamic module. For more information, see [GeoIP2 quickstart]({{< ref "/nginxaas-azure/quickstart/geoip2.md">}}). For a complete list of allowed directives, see the [Configuration Directives List]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview/#configuration-directives-list" >}}). ## November 18, 2024 @@ -38,13 +38,13 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ Users can now view the file paths and associated metadata of protected files added to the NGINX configuration of an NGINXaaS deployment, while the file contents remain confidential. Users can also overwrite an existing protected file with new file contents or resubmit it without having to provide the file contents again. - For more details on protected files, refer to the [Add an NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#add-an-nginx-configuration" >}}) section. + For more details on protected files, refer to the [Add an NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#add-an-nginx-configuration" >}}) section. ## October 23, 2024 - {{% icon-feature %}} **NGINXaaS Load Balancer for Kubernetes preview release** - You can now use NGINXaaS as an external load balancer to direct traffic into Kubernetes. For details, see the [quickstart]({{< relref "/nginxaas-azure/quickstart/loadbalancer-kubernetes.md" >}}). + You can now use NGINXaaS as an external load balancer to direct traffic into Kubernetes. For details, see the [quickstart]({{< ref "/nginxaas-azure/quickstart/loadbalancer-kubernetes.md" >}}). ## October 10, 2024 @@ -54,13 +54,13 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ - Brazil South - See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. + See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. ## September 18, 2024 - {{% icon-feature %}} **NGINXaaS is now running NGINX Plus Release 32 (R32) in the Stable Upgrade Channel** - NGINXaaS for Azure deployments using the **Stable** [Upgrade Channel]({{< relref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}) have now been automatically upgraded to [NGINX Plus Release 32 (R32)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-32-r32). This upgrade also includes updates to the following NGINX Plus modules: + NGINXaaS for Azure deployments using the **Stable** [Upgrade Channel]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}) have now been automatically upgraded to [NGINX Plus Release 32 (R32)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-32-r32). This upgrade also includes updates to the following NGINX Plus modules: - nginx-plus-module-headers-more - nginx-plus-module-image-filter - nginx-plus-module-lua @@ -69,7 +69,7 @@ To see a list of currently active issues, visit the [Known issues]({{< relref "/ - nginx-plus-module-otel - nginx-plus-module-xslt - For a complete list of allowed directives, see the [Configuration Directives List]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). + For a complete list of allowed directives, see the [Configuration Directives List]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). ## September 13, 2024 @@ -97,13 +97,13 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d - {{% icon-feature %}} **NGINXaaS for Azure now supports NGINX App Protect WAF in Preview** - NGINXaaS now supports [NGINX App Protect WAF](https://docs.nginx.com/nginx-app-protect-waf/v5) in Preview as part of the [Standard v2 plan]({{< relref "/nginxaas-azure/billing/overview.md#standard-v2-plan">}}). For more information, see [enable WAF]({{< relref "/nginxaas-azure/app-protect/enable-waf.md">}}). + NGINXaaS now supports [NGINX App Protect WAF](https://docs.nginx.com/nginx-app-protect-waf/v5) in Preview as part of the [Standard v2 plan]({{< ref "/nginxaas-azure/billing/overview.md#standard-v2-plan">}}). For more information, see [enable WAF]({{< ref "/nginxaas-azure/app-protect/enable-waf.md">}}). ## Aug 16, 2024 - {{% icon-feature %}} **Notification on update to deployments using the Stable Upgrade Channel** - NGINXaaS for Azure deployments using the **Stable** [Upgrade Channel]({{< relref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}) will be updated to [NGINX Plus Release 32 (R32)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-32-r32) during the week of September 16-22, 2024. This will also include updates to the following NGINX Plus modules: + NGINXaaS for Azure deployments using the **Stable** [Upgrade Channel]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}) will be updated to [NGINX Plus Release 32 (R32)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-32-r32) during the week of September 16-22, 2024. This will also include updates to the following NGINX Plus modules: - nginx-plus-module-headers-more - nginx-plus-module-image-filter - nginx-plus-module-lua @@ -112,9 +112,9 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d - nginx-plus-module-otel - nginx-plus-module-xslt - Please review the [NGINX Plus Release 32 (R32)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-32-r32) Release Notes carefully. If you have any concerns, it's recommended to validate your configuration against NGINX Plus R32 by setting up a test deployment using the **Preview** [Upgrade Channel]({{< relref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). See [these instructions]({{< relref "/nginxaas-azure/quickstart/recreate.md" >}}) on how to set up a deployment similar to your current one. + Please review the [NGINX Plus Release 32 (R32)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-32-r32) Release Notes carefully. If you have any concerns, it's recommended to validate your configuration against NGINX Plus R32 by setting up a test deployment using the **Preview** [Upgrade Channel]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). See [these instructions]({{< ref "/nginxaas-azure/quickstart/recreate.md" >}}) on how to set up a deployment similar to your current one. - If you have any questions or concerns, please [contact us]({{< relref "/nginxaas-azure/troubleshooting/troubleshooting.md" >}}). + If you have any questions or concerns, please [contact us]({{< ref "/nginxaas-azure/troubleshooting/troubleshooting.md" >}}). ## July 30, 2024 @@ -125,7 +125,7 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d - Central India - South India - See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. + See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. ## July 23, 2024 @@ -135,7 +135,7 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d - Germany West Central - See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. + See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. ## July 10, 2024 @@ -146,31 +146,31 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d - Southeast Asia - Sweden Central - See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. + See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. ## June 28, 2024 - {{% icon-feature %}} **NGINXaaS for Azure now supports the Lua dynamic module** - NGINXaaS now supports the [Lua](https://github.com/openresty/lua-nginx-module) dynamic module `v0.10.25`. The `lua_capture_error_log` directive is not supported at this time. For a complete list of allowed directives, see the [Configuration Directives List]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). + NGINXaaS now supports the [Lua](https://github.com/openresty/lua-nginx-module) dynamic module `v0.10.25`. The `lua_capture_error_log` directive is not supported at this time. For a complete list of allowed directives, see the [Configuration Directives List]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). ## June 18, 2024 - {{% icon-feature %}} **NGINXaaS now supports NGINX Plus Release 31 (R31)** - NGINXaaS now supports [NGINX Plus Release 31 (R31)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-31-r31). For a complete list of allowed directives, see the [Configuration Directives List]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). + NGINXaaS now supports [NGINX Plus Release 31 (R31)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-31-r31). For a complete list of allowed directives, see the [Configuration Directives List]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). ## June 17, 2024 - {{% icon-feature %}} **NGINXaaS for Azure now supports the Headers-More dynamic module** - NGINXaaS now supports the [Headers-More](https://github.com/openresty/headers-more-nginx-module) dynamic module. For a complete list of allowed directives, see the [Configuration Directives List]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). + NGINXaaS now supports the [Headers-More](https://github.com/openresty/headers-more-nginx-module) dynamic module. For a complete list of allowed directives, see the [Configuration Directives List]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). ## June 6, 2024 - {{% icon-feature %}} **Notification on update to deployments using the Stable Upgrade Channel** - NGINXaaS for Azure deployments using the **Stable** [Upgrade Channel]({{< relref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}) will be updated to [NGINX Plus Release 31 (R31)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-31-r31) during the week of June 17-23, 2024. This will also include updates to the following NGINX Plus modules: + NGINXaaS for Azure deployments using the **Stable** [Upgrade Channel]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}) will be updated to [NGINX Plus Release 31 (R31)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-31-r31) during the week of June 17-23, 2024. This will also include updates to the following NGINX Plus modules: - nginx-plus-module-headers-more - nginx-plus-module-image-filter @@ -180,15 +180,15 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d - nginx-plus-module-otel - nginx-plus-module-xslt - Please review the [NGINX Plus Release 31 (R31)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-31-r31) Release Notes carefully. If you have any concerns, it's recommended to validate your configuration against NGINX Plus R31 by setting up a test deployment using the **Preview** [Upgrade Channel]({{< relref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). See [these instructions]({{< relref "/nginxaas-azure/quickstart/recreate.md" >}}) on how to set up a deployment similar to your current one. + Please review the [NGINX Plus Release 31 (R31)](https://docs.nginx.com/nginx/releases/#nginxplusrelease-31-r31) Release Notes carefully. If you have any concerns, it's recommended to validate your configuration against NGINX Plus R31 by setting up a test deployment using the **Preview** [Upgrade Channel]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). See [these instructions]({{< ref "/nginxaas-azure/quickstart/recreate.md" >}}) on how to set up a deployment similar to your current one. - If you have any questions or concerns, please [contact us]({{< relref "/nginxaas-azure/troubleshooting/troubleshooting.md" >}}). + If you have any questions or concerns, please [contact us]({{< ref "/nginxaas-azure/troubleshooting/troubleshooting.md" >}}). ## May 20, 2024 - {{% icon-feature %}} **NGINXaaS for Azure now supports a Basic plan for dev/test purposes** - For trial, development and testing purposes without SLA guarantees, redundancy or scaling, NGINXaaS provides the ability to choose a Basic plan deployment. For more information, see [pricing plans]({{< relref "nginxaas-azure/billing/overview.md#pricing-plans">}}). + For trial, development and testing purposes without SLA guarantees, redundancy or scaling, NGINXaaS provides the ability to choose a Basic plan deployment. For more information, see [pricing plans]({{< ref "nginxaas-azure/billing/overview.md#pricing-plans">}}). ## April 18, 2024 @@ -204,11 +204,11 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d [Runtime State Sharing](https://docs.nginx.com/nginx/admin-guide/high-availability/zone_sync/) enables NGINXaaS to be configured for use cases such as [OIDC](https://github.com/nginxinc/nginx-openid-connect) and [SAML](https://github.com/nginxinc/nginx-saml) authentication. - Refer to [Runtime State Sharing with NGINXaaS for Azure]({{< relref "/nginxaas-azure/quickstart/runtime-state-sharing.md" >}}) for the configuration guide. + Refer to [Runtime State Sharing with NGINXaaS for Azure]({{< ref "/nginxaas-azure/quickstart/runtime-state-sharing.md" >}}) for the configuration guide. - {{% icon-feature %}} **NGINXaaS for Azure now supports metrics from stream zone_sync statistics** - For a complete catalog of metrics, see the [Metrics Catalog]({{< relref "/nginxaas-azure/monitoring/metrics-catalog.md">}}). + For a complete catalog of metrics, see the [Metrics Catalog]({{< ref "/nginxaas-azure/monitoring/metrics-catalog.md">}}). ## April 9, 2024 @@ -216,8 +216,8 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d In addition to the Azure Portal and the ARM API version `2024-01-01-preview`, you can now use all other client tools, such as the Azure CLI or Terraform, to enable autoscaling or specify an Upgrade Channel. - For more information on autoscaling, see the [Autoscaling documentation]({{< relref "/nginxaas-azure/quickstart/scaling.md#autoscaling">}}). - For more information on Upgrade Channels, see [Upgrade Channels]({{< relref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). + For more information on autoscaling, see the [Autoscaling documentation]({{< ref "/nginxaas-azure/quickstart/scaling.md#autoscaling">}}). + For more information on Upgrade Channels, see [Upgrade Channels]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). - {{% icon-feature %}} **NGINXaaS for Azure can now accept a system assigned and a user assigned managed identity** @@ -227,7 +227,7 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d - {{% icon-feature %}} **NGINXaaS for Azure now supports Upgrade Channels** - An Upgrade Channels lets you control the frequency at which your NGINXaaS deployment receives upgrades for NGINX Plus and its related modules. For more information, see [Upgrade Channels]({{< relref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). + An Upgrade Channels lets you control the frequency at which your NGINXaaS deployment receives upgrades for NGINX Plus and its related modules. For more information, see [Upgrade Channels]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). ## March 20, 2024 @@ -235,13 +235,13 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d Enable autoscaling to automatically adjust the size of your deployment based on the traffic requirements. Autoscaling can be enabled in the Azure Portal or the ARM API version `2024-01-01-preview`, with other client tools coming soon. - For more information on autoscaling, see the [Autoscaling documentation]({{< relref "/nginxaas-azure/quickstart/scaling.md#autoscaling">}}). + For more information on autoscaling, see the [Autoscaling documentation]({{< ref "/nginxaas-azure/quickstart/scaling.md#autoscaling">}}). ## March 13, 2024 - {{% icon-resolved %}} **Fixed a known issue causing Terraform to show an error while trying to manage configuration of a new deployment (ID-891)** - NGINXaaS for Azure now requires users to take an explicit action to create a default NGINX configuration with a deployment. We have added the "Apply default NGINX configuration" field in the [updated deployment creation workflow]({{< relref "/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md#networking-tab" >}}) in the Azure portal. For other client tools like Terraform, NGINXaaS for Azure now requires users to explicitly create an NGINX configuration. + NGINXaaS for Azure now requires users to take an explicit action to create a default NGINX configuration with a deployment. We have added the "Apply default NGINX configuration" field in the [updated deployment creation workflow]({{< ref "/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md#networking-tab" >}}) in the Azure portal. For other client tools like Terraform, NGINXaaS for Azure now requires users to explicitly create an NGINX configuration. ## March 5, 2024 @@ -251,11 +251,11 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d Please note that NGINXaaS does not support outbound connections on port 25, and an alternative port should be used for SMTP. Additionally, ensure network connectivity from the NGINXaaS deployment to both the mail server and authentication server to support proper mail authentication. - For a complete list of allowed directives, see the [Configuration Directives List]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). + For a complete list of allowed directives, see the [Configuration Directives List]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). - {{% icon-feature %}} **NGINXaaS for Azure now supports resolver statistics metrics** - For a complete catalog of metrics, see the [Metrics Catalog]({{< relref "/nginxaas-azure/monitoring/metrics-catalog.md">}}). + For a complete catalog of metrics, see the [Metrics Catalog]({{< ref "/nginxaas-azure/monitoring/metrics-catalog.md">}}). ## February 15, 2024 @@ -267,13 +267,13 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d - Korea South - Korea Central - See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. + See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. ## February 8, 2024 - {{% icon-feature %}} ****NGINXaaS for Azure now supports [Diagnostic settings in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings) to send NGINX logs to different destinations**** - An NGINXaaS deployment now supports adding Diagnostic Settings to export NGINX logs. See [Enable NGINX Logs]({{< relref "/nginxaas-azure/monitoring/enable-logging/" >}}) for more details. + An NGINXaaS deployment now supports adding Diagnostic Settings to export NGINX logs. See [Enable NGINX Logs]({{< ref "/nginxaas-azure/monitoring/enable-logging/" >}}) for more details. ## January 22, 2024 @@ -281,4 +281,4 @@ An NGINXaaS deployment can now be gracefully updated to a new subnet with zero d NGINXaaS for Azure is now available in Canada Central. - See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. + See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. diff --git a/content/nginxaas-azure/changelog.md b/content/nginxaas-azure/changelog.md index f2a6d7546..7e7345552 100644 --- a/content/nginxaas-azure/changelog.md +++ b/content/nginxaas-azure/changelog.md @@ -9,9 +9,9 @@ url: /nginxaas/azure/changelog/ Learn about the latest updates, new features, and resolved bugs in F5 NGINX as a Service for Azure. -To see a list of currently active issues, visit the [Known issues]({{< relref "/nginxaas-azure/known-issues.md" >}}) page. +To see a list of currently active issues, visit the [Known issues]({{< ref "/nginxaas-azure/known-issues.md" >}}) page. -To review older entries, visit the [Changelog archive]({{< relref "/nginxaas-azure/changelog-archive" >}}) section. +To review older entries, visit the [Changelog archive]({{< ref "/nginxaas-azure/changelog-archive" >}}) section. ## March 31, 2025 @@ -24,28 +24,28 @@ To review older entries, visit the [Changelog archive]({{< relref "/nginxaas-azu - UK West - UK South -See the [Supported Regions]({{< relref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. +See the [Supported Regions]({{< ref "/nginxaas-azure/overview/overview.md#supported-regions" >}}) documentation for the full list of regions where NGINXaaS for Azure is available. ## March 13, 2025 - {{% icon-resolved %}} **Percentage capacity metric** - We’re introducing the new percentage capacity metric, `nginxaas.capacity.percentage`, which provides a more accurate estimate of your deployment's load compared to the previous consumed NCUs metric. The new capacity metric expresses the capacity consumed as a percentage of the deployment's total capacity. Please modify any alerts and monitoring on deployment performance to use the new percentage capacity metric. The consumed NCUs metric is being deprecated and will be removed in the near future. Please see [Scaling guidance]({{< relref "/nginxaas-azure/quickstart/scaling.md">}}) for more details. + We’re introducing the new percentage capacity metric, `nginxaas.capacity.percentage`, which provides a more accurate estimate of your deployment's load compared to the previous consumed NCUs metric. The new capacity metric expresses the capacity consumed as a percentage of the deployment's total capacity. Please modify any alerts and monitoring on deployment performance to use the new percentage capacity metric. The consumed NCUs metric is being deprecated and will be removed in the near future. Please see [Scaling guidance]({{< ref "/nginxaas-azure/quickstart/scaling.md">}}) for more details. ## March 5, 2025 - {{% icon-info %}} **Retirement of Standard Plan** - The `Standard` plan for NGINXaaS for Azure has been retired, and you can no longer use it to create new deployments. If you have a deployment running on the `Standard` plan, consider [migrating]({{< relref "/nginxaas-azure/troubleshooting/migrate-from-standard.md">}}) it to the [`Standard V2 plan`]({{< relref "/nginxaas-azure/billing/overview.md#standard-v2-plan" >}}) to access new features such as NGINX App Protect WAF and additional listen ports. Plan migration does not incur downtime. + The `Standard` plan for NGINXaaS for Azure has been retired, and you can no longer use it to create new deployments. If you have a deployment running on the `Standard` plan, consider [migrating]({{< ref "/nginxaas-azure/troubleshooting/migrate-from-standard.md">}}) it to the [`Standard V2 plan`]({{< ref "/nginxaas-azure/billing/overview.md#standard-v2-plan" >}}) to access new features such as NGINX App Protect WAF and additional listen ports. Plan migration does not incur downtime. ## February 10, 2025 - {{% icon-feature %}} **NGINXaaS Load Balancer for Kubernetes is now Generally Available** - NGINXaaS can now be used as an external load balancer to route traffic to workloads running in your Azure Kubernetes Cluster. To learn how to set it up, see the [Quickstart Guide]({{< relref "/nginxaas-azure/quickstart/loadbalancer-kubernetes.md">}}). + NGINXaaS can now be used as an external load balancer to route traffic to workloads running in your Azure Kubernetes Cluster. To learn how to set it up, see the [Quickstart Guide]({{< ref "/nginxaas-azure/quickstart/loadbalancer-kubernetes.md">}}). ## January 23, 2025 - {{< icon-feature >}} **In-place SKU Migration from Standard to Standard V2** - You can now migrate NGINXaaS for Azure from the Standard plan to the Standard V2 plan without redeploying. We recommend upgrading to the Standard V2 plan to access features like NGINX App Protect WAF and more listen ports. The Standard plan will be retired soon. For migration details, see [migrate from standard]({{< relref "/nginxaas-azure/troubleshooting/migrate-from-standard.md">}}). + You can now migrate NGINXaaS for Azure from the Standard plan to the Standard V2 plan without redeploying. We recommend upgrading to the Standard V2 plan to access features like NGINX App Protect WAF and more listen ports. The Standard plan will be retired soon. For migration details, see [migrate from standard]({{< ref "/nginxaas-azure/troubleshooting/migrate-from-standard.md">}}). diff --git a/content/nginxaas-azure/client-tools/sdk.md b/content/nginxaas-azure/client-tools/sdk.md index fab5d2092..50305b9e7 100644 --- a/content/nginxaas-azure/client-tools/sdk.md +++ b/content/nginxaas-azure/client-tools/sdk.md @@ -14,7 +14,7 @@ F5 NGINX as a Service for Azure (NGINXaaS) deployments can be managed using the ## Prerequisites -- [NGINXaaS Prerequisites]({{< relref "/nginxaas-azure/getting-started/prerequisites.md" >}}) +- [NGINXaaS Prerequisites]({{< ref "/nginxaas-azure/getting-started/prerequisites.md" >}}) - Install Azure Identity package - [azure-identity](https://pypi.org/project/azure-identity/) - Install the NGINX SDK - [azure-mgmt-nginx](https://pypi.org/project/azure-mgmt-nginx/) - See [NGINXaaS Snippets](https://github.com/nginxinc/nginxaas-for-azure-snippets/tree/main/sdk/python/deployments/) for an example script to create prerequisite resources. @@ -30,8 +30,8 @@ For example scripts to create or update deployment resources, see [NGINXaaS Snip - [Azure SDK Deployment Create or Update Documentation](https://learn.microsoft.com/en-us/python/api/azure-mgmt-nginx/azure.mgmt.nginx.operations.deploymentsoperations?view=azure-python#azure-mgmt-nginx-operations-deploymentsoperations-begin-create-or-update) - [Azure SDK Deployment Delete Documentation](https://learn.microsoft.com/en-us/python/api/azure-mgmt-nginx/azure.mgmt.nginx.operations.deploymentsoperations?view=azure-python#azure-mgmt-nginx-operations-deploymentsoperations-begin-delete) -- [NGINXaaS Managed Identity Documentation]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) -- [NGINXaaS Azure Monitor Documentation]({{< relref "/nginxaas-azure/monitoring/enable-monitoring/" >}}) +- [NGINXaaS Managed Identity Documentation]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) +- [NGINXaaS Azure Monitor Documentation]({{< ref "/nginxaas-azure/monitoring/enable-monitoring/" >}}) ### Create or update a certificate @@ -39,7 +39,7 @@ Create or update a certificate under a deployment. This references an existing c - [Azure SDK Certificate Create or Update Documentation](https://learn.microsoft.com/en-us/python/api/azure-mgmt-nginx/azure.mgmt.nginx.operations.certificatesoperations?view=azure-python#azure-mgmt-nginx-operations-certificatesoperations-begin-create-or-update) - [Azure SDK Certificate Delete Documentation](https://learn.microsoft.com/en-us/python/api/azure-mgmt-nginx/azure.mgmt.nginx.operations.configurationsoperations?view=azure-python#azure-mgmt-nginx-operations-configurationsoperations-begin-delete) -- [NGINXaaS Certificates Documentation]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}) +- [NGINXaaS Certificates Documentation]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}) - [Azure SDK Key Vault Documentation](https://learn.microsoft.com/en-us/python/api/overview/azure/key-vault) ### Create or update a configuration @@ -47,7 +47,7 @@ Create or update a certificate under a deployment. This references an existing c Create or update the default configuration for a deployment using a gzipped archive based on the NGINXaaS documentation below. See [NGINXaaS Snippets](https://github.com/nginxinc/nginxaas-for-azure-snippets/tree/main/sdk/python/configurations/) for example scripts to create or update deployment configuration resources. - [Azure SDK Configuration Create or Update Documentation](https://learn.microsoft.com/en-us/python/api/azure-mgmt-nginx/azure.mgmt.nginx.operations.configurationsoperations?view=azure-python#azure-mgmt-nginx-operations-configurationsoperations-begin-create-or-update) -- [NGINXaaS GZIP Configuration Documentation]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#upload-gzip-nginx-configuration" >}}) +- [NGINXaaS GZIP Configuration Documentation]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#upload-gzip-nginx-configuration" >}}) ## Additional Docs diff --git a/content/nginxaas-azure/client-tools/templates.md b/content/nginxaas-azure/client-tools/templates.md index 83559f15f..e9cdeb468 100644 --- a/content/nginxaas-azure/client-tools/templates.md +++ b/content/nginxaas-azure/client-tools/templates.md @@ -14,7 +14,7 @@ F5 NGINX as a Service for Azure (NGINXaaS) deployments can be managed using the ## Prerequisites -- [NGINXaaS Prerequisites]({{< relref "/nginxaas-azure/getting-started/prerequisites.md" >}}) +- [NGINXaaS Prerequisites]({{< ref "/nginxaas-azure/getting-started/prerequisites.md" >}}) - [Azure CLI Installation](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) - You need to be logged in to your Azure account through the CLI if you are using that for template deployment, see [Azure CLI Authentication](https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli) - See [NGINXaaS Snippets](https://github.com/nginxinc/nginxaas-for-azure-snippets/tree/main/arm-templates/deployments/prerequisites) for an example template to create the prerequisite resources. @@ -25,21 +25,21 @@ F5 NGINX as a Service for Azure (NGINXaaS) deployments can be managed using the See [NGINXaaS Snippets](https://github.com/nginxinc/nginxaas-for-azure-snippets/tree/main/arm-templates/deployments/create-or-update) for an example template to create or update deployment resources. -- [NGINXaaS Managed Identity Documentation]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) -- [NGINXaaS Azure Monitor Documentation]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) +- [NGINXaaS Managed Identity Documentation]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) +- [NGINXaaS Azure Monitor Documentation]({{< ref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) ### Create or update a certificate Create or update a certificate under a deployment. This references an existing certificate in an Azure Key Vault and makes it available to the NGINX configuration. See [NGINXaaS Snippets](https://github.com/nginxinc/nginxaas-for-azure-snippets/tree/main/arm-templates/certificates/create-or-update) for an example template to create or update certificate resources. -- [NGINXaaS Certificates Documentation]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}) +- [NGINXaaS Certificates Documentation]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}) - [ARM Template Key Vault Documentation](https://learn.microsoft.com/en-us/azure/templates/microsoft.keyvault/vaults) ### Create or update a configuration Create or update the default configuration for a deployment using a gzipped archive based on the NGINXaaS documentation below. See [NGINXaaS Snippets](https://github.com/nginxinc/nginxaas-for-azure-snippets/tree/main/arm-templates/configuration) for an example template to create or update configuration resources. -- [NGINXaaS GZIP Configuration Documentation]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#upload-gzip-nginx-configuration" >}}) +- [NGINXaaS GZIP Configuration Documentation]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#upload-gzip-nginx-configuration" >}}) ## Additional Docs diff --git a/content/nginxaas-azure/client-tools/terraform.md b/content/nginxaas-azure/client-tools/terraform.md index cdd6e9a44..7a0ea91b2 100644 --- a/content/nginxaas-azure/client-tools/terraform.md +++ b/content/nginxaas-azure/client-tools/terraform.md @@ -14,7 +14,7 @@ F5 NGINX as a Service for Azure (NGINXaaS) deployments can be managed using Terr ## Prerequisites -- [NGINXaaS Prerequisites]({{< relref "/nginxaas-azure/getting-started/prerequisites.md" >}}) +- [NGINXaaS Prerequisites]({{< ref "/nginxaas-azure/getting-started/prerequisites.md" >}}) - [Authenticate Terraform to Azure](https://learn.microsoft.com/en-us/azure/developer/terraform/authenticate-to-azure) - [Install Terraform](https://developer.hashicorp.com/terraform/downloads) @@ -24,20 +24,20 @@ F5 NGINX as a Service for Azure (NGINXaaS) deployments can be managed using Terr See [NGINXaaS Snippets](https://github.com/nginxinc/nginxaas-for-azure-snippets/tree/main/terraform/deployments/create-or-update) for an example to create or update deployment resources. -- [NGINXaaS Managed Identity Documentation]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) -- [NGINXaaS Azure Monitor Documentation]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) +- [NGINXaaS Managed Identity Documentation]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) +- [NGINXaaS Azure Monitor Documentation]({{< ref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) ### Create or update a certificate Upload a self-signed certificate created in Azure Key Vault to a deployment. See [NGINXaaS Snippets](https://github.com/nginxinc/nginxaas-for-azure-snippets/tree/main/terraform/certificates) for an example to create or update certificate resources. -- [NGINXaaS Certificates Documentation]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}) +- [NGINXaaS Certificates Documentation]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}) ### Create or update a configuration Upload an example multi-file NGINX configuration to a deployment. See [NGINXaaS Snippets](https://github.com/nginxinc/nginxaas-for-azure-snippets/tree/main/terraform/configurations) for an example to create or update configurations resources. -- [NGINXaaS Configuration Documentation]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) +- [NGINXaaS Configuration Documentation]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) ## Additional Docs diff --git a/content/nginxaas-azure/faq.md b/content/nginxaas-azure/faq.md index b791121dc..9530fd46c 100644 --- a/content/nginxaas-azure/faq.md +++ b/content/nginxaas-azure/faq.md @@ -14,21 +14,21 @@ Common questions about F5 NGINX as a Service for Azure (NGINXaaS). - Your NGINXaaS deployment resource is visible to you under your subscription. The underlying compute resources of your deployment, which are managed by NGINX on your behalf, are not visible in your subscription. ### Is NGINXaaS active-active? What is the architecture of NGINXaaS? -- NGINXaaS is deployed as an active-active pattern for high availability. To learn more, see the [user guide]({{< relref "/nginxaas-azure/overview/overview.md#architecture" >}}). +- NGINXaaS is deployed as an active-active pattern for high availability. To learn more, see the [user guide]({{< ref "/nginxaas-azure/overview/overview.md#architecture" >}}). ### In which Azure regions is NGINXaaS currently supported? -- We are constantly adding support for new regions. You can find the updated list of supported regions in the [NGINXaaS documentation]({{< relref "/nginxaas-azure/overview/overview.md" >}}). +- We are constantly adding support for new regions. You can find the updated list of supported regions in the [NGINXaaS documentation]({{< ref "/nginxaas-azure/overview/overview.md" >}}). ### My servers are located in different geographies, can NGINXaaS load balance for these upstream servers? -- Yes, NGINXaaS can load balance even if upstream servers are located in different geography as long as no networking limitations are mentioned in the [Known Issues]({{< relref "known-issues.md" >}}). +- Yes, NGINXaaS can load balance even if upstream servers are located in different geography as long as no networking limitations are mentioned in the [Known Issues]({{< ref "known-issues.md" >}}). ### How do I analyze traffic statistics for NGINXaaS? -- NGINXaaS is integrated with [Azure monitoring](https://learn.microsoft.com/en-us/azure/azure-monitor/overview). NGINXaaS publishes [traffic statistics]({{< relref "/nginxaas-azure/monitoring/metrics-catalog.md" >}}) in Azure monitoring. Customers can analyze the traffic statistics by following the steps mentioned in the [NGINXaaS Monitoring]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) documentation. +- NGINXaaS is integrated with [Azure monitoring](https://learn.microsoft.com/en-us/azure/azure-monitor/overview). NGINXaaS publishes [traffic statistics]({{< ref "/nginxaas-azure/monitoring/metrics-catalog.md" >}}) in Azure monitoring. Customers can analyze the traffic statistics by following the steps mentioned in the [NGINXaaS Monitoring]({{< ref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) documentation. ### When should I scale my deployment? -- Consider requesting additional NCUs if the number of consumed NCUs is over 70% of the number of provisioned NCUs. Consider reducing the number of requested NCUs when the number of consumed NCUs is under 60% of the number of provisioned NCUs. For more information on observing the consumed and provisioned NCUs in your deployment, see the [Scaling documentation]({{< relref "/nginxaas-azure/quickstart/scaling.md#metrics" >}}). +- Consider requesting additional NCUs if the number of consumed NCUs is over 70% of the number of provisioned NCUs. Consider reducing the number of requested NCUs when the number of consumed NCUs is under 60% of the number of provisioned NCUs. For more information on observing the consumed and provisioned NCUs in your deployment, see the [Scaling documentation]({{< ref "/nginxaas-azure/quickstart/scaling.md#metrics" >}}). -- Alternatively, [enable autoscaling]({{< relref "/nginxaas-azure/quickstart/scaling.md#autoscaling" >}}) to let the system automatically scale your deployment for you. +- Alternatively, [enable autoscaling]({{< ref "/nginxaas-azure/quickstart/scaling.md#autoscaling" >}}) to let the system automatically scale your deployment for you. ### I am an NGINX Plus customer; how can I switch to NGINXaaS? - In NGINX Plus, customers SSH into the NGINX Plus system, store their certificates in some kind of storage and configure the network and subnet to connect to NGINX Plus. @@ -42,14 +42,14 @@ Common questions about F5 NGINX as a Service for Azure (NGINXaaS). - Alternatively, you can enable autoscaling, and NGINXaaS will automatically scale your deployment based on the consumption of NCUs. -- See the [Scaling Guidance]({{< relref "/nginxaas-azure/quickstart/scaling.md" >}}) documentation for more information. +- See the [Scaling Guidance]({{< ref "/nginxaas-azure/quickstart/scaling.md" >}}) documentation for more information. ### What types and formats of certificates are supported in NGINXaaS? - NGINXaaS supports self-signed certificates, Domain Validated (DV) certificates, Organization Validated (OV) certificates, and Extended Validation (EV) certificates. - Currently, NGINXaaS supports PEM and PKCS12 format certificates. -- See the [SSL/TLS Certificates documentation]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}) to learn how to change certificates. +- See the [SSL/TLS Certificates documentation]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}) to learn how to change certificates. ### Does NGINXaaS support layer 4 load balancing? - Yes, NGINXaaS currently supports layer 4 TCP and HTTP layer 7 load balancing. @@ -96,7 +96,7 @@ Common questions about F5 NGINX as a Service for Azure (NGINXaaS). - No, there's no downtime while an NGINXaaS deployment changes capacity. ### How is my application safe at the time of disaster? Any method for disaster recovery? -- In any Azure region with more than one availability zone, NGINXaaS provides cross-zone replication for disaster recovery. See [Architecture]({{< relref "/nginxaas-azure/overview/overview.md#architecture" >}}) for more details. +- In any Azure region with more than one availability zone, NGINXaaS provides cross-zone replication for disaster recovery. See [Architecture]({{< ref "/nginxaas-azure/overview/overview.md#architecture" >}}) for more details. ### Can I configure the TLS policy to control TLS protocol versions? - Yes. You can overwrite the NGINX default protocol to configure the desired TLS/SSL policy. Read more about the procedure in the [Module ngx_http_ssl_module](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) documentation. @@ -105,7 +105,7 @@ Common questions about F5 NGINX as a Service for Azure (NGINXaaS). - NGINXaaS supports up to 100 TLS/SSL certificates. ### Does NGINXaaS natively integrate with Azure Key Vault? -- Yes, NGINXaaS natively integrates with Azure Key Vault, so you can bring your own certificates and manage them in a centralized location. You can learn more about adding certificates in Azure Key Vault in the [SSL/TLS Certificates documentation]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}). +- Yes, NGINXaaS natively integrates with Azure Key Vault, so you can bring your own certificates and manage them in a centralized location. You can learn more about adding certificates in Azure Key Vault in the [SSL/TLS Certificates documentation]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}). ### Can I deploy any other resources in the NGINXaaS subnet? - Yes, the subnet can contain other resources and is not dedicated to the NGINXaaS for Azure resources; ensure the subnet size is adequate to scale the NGINXaaS deployment. @@ -117,23 +117,23 @@ Common questions about F5 NGINX as a Service for Azure (NGINXaaS). - Yes, you can restrict access to NGINXaaS by defining restriction rules at the Network Security Group level or using NGINX's access control list. To learn more, see the [NGINX module ngx_http_access_module](http://nginx.org/en/docs/http/ngx_http_access_module.html) documentation. ### What are the supported networking services of NGINXaaS? -- NGINX currently supports VNet, and VPN gateway if they do not have limitations. Known limitations can be found in the [Known Issues]({{< relref "known-issues.md" >}}). +- NGINX currently supports VNet, and VPN gateway if they do not have limitations. Known limitations can be found in the [Known Issues]({{< ref "known-issues.md" >}}). ### Does NGINXaaS support end-to-end encryption from client to the upstream server? - Yes, NGINXaaS supports end-to-end encryption from client to upstream server. ### What types of logs does NGINXaaS provide? -- NGINXaaS supports the following [two types of logs]({{< relref "/nginxaas-azure/monitoring/enable-logging/">}}). +- NGINXaaS supports the following [two types of logs]({{< ref "/nginxaas-azure/monitoring/enable-logging/">}}). - Access Log: To troubleshoot server issues, analyze web traffic patterns and monitor server performance. For more details, please see the [Module ngx_http_log_module](https://nginx.org/en/docs/http/ngx_http_log_module.html?&_ga=2.80762515.545098740.1677716889-256521444.1670450998#access_log) documentation. - Error Log: To capture, troubleshoot and identify issues that may occur during the server's operations, such as 400 bad requests, 401 unauthorized, 500 internal server errors, etc. For more details, please see the [Core functionality](https://nginx.org/en/docs/ngx_core_module.html?&_ga=2.8347062.545098740.1677716889-256521444.1670450998#error_log) documentation. ### What is the retention policy for the above logs? How long are the logs stored? Where are they stored? -- NGINXaaS logs are stored in customer’s storage. Customers can custom define the retention policy. Customers can configure the storage by following the steps outlined in the [NGINXaaS Logging]({{< relref "/nginxaas-azure/monitoring/enable-logging/">}}) documentation. +- NGINXaaS logs are stored in customer’s storage. Customers can custom define the retention policy. Customers can configure the storage by following the steps outlined in the [NGINXaaS Logging]({{< ref "/nginxaas-azure/monitoring/enable-logging/">}}) documentation. ### Can I set up an alert with NGINXaaS? -- You can set up an alert with NGINXaaS by following the steps outlined in the [Configure Alerts]({{< relref "/nginxaas-azure/monitoring/configure-alerts.md">}}) documentation. +- You can set up an alert with NGINXaaS by following the steps outlined in the [Configure Alerts]({{< ref "/nginxaas-azure/monitoring/configure-alerts.md">}}) documentation. ### Is request tracing supported in NGINXaaS? - Yes, see the [Application Performance Management with NGINX Variables](https://www.nginx.com/blog/application-tracing-nginx-plus/) documentation to learn more about tracing. @@ -142,7 +142,7 @@ Common questions about F5 NGINX as a Service for Azure (NGINXaaS). - No; NGINXaaS will deploy the right resources to ensure you get the right price-to-performance ratio. ### Can I migrate from on-prem NGINX+ to NGINXaaS on Azure? -- Yes, you can bring your own configurations or create a new configuration in the cloud. See the [NGINXaaS Deployment]({{< relref "/nginxaas-azure/getting-started/create-deployment/">}}) documentation for more details. +- Yes, you can bring your own configurations or create a new configuration in the cloud. See the [NGINXaaS Deployment]({{< ref "/nginxaas-azure/getting-started/create-deployment/">}}) documentation for more details. ### Can I associate multiple certificates for the same domain? - Yes, the "ssl_certificate" directive can be specified multiple times to load certificates of different types. To learn more, see the [Module ngx_http_ssl_module](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate) documentation. @@ -170,7 +170,7 @@ Common questions about F5 NGINX as a Service for Azure (NGINXaaS). - The NGINXaaS deployment IP doesn't change over time. ### Does NGINXaaS support autoscaling? -- Yes; NGINXaaS supports autoscaling as well as manual scaling. Refer to the [Scaling Guidance]({{< relref "/nginxaas-azure/quickstart/scaling.md#autoscaling" >}}) for more information. +- Yes; NGINXaaS supports autoscaling as well as manual scaling. Refer to the [Scaling Guidance]({{< ref "/nginxaas-azure/quickstart/scaling.md#autoscaling" >}}) for more information. ### How can I manually start/stop NGINXaaS? - Currently, we can't manually start/stop NGINXaaS. You have the option to delete the deployment and re-deploy at a future date. @@ -181,7 +181,7 @@ Common questions about F5 NGINX as a Service for Azure (NGINXaaS). - If the existing NGINXaaS deployment is using a private IP address, you can only change the backend subnet. You cannot change the backend virtual network because the frontend and backend subnets must be in the same virtual network. ### How do I configure HTTPS listeners for .com and .net sites? -- NGINXaaS is a Layer 7 HTTP protocol. To configure .com and .net servers, refer to the server name in the server block within the HTTP context. To learn more, and see examples, follow the instructions in the [NGINX Configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#nginx-configuration-validation" >}}) documentation. +- NGINXaaS is a Layer 7 HTTP protocol. To configure .com and .net servers, refer to the server name in the server block within the HTTP context. To learn more, and see examples, follow the instructions in the [NGINX Configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#nginx-configuration-validation" >}}) documentation. ### If I remove/delete an NGINXaaS deployment, what will happen to the eNICs that were associated with it? - When you remove or delete an NGINXaaS deployment, the associated eNICs will automatically be deleted. @@ -237,7 +237,7 @@ server { ### How often does my deployment get billed? -- NGINXaaS is [billed monthly]({{< relref "/nginxaas-azure/billing/overview.md" >}}) based on hourly consumption. +- NGINXaaS is [billed monthly]({{< ref "/nginxaas-azure/billing/overview.md" >}}) based on hourly consumption. ### Why do the metrics show more connections and requests than I was expecting? @@ -249,8 +249,8 @@ server { ### Will my deployment detect a new version of my certificate and apply it? -- NGINXaaS supports certificate rotation. See the [Certificate Rotation documentation]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md#certificate-rotation" >}}) to learn more. +- NGINXaaS supports certificate rotation. See the [Certificate Rotation documentation]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md#certificate-rotation" >}}) to learn more. ### Why are some of my deployment's metrics intermittently missing in Azure monitor? -- This may indicate that the deployment's underlying compute resources are being exhausted. Monitor the `system.cpu` metric to see the deployment's CPU utilization. If it's nearing 100%, consider increasing the deployment's NCU capacity. See the [Scaling Guidance]({{< relref "/nginxaas-azure/quickstart/scaling.md" >}}) documentation for more information. +- This may indicate that the deployment's underlying compute resources are being exhausted. Monitor the `system.cpu` metric to see the deployment's CPU utilization. If it's nearing 100%, consider increasing the deployment's NCU capacity. See the [Scaling Guidance]({{< ref "/nginxaas-azure/quickstart/scaling.md" >}}) documentation for more information. diff --git a/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-cli.md b/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-cli.md index 032eafdcd..df65d9f66 100644 --- a/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-cli.md +++ b/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-cli.md @@ -13,7 +13,7 @@ The Azure CLI has an extension to be used for management of F5 NGINX as a Servic ## Prerequisites -- Install [Azure CLI with NGINXaaS extension]({{< relref "/nginxaas-azure/client-tools/cli.md" >}}) +- Install [Azure CLI with NGINXaaS extension]({{< ref "/nginxaas-azure/client-tools/cli.md" >}}) ## Create a deployment diff --git a/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md b/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md index 4402ecc51..dbbaec46e 100644 --- a/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md +++ b/content/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md @@ -34,9 +34,9 @@ You can start the NGINXaaS deployment process by visiting the [Create NGINXaaS]( | Name | Provide a unique name for your deployment. | | Region | Select the region you want to deploy to. | | Pricing Plan | Select the Standard V2 plan. For more information, see [Pricing Plans]({{< ref "/nginxaas-azure/billing/overview.md#pricing-plans">}}) | - | Scaling | Select Manual to set the capacity of your deployment in NCUs or select Autoscale to automatically adjust the capacity of your deployment. Learn more about NCUs in [Scaling Guidance]({{< relref "/nginxaas-azure/quickstart/scaling.md" >}}). | + | Scaling | Select Manual to set the capacity of your deployment in NCUs or select Autoscale to automatically adjust the capacity of your deployment. Learn more about NCUs in [Scaling Guidance]({{< ref "/nginxaas-azure/quickstart/scaling.md" >}}). | | Email | Provide an email address that can be notified about service alerts, maintenance data and activity reports. | - | Upgrade Channel | Select the desired upgrade channel for your deployment. For more information, see [Upgrade Channels]({{< relref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). | + | Upgrade Channel | Select the desired upgrade channel for your deployment. For more information, see [Upgrade Channels]({{< ref "/nginxaas-azure/quickstart/upgrade-channels.md" >}}). | {{}} @@ -80,11 +80,11 @@ You can start the NGINXaaS deployment process by visiting the [Create NGINXaaS]( 1. To test your deployment, you can go to the IP address noted on the overview page. The default NGINX welcome screen should load. - {{}}You will not see the default NGINX welcome screen if you unchecked "Apply default NGINX configuration" in the [Networking Tab screen]({{< relref "create-deployment.md#networking-tab" >}}) above. You can proceed with providing your own NGINX configuration as outlined in the [NGINX configuration]({{< relref "nginx-configuration.md#networking-tab" >}}) section.{{}} + {{}}You will not see the default NGINX welcome screen if you unchecked "Apply default NGINX configuration" in the [Networking Tab screen]({{< ref "create-deployment.md#networking-tab" >}}) above. You can proceed with providing your own NGINX configuration as outlined in the [NGINX configuration]({{< ref "nginx-configuration.md#networking-tab" >}}) section.{{}} {{< img src="nginxaas-azure/test-deployment.png" alt="NGINXaaS Overview page showing the IP address of the deployment in the Essentials section." >}} ## What's next -[Assign Managed Identities]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) +[Assign Managed Identities]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) diff --git a/content/nginxaas-azure/getting-started/managed-identity-portal.md b/content/nginxaas-azure/getting-started/managed-identity-portal.md index d9eef4988..802fa37ce 100644 --- a/content/nginxaas-azure/getting-started/managed-identity-portal.md +++ b/content/nginxaas-azure/getting-started/managed-identity-portal.md @@ -82,4 +82,4 @@ F5 NGINX as a Service for Azure (NGINXaaS) leverages a user assigned and a syste ## What's next -[Add SSL/TLS Certificates]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}) +[Add SSL/TLS Certificates]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md" >}}) diff --git a/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-azure-cli.md b/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-azure-cli.md index 602110ef8..a880403a7 100644 --- a/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-azure-cli.md +++ b/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-azure-cli.md @@ -13,7 +13,7 @@ F5 NGINX as a Service for Azure (NGINXaaS) configurations can be managed using t ## Prerequisites -- Install [Azure CLI with NGINXaaS extension]({{< relref "/nginxaas-azure/client-tools/cli.md" >}}) +- Install [Azure CLI with NGINXaaS extension]({{< ref "/nginxaas-azure/client-tools/cli.md" >}}) - If the NGINX configuration requires SSL/TLS certificates, then a managed identity and integration with Azure Key Vault is required. @@ -216,13 +216,13 @@ See the [Azure CLI Configuration Update Documentation](https://learn.microsoft.c {{< tip >}} -See the [NGINX connfiguration overview]({{< relref "overview.md" >}}) topic +See the [NGINX connfiguration overview]({{< ref "overview.md" >}}) topic to learn more about: -- [NGINX configuration automation workflows]({{< relref "overview.md#nginx-configuration-automation-workflows" >}}) -- [NGINX filesystem restrictions]({{< relref "overview.md#nginx-filesystem-restrictions" >}}) -- [Disallowed configuration directives]({{< relref "overview.md#disallowed-configuration-directives" >}}) -- [Directives that cannot be overridden]({{< relref "overview.md#directives-that-cannot-be-overridden" >}}) -- [Configuration directives list]({{< relref "overview.md#configuration-directives-list" >}}) +- [NGINX configuration automation workflows]({{< ref "overview.md#nginx-configuration-automation-workflows" >}}) +- [NGINX filesystem restrictions]({{< ref "overview.md#nginx-filesystem-restrictions" >}}) +- [Disallowed configuration directives]({{< ref "overview.md#disallowed-configuration-directives" >}}) +- [Directives that cannot be overridden]({{< ref "overview.md#directives-that-cannot-be-overridden" >}}) +- [Configuration directives list]({{< ref "overview.md#configuration-directives-list" >}}) {{< /tip >}} diff --git a/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md b/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md index 97f0c0701..0b00d2613 100644 --- a/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md +++ b/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md @@ -13,7 +13,7 @@ An NGINX configuration can be applied to the deployment using the Azure portal i - Create a new NGINX configuration from scratch or by pasting it in the Azure portal editor. - Upload a gzip compressed tar archive containing your NGINX configuration. -As part of applying your NGINX configuration, the service validates the configuration for syntax and compatibility with F5 NGINX as a Service for Azure (NGINXaaS). The use of certain directives and parameters is not allowed to ensure the NGINX configuration’s compatibility with IaaS deployment model in Azure. Validation errors are reported in the editor for you to correct. For more information, check the [NGINX Configuration Validation]({{< relref "nginx-configuration.md#nginx-configuration-validation" >}}) section. +As part of applying your NGINX configuration, the service validates the configuration for syntax and compatibility with F5 NGINX as a Service for Azure (NGINXaaS). The use of certain directives and parameters is not allowed to ensure the NGINX configuration’s compatibility with IaaS deployment model in Azure. Validation errors are reported in the editor for you to correct. For more information, check the [NGINX Configuration Validation]({{< ref "nginx-configuration.md#nginx-configuration-validation" >}}) section. ## Prerequisites @@ -39,15 +39,15 @@ As part of applying your NGINX configuration, the service validates the configur | Protected File | Indicates that the file may contain sensitive data such as passwords or represent an ssl/tls certificate.
  • To protect a file, enable the **Protected** {{}} toggle button.
  • You cannot access the file contents of a protected file saved to the NGINX configuration, but you can view its metadata, such as the SHA-256 hash of the file contents.
  • You can provide new contents for an existing protected file using the **Overwrite** link or resubmit it without having to provide the file contents again.
  • To modify the file path of a protected file or convert it to a regular file, delete the original file and create a new one.
  • A protected file is designated with a {{}} icon on the portal.
| {{}} - {{}}If specifying an absolute file path, see the [NGINX Filesystem Restrictions table]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) for the allowed directories the file can be written to.{{}} + {{}}If specifying an absolute file path, see the [NGINX Filesystem Restrictions table]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) for the allowed directories the file can be written to.{{}} 1. Provide your NGINX configuration in the configuration file. -1. Files like SSL/TLS certificates can be added as well. However, we reccommend using Azure Key Vault to store your certificates. See [Add SSL/TLS certificates]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md#add-ssltls-certificates">}}) for more information. +1. Files like SSL/TLS certificates can be added as well. However, we reccommend using Azure Key Vault to store your certificates. See [Add SSL/TLS certificates]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md#add-ssltls-certificates">}}) for more information. 1. Select **Submit** to apply the new configuration. -{{}}We currently only support more than 5 unique listen ports on the Standard V2 plan. NGINX configurations that specify more than 5 ports on other plans will be rejected. For more information on listen port limitations, see our [FAQ]({{< relref "/nginxaas-azure/faq" >}}).{{}} +{{}}We currently only support more than 5 unique listen ports on the Standard V2 plan. NGINX configurations that specify more than 5 ports on other plans will be rejected. For more information on listen port limitations, see our [FAQ]({{< ref "/nginxaas-azure/faq" >}}).{{}} ### NGINX configuration validation @@ -153,13 +153,13 @@ http { {{< tip >}} -See the [NGINX connfiguration overview]({{< relref "overview.md" >}}) topic +See the [NGINX connfiguration overview]({{< ref "overview.md" >}}) topic to learn more about: -- [NGINX configuration automation workflows]({{< relref "overview.md#nginx-configuration-automation-workflows" >}}) -- [NGINX filesystem restrictions]({{< relref "overview.md#nginx-filesystem-restrictions" >}}) -- [Disallowed configuration directives]({{< relref "overview.md#disallowed-configuration-directives" >}}) -- [Directives that cannot be overridden]({{< relref "overview.md#directives-that-cannot-be-overridden" >}}) -- [Configuration directives list]({{< relref "overview.md#configuration-directives-list" >}}) +- [NGINX configuration automation workflows]({{< ref "overview.md#nginx-configuration-automation-workflows" >}}) +- [NGINX filesystem restrictions]({{< ref "overview.md#nginx-filesystem-restrictions" >}}) +- [Disallowed configuration directives]({{< ref "overview.md#disallowed-configuration-directives" >}}) +- [Directives that cannot be overridden]({{< ref "overview.md#directives-that-cannot-be-overridden" >}}) +- [Configuration directives list]({{< ref "overview.md#configuration-directives-list" >}}) {{< /tip >}} diff --git a/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configurations-terraform.md b/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configurations-terraform.md index fc279961c..e0d8fb643 100644 --- a/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configurations-terraform.md +++ b/content/nginxaas-azure/getting-started/nginx-configuration/nginx-configurations-terraform.md @@ -72,13 +72,13 @@ Once the deployment is no longer needed, run the following to clean up the deplo {{< tip >}} -See the [NGINX connfiguration overview]({{< relref "overview.md" >}}) topic +See the [NGINX connfiguration overview]({{< ref "overview.md" >}}) topic to learn more about: -- [NGINX configuration automation workflows]({{< relref "overview.md#nginx-configuration-automation-workflows" >}}) -- [NGINX filesystem restrictions]({{< relref "overview.md#nginx-filesystem-restrictions" >}}) -- [Disallowed configuration directives]({{< relref "overview.md#disallowed-configuration-directives" >}}) -- [Directives that cannot be overridden]({{< relref "overview.md#directives-that-cannot-be-overridden" >}}) -- [Configuration directives list]({{< relref "overview.md#configuration-directives-list" >}}) +- [NGINX configuration automation workflows]({{< ref "overview.md#nginx-configuration-automation-workflows" >}}) +- [NGINX filesystem restrictions]({{< ref "overview.md#nginx-filesystem-restrictions" >}}) +- [Disallowed configuration directives]({{< ref "overview.md#disallowed-configuration-directives" >}}) +- [Directives that cannot be overridden]({{< ref "overview.md#directives-that-cannot-be-overridden" >}}) +- [Configuration directives list]({{< ref "overview.md#configuration-directives-list" >}}) {{< /tip >}} diff --git a/content/nginxaas-azure/getting-started/nginx-configuration/overview.md b/content/nginxaas-azure/getting-started/nginx-configuration/overview.md index 4fc59bf78..a7e3ca93b 100644 --- a/content/nginxaas-azure/getting-started/nginx-configuration/overview.md +++ b/content/nginxaas-azure/getting-started/nginx-configuration/overview.md @@ -14,9 +14,9 @@ F5 NGINX as a Service for Azure deployment, restrictions, and available directiv NGINX configurations can be uploaded to your NGINXaaS for Azure deployment using the Azure portal, Azure CLI, or Terraform. The following documents provide detailed steps on how to upload NGINX configurations: -- [Upload using the Azure portal]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) -- [Upload using the Azure CLI]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-azure-cli" >}}) -- [Upload using Terraform]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configurations-terraform.md" >}}) +- [Upload using the Azure portal]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) +- [Upload using the Azure CLI]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-azure-cli" >}}) +- [Upload using Terraform]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configurations-terraform.md" >}}) The topics below provide information on NGINX configuration restrictions and directives that are supported by NGINXaaS for Azure when using any of the above workflows. diff --git a/content/nginxaas-azure/getting-started/prerequisites.md b/content/nginxaas-azure/getting-started/prerequisites.md index 0d4187ee0..58f96d7df 100644 --- a/content/nginxaas-azure/getting-started/prerequisites.md +++ b/content/nginxaas-azure/getting-started/prerequisites.md @@ -18,8 +18,8 @@ Before you deploy F5 NGINX as a Service for Azure (NGINXaaS) you need to meet th - It's possible to complete a limited setup with the built-in [Contributor](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor) role. -For specific permissions check the [NGINXaaS for Azure Frequently Asked Questions]({{< relref "/nginxaas-azure/faq" >}}). +For specific permissions check the [NGINXaaS for Azure Frequently Asked Questions]({{< ref "/nginxaas-azure/faq" >}}). ## What's next -[Create a Deployment]({{< relref "/nginxaas-azure/getting-started/create-deployment/" >}}) +[Create a Deployment]({{< ref "/nginxaas-azure/getting-started/create-deployment/" >}}) diff --git a/content/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md b/content/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md index f0e335c73..f348782da 100644 --- a/content/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md +++ b/content/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md @@ -15,13 +15,13 @@ This document provides details about using SSL/TLS certificates with your F5 NGI Add a certificate from an Azure Key Vault to your NGINXaaS deployment using your preferred client tool: -* [Add certificates using the Azure portal]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}) -* [Add certificates using the Azure CLI]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-azure-cli.md">}}) -* [Add certificates using Terraform]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-terraform.md">}}) +* [Add certificates using the Azure portal]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}) +* [Add certificates using the Azure CLI]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-azure-cli.md">}}) +* [Add certificates using Terraform]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-terraform.md">}}) ### Add SSL/TLS certificates bundled with NGINXaaS configuration -You can also add your certificate as a file to your NGINX configuration filesystem; refer to [Upload an NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview.md">}}) to learn about the different options. Although this is a quick method for adding SSL/TLS certificates to your NGINXaaS deployment, we recommend adding certificates through Azure Key Vault (AKV) for enhanced security, certificate rotation, and monitoring. +You can also add your certificate as a file to your NGINX configuration filesystem; refer to [Upload an NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview.md">}}) to learn about the different options. Although this is a quick method for adding SSL/TLS certificates to your NGINXaaS deployment, we recommend adding certificates through Azure Key Vault (AKV) for enhanced security, certificate rotation, and monitoring. Once a certificate has been added, update your NGINX configuration to reference your SSL/TLS certificate and key file paths. @@ -46,14 +46,14 @@ For Azure client tools, such as the Azure CLI or Azure Resource Manager, the cer ## Monitor certificates -To view the status of your SSL/TLS certificates, [enable monitoring]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) for your NGINXaaS deployment and navigate to the **Metrics** tab in the Azure portal. View the `nginxaas.certificates` metric under the `nginxaas statistics` metric namespace. The `nginxaas.certificates` metric allows you to filter by certificate name and the status of the certificate. The status dimension reports the health of your certificates through the following values: +To view the status of your SSL/TLS certificates, [enable monitoring]({{< ref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) for your NGINXaaS deployment and navigate to the **Metrics** tab in the Azure portal. View the `nginxaas.certificates` metric under the `nginxaas statistics` metric namespace. The `nginxaas.certificates` metric allows you to filter by certificate name and the status of the certificate. The status dimension reports the health of your certificates through the following values: {{}} | Status | Description | | ------------- | ------------- | | `active` | The certificate was successfully fetched from AKV. | - | `unauthorized`| Azure returned a 401/403 error when fetching the certificate from AKV, which usually indicates an issue with the deployment's [Managed Identity]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}). | + | `unauthorized`| Azure returned a 401/403 error when fetching the certificate from AKV, which usually indicates an issue with the deployment's [Managed Identity]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}). | | `not found` | Azure returned a 404 error when fetching the certificate from AKV. | | `incompatible`| An error occurred while fetching or processing the certificate from AKV.

The possible reasons include:

  • Error while downloading certificate and key
  • Missing content type in certificate
  • Missing content in certificate
  • Unrecognized content type, certificate not in PEM or PKCS12 format
| @@ -67,7 +67,7 @@ The following section describes common errors you might encounter while adding S #### Error code: `ForbiddenByRbac` -**Description:** The [Managed Identity]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) associated with the NGINXaaS deployment does not have permissions to fetch certificates from key vault. This error is returned when the key vault's permission model is set to [Azure role-based access control](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview?WT.mc_id=Portal-Microsoft_Azure_KeyVault). +**Description:** The [Managed Identity]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) associated with the NGINXaaS deployment does not have permissions to fetch certificates from key vault. This error is returned when the key vault's permission model is set to [Azure role-based access control](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview?WT.mc_id=Portal-Microsoft_Azure_KeyVault). **Resolution:** Assign the [Key Vault Secrets User](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-secrets-user) role to the managed identity associated with your NGINXaaS deployment. @@ -117,7 +117,7 @@ The following section describes common errors you might encounter while adding S #### Error code: `AccessDenied` -**Description:** The [Managed Identity]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) associated with the NGINXaaS deployment has not been assigned to an access policy on the key vault. This error is returned when the key vault's permission model is set to [Vault access policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?WT.mc_id=Portal-Microsoft_Azure_KeyVault&tabs=azure-portal). +**Description:** The [Managed Identity]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) associated with the NGINXaaS deployment has not been assigned to an access policy on the key vault. This error is returned when the key vault's permission model is set to [Vault access policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?WT.mc_id=Portal-Microsoft_Azure_KeyVault&tabs=azure-portal). **Resolution:** Assign an access policy to the managed identity associated with your NGINXaaS deployment with *Get secrets* permissions or higher. If you are using the Azure portal, assign an additional access policy to your user with *List certificates* permissions or higher. @@ -165,7 +165,7 @@ The following section describes common errors you might encounter while adding S **Description:** The key vault's firewall is enabled and NGINXaaS is not authorized to fetch certificates. -**Resolution:** [Configure Network Security Perimeter]({{< relref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}}) to allow the subscription of the NGINXaaS deployment to access the key vault. +**Resolution:** [Configure Network Security Perimeter]({{< ref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}}) to allow the subscription of the NGINXaaS deployment to access the key vault.
Create a network security perimeter - Azure CLI @@ -245,7 +245,7 @@ The following section describes common errors you might encounter while adding S #### Error code: `ForbiddenByPolicy` -**Description:** The [Managed Identity]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) associated with the NGINXaaS deployment does not have permissions to fetch certificates from key vault. This error is returned when the key vault's permission model is set to [Vault access policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?WT.mc_id=Portal-Microsoft_Azure_KeyVault&tabs=azure-portal). +**Description:** The [Managed Identity]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) associated with the NGINXaaS deployment does not have permissions to fetch certificates from key vault. This error is returned when the key vault's permission model is set to [Vault access policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?WT.mc_id=Portal-Microsoft_Azure_KeyVault&tabs=azure-portal). **Resolution:** Assign an access policy to the managed identity associated with your NGINXaaS deployment with *Get secrets* permissions or higher. If you are using the Azure portal, assign an additional access policy to your user with *List certificates* permissions or higher. @@ -331,7 +331,7 @@ The following section describes common errors you might encounter while adding S **Description:** The retrieved secret is missing the *contentType* field. -**Resolution:** When creating an [Azure certificate](https://learn.microsoft.com/en-us/azure/key-vault/certificates/about-certificates) in key vault, the *contentType* field will be properly set to either *application/x-pem-file* or *application/x-pkcs12*. If a certificate is added as a generic [Azure secret](https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets) the *contentType* field must be manually set to help with interpreting the secret data when it is retrieved. We recommend creating a certificate object, instead of a secret object containing certificate data, to ensure proprer formatting and *contentType*. +**Resolution:** When creating an [Azure certificate](https://learn.microsoft.com/en-us/azure/key-vault/certificates/about-certificates) in key vault, the *contentType* field will be properly set to either *application/x-pem-file* or *application/x-pkcs12*. If a certificate is added as a generic [Azure secret](https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets) the *contentType* field must be manually set to help with interpreting the secret data when it is retrieved. We recommend creating a certificate object, instead of a secret object containing certificate data, to ensure proprer formatting and *contentType*. #### Error code: `UnrecognizedContentType` diff --git a/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-azure-cli.md b/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-azure-cli.md index c5d5a5f30..1c8f189c7 100644 --- a/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-azure-cli.md +++ b/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-azure-cli.md @@ -13,7 +13,7 @@ You can use Azure Key Vault (AKV) to store SSL/TLS certificates and keys to use {{< include "/nginxaas-azure/ssl-tls-prerequisites.md" >}} -- Install [Azure CLI with NGINXaaS extension]({{< relref "/nginxaas-azure/client-tools/cli.md" >}}) +- Install [Azure CLI with NGINXaaS extension]({{< ref "/nginxaas-azure/client-tools/cli.md" >}}) ## Create a certificate diff --git a/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md b/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md index f13a29f6e..fd593de98 100644 --- a/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md +++ b/content/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md @@ -47,15 +47,15 @@ Before you begin, refer Azure documentation to [Import a certificate to your Key If you need to create a new key vault or certificate, you can do so by selecting **Create new key vault** or **Create new** under the **Key Vault** and **Certificate** fields, respectively. - {{}}If specifying an absolute file path as the `Certificate path` or `Key path`, see the [NGINX Filesystem Restrictions table]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) for the allowed directories the file can be written to.{{}} + {{}}If specifying an absolute file path as the `Certificate path` or `Key path`, see the [NGINX Filesystem Restrictions table]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) for the allowed directories the file can be written to.{{}} - {{}}A certificate added to an NGINXaaS for Azure deployment using the Azure Portal refers to an unversioned Azure Key Vault (AKV) secret identifier. To add a certificate with a versioned AKV secret identifier, follow the documented steps with alternative [Client tools]({{< relref "/nginxaas-azure/client-tools/_index.md" >}}) for NGINXaaS for Azure.{{}} + {{}}A certificate added to an NGINXaaS for Azure deployment using the Azure Portal refers to an unversioned Azure Key Vault (AKV) secret identifier. To add a certificate with a versioned AKV secret identifier, follow the documented steps with alternative [Client tools]({{< ref "/nginxaas-azure/client-tools/_index.md" >}}) for NGINXaaS for Azure.{{}} 1. Select **Add certificate**. 1. Repeat the same steps to add as many certificates as needed. -1. Now you can [provide an NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) that references the certificate you just added by the **path** value. +1. Now you can [provide an NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) that references the certificate you just added by the **path** value. ### View certificate details @@ -94,4 +94,4 @@ Before you begin, refer Azure documentation to [Import a certificate to your Key ## What's next -[Upload an NGINX Configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) +[Upload an NGINX Configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) diff --git a/content/nginxaas-azure/known-issues.md b/content/nginxaas-azure/known-issues.md index 276879348..09f11367a 100644 --- a/content/nginxaas-azure/known-issues.md +++ b/content/nginxaas-azure/known-issues.md @@ -59,7 +59,7 @@ Inner Errors: ### {{% icon-bug %}} Not all NGINX Plus directives and use-cases are supported in NGINXaaS (ID-4331) -NGINXaaS currently does not support all NGINX Plus directives and use-cases. We are continually adding new NGINX Plus capabilities into NGINXaaS to close the gap in functionality. You can follow the updates to the supported use-cases by visiting the [Changelog]({{< relref "./changelog.md" >}}). For a comprehensive list of currently allowed directives, please see the [Configuration Directives List]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). +NGINXaaS currently does not support all NGINX Plus directives and use-cases. We are continually adding new NGINX Plus capabilities into NGINXaaS to close the gap in functionality. You can follow the updates to the supported use-cases by visiting the [Changelog]({{< relref "./changelog.md" >}}). For a comprehensive list of currently allowed directives, please see the [Configuration Directives List]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#configuration-directives-list" >}}). ### {{% icon-bug %}} Terraform errors using `package_data` (ID-2752) diff --git a/content/nginxaas-azure/monitoring/configure-alerts.md b/content/nginxaas-azure/monitoring/configure-alerts.md index 4704b0de3..6fabc34ec 100644 --- a/content/nginxaas-azure/monitoring/configure-alerts.md +++ b/content/nginxaas-azure/monitoring/configure-alerts.md @@ -18,11 +18,11 @@ This guide explains how to create and configure metrics-based alerts for your NG ## Prerequisites -- Setup is complete for [NGINXaaS for Azure deployment]({{< relref "/nginxaas-azure/getting-started/create-deployment/" >}}). +- Setup is complete for [NGINXaaS for Azure deployment]({{< ref "/nginxaas-azure/getting-started/create-deployment/" >}}). - To complete this setup, you must be an owner or user access administrator for the NGINX deployment resource. -- To enable metrics, see [Enable Monitoring]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}). +- To enable metrics, see [Enable Monitoring]({{< ref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}). {{}} See [Azure monitor overview](https://docs.microsoft.com/en-us/azure/azure-monitor/overview) documentation to familiarize with Azure Monitor. {{}} diff --git a/content/nginxaas-azure/monitoring/enable-monitoring.md b/content/nginxaas-azure/monitoring/enable-monitoring.md index 44bd0b132..c41e75526 100644 --- a/content/nginxaas-azure/monitoring/enable-monitoring.md +++ b/content/nginxaas-azure/monitoring/enable-monitoring.md @@ -145,4 +145,4 @@ This section shows you how to effectively discover, gather and analyze NGINXaaS } ``` -{{}} Refer to the [Metrics Catalog]({{< relref "/nginxaas-azure/monitoring/metrics-catalog.md" >}}) for a listing of available namespaces and metrics.{{}} +{{}} Refer to the [Metrics Catalog]({{< ref "/nginxaas-azure/monitoring/metrics-catalog.md" >}}) for a listing of available namespaces and metrics.{{}} diff --git a/content/nginxaas-azure/monitoring/metrics-catalog.md b/content/nginxaas-azure/monitoring/metrics-catalog.md index 9c6e22fdf..c48c442c3 100644 --- a/content/nginxaas-azure/monitoring/metrics-catalog.md +++ b/content/nginxaas-azure/monitoring/metrics-catalog.md @@ -38,10 +38,10 @@ The metrics are categorized by the namespace used in Azure Monitor. The dimensio | --------------------- | -------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- | | ncu.provisioned | | count | The number of successfully provisioned NCUs during the aggregation interval. During scaling events, this may lag behind `ncu.requested` as the system works to achieve the request. Available for Standard plan(s) only. | deployment | | ncu.requested | | count | The requested number of NCUs during the aggregation interval. Describes the goal state of the system. Available for Standard plans(s) only. | deployment | -| nginxaas.capacity.percentage | | count | The percentage of the deployment's total capacity being used. This can be used to guide scaling your workload. See [Scaling Guidance]({{< relref "/nginxaas-azure/quickstart/scaling.md#iterative-approach" >}}) for details. Available for Standard plan(s) only. | deployment | +| nginxaas.capacity.percentage | | count | The percentage of the deployment's total capacity being used. This can be used to guide scaling your workload. See [Scaling Guidance]({{< ref "/nginxaas-azure/quickstart/scaling.md#iterative-approach" >}}) for details. Available for Standard plan(s) only. | deployment | | system.worker_connections | pid process_name | count | The number of nginx worker connections used on the dataplane. This metric is one of the factors which determines the deployment's consumed NCU value. | deployment | -| nginxaas.certificates | name status | count | The number of certificates added to the NGINXaaS deployment dimensioned by the name of the certificate and its status. Refer to [Certificate Health]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md#monitor-certificates" >}}) to learn more about the status dimension. | deployment | -| nginxaas.maxmind | status | count | The status of any MaxMind license in use for downloading geoip2 databases. Refer to [License Health]({{< relref "/nginxaas-azure/quickstart/geoip2.md#monitoring" >}}) to learn more about the status dimension. | deployment | +| nginxaas.certificates | name status | count | The number of certificates added to the NGINXaaS deployment dimensioned by the name of the certificate and its status. Refer to [Certificate Health]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md#monitor-certificates" >}}) to learn more about the status dimension. | deployment | +| nginxaas.maxmind | status | count | The status of any MaxMind license in use for downloading geoip2 databases. Refer to [License Health]({{< ref "/nginxaas-azure/quickstart/geoip2.md#monitoring" >}}) to learn more about the status dimension. | deployment | {{}} diff --git a/content/nginxaas-azure/overview/overview.md b/content/nginxaas-azure/overview/overview.md index 5331c90b3..c06b74a5e 100644 --- a/content/nginxaas-azure/overview/overview.md +++ b/content/nginxaas-azure/overview/overview.md @@ -66,4 +66,4 @@ NGINX Plus instances are automatically upgraded to receive security patches and ## What's next -To get started, check the [NGINX as a Service for Azure prerequisites]({{< relref "/nginxaas-azure/getting-started/prerequisites.md" >}}) +To get started, check the [NGINX as a Service for Azure prerequisites]({{< ref "/nginxaas-azure/getting-started/prerequisites.md" >}}) diff --git a/content/nginxaas-azure/quickstart/basic-caching.md b/content/nginxaas-azure/quickstart/basic-caching.md index 094252dda..ce7ad0bee 100644 --- a/content/nginxaas-azure/quickstart/basic-caching.md +++ b/content/nginxaas-azure/quickstart/basic-caching.md @@ -22,4 +22,4 @@ NGINXaaS for Azure only supports caching to `/var/cache/nginx`. This is because ## Limitations -Currently, `proxy_cache_purge` might not work as expected because NGINXaaS [deploys multiple instances of NGINX Plus]({{< relref "/nginxaas-azure/overview/overview.md#architecture" >}}) for high availability. The `PURGE` request will be routed to a single instance, and only the matched values on that instance will be purged. +Currently, `proxy_cache_purge` might not work as expected because NGINXaaS [deploys multiple instances of NGINX Plus]({{< ref "/nginxaas-azure/overview/overview.md#architecture" >}}) for high availability. The `PURGE` request will be routed to a single instance, and only the matched values on that instance will be purged. diff --git a/content/nginxaas-azure/quickstart/geoip2.md b/content/nginxaas-azure/quickstart/geoip2.md index e92d5d39d..227b79d1c 100644 --- a/content/nginxaas-azure/quickstart/geoip2.md +++ b/content/nginxaas-azure/quickstart/geoip2.md @@ -15,7 +15,7 @@ NGINXaaS uses your MaxMind license to download GeoIP2 databases, puts them in th ## Configure -To enable GeoIP2 you [update your NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview.md">}}) to include your MaxMind license and the relevant NGINX directives. +To enable GeoIP2 you [update your NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview.md">}}) to include your MaxMind license and the relevant NGINX directives. 1. Log into MaxMind and [generate a `GeoIP.conf`](https://dev.maxmind.com/geoip/updating-databases/#2-obtain-geoipconf-with-account-information) file. 2. Add the `GeoIP.conf` file to your NGINX configuration, using the exact path `/etc/nginx/GeoIP.conf`. The `GeoIP.conf` will be validated, and must include `AccountID`, `LicenseKey`, and `EditionIDs`. Other configuration options in `GeoIP.conf` are ignored. We recommend you enable the **Protected** {{}} toggle button to mark `GeoIP.conf` as a protected file, which will prevent the contents from being read via any Azure client tools. @@ -49,7 +49,7 @@ http { All licenses are [validated with MaxMind](https://dev.maxmind.com/license-key-validation-api/) when initially added to your deployment, but MaxMind licenses can expire or be manually revoked. -To view the status of your MaxMind license, [enable monitoring]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) for your NGINXaaS deployment and navigate to the Metrics tab. View the `nginxaas.maxmind` metric under the `nginxaas statistics` metric namespace. The `nginxaas.maxmind` metric reports the health of your license through the `status` dimension: +To view the status of your MaxMind license, [enable monitoring]({{< ref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) for your NGINXaaS deployment and navigate to the Metrics tab. View the `nginxaas.maxmind` metric under the `nginxaas statistics` metric namespace. The `nginxaas.maxmind` metric reports the health of your license through the `status` dimension: {{}} diff --git a/content/nginxaas-azure/quickstart/hosting-static-content.md b/content/nginxaas-azure/quickstart/hosting-static-content.md index a58d9de11..3495ea824 100644 --- a/content/nginxaas-azure/quickstart/hosting-static-content.md +++ b/content/nginxaas-azure/quickstart/hosting-static-content.md @@ -42,7 +42,7 @@ test-static-files $ tree . 2 directories, 2 files ``` -{{}}`index.html` is placed under the `srv` directory. When using `tar` to upload static content, the static content has to be placed under one of the allowed paths listed in the [NGINX Filesystem Restrictions table]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}).{{}} +{{}}`index.html` is placed under the `srv` directory. When using `tar` to upload static content, the static content has to be placed under one of the allowed paths listed in the [NGINX Filesystem Restrictions table]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}).{{}} 3. Create the tarball. @@ -50,7 +50,7 @@ test-static-files $ tree . test-static-files $ tar -cvzf /test.tar.gz * ``` -4. Upload the tarball following instructions listed in the [NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#upload-gzip-nginx-configuration" >}}) documentation. +4. Upload the tarball following instructions listed in the [NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#upload-gzip-nginx-configuration" >}}) documentation. 5. After uploading the configuration, you should see the following files in your deployment: - `nginx.conf` @@ -60,7 +60,7 @@ test-static-files $ tar -cvzf /test.tar.gz * ## Uploading static files directly to the deployment -You can also upload static files directly to the deployment. See [Adding NGINX Configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#add-nginx-configuration" >}}) to upload individual files to your deployment. Refer to the [NGINX Filesystem Restrictions table]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) to see where files can be written to and read from. +You can also upload static files directly to the deployment. See [Adding NGINX Configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#add-nginx-configuration" >}}) to upload individual files to your deployment. Refer to the [NGINX Filesystem Restrictions table]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) to see where files can be written to and read from. ## Limitations diff --git a/content/nginxaas-azure/quickstart/loadbalancer-kubernetes.md b/content/nginxaas-azure/quickstart/loadbalancer-kubernetes.md index 9e0e13319..1db138ebd 100644 --- a/content/nginxaas-azure/quickstart/loadbalancer-kubernetes.md +++ b/content/nginxaas-azure/quickstart/loadbalancer-kubernetes.md @@ -56,7 +56,7 @@ This guide explains how to integrate NGINXaaS with an Azure Kubernetes Service ( Before following the steps in this guide, you must: - Create an AKS cluster. -- Create an NGINXaaS deployment. See the [documentation]({{< relref "/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal/" >}}) to deploy via the Azure portal. +- Create an NGINXaaS deployment. See the [documentation]({{< ref "/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal/" >}}) to deploy via the Azure portal. - Ensure network connectivity between the subnet delegated to the NGINXaaS deployment and the subnet where AKS is deployed. For example, the AKS cluster and NGINXaaS deployment can run on the same Azure VNET or on peered VNETs. ### Initial setup @@ -237,7 +237,7 @@ http { } ``` -[Apply the NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview/" >}}) to your deployment after making the required changes. +[Apply the NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview/" >}}) to your deployment after making the required changes. ### Create a Kubernetes Service @@ -367,7 +367,7 @@ To setup logging: 1. Enable the **NGINX Upstream Update Logs** category. 1. Select a destination. -For more information on logging, see [Enable NGINX Logs]({{< relref "/nginxaas-azure/monitoring/enable-logging/">}}). +For more information on logging, see [Enable NGINX Logs]({{< ref "/nginxaas-azure/monitoring/enable-logging/">}}). ### Metrics diff --git a/content/nginxaas-azure/quickstart/njs-support.md b/content/nginxaas-azure/quickstart/njs-support.md index 92621c818..b64f26927 100644 --- a/content/nginxaas-azure/quickstart/njs-support.md +++ b/content/nginxaas-azure/quickstart/njs-support.md @@ -12,9 +12,9 @@ F5 NGINX as a Service for Azure (NGINXaaS) supports the open-source [njs module] ## Upload NGINX configuration with njs -Create an njs script file by uploading a gzipped tar file or create the script file in the editor. See [NGINX Configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) for a step-by-step guide. +Create an njs script file by uploading a gzipped tar file or create the script file in the editor. See [NGINX Configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) for a step-by-step guide. -{{}}If specifying an absolute file path as your njs script's `File path`, see the [NGINX Filesystem Restrictions table]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) for the allowed directories the file can be written to.{{}} +{{}}If specifying an absolute file path as your njs script's `File path`, see the [NGINX Filesystem Restrictions table]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) for the allowed directories the file can be written to.{{}} Switch between the language options to see syntax highlighting for NGINX configs or JavaScript. @@ -36,8 +36,8 @@ http { ## njs validation -NGINXaaS will not parse, evaluate, or run any provided njs scripts when validating the NGINX configuration. [Enable logging]({{< relref "/nginxaas-azure/monitoring/enable-logging/" >}}) to monitor errors caused by njs scripts. +NGINXaaS will not parse, evaluate, or run any provided njs scripts when validating the NGINX configuration. [Enable logging]({{< ref "/nginxaas-azure/monitoring/enable-logging/" >}}) to monitor errors caused by njs scripts. ## "fs" module -The njs [File System module](http://nginx.org/en/docs/njs/reference.html#njs_api_fs) provides operations with files. NGINXaaS only allows reading and writing from [specified directories]({{< relref "nginx-configuration.md#nginx-process-restrictions" >}}). +The njs [File System module](http://nginx.org/en/docs/njs/reference.html#njs_api_fs) provides operations with files. NGINXaaS only allows reading and writing from [specified directories]({{< ref "nginx-configuration.md#nginx-process-restrictions" >}}). diff --git a/content/nginxaas-azure/quickstart/rate-limiting.md b/content/nginxaas-azure/quickstart/rate-limiting.md index b3780752d..61662c2bf 100644 --- a/content/nginxaas-azure/quickstart/rate-limiting.md +++ b/content/nginxaas-azure/quickstart/rate-limiting.md @@ -28,4 +28,4 @@ http { } ``` -{{}}As a prerequisite to using the `sync` parameter with `limit_req_zone` directive for rate limiting, enable [Runtime State Sharing with NGINXaaS for Azure]({{< relref "/nginxaas-azure/quickstart/runtime-state-sharing.md" >}}).{{}} +{{}}As a prerequisite to using the `sync` parameter with `limit_req_zone` directive for rate limiting, enable [Runtime State Sharing with NGINXaaS for Azure]({{< ref "/nginxaas-azure/quickstart/runtime-state-sharing.md" >}}).{{}} diff --git a/content/nginxaas-azure/quickstart/runtime-state-sharing.md b/content/nginxaas-azure/quickstart/runtime-state-sharing.md index 1e239cd87..24f2be0c0 100644 --- a/content/nginxaas-azure/quickstart/runtime-state-sharing.md +++ b/content/nginxaas-azure/quickstart/runtime-state-sharing.md @@ -18,7 +18,7 @@ With runtime state sharing, NGINXaaS instances can share some state data between {{}}`sync` parameter with a directive describing shared memory zones, cannot be added to an existing memory zone that was not configured to sync and cannot be removed from an existing memory zone that was configured to sync. To switch, consider removing the directive before reapplying it with the desired parameters.{{}} -For information on enabling synchronization for rate limiting with NGINXaaS for Azure, please visit the [Rate Limiting]({{< relref "/nginxaas-azure/quickstart/rate-limiting.md" >}}) documentation. +For information on enabling synchronization for rate limiting with NGINXaaS for Azure, please visit the [Rate Limiting]({{< ref "/nginxaas-azure/quickstart/rate-limiting.md" >}}) documentation. ## Configuring runtime state sharing among NGINXaaS for Azure deployment cluster instances diff --git a/content/nginxaas-azure/quickstart/scaling.md b/content/nginxaas-azure/quickstart/scaling.md index 686aa10eb..dc77a733c 100644 --- a/content/nginxaas-azure/quickstart/scaling.md +++ b/content/nginxaas-azure/quickstart/scaling.md @@ -82,14 +82,14 @@ NGINXaaS provides metrics for visibility of the current and historical capacity - NCUs Requested: `ncu.requested` -- how many NCUs have been requested using the API. This is the goal state of the system at that point in time. - NCUs Provisioned: `ncu.provisioned` -- how many NCUs have been successfully provisioned by the service. - - This is the basis for [billing]({{< relref "/nginxaas-azure/billing/overview.md" >}}). + - This is the basis for [billing]({{< ref "/nginxaas-azure/billing/overview.md" >}}). - This may differ from `ncu.requested` temporarily during scale-out/scale-in events or during automatic remediation for a hardware failure. - Capacity Percentage: `nginxaas.capacity.percentage` -- the percentage of the current workload's total capacity that is being used. - If this is over 70%, consider scaling out; otherwise, requests may fail or take longer than expected. Alternatively, enable autoscaling, so your deployment can automatically scale based on the amount of capacity consumed. -See the [Metrics Catalog]({{< relref "/nginxaas-azure/monitoring/metrics-catalog.md" >}}) for a reference of all metrics. +See the [Metrics Catalog]({{< ref "/nginxaas-azure/monitoring/metrics-catalog.md" >}}) for a reference of all metrics. -{{< note >}}These metrics aren't visible unless enabled, see how to [Enable Monitoring]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) for details.{{< /note >}} +{{< note >}}These metrics aren't visible unless enabled, see how to [Enable Monitoring]({{< ref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}) for details.{{< /note >}} {{< warning >}}The `ncu.consumed` metric is now deprecated and is on the path to retirement. Please change any alerting on this metric to use the new Capacity Percentage metric.{{< /warning >}} ## Estimating how many NCUs to provision @@ -109,7 +109,7 @@ In addition to the maximum capacity needed, we recommend adding a 10% to 20% buf ### Iterative approach 1. Make an estimate by either: - - using the [Usage and Cost Estimator]({{< relref "/nginxaas-azure/billing/usage-and-cost-estimator.md" >}}) + - using the [Usage and Cost Estimator]({{< ref "/nginxaas-azure/billing/usage-and-cost-estimator.md" >}}) - compare to a [reference workload](#reference-workloads) 2. Observe the `nginxaas.capacity.percentage` [metric](#metrics) in Azure Monitor of your workload 3. Decide what headroom factor you wish to have diff --git a/content/nginxaas-azure/quickstart/security-controls/auth-basic.md b/content/nginxaas-azure/quickstart/security-controls/auth-basic.md index fd9684f68..4470cf1aa 100644 --- a/content/nginxaas-azure/quickstart/security-controls/auth-basic.md +++ b/content/nginxaas-azure/quickstart/security-controls/auth-basic.md @@ -31,7 +31,7 @@ location /protected { Submit the NGINX configuration to apply it. You should be prompted to log in when you access the protected location or server. -{{}}The NGINX worker processes will open the password file. You must place the password file in a [directory the worker processes are allowed to read]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#nginx-filesystem-restrictions" >}}) or else all authenticated requests will fail.{{}} +{{}}The NGINX worker processes will open the password file. You must place the password file in a [directory the worker processes are allowed to read]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md#nginx-filesystem-restrictions" >}}) or else all authenticated requests will fail.{{}} - `/opt` - `/srv` diff --git a/content/nginxaas-azure/quickstart/security-controls/certificates.md b/content/nginxaas-azure/quickstart/security-controls/certificates.md index b96f51776..651f76c5c 100644 --- a/content/nginxaas-azure/quickstart/security-controls/certificates.md +++ b/content/nginxaas-azure/quickstart/security-controls/certificates.md @@ -34,7 +34,7 @@ NGINXaaS enables customers to securely store SSL/TLS certificates in Azure Key V ## Create an NGINXaaS deployment -If you do not have an NGINXaaS deployment, follow the steps in [Deploy using the Azure portal]({{< relref "/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md" >}}). +If you do not have an NGINXaaS deployment, follow the steps in [Deploy using the Azure portal]({{< ref "/nginxaas-azure/getting-started/create-deployment/deploy-azure-portal.md" >}}). {{}} Your NGINXaaS deployment and your key vault must be in the same subscription. {{}} @@ -61,7 +61,7 @@ Next, you can add an SSL/TLS certificate to your key vault by following [Azure's ## Assign a managed identity to your NGINXaaS deployment -In order for your NGINXaaS deployment to access your key vault, it must have an assinged managed idenity with the `Key Vault Secrets User` role. For more information, see [Assign Managed Identities]({{< relref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) and [Prerequisites for adding SSL/TLS certificates]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md#prerequisites" >}}). +In order for your NGINXaaS deployment to access your key vault, it must have an assinged managed idenity with the `Key Vault Secrets User` role. For more information, see [Assign Managed Identities]({{< ref "/nginxaas-azure/getting-started/managed-identity-portal.md" >}}) and [Prerequisites for adding SSL/TLS certificates]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md#prerequisites" >}}). 1. Go to your NGINXaaS deployment. 1. Select **Identity** in the left menu. @@ -83,7 +83,7 @@ In order for your NGINXaaS deployment to access your key vault, it must have an ## Add your certificate to your NGINXaaS deployment -Now, you can add your SSL/TLS certificate from your key vault to your NGINXaaS deployment. For more information, see [Add certificates using the Azure portal]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}). +Now, you can add your SSL/TLS certificate from your key vault to your NGINXaaS deployment. For more information, see [Add certificates using the Azure portal]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}). 1. Go to your NGINXaaS deployment. 1. Select **NGINX certificates** in the left menu. @@ -109,7 +109,7 @@ Now, you can add your SSL/TLS certificate from your key vault to your NGINXaaS d ## Reference your certificate in your NGINX configuration -Once a certificate has been added to your NGINXaaS deployment, you can reference it in your NGINX configuration to secure traffic. Refer to [Upload an NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview.md">}}) to add and update NGINX configuration files to your NGINXaaS deployment. The following NGINX configurations show examples of different certificate use cases. +Once a certificate has been added to your NGINXaaS deployment, you can reference it in your NGINX configuration to secure traffic. Refer to [Upload an NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview.md">}}) to add and update NGINX configuration files to your NGINXaaS deployment. The following NGINX configurations show examples of different certificate use cases. ### Use case 1: SSL/TLS termination diff --git a/content/nginxaas-azure/quickstart/security-controls/jwt.md b/content/nginxaas-azure/quickstart/security-controls/jwt.md index 7092c5458..e3a4441dc 100644 --- a/content/nginxaas-azure/quickstart/security-controls/jwt.md +++ b/content/nginxaas-azure/quickstart/security-controls/jwt.md @@ -42,7 +42,7 @@ server { {{}} When using the common Microsoft Entra signing keys you will need to increase the size of the subrequest output buffer as the key file will not fit in the default buffer. -If the buffer is not sized properly, requests will result in empty responses. If [error logging is enabled]({{< relref "/nginxaas-azure/monitoring/enable-logging/" >}}), you will see an error in the error log.{{}} +If the buffer is not sized properly, requests will result in empty responses. If [error logging is enabled]({{< ref "/nginxaas-azure/monitoring/enable-logging/" >}}), you will see an error in the error log.{{}} Enabling JWT key caching is recommended to achieve optimal performance. This can be done with the [auth_jwt_key_cache](https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html#auth_jwt_key_cache) directive. Note that caching of keys obtained from variables is not supported. If you are using Microsoft Entra as an identity provider for JWT authentication, please be aware that [keys are rotated frequently](https://learn.microsoft.com/en-us/entra/identity-platform/signing-key-rollover), and it is recommended to take that into consideration before using it as a static file or caching the response from the subrequest. diff --git a/content/nginxaas-azure/quickstart/security-controls/oidc.md b/content/nginxaas-azure/quickstart/security-controls/oidc.md index f5d219deb..ea0aa9875 100644 --- a/content/nginxaas-azure/quickstart/security-controls/oidc.md +++ b/content/nginxaas-azure/quickstart/security-controls/oidc.md @@ -14,9 +14,9 @@ Learn how to configure F5 NGINX as a Service (NGINXaaS) for Azure with OpenID Co ## Prerequisites -1. Configure an NGINXaaS deployment with [SSL/TLS certificates]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/" >}}). +1. Configure an NGINXaaS deployment with [SSL/TLS certificates]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/" >}}). -2. Enable [Runtime State Sharing]({{< relref "/nginxaas-azure/quickstart/runtime-state-sharing.md" >}}) on the NGINXaaS deployment. +2. Enable [Runtime State Sharing]({{< ref "/nginxaas-azure/quickstart/runtime-state-sharing.md" >}}) on the NGINXaaS deployment. 3. [Configure the IdP](https://github.com/nginxinc/nginx-openid-connect/blob/main/README.md#configuring-your-idp). For example, you can [register a Microsoft Entra Web application](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) as the IdP. @@ -44,13 +44,13 @@ Configuring NGINXaaS for Azure with OIDC is similar as [Configuring NGINX Plus]( } ``` - b. Set a proper path for `proxy_cache_path`, see [Enable content caching]({{< relref "basic-caching.md" >}}). + b. Set a proper path for `proxy_cache_path`, see [Enable content caching]({{< ref "basic-caching.md" >}}). ```nginx proxy_cache_path /var/cache/nginx/jwt levels=1 keys_zone=jwk:64k max_size=1m; ``` - c. Enable `sync` for the keyval memory zones and specify the state files to persist the current state across NGINX restarts. The state file paths are subject to [NGINX Filesystem Restrictions table]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) and must be placed in a directory accessible to the NGINX worker processes. + c. Enable `sync` for the keyval memory zones and specify the state files to persist the current state across NGINX restarts. The state file paths are subject to [NGINX Filesystem Restrictions table]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/overview/#nginx-filesystem-restrictions" >}}) and must be placed in a directory accessible to the NGINX worker processes. ```nginx keyval_zone zone=oidc_id_tokens:1M state=/opt/oidc_id_tokens.json timeout=1h sync; @@ -156,7 +156,7 @@ Configuring NGINXaaS for Azure with OIDC is similar as [Configuring NGINX Plus]( ```
-3. Upload the NGINX configurations. See [Upload an NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/" >}}) for more details. +3. Upload the NGINX configurations. See [Upload an NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/" >}}) for more details. 4. In a web browser, open `https:///`. The browser will be redirected to the IdP server. After a successful login using the credentials of a user who has the authorization, the protected URI can be accessed. For example, using the `nginx.conf` in this guide, open `https:///` and complete the authentication. The browser will show: @@ -166,8 +166,8 @@ Configuring NGINXaaS for Azure with OIDC is similar as [Configuring NGINX Plus]( ## Troubleshooting -[Enable NGINX logs]({{< relref "/nginxaas-azure/monitoring/enable-logging/" >}}) and [Troubleshooting](https://github.com/nginxinc/nginx-openid-connect/tree/main?tab=readme-ov-file#troubleshooting) the OIDC issues. +[Enable NGINX logs]({{< ref "/nginxaas-azure/monitoring/enable-logging/" >}}) and [Troubleshooting](https://github.com/nginxinc/nginx-openid-connect/tree/main?tab=readme-ov-file#troubleshooting) the OIDC issues. ## Monitoring -[Enable monitoring]({{< relref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}), check [real time monitoring](https://github.com/nginxinc/nginx-openid-connect/blob/main/README.md#real-time-monitoring) to see how OIDC metrics are collected, and use "plus.http.*" metrics filtered with location_zone dimension in [NGINX requests and response statistics]({{< relref "/nginxaas-azure/monitoring/metrics-catalog.md#nginx-requests-and-response-statistics" >}}) to check the OIDC metrics. +[Enable monitoring]({{< ref "/nginxaas-azure/monitoring/enable-monitoring.md" >}}), check [real time monitoring](https://github.com/nginxinc/nginx-openid-connect/blob/main/README.md#real-time-monitoring) to see how OIDC metrics are collected, and use "plus.http.*" metrics filtered with location_zone dimension in [NGINX requests and response statistics]({{< ref "/nginxaas-azure/monitoring/metrics-catalog.md#nginx-requests-and-response-statistics" >}}) to check the OIDC metrics. diff --git a/content/nginxaas-azure/quickstart/security-controls/securing-upstream-traffic.md b/content/nginxaas-azure/quickstart/security-controls/securing-upstream-traffic.md index 978ba7cbd..c9b54ce8d 100644 --- a/content/nginxaas-azure/quickstart/security-controls/securing-upstream-traffic.md +++ b/content/nginxaas-azure/quickstart/security-controls/securing-upstream-traffic.md @@ -8,16 +8,16 @@ type: - how-to --- -Learn how to encrypt HTTP traffic between F5 NGINX as a Service for Azure (NGINXaaS) and an upstream group or a proxied server. To secure TCP traffic to upstream servers, follow the [NGINX Plus guide](https://docs.nginx.com/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream/). As with securing HTTP traffic, you will need to [add the SSL/TLS client certificate]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}) to the NGINXaaS deployment. +Learn how to encrypt HTTP traffic between F5 NGINX as a Service for Azure (NGINXaaS) and an upstream group or a proxied server. To secure TCP traffic to upstream servers, follow the [NGINX Plus guide](https://docs.nginx.com/nginx/admin-guide/security-controls/securing-tcp-traffic-upstream/). As with securing HTTP traffic, you will need to [add the SSL/TLS client certificate]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}) to the NGINXaaS deployment. ### Prerequisites -- [Add a SSL/TLS Certificate]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}) to the NGINXaaS deployment. -- Enable [njs module]({{< relref "/nginxaas-azure/quickstart/njs-support.md">}}) if configuration uses njs directives. +- [Add a SSL/TLS Certificate]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}) to the NGINXaaS deployment. +- Enable [njs module]({{< ref "/nginxaas-azure/quickstart/njs-support.md">}}) if configuration uses njs directives. ### Configuring NGINX -[Add the client certificate and the key]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}) that will be used to authenticate NGINX to the NGINXaaS deployment. Make a note of the filepaths you assign to the `Certificate path` and `Key path`. +[Add the client certificate and the key]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}) that will be used to authenticate NGINX to the NGINXaaS deployment. Make a note of the filepaths you assign to the `Certificate path` and `Key path`. Next, change the URL to an upstream group to support SSL connections. In the NGINX configuration file, specify the “https” protocol for the proxied server or an upstream group in the `proxy_pass` directive: @@ -37,7 +37,7 @@ location /upstream { } ``` -If you use a self-signed certificate for an upstream or your own CA, you may include this file by adding it to the [NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md">}}) and including the `proxy_ssl_trusted_certificate` directive. The file must be in the PEM format. Optionally, include the [`proxy_ssl_verify`](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify) and [`proxy_ssl_verify_depth`](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify_depth) directives to have NGINX check the validity of the security certificates: +If you use a self-signed certificate for an upstream or your own CA, you may include this file by adding it to the [NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md">}}) and including the `proxy_ssl_trusted_certificate` directive. The file must be in the PEM format. Optionally, include the [`proxy_ssl_verify`](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify) and [`proxy_ssl_verify_depth`](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify_depth) directives to have NGINX check the validity of the security certificates: ```nginx location /upstream { @@ -49,7 +49,7 @@ location /upstream { } ``` -If your configuration is using the [njs module]({{< relref "/nginxaas-azure/quickstart/njs-support.md">}}), you can include the `js_fetch_trusted_certificate` directive to [verify](http://nginx.org/en/docs/njs/reference.html#fetch_verify) HTTPS certificates with the [Fetch API](http://nginx.org/en/docs/njs/reference.html#ngx_fetch). +If your configuration is using the [njs module]({{< ref "/nginxaas-azure/quickstart/njs-support.md">}}), you can include the `js_fetch_trusted_certificate` directive to [verify](http://nginx.org/en/docs/njs/reference.html#fetch_verify) HTTPS certificates with the [Fetch API](http://nginx.org/en/docs/njs/reference.html#ngx_fetch). Toggle `yes` to include the CA file as proctectd file when using Azure Portal as show below: @@ -57,7 +57,7 @@ Toggle `yes` to include the CA file as proctectd file when using Azure Portal as ### Configuring upstreams -Each upstream server should be configured to accept HTTPS connections. For each upstream server, specify a path to the server certificate and the private key [added to the NGINXaaS Deployment]({{< relref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}) with `ssl_certificate` and `ssl_certificate_key` directives: +Each upstream server should be configured to accept HTTPS connections. For each upstream server, specify a path to the server certificate and the private key [added to the NGINXaaS Deployment]({{< ref "/nginxaas-azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal.md">}}) with `ssl_certificate` and `ssl_certificate_key` directives: ```nginx server { @@ -74,7 +74,7 @@ server { } ``` -Specify the path to a trusted client CA certificate added to the [NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md">}}) with the `ssl_client_certificate` or `ssl_trusted_certificate` directives. The file should be in PEM format. +Specify the path to a trusted client CA certificate added to the [NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md">}}) with the `ssl_client_certificate` or `ssl_trusted_certificate` directives. The file should be in PEM format. ```nginx server { @@ -110,7 +110,7 @@ location /upstream { } ``` -`ssl_session_ticket_key` directive specifies a file with the secret key used to encrypt and decrypt TLS session tickets. To use these directives in your config file, include a file to your [NGINX configuration]({{< relref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) with 80 or 48 bytes of random data generated using `openssl` command, in your config bundle. For example, +`ssl_session_ticket_key` directive specifies a file with the secret key used to encrypt and decrypt TLS session tickets. To use these directives in your config file, include a file to your [NGINX configuration]({{< ref "/nginxaas-azure/getting-started/nginx-configuration/nginx-configuration-portal.md" >}}) with 80 or 48 bytes of random data generated using `openssl` command, in your config bundle. For example, ```nginx http { diff --git a/content/nginxaas-azure/quickstart/upgrade-channels.md b/content/nginxaas-azure/quickstart/upgrade-channels.md index c254e02d5..9abd6486f 100644 --- a/content/nginxaas-azure/quickstart/upgrade-channels.md +++ b/content/nginxaas-azure/quickstart/upgrade-channels.md @@ -33,7 +33,7 @@ Maintaining the latest version NGINX Plus, operating system (OS), and other soft | stable | No sooner than 45 days of a new NGINX Plus [release](https://docs.nginx.com/nginx/releases/). | {{}} -A new version of NGINX Plus and its related modules is first introduced to the **preview** channel, where it is goes through our acceptance testing. Once we have baked the software in the **preview** channel for a reasonable time, it is eventually graduated to the **stable** channel. The actual promotion timelines can vary, and you can view our [Changelog]({{< relref "/nginxaas-azure/changelog.md" >}}) for latest updates. +A new version of NGINX Plus and its related modules is first introduced to the **preview** channel, where it is goes through our acceptance testing. Once we have baked the software in the **preview** channel for a reasonable time, it is eventually graduated to the **stable** channel. The actual promotion timelines can vary, and you can view our [Changelog]({{< ref "/nginxaas-azure/changelog.md" >}}) for latest updates. ## Changing the upgrade channel diff --git a/content/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md b/content/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md index abab2ba3e..f118da1c5 100644 --- a/content/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md +++ b/content/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md @@ -19,7 +19,7 @@ h2 { NGINX Instance Manager uses NGINX as a front-end proxy and for managing user access. By default, NGINX Instance Manager uses basic authentication, requiring you to send your username and password with each request to confirm your identity. When logging in for the first time, use the default `admin` account and password. After that, you can create additional user accounts. Instructions for adding users and setting passwords are provided below. -{{< call-out "warning" "Security consideration" >}} While convenient, basic authentication is less secure than other methods: credentials are sent as base64-encoded text, which is not a secure encryption method. If your data is intercepted, the encoding can be easily reversed. If you're using NGINX Plus for your front-end proxy, consider [switching to OpenID Connect (OIDC) for authentication]({{< relref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}). For production environments, we strongly recommend OIDC.{{< /call-out >}} +{{< call-out "warning" "Security consideration" >}} While convenient, basic authentication is less secure than other methods: credentials are sent as base64-encoded text, which is not a secure encryption method. If your data is intercepted, the encoding can be easily reversed. If you're using NGINX Plus for your front-end proxy, consider [switching to OpenID Connect (OIDC) for authentication]({{< ref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}). For production environments, we strongly recommend OIDC.{{< /call-out >}} ## Default admin user @@ -27,7 +27,7 @@ When you install NGINX Instance Manager, a default `admin` user is created with You can change the default `admin` password by running the provided script or by manually editing the `/etc/nms/nginx/.htpasswd` file. For instructions, see the [Set user passwords](#set-basic-passwords) section below. -The `admin` user is associated with an [admin role]({{< relref "/nim/admin-guide/rbac/overview-rbac.md" >}}) that grants full permissions for all modules and features. You can delete the `admin` user, but only after assigning the admin role to another user. The admin role cannot be deleted and must always be assigned to at least one user. +The `admin` user is associated with an [admin role]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}) that grants full permissions for all modules and features. You can delete the `admin` user, but only after assigning the admin role to another user. The admin role cannot be deleted and must always be assigned to at least one user. ## Create new users {#create-users} @@ -49,11 +49,11 @@ To add users, take the following steps: 1. In the **Roles** list, select one or more roles to assign to the user. - Learn more about roles and how to create them in the [Getting started with RBAC]({{< relref "/nim/admin-guide/rbac/overview-rbac" >}}) topic. + Learn more about roles and how to create them in the [Getting started with RBAC]({{< ref "/nim/admin-guide/rbac/overview-rbac" >}}) topic. -1. (Required for Basic Auth) Add each user's username and password to the `/etc/nms/nginx/.htpasswd` file on the NGINX Instance Manager server. You can choose to run a script or make the changes manually. Refer to the [Set user passwords]({{< relref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md#set-basic-passwords" >}}) topic for instructions. +1. (Required for Basic Auth) Add each user's username and password to the `/etc/nms/nginx/.htpasswd` file on the NGINX Instance Manager server. You can choose to run a script or make the changes manually. Refer to the [Set user passwords]({{< ref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md#set-basic-passwords" >}}) topic for instructions. -{{< see-also >}} Refer to the [Provision users and groups with SCIM]({{< relref "/nim/admin-guide/authentication/oidc/scim-provisioning.md" >}}) topic for instructions on automating user and group creation using the SCIM API. {{< /see-also >}} +{{< see-also >}} Refer to the [Provision users and groups with SCIM]({{< ref "/nim/admin-guide/authentication/oidc/scim-provisioning.md" >}}) topic for instructions on automating user and group creation using the SCIM API. {{< /see-also >}} ## Set user passwords {#set-basic-passwords} @@ -90,7 +90,7 @@ To manually set user passwords: 1. Open the `/etc/nms/nginx/.htpasswd` file on the NGINX Instance Manager host and add the username and password for each user. 2. Save the changes to the file. -{{< see-also >}}Refer to the documentation [Restricting access with HTTP basic auth]({{< relref "/nginx/admin-guide/security-controls/configuring-http-basic-authentication.md" >}}) for detailed instructions on working with the password file.{{< /see-also >}} +{{< see-also >}}Refer to the documentation [Restricting access with HTTP basic auth]({{< ref "/nginx/admin-guide/security-controls/configuring-http-basic-authentication.md" >}}) for detailed instructions on working with the password file.{{< /see-also >}} ## Making API requests with basic authentication diff --git a/content/nim/admin-guide/authentication/oidc/getting-started.md b/content/nim/admin-guide/authentication/oidc/getting-started.md index 0c42ff40d..1ca092e8e 100644 --- a/content/nim/admin-guide/authentication/oidc/getting-started.md +++ b/content/nim/admin-guide/authentication/oidc/getting-started.md @@ -16,7 +16,7 @@ NGINX Instance Manager’s implementation of OIDC is designed to work with any I {{}}To learn how to configure OIDC with a specific identity provider, refer to the linked topics in the [Set up specific IdPs for OIDC](#oidc-specific-idps) section at the bottom of this page.{{}} -{{}}OpenID Connect (OIDC) authentication is not supported when NGINX Instance Manager is running in [forward-proxy mode]({{< relref "nim/system-configuration/configure-forward-proxy.md" >}}). OIDC is configured on the NGINX Plus layer and cannot pass authentication requests through a forward proxy.{{}} +{{}}OpenID Connect (OIDC) authentication is not supported when NGINX Instance Manager is running in [forward-proxy mode]({{< ref "nim/system-configuration/configure-forward-proxy.md" >}}). OIDC is configured on the NGINX Plus layer and cannot pass authentication requests through a forward proxy.{{}} ## Create roles and user groups in NGINX Instance Manager {#configure-nim} @@ -60,7 +60,7 @@ When you configure OIDC for NGINX Instance Manager, basic authentication will be The following requirements must be met before you can use OIDC with NGINX Instance Manager: -1. [Install Instance Manager]({{< relref "/nim/deploy/vm-bare-metal/install.md" >}}) on a server that also has [NGINX Plus R21 or newer]({{< relref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) installed. Ensure the server hosting NGINX Plus has a fully qualified domain name (FQDN). +1. [Install Instance Manager]({{< ref "/nim/deploy/vm-bare-metal/install.md" >}}) on a server that also has [NGINX Plus R21 or newer]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}) installed. Ensure the server hosting NGINX Plus has a fully qualified domain name (FQDN). 2. [Install the NGINX JavaScript module (njs)](https://www.nginx.com/blog/introduction-nginscript/) on the same server as Instance Manager. This module is required for managing communications between NGINX Plus and the identity provider. @@ -101,5 +101,5 @@ For custom settings, adjust parameters such as `$oidc_authz_path_params_enable`, For specific IdP setup instructions, refer to the following: -- [Set up Microsoft Entra as an OIDC identity provider]({{< relref "/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md" >}}) -- [Set up Keycloak as an OIDC identity provider]({{< relref "/nim/admin-guide/authentication/oidc/keycloak-setup.md" >}}) +- [Set up Microsoft Entra as an OIDC identity provider]({{< ref "/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md" >}}) +- [Set up Keycloak as an OIDC identity provider]({{< ref "/nim/admin-guide/authentication/oidc/keycloak-setup.md" >}}) diff --git a/content/nim/admin-guide/authentication/oidc/keycloak-setup.md b/content/nim/admin-guide/authentication/oidc/keycloak-setup.md index c31dd79a3..24ace8bc0 100644 --- a/content/nim/admin-guide/authentication/oidc/keycloak-setup.md +++ b/content/nim/admin-guide/authentication/oidc/keycloak-setup.md @@ -25,8 +25,8 @@ To follow the instructions in this guide, ensure you have the following setup fo On the NGINX Instance Manager host, complete the following: -- [Install NGINX Plus R25 or a later version]({{< relref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). Ensure the server hosting NGINX Plus has a fully qualified domain name (FQDN). -- [Install NGINX Instance Manager]({{< relref "/nim/deploy/vm-bare-metal/install.md" >}}). +- [Install NGINX Plus R25 or a later version]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). Ensure the server hosting NGINX Plus has a fully qualified domain name (FQDN). +- [Install NGINX Instance Manager]({{< ref "/nim/deploy/vm-bare-metal/install.md" >}}). - [Install the NGINX JavaScript module (njs)](https://www.nginx.com/blog/introduction-nginscript/). This module is needed for managing communications between NGINX Plus and the identity provider. ## Configure Keycloak {#configure-keycloak} @@ -169,7 +169,7 @@ To configure NGINX Instance Manager with the necessary OIDC settings, follow the "https://$KEYCLOAK_IP:8443/realms//.well-known/openid-configuration" | \ jq -r ".jwks_uri") ``` - + - Back up the original configuration files: ```bash diff --git a/content/nim/admin-guide/authentication/oidc/microsoft-entra-automation.md b/content/nim/admin-guide/authentication/oidc/microsoft-entra-automation.md index e510ad8d5..27314f6ad 100644 --- a/content/nim/admin-guide/authentication/oidc/microsoft-entra-automation.md +++ b/content/nim/admin-guide/authentication/oidc/microsoft-entra-automation.md @@ -14,7 +14,7 @@ This guide explains how to secure NGINX Instance Manager with OpenID Connect (OI ## Before you begin {{}} -Before proceeding, first secure NGINX Instance Manager with OpenID Connect (OIDC) using Microsoft Entra as the identity provider. Complete the steps in the [Set up OIDC authentication with Microsoft Entra]({{< relref "/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md" >}}) guide. Afterward, you'll have a registered application (e.g., "NGINX Instance Manager") in Microsoft Entra, as well as a client ID and secret to configure automation. +Before proceeding, first secure NGINX Instance Manager with OpenID Connect (OIDC) using Microsoft Entra as the identity provider. Complete the steps in the [Set up OIDC authentication with Microsoft Entra]({{< ref "/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md" >}}) guide. Afterward, you'll have a registered application (e.g., "NGINX Instance Manager") in Microsoft Entra, as well as a client ID and secret to configure automation. {{}} ## Configure Azure @@ -45,7 +45,7 @@ Before proceeding, first secure NGINX Instance Manager with OpenID Connect (OIDC 1. In the left navigation menu, under **Manage**, select **App roles**. 2. Select **Create app role**. -3. Fill in the role details. Use the information from an existing user group in NGINX Instance Manager, such as from the [Create user groups in Instance Manager]({{< relref "/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md#create-user-groups-in-nginx-instance-manager" >}}) step: +3. Fill in the role details. Use the information from an existing user group in NGINX Instance Manager, such as from the [Create user groups in Instance Manager]({{< ref "/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md#create-user-groups-in-nginx-instance-manager" >}}) step: - In the **Display name** field, enter a role name (e.g., "Admin"). - In **Allowed member types**, select **Applications**. - In the **Value** field, enter the value for the role. This must match the user group in NGINX Management Suite. @@ -66,7 +66,7 @@ Before proceeding, first secure NGINX Instance Manager with OpenID Connect (OIDC ## Configure NGINX OIDC to use Microsoft Entra as the IdP -Complete the steps in the [Configure NGINX Plus with Microsoft Entra as Identity Provider]({{< relref "/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md#configure-nginx-plus" >}}) topic. Note that you may have already completed some of these steps in the [Before you begin](#before-you-begin) section of this guide. +Complete the steps in the [Configure NGINX Plus with Microsoft Entra as Identity Provider]({{< ref "/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md#configure-nginx-plus" >}}) topic. Note that you may have already completed some of these steps in the [Before you begin](#before-you-begin) section of this guide. Additionally, complete the following steps: diff --git a/content/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md b/content/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md index 71eaba97f..68a41e454 100644 --- a/content/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md +++ b/content/nim/admin-guide/authentication/oidc/microsoft-entra-setup.md @@ -31,7 +31,7 @@ To configure Microsoft Entra as an OIDC IdP, follow these steps: To successfully follow the instructions in this guide, you must complete the following requirements: 1. Create a [Microsoft Entra premium account](https://azure.microsoft.com/en-us/pricing/details/active-directory/). If you have a standard account, you'll need to upgrade. -2. [Install Instance Manager]({{< relref "/nim/deploy/vm-bare-metal/install.md" >}}) on a server that also has [NGINX Plus R25 or a newer version installed]({{< relref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). Make sure the server hosting NGINX Plus has a fully qualified domain name (FQDN). +2. [Install Instance Manager]({{< ref "/nim/deploy/vm-bare-metal/install.md" >}}) on a server that also has [NGINX Plus R25 or a newer version installed]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). Make sure the server hosting NGINX Plus has a fully qualified domain name (FQDN). 3. [Install the NGINX JavaScript module (njs)](https://www.nginx.com/blog/introduction-nginscript/) on the same server as Instance Manager. This module is necessary for managing communications between NGINX Plus and the identity provider. ## Configure Microsoft Entra {#configur-entra} diff --git a/content/nim/admin-guide/authentication/oidc/scim-provisioning.md b/content/nim/admin-guide/authentication/oidc/scim-provisioning.md index 33d32f148..ff51b27e7 100644 --- a/content/nim/admin-guide/authentication/oidc/scim-provisioning.md +++ b/content/nim/admin-guide/authentication/oidc/scim-provisioning.md @@ -134,7 +134,7 @@ In this request, `User` is assigned as a member. } ``` -{{< important >}}After creating a group with SCIM, you need to [assign roles to the group]({{< relref "/nim/admin-guide/rbac/assign-roles.md" >}}) in NGINX Instance Manager so the group has permissions associated with it.{{< /important >}} +{{< important >}}After creating a group with SCIM, you need to [assign roles to the group]({{< ref "/nim/admin-guide/rbac/assign-roles.md" >}}) in NGINX Instance Manager so the group has permissions associated with it.{{< /important >}} ## Update users created with SCIM diff --git a/content/nim/admin-guide/license/report-usage-connected-deployment.md b/content/nim/admin-guide/license/report-usage-connected-deployment.md index 9ec7836bc..b061fbe61 100644 --- a/content/nim/admin-guide/license/report-usage-connected-deployment.md +++ b/content/nim/admin-guide/license/report-usage-connected-deployment.md @@ -22,7 +22,7 @@ In environments where NGINX Instance Manager has internet access but NGINX Plus See the steps below to configure NGINX Plus to report usage data to NGINX Instance Manager and how to submit the report to F5 for verification. -{{}}If your deployment of NGINX Instance Manager doesn’t allow internet access, follow the steps in [Report usage data in network-restricted environments]({{< relref "nim/disconnected/report-usage-disconnected-deployment.md" >}}) to report usage data to F5.{{}} +{{}}If your deployment of NGINX Instance Manager doesn’t allow internet access, follow the steps in [Report usage data in network-restricted environments]({{< ref "nim/disconnected/report-usage-disconnected-deployment.md" >}}) to report usage data to F5.{{}} --- @@ -49,13 +49,13 @@ To configure NGINX Plus (R33 and later) to report usage data to NGINX Instance M ### Automatic reporting -When you [add your JSON Web Token (JWT)]({{< relref "nim/admin-guide/license/add-license.md" >}}) to NGINX Instance Manager, usage reporting is enabled by default. +When you [add your JSON Web Token (JWT)]({{< ref "nim/admin-guide/license/add-license.md" >}}) to NGINX Instance Manager, usage reporting is enabled by default. NGINX Instance Manager will automatically report subscription entitlement and usage data to F5 if internet access is available. ### Manual reporting -{{}}You need to report usage to F5 regularly. **If usage isn’t reported for 180 days, NGINX Plus will stop processing traffic**. For more details about the usage reporting process, see [About subscription licenses]({{< relref "solutions/about-subscription-licenses.md" >}}).{{}} +{{}}You need to report usage to F5 regularly. **If usage isn’t reported for 180 days, NGINX Plus will stop processing traffic**. For more details about the usage reporting process, see [About subscription licenses]({{< ref "solutions/about-subscription-licenses.md" >}}).{{}} If you prefer submitting usage reports to F5 manually, follow these steps: diff --git a/content/nim/admin-guide/maintenance/backup-and-recovery.md b/content/nim/admin-guide/maintenance/backup-and-recovery.md index 54940a437..3757ef5fe 100644 --- a/content/nim/admin-guide/maintenance/backup-and-recovery.md +++ b/content/nim/admin-guide/maintenance/backup-and-recovery.md @@ -11,7 +11,7 @@ NGINX Instance Manager includes several scripts for backing up and restoring con The backup and restore scripts are provided for reference and may need to be adjusted to suit your specific deployment. -{{< call-out "important" "NGINX Instance Manager 2.14.1 and earlier:" >}}If you're using **NGINX Instance Manager version 2.14.1 or earlier**, you'll need to [install SQLite]({{< relref "/nim/admin-guide/maintenance/sqlite-installation.md" >}}) to run the backup and recovery scripts.{{}} +{{< call-out "important" "NGINX Instance Manager 2.14.1 and earlier:" >}}If you're using **NGINX Instance Manager version 2.14.1 or earlier**, you'll need to [install SQLite]({{< ref "/nim/admin-guide/maintenance/sqlite-installation.md" >}}) to run the backup and recovery scripts.{{}} {{}} Some commands and directories still use `nms` in their paths or names because they were established when NGINX Instance Manager was part of the NGINX Management Suite. These names remain unchanged in this version for consistency with the existing file structure.{{}} @@ -85,7 +85,7 @@ To complete the steps in this guide, ensure the following: -- **Root Access**: +- **Root Access**: You’ll need superuser (sudo) access to run the backup and restore scripts, which use the `kubectl` command to interact with the Kubernetes API. Ensure that the root user has access to the Kubernetes cluster. To verify root access to the Kubernetes API, run this command: @@ -104,17 +104,17 @@ To complete the steps in this guide, ensure the following: Replace `/etc/kubernetes/admin.conf` with the actual configuration path for your cluster if it differs. -- **Utility Pod**: +- **Utility Pod**: Ensure the `utility` pod is installed in your Kubernetes cluster: - 1. Update your [Helm Deployment values.yaml file]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}), adding the following line to enable the utility pod: + 1. Update your [Helm Deployment values.yaml file]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}), adding the following line to enable the utility pod: ```yaml global: utility: true ``` - 2. [Upgrade your NGINX Instance Manager deployment]({{< relref "/nim/deploy/kubernetes/deploy-using-helm#helm-upgrade-nim" >}}). + 2. [Upgrade your NGINX Instance Manager deployment]({{< ref "/nim/deploy/kubernetes/deploy-using-helm#helm-upgrade-nim" >}}). 3. Download the Helm chart for the installed version of NGINX Instance Manager: @@ -177,7 +177,7 @@ To restore NGINX Instance Manager to the same Kubernetes cluster: If the Kubernetes configuration is different, update the path accordingly. - {{< note >}}The restore script requires [root access]({{< relref "/nim/admin-guide/maintenance/backup-and-recovery.md#root-access" >}}).{{}} + {{< note >}}The restore script requires [root access]({{< ref "/nim/admin-guide/maintenance/backup-and-recovery.md#root-access" >}}).{{}} 5. After specifying the NGINX Instance Manager namespace, the script will use the provided backup archive. @@ -209,7 +209,7 @@ To restore NGINX Instance Manager to a different Kubernetes cluster: If the Kubernetes configuration differs, update the path accordingly. - {{< note >}}The restore script requires [root access]({{< relref "/nim/admin-guide/maintenance/backup-and-recovery.md#root-access" >}}).{{}} + {{< note >}}The restore script requires [root access]({{< ref "/nim/admin-guide/maintenance/backup-and-recovery.md#root-access" >}}).{{}} 5. After specifying the NGINX Instance Manager namespace, the script will restore the databases and core secrets. diff --git a/content/nim/admin-guide/maintenance/sqlite-installation.md b/content/nim/admin-guide/maintenance/sqlite-installation.md index 4d59f278d..391db1caa 100644 --- a/content/nim/admin-guide/maintenance/sqlite-installation.md +++ b/content/nim/admin-guide/maintenance/sqlite-installation.md @@ -7,7 +7,7 @@ weight: 10 ## Install SQLite for your Linux distribution -If you're using **NGINX Instance Manager version 2.14.1 or earlier**, you'll need to install SQLite to run the [backup and recovery scripts]({{< relref "/nim/admin-guide/maintenance/backup-and-recovery.md" >}}). +If you're using **NGINX Instance Manager version 2.14.1 or earlier**, you'll need to install SQLite to run the [backup and recovery scripts]({{< ref "/nim/admin-guide/maintenance/backup-and-recovery.md" >}}). Follow the steps to install SQLite for your operating system. Note that some older versions of Linux might require additional steps, explained below. ### CentOS, RHEL, and RPM-based distributions diff --git a/content/nim/admin-guide/rbac/assign-roles.md b/content/nim/admin-guide/rbac/assign-roles.md index a5bfe9575..549295ed7 100644 --- a/content/nim/admin-guide/rbac/assign-roles.md +++ b/content/nim/admin-guide/rbac/assign-roles.md @@ -16,8 +16,8 @@ In NGINX Instance Manager, role-based access control (RBAC) lets you assign perm {{}} Make sure you’ve already created users or user groups that can be assigned roles. If not, follow these guides: -- To create users, follow the instructions in [Set up basic authentication]({{< relref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md" >}}). -- To create user groups, follow the steps in [Getting started with OIDC]({{< relref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}). +- To create users, follow the instructions in [Set up basic authentication]({{< ref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md" >}}). +- To create user groups, follow the steps in [Getting started with OIDC]({{< ref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}). {{}} diff --git a/content/nim/admin-guide/rbac/create-roles.md b/content/nim/admin-guide/rbac/create-roles.md index cb0161953..c982bb3b5 100644 --- a/content/nim/admin-guide/rbac/create-roles.md +++ b/content/nim/admin-guide/rbac/create-roles.md @@ -31,7 +31,7 @@ To modify an existing role in NGINX Instance Manager, follow these steps: 1. Select **Add Permission**. 2. In the **Module** list, select the relevant module. - 3. In the **Feature** list, select the feature you're assigning permissions for. + 3. In the **Feature** list, select the feature you're assigning permissions for. 4. Select **Add Additional Access** to grant a CRUD (Create, Read, Update, Delete) access level. @@ -51,4 +51,4 @@ To modify an existing role in NGINX Instance Manager, follow these steps: Once you’ve created roles, assign them to users or user groups to ensure that permissions align with responsibilities. This helps maintain clear and organized access control. -- [Assign roles to users or user groups]({{< relref "/nim/admin-guide/rbac/assign-roles.md" >}}) +- [Assign roles to users or user groups]({{< ref "/nim/admin-guide/rbac/assign-roles.md" >}}) diff --git a/content/nim/admin-guide/rbac/manage-resource-groups.md b/content/nim/admin-guide/rbac/manage-resource-groups.md index ba2156729..c85e4787a 100644 --- a/content/nim/admin-guide/rbac/manage-resource-groups.md +++ b/content/nim/admin-guide/rbac/manage-resource-groups.md @@ -9,13 +9,13 @@ type: ## Overview -Resource groups are containers that help you manage multiple resources collectively, such as instances, instance groups, and certificates. By using resource groups, you can assign RBAC (Role-Based Access Control) permissions to multiple resources as a single entity. This provides a more flexible way of managing resources compared to [Instance Groups]({{< relref "/nim/nginx-instances/manage-instance-groups.md" >}}), where all instances share the same configuration. Resource groups don’t have this limitation and allow you to manage various resources under one group for better control. +Resource groups are containers that help you manage multiple resources collectively, such as instances, instance groups, and certificates. By using resource groups, you can assign RBAC (Role-Based Access Control) permissions to multiple resources as a single entity. This provides a more flexible way of managing resources compared to [Instance Groups]({{< ref "/nim/nginx-instances/manage-instance-groups.md" >}}), where all instances share the same configuration. Resource groups don’t have this limitation and allow you to manage various resources under one group for better control. ## Before you begin To complete the steps in this guide, ensure you have: -- A running version of [NGINX Instance Manager]({{< relref "/nim/deploy/_index.md" >}}). +- A running version of [NGINX Instance Manager]({{< ref "/nim/deploy/_index.md" >}}). - One or more registered NGINX data plane instances. {{< include "/nim/how-to-access-api-docs.md" >}} diff --git a/content/nim/admin-guide/rbac/overview-rbac.md b/content/nim/admin-guide/rbac/overview-rbac.md index f3259a258..c49e14463 100644 --- a/content/nim/admin-guide/rbac/overview-rbac.md +++ b/content/nim/admin-guide/rbac/overview-rbac.md @@ -24,7 +24,7 @@ The following are essential concepts related to RBAC: ## Features {#features} -NGINX Instance Manager provides a range of capabilities called features, which system administrators can manage using role-based access control (RBAC). The availability of some features depends on your license. For more information on licensing, see the [Add a license]({{< relref "/nim/admin-guide/license/add-license.md" >}}) topic. +NGINX Instance Manager provides a range of capabilities called features, which system administrators can manage using role-based access control (RBAC). The availability of some features depends on your license. For more information on licensing, see the [Add a license]({{< ref "/nim/admin-guide/license/add-license.md" >}}) topic. ### NGINX Instance Manager features diff --git a/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md b/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md index 57cdb413c..aba19ad72 100644 --- a/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md +++ b/content/nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md @@ -10,9 +10,9 @@ type: ## Overview -This guide will show you how to deploy and use F5 NGINX Instance Manager in Docker using [Docker Compose](https://docs.docker.com/compose/). +This guide will show you how to deploy and use F5 NGINX Instance Manager in Docker using [Docker Compose](https://docs.docker.com/compose/). -This NGINX Instance Manager docker compose deployment is a single Docker image containing NGINX Instance Manager, Security Monitoring, and the latest App Protect compilers, which is orchestrated using a Docker Compose docker-compose.yaml definition. +This NGINX Instance Manager docker compose deployment is a single Docker image containing NGINX Instance Manager, Security Monitoring, and the latest App Protect compilers, which is orchestrated using a Docker Compose docker-compose.yaml definition. The ClickHouse database is deployed in a separate container to improve resilience and make this a fault tolerant solution. You can also configure persistent storage @@ -24,7 +24,7 @@ The ClickHouse database is deployed in a separate container to improve resilienc - Your NGINX Instance Manager subscription's JSON Web Token from [MyF5](https://my.f5.com/manage/s/subscriptions) You can use the same JSON Web Token as NGINX Plus in your MyF5 portal. - This pre-configured `docker-compose.yaml` file: - {{}} {{}}. - + --- ## Minimum requirements @@ -47,7 +47,7 @@ To set up Docker to communicate with the NGINX container registry located at `pr {{}} -If you are configuring a **forward proxy**, follow the steps in the [Forward Proxy Configuration Guide]({{< relref "nim/system-configuration/configure-forward-proxy.md" >}}) to modify `docker-compose.yaml` with the correct proxy settings **before** deploying NGINX Instance Manager. +If you are configuring a **forward proxy**, follow the steps in the [Forward Proxy Configuration Guide]({{< ref "nim/system-configuration/configure-forward-proxy.md" >}}) to modify `docker-compose.yaml` with the correct proxy settings **before** deploying NGINX Instance Manager. {{}} @@ -77,8 +77,8 @@ If the deployment succeeds, you’ll see output similar to this:
-{{}} -For details on configuring a forward proxy, see the [Forward Proxy Configuration Guide]({{< relref "nim/system-configuration/configure-forward-proxy.md" >}}). +{{}} +For details on configuring a forward proxy, see the [Forward Proxy Configuration Guide]({{< ref "nim/system-configuration/configure-forward-proxy.md" >}}). {{}} ### Compose stop or tear down @@ -133,7 +133,7 @@ secrets: --- -## Backup +## Backup Once you've set up your Docker containers, use the following command to back them up: @@ -154,7 +154,7 @@ ubuntu@ip-
:~/compose$ sudo ls -l /var/lib/docker/volumes/nim_nim-data/_ --- -## Restore +## Restore Before you can restore a backup, set your containers to maintenance mode in the same `docker-compose.yaml` file: @@ -185,8 +185,8 @@ For all storage volumes, make sure to mount them, before running `docker compose ```yaml volumes: - # By default docker compose will create a named volume - # Refer to https://docs.docker.com/reference/compose-file/volumes/ for additional storage options such as NFS + # By default docker compose will create a named volume + # Refer to https://docs.docker.com/reference/compose-file/volumes/ for additional storage options such as NFS nim-data: driver: local driver_opts: @@ -203,7 +203,7 @@ volumes: --- -## Support Data +## Support Data In case of problems, it's a good practice to: diff --git a/content/nim/deploy/infrastructure-as-code/overview.md b/content/nim/deploy/infrastructure-as-code/overview.md index 29f126aac..b02761dcb 100644 --- a/content/nim/deploy/infrastructure-as-code/overview.md +++ b/content/nim/deploy/infrastructure-as-code/overview.md @@ -19,7 +19,7 @@ The steps in this guide refer to the }}). +- An NGINX repository certificate and key. For instructions on how to download them, click [here]({{< ref "/nim/deploy/vm-bare-metal/install.md#download-cert-key" >}}). - A host capable of running Ansible.
@@ -38,7 +38,7 @@ The Infrastructure as Code (IaC) project makes it easy to set up the control pla The IaC project requires the following: -- An NGINX repository certificate and key. For instructions on how to download them, click [here]({{< relref "/nim/deploy/vm-bare-metal/install.md#download-cert-key" >}}). +- An NGINX repository certificate and key. For instructions on how to download them, click [here]({{< ref "/nim/deploy/vm-bare-metal/install.md#download-cert-key" >}}). - A trial or paid subscription for NGINX Instance Manager. You can [sign up for NGINX Instance Manager at MyF5](https://account.f5.com/myf5). - A host capable of running Packer, Ansible, and Terraform. diff --git a/content/nim/deploy/kubernetes/deploy-using-helm.md b/content/nim/deploy/kubernetes/deploy-using-helm.md index 953373ecb..8d39db8eb 100644 --- a/content/nim/deploy/kubernetes/deploy-using-helm.md +++ b/content/nim/deploy/kubernetes/deploy-using-helm.md @@ -246,7 +246,7 @@ The status should show `STATUS: deployed` if successful. A valid license is required to use all NGINX Instance Manager features. -For instructions on downloading and applying a license, see [Add a License]({{< relref "/nim/admin-guide/license/add-license.md" >}}). +For instructions on downloading and applying a license, see [Add a License]({{< ref "/nim/admin-guide/license/add-license.md" >}}). --- @@ -269,7 +269,7 @@ To upgrade: --wait ``` - - Replace `` with the path to the `values.yaml` file you created]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}). + - Replace `` with the path to the `values.yaml` file you created]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}). - Replace `YourPassword123#` with a secure password that includes uppercase and lowercase letters, numbers, and special characters. {{}} Save this password for future use. Only the encrypted password is stored in Kubernetes, and you can’t recover or reset it later. {{}} @@ -424,7 +424,7 @@ To upgrade: --wait ``` - - Replace `` with the path to the `values.yaml` file you created]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}). + - Replace `` with the path to the `values.yaml` file you created]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}). - Replace `YourPassword123#` with a secure password that includes uppercase and lowercase letters, numbers, and special characters. {{}} Save this password for future use. Only the encrypted password is stored in Kubernetes, and you can’t recover or reset it later. {{}} @@ -433,5 +433,5 @@ To upgrade: ## Troubleshooting -For instructions on creating a support package to share with NGINX Customer Support, see [Create a Support Package from a Helm Installation]({{< relref "/nms/support/k8s-support-package.md" >}}). +For instructions on creating a support package to share with NGINX Customer Support, see [Create a Support Package from a Helm Installation]({{< ref "/nms/support/k8s-support-package.md" >}}). diff --git a/content/nim/deploy/kubernetes/frequently-used-helm-configs.md b/content/nim/deploy/kubernetes/frequently-used-helm-configs.md index 06e662c5b..05d450a93 100644 --- a/content/nim/deploy/kubernetes/frequently-used-helm-configs.md +++ b/content/nim/deploy/kubernetes/frequently-used-helm-configs.md @@ -13,7 +13,7 @@ type: This guide provides frequently used configurations for NGINX Instance Manager. To apply any of these configurations, modify the `values.yaml` file accordingly. -Refer to the [configurable Helm settings]({{< relref "/nim/deploy/kubernetes/helm-config-settings.md" >}}) guide for a complete list of configurable parameters and default values used by NGINX Instance Manager and its modules when installing from a Helm chart. +Refer to the [configurable Helm settings]({{< ref "/nim/deploy/kubernetes/helm-config-settings.md" >}}) guide for a complete list of configurable parameters and default values used by NGINX Instance Manager and its modules when installing from a Helm chart. --- @@ -82,7 +82,7 @@ To use NGINX Plus for the API Gateway, follow these steps: 1. Build your own Docker image for the NGINX Plus API Gateway by providing your `nginx-repo.crt` and `nginx-repo.key`. Download the certificate and key from the [MyF5 website](https://my.f5.com) and add them to your build context. - Use the following example Dockerfile to build the image. In this example, we use `apigw:` as the base image, which you obtained when you [downloaded the Helm package]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md#download-helm-package" >}}). + Use the following example Dockerfile to build the image. In this example, we use `apigw:` as the base image, which you obtained when you [downloaded the Helm package]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md#download-helm-package" >}}). **Example Dockerfile:** diff --git a/content/nim/deploy/kubernetes/helm-config-settings.md b/content/nim/deploy/kubernetes/helm-config-settings.md index 984207c89..83ce7682c 100644 --- a/content/nim/deploy/kubernetes/helm-config-settings.md +++ b/content/nim/deploy/kubernetes/helm-config-settings.md @@ -45,7 +45,7 @@ To modify a configuration for an existing release, run the `helm upgrade` comman | `nms-hybrid.externalClickhouse.password` | Password of the external ClickHouse service. | | | `nms-hybrid.serviceAccount.annotations` | Set custom annotations for the service account used by NGINX Instance Manager. | `{}` | | `nms-hybrid.apigw.name` | Name used for API Gateway resources. | `apigw` | -| `nms-hybrid.apigw.tlsSecret` | By default, this Helm chart creates its own Certificate Authority (CA) to self-sign HTTPS server cert key pairs. These are not managed by NGINX Instance Manager. You can bring your own NGINX API Gateway certificates for hosting the HTTPS server by setting `tlsSecret` to an existing Kubernetes secret name in the targeted namespace. The secret should include `tls.crt`, `tls.key`, and `ca.pem` in the data object. Using a self-provisioned "tlsSecret" is recommended for production.

Refer to the "Use your own certificates" section in [Frequently used Helm configurations]({{< relref "/nim/deploy/kubernetes/frequently-used-helm-configs.md#use-your-own-certificates" >}}) for an example. | | +| `nms-hybrid.apigw.tlsSecret` | By default, this Helm chart creates its own Certificate Authority (CA) to self-sign HTTPS server cert key pairs. These are not managed by NGINX Instance Manager. You can bring your own NGINX API Gateway certificates for hosting the HTTPS server by setting `tlsSecret` to an existing Kubernetes secret name in the targeted namespace. The secret should include `tls.crt`, `tls.key`, and `ca.pem` in the data object. Using a self-provisioned "tlsSecret" is recommended for production.

Refer to the "Use your own certificates" section in [Frequently used Helm configurations]({{< ref "/nim/deploy/kubernetes/frequently-used-helm-configs.md#use-your-own-certificates" >}}) for an example. | | | `nms-hybrid.apigw.image.repository` | Repository name and path for the `apigw` image. | `apigw` | | `nms-hybrid.apigw.image.tag` | Tag used for pulling images from the registry. | `latest` | | `nms-hybrid.apigw.image.pullPolicy` | Image pull policy. | `IfNotPresent` | diff --git a/content/nim/deploy/vm-bare-metal/install-nim-deprecated.md b/content/nim/deploy/vm-bare-metal/install-nim-deprecated.md index 0bb9ec5e4..9baf8129a 100644 --- a/content/nim/deploy/vm-bare-metal/install-nim-deprecated.md +++ b/content/nim/deploy/vm-bare-metal/install-nim-deprecated.md @@ -14,7 +14,7 @@ type: Follow the steps in this guide to install or upgrade NGINX Instance Manager. {{}} -This document outlines manual steps that have been replaced by a simplified script-based process. For most users, we recommend using the updated process documented [here]({{< relref "nim/deploy/vm-bare-metal/install.md" >}}).{{}} +This document outlines manual steps that have been replaced by a simplified script-based process. For most users, we recommend using the updated process documented [here]({{< ref "nim/deploy/vm-bare-metal/install.md" >}}).{{}} ## Before You Begin @@ -79,7 +79,7 @@ Install NGINX Open Source or NGINX Plus on the host where you'll install NGINX I -{{}}Make sure to review the [Technical Specifications]({{< relref "tech-specs" >}}) guide for sizing requirements and other recommended specs.{{}} +{{}}Make sure to review the [Technical Specifications]({{< ref "/nim/fundamentals/tech-specs" >}}) guide for sizing requirements and other recommended specs.{{}} --- @@ -112,7 +112,7 @@ To install and enable ClickHouse CentOS, RHEL, and RPM-Based distributions, take > **IMPORTANT!** When installing ClickHouse, you have the option to specify a password or leave the password blank (the default is an empty string). If you choose to specify a password for ClickHouse, you must also edit the `/etc/nms/nms.conf` file after installing NGINX Instance Manager and enter your ClickHouse password; otherwise, NGINX Instance Manager won't start. > - > For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< relref "nim/system-configuration/configure-clickhouse.md" >}}) topic. + > For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< ref "nim/system-configuration/configure-clickhouse.md" >}}) topic. 1. Enable ClickHouse so that it starts automatically if the server is restarted: @@ -159,7 +159,7 @@ To install and enable ClickHouse on Debian, Ubuntu, and Deb-Based distributions, > **IMPORTANT!** When installing ClickHouse, you have the option to specify a password or leave the password blank (the default is an empty string). If you choose to specify a password for ClickHouse, you must also edit the `/etc/nms/nms.conf` file after installing NGINX Instance Manager and enter your ClickHouse password; otherwise, NGINX Instance Manager won't start. > - > For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< relref "nim/system-configuration/configure-clickhouse.md" >}}) topic. + > For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< ref "nim/system-configuration/configure-clickhouse.md" >}}) topic. 1. Enable ClickHouse so that it starts automatically if the server is restarted: @@ -187,7 +187,7 @@ To install and enable ClickHouse on Debian, Ubuntu, and Deb-Based distributions, NGINX Instance Manager uses the following default values for ClickHouse: -{{}}You can customize these settings. However, if you use custom settings, make sure to follow the [Configure ClickHouse]({{< relref "nim/system-configuration/configure-clickhouse.md" >}}) instructions to update the `nms.conf` file after you've installed NGINX Instance Manager; otherwise NGINX Instance Manager won't be able to connect to ClickHouse.{{}} +{{}}You can customize these settings. However, if you use custom settings, make sure to follow the [Configure ClickHouse]({{< ref "nim/system-configuration/configure-clickhouse.md" >}}) instructions to update the `nms.conf` file after you've installed NGINX Instance Manager; otherwise NGINX Instance Manager won't be able to connect to ClickHouse.{{}} {{< include "installation/clickhouse-defaults.md" >}} @@ -201,7 +201,7 @@ To install and enable Vault, take the following steps: - Follow Vault's instructions to [install Vault 1.8.8 or later](https://www.vaultproject.io/docs/install) for your distribution. - Ensure you are running Vault in a [Production Hardened Environment](https://learn.hashicorp.com/tutorials/vault/production-hardening). -- After installing NGINX Instance Manager, follow the steps to [Configure Vault for Storing Secrets]({{< relref "nim/system-configuration/configure-vault.md" >}}). +- After installing NGINX Instance Manager, follow the steps to [Configure Vault for Storing Secrets]({{< ref "nim/system-configuration/configure-vault.md" >}}). --- @@ -312,4 +312,4 @@ To install NGINX Instance Manager, you need to add the official repository to pu sudo systemctl restart nginx ``` -4. (Optional) If you use SELinux, follow the steps in the [Configure SELinux]({{< relref "nim/system-configuration/configure-selinux.md" >}}) guide to restore the default SELinux labels (`restorecon`) for the files and directories related to NGINX Management suite. +4. (Optional) If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "nim/system-configuration/configure-selinux.md" >}}) guide to restore the default SELinux labels (`restorecon`) for the files and directories related to NGINX Management suite. diff --git a/content/nim/deploy/vm-bare-metal/install.md b/content/nim/deploy/vm-bare-metal/install.md index fad7004b3..8e4a1ae44 100644 --- a/content/nim/deploy/vm-bare-metal/install.md +++ b/content/nim/deploy/vm-bare-metal/install.md @@ -14,7 +14,7 @@ type: This guide explains how to install F5 NGINX Instance Manager on a virtual machine or bare metal system using the `install-nim-bundle.sh` script. -The script simplifies the installation by automating tasks such as verifying system requirements, configuring services, and managing environment-specific options. For more control or an alternative approach, you can refer to the [manual installation guide]({{< relref "nim/deploy/vm-bare-metal/install-nim-deprecated.md" >}}), which provides detailed, step-by-step instructions. +The script simplifies the installation by automating tasks such as verifying system requirements, configuring services, and managing environment-specific options. For more control or an alternative approach, you can refer to the [manual installation guide]({{< ref "nim/deploy/vm-bare-metal/install-nim-deprecated.md" >}}), which provides detailed, step-by-step instructions. --- @@ -22,22 +22,22 @@ The script simplifies the installation by automating tasks such as verifying sys Follow these steps to prepare for installing NGINX Instance Manager: -- **Download the certificate and private key** (see the steps [below](#download-cert-key)): - Use the certificate and private key for NGINX Instance Manager (the same files used for NGINX Plus). - - Ensure the files have `.crt` and `.key` extensions. - - Save them to the target system. The default locations are: - - `/etc/ssl/nginx/nginx-repo.crt` - - `/etc/ssl/nginx/nginx-repo.key` +- **Download the certificate and private key** (see the steps [below](#download-cert-key)): + Use the certificate and private key for NGINX Instance Manager (the same files used for NGINX Plus). + - Ensure the files have `.crt` and `.key` extensions. + - Save them to the target system. The default locations are: + - `/etc/ssl/nginx/nginx-repo.crt` + - `/etc/ssl/nginx/nginx-repo.key` -- **Check for previous deployments**: - Ensure that NGINX Instance Manager and its components are not already installed. +- **Check for previous deployments**: + Ensure that NGINX Instance Manager and its components are not already installed. - If NGINX Instance Manager or its components (such as ClickHouse or NGINX) are detected, either follow the [upgrade instructions](#upgrade-nim) to update them or [manually remove the components](#uninstall-nim) before proceeding with the installation. -- **Record the version details**: - Note the current version of NGINX Instance Manager and confirm the supported version of NGINX OSS or NGINX Plus you intend to use. +- **Record the version details**: + Note the current version of NGINX Instance Manager and confirm the supported version of NGINX OSS or NGINX Plus you intend to use. - By default, the script installs the latest version. -- **(Optional) Install and configure Vault**: +- **(Optional) Install and configure Vault**: If you plan to use Vault, set it up before proceeding. ### Security considerations @@ -94,7 +94,7 @@ Download the certificate and private key required for NGINX Instance Manager. Th ## Download and run the installation script {#download-install} -Download the `install-nim-bundle.sh` script: +Download the `install-nim-bundle.sh` script: {{}} {{}} @@ -106,10 +106,10 @@ Follow these steps to get your system ready for a successful installation with t The script supports only new installations. If NGINX Instance Manager is already installed, take one of the following actions: -- **Upgrade manually** +- **Upgrade manually** The script cannot perform upgrades. To update an existing installation, follow the [upgrade steps](#upgrade-nim) in this document. -- **Uninstall first** +- **Uninstall first** Remove the current installation and its dependencies for a fresh start. Use the [uninstall steps](#uninstall-nim) to delete the primary components. Afterward, manually check for and remove leftover files such as repository configurations or custom settings to ensure a clean system. #### Verify SSL certificates and private keys @@ -118,7 +118,7 @@ Ensure that the required `.crt` and `.key` files are available, preferably in th #### Use the manual installation steps if needed -If the script fails or if you prefer more control over the process, consider using the [manual installation steps]({{< relref "nim/deploy/vm-bare-metal/install-nim-deprecated.md" >}}). These steps provide a reliable alternative for troubleshooting or handling complex setups. +If the script fails or if you prefer more control over the process, consider using the [manual installation steps]({{< ref "nim/deploy/vm-bare-metal/install-nim-deprecated.md" >}}). These steps provide a reliable alternative for troubleshooting or handling complex setups. ### Run the installation script @@ -133,7 +133,7 @@ The `install-nim-bundle.sh` script automates the installation of NGINX Instance {{< warning >}} -As noted in [About subscription licenses]({{< relref "solutions/about-subscription-licenses.md#apply-the-jwt" >}}), **custom paths won't work until you upgrade to NGINX Plus R33**. +As noted in [About subscription licenses]({{< ref "solutions/about-subscription-licenses.md#apply-the-jwt" >}}), **custom paths won't work until you upgrade to NGINX Plus R33**. {{< /warning >}} @@ -189,12 +189,12 @@ After installation, you can access the NGINX Instance Manager web interface to b 2. Navigate to `https://`, replacing `` with the fully qualified domain name of your NGINX Instance Manager host. 3. Log in using the default administrator username (`admin`) and the autogenerated password displayed during installation. -Save the autogenerated password displayed at the end of the installation process. If you want to change the admin password, refer to the [Set user passwords]({{< relref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md#set-basic-passwords" >}}) section in the Basic Authentication topic. +Save the autogenerated password displayed at the end of the installation process. If you want to change the admin password, refer to the [Set user passwords]({{< ref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md#set-basic-passwords" >}}) section in the Basic Authentication topic. ### Using the script to uninstall NGINX Instance Manager and its dependencies -In some cases, the script may need to be re-run due to parameters not being set correctly, or wrong versions being specified. You can remove NGINX Instance Manager and all of its dependencies (including NGINX) so that the script can be re-run. +In some cases, the script may need to be re-run due to parameters not being set correctly, or wrong versions being specified. You can remove NGINX Instance Manager and all of its dependencies (including NGINX) so that the script can be re-run. {{}}The `-r` option removes all NGINX configuration files, NGINX Instance Manager, and ClickHouse. Once you run this command, the data is gone and cannot be recovered unless you have backups. Use this option only if you need to remove NGINX Instance Manager to re-run the script in a fresh environment for a new installation. See "[Uninstall NGINX Instance Manager](#uninstall-nim)" below to perform these steps manually. If you do not want to lose your NGINX Configuration, you should take a backup of `/etc/nginx/`. {{}} @@ -211,13 +211,13 @@ bash install-nim-bundle.sh -r {{}}NGINX Instance Manager relies on [ClickHouse](https://clickhouse.com) **24.9.2.42** or later to store essential data, including metrics, events, alerts, and configuration settings.{{}} -{{}}The NGINX Instance Manager installation script also installs ClickHouse with a blank password. Update the **/etc/nms/nms.conf** file with it after installing NGINX Instance Manager. Otherwise, NGINX Instance Manager won't start. For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< relref "/nim/system-configuration/configure-clickhouse.md" >}}) topic. {{}} +{{}}The NGINX Instance Manager installation script also installs ClickHouse with a blank password. Update the **/etc/nms/nms.conf** file with it after installing NGINX Instance Manager. Otherwise, NGINX Instance Manager won't start. For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< ref "/nim/system-configuration/configure-clickhouse.md" >}}) topic. {{}} #### ClickHouse default settings NGINX Instance Manager uses the following default values for ClickHouse: -{{}}You can customize these settings. However, if you use custom settings, make sure to follow the [Configure ClickHouse]({{< relref "/nim/system-configuration/configure-clickhouse.md" >}}) instructions to update the **nms.conf** file after you've installed NGINX Instance Manager. Otherwise, NGINX Instance Manager won't be able to connect to ClickHouse.{{}} +{{}}You can customize these settings. However, if you use custom settings, make sure to follow the [Configure ClickHouse]({{< ref "/nim/system-configuration/configure-clickhouse.md" >}}) instructions to update the **nms.conf** file after you've installed NGINX Instance Manager. Otherwise, NGINX Instance Manager won't be able to connect to ClickHouse.{{}} {{< include "installation/clickhouse-defaults.md" >}} @@ -229,13 +229,13 @@ To install and enable Vault, follow these steps: - Follow Vault's instructions to [install Vault 1.8.8 or later](https://www.vaultproject.io/docs/install) for your distribution. - Ensure you're running Vault in a [production-hardened environment](https://learn.hashicorp.com/tutorials/vault/production-hardening). -- After installing NGINX Instance Manager, follow the steps to [configure Vault for storing secrets]({{< relref "/nim/system-configuration/configure-vault.md" >}}). +- After installing NGINX Instance Manager, follow the steps to [configure Vault for storing secrets]({{< ref "/nim/system-configuration/configure-vault.md" >}}). ### (Optional) Configure SELinux SELinux helps secure your deployment by enforcing mandatory access control policies. -If you use SELinux, follow the steps in the [Configure SELinux]({{< relref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts (`restorecon`) for the files and directories related to NGINX Instance Manager. +If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts (`restorecon`) for the files and directories related to NGINX Instance Manager. ### License NGINX Instance Manager @@ -301,7 +301,7 @@ If you use SELinux, follow the steps in the [Configure SELinux]({{< relref "/nim sudo systemctl restart clickhouse-server ``` -5. (Optional) If you use SELinux, follow the steps in the [Configure SELinux]({{< relref "nim/system-configuration/configure-selinux.md" >}}) guide to restore the default SELinux labels (`restorecon`) for the files and directories related to NGINX Instance Manager. +5. (Optional) If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "nim/system-configuration/configure-selinux.md" >}}) guide to restore the default SELinux labels (`restorecon`) for the files and directories related to NGINX Instance Manager. --- diff --git a/content/nim/disconnected/offline-install-guide-deprecated.md b/content/nim/disconnected/offline-install-guide-deprecated.md index 84af7aa3a..7f07ebff4 100644 --- a/content/nim/disconnected/offline-install-guide-deprecated.md +++ b/content/nim/disconnected/offline-install-guide-deprecated.md @@ -9,7 +9,7 @@ docs: DOCS-000 --- {{}} -This document outlines manual steps that have been replaced by a simplified script-based process. For most users, we recommend using the updated process documented [here]({{< relref "nim/disconnected/offline-install-guide.md" >}}).{{}} +This document outlines manual steps that have been replaced by a simplified script-based process. For most users, we recommend using the updated process documented [here]({{< ref "nim/disconnected/offline-install-guide.md" >}}).{{}} ## Overview @@ -38,7 +38,7 @@ To complete the steps in this guide, you need to download the NGINX Instance Man Local dependencies are common Linux packages like `curl` or `openssl`, which most Linux distributions include by default. When installing NGINX Instance Manager, your package manager will automatically install these dependencies. Without internet access, ensure your package manager can use a local package repository, such as a distribution DVD/ISO image or internal network mirror. Check your Linux distribution's documentation for details. -{{< call-out "note" "RedHat on AWS" "fa-brands fa-aws" >}}If you're using AWS and can't attach remote or local RedHat package repositories, download the necessary packages on another RedHat machine and copy them to your target machine. Use the `yumdownloader` utility for this task: +{{< call-out "note" "RedHat on AWS" "fa-brands fa-aws" >}}If you're using AWS and can't attach remote or local RedHat package repositories, download the necessary packages on another RedHat machine and copy them to your target machine. Use the `yumdownloader` utility for this task: . {{}} @@ -97,9 +97,9 @@ To download external dependencies: ``` {{< call-out "important" "Setting a custom ClickHouse password" "fas fa-exclamation-triangle" >}} - - When installing ClickHouse, you can set a password or leave it blank (default is an empty string). If you set a password, make sure to update the **/etc/nms/nms.conf** file with it after installing NGINX Instance Manager. Otherwise, NGINX Instance Manager won't start. For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< relref "/nim/system-configuration/configure-clickhouse.md" >}}) topic. - + + When installing ClickHouse, you can set a password or leave it blank (default is an empty string). If you set a password, make sure to update the **/etc/nms/nms.conf** file with it after installing NGINX Instance Manager. Otherwise, NGINX Instance Manager won't start. For more information on customizing ClickHouse settings, refer to the [Configure ClickHouse]({{< ref "/nim/system-configuration/configure-clickhouse.md" >}}) topic. + {{}} @@ -177,7 +177,7 @@ To upgrade NGINX Instance Manager to a newer version: {{< include "installation/nms-user.md" >}} -3. (Optional) If you use SELinux, follow the [Configure SELinux]({{< relref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts using restorecon for files and directories related to NGINX Instance Manager. +3. (Optional) If you use SELinux, follow the [Configure SELinux]({{< ref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts using restorecon for files and directories related to NGINX Instance Manager. --- diff --git a/content/nim/disconnected/offline-install-guide.md b/content/nim/disconnected/offline-install-guide.md index 58ac40c25..6d4b8414d 100644 --- a/content/nim/disconnected/offline-install-guide.md +++ b/content/nim/disconnected/offline-install-guide.md @@ -13,7 +13,7 @@ docs: DOCS-803 This guide shows you how to install and upgrade NGINX Instance Manager in environments without internet access. It covers key steps, including downloading packages, managing dependencies, and configuring the system for offline use. You’ll also learn how to set up NGINX Instance Manager in disconnected mode and update the CVE list manually to keep your system secure. -{{}}If you prefer to follow the original manual steps, you can access the [deprecated guide]({{< relref "nim/disconnected/offline-install-guide-deprecated.md" >}}). Please note that this guide is no longer actively maintained and may not reflect the latest updates or best practices.{{}} +{{}}If you prefer to follow the original manual steps, you can access the [deprecated guide]({{< ref "nim/disconnected/offline-install-guide-deprecated.md" >}}). Please note that this guide is no longer actively maintained and may not reflect the latest updates or best practices.{{}} --- @@ -29,10 +29,10 @@ Follow these steps to get your system ready for a successful installation with t The script supports only new installations. If NGINX Instance Manager is already installed, take one of the following actions: -- **Upgrade manually** +- **Upgrade manually** The script cannot perform upgrades. To update an existing installation, follow the [upgrade steps](#upgrade-nim) in this document. -- **Uninstall first** +- **Uninstall first** Remove the current installation and its dependencies for a fresh start. Use the [uninstall steps](#uninstall-nim) to delete the primary components. Afterward, manually check for and remove leftover files such as repository configurations or custom settings to ensure a clean system. #### Verify SSL certificates and private keys @@ -41,7 +41,7 @@ Ensure that the required `.crt` and `.key` files are available, preferably in th #### Use the manual installation steps if needed -If the script fails or if you prefer more control over the process, consider using the [manual installation steps]({{< relref "nim/disconnected/offline-install-guide-deprecated.md" >}}). These steps provide a reliable alternative for troubleshooting or handling complex setups. +If the script fails or if you prefer more control over the process, consider using the [manual installation steps]({{< ref "nim/disconnected/offline-install-guide-deprecated.md" >}}). These steps provide a reliable alternative for troubleshooting or handling complex setups. ### Download the SSL Certificate and Private Key from MyF5 @@ -71,7 +71,7 @@ sudo bash install-nim-bundle.sh \
-By default, this command installs the latest version of NGINX Open Source to run NGINX Instance Manager. NGINX Plus is currently not supported when using the script in Disconnected mode. Please see this guide to install NGINX Plus offline if you would like to use this in front of NGINX Instance Manager +By default, this command installs the latest version of NGINX Open Source to run NGINX Instance Manager. NGINX Plus is currently not supported when using the script in Disconnected mode. Please see this guide to install NGINX Plus offline if you would like to use this in front of NGINX Instance Manager
@@ -108,7 +108,7 @@ The script downloads the required packages and adds them to a tarball file. You ```shell sudo bash install-nim-bundle.sh \ - -c + -c -k \ -m offline \ -d \ @@ -120,7 +120,7 @@ The script downloads the required packages and adds them to a tarball file. You ```shell Regenerated Admin password: ``` - + Save that password. You'll need it when you sign in to NGINX Instance Manager. 3. After installation, open a web browser, go to `https://` (the fully qualified domain name of the NGINX Instance Manager host), and log in. @@ -163,7 +163,7 @@ To upgrade NGINX Instance Manager to a newer version: {{< include "installation/nms-user.md" >}} -3. (Optional) If you use SELinux, follow the [Configure SELinux]({{< relref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts using restorecon for files and directories related to NGINX Instance Manager. +3. (Optional) If you use SELinux, follow the [Configure SELinux]({{< ref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts using restorecon for files and directories related to NGINX Instance Manager. --- diff --git a/content/nim/fundamentals/dashboard-overview.md b/content/nim/fundamentals/dashboard-overview.md index b69b27c44..9bb4f28bc 100644 --- a/content/nim/fundamentals/dashboard-overview.md +++ b/content/nim/fundamentals/dashboard-overview.md @@ -17,14 +17,14 @@ You’ll need a user with access to these RBAC features to use the dashboard: - Certificates - Analytics -To learn more about Role-based Access Control and the available features, see the [Getting Started with RBAC]({{< relref "/nim/admin-guide/rbac/overview-rbac.md" >}}) documentation. +To learn more about Role-based Access Control and the available features, see the [Getting Started with RBAC]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}) documentation. ## Prerequisites Follow these steps to stream and display all relevant metrics in the dashboard: 1. Install NGINX Agent v2.30 or later on your NGINX data plane instances. See the [Upgrade NGINX Agent Package](https://docs.nginx.com/nginx-agent/installation-upgrade/upgrade/) for more information. -2. Ensure that NGINX Plus or NGINX Open Source Stub Status APIs are configured to send NGINX metrics using NGINX Agent. See the [Instance Metrics Overview]({{< relref "/nim/monitoring/overview-metrics.md" >}}) for more details. +2. Ensure that NGINX Plus or NGINX Open Source Stub Status APIs are configured to send NGINX metrics using NGINX Agent. See the [Instance Metrics Overview]({{< ref "/nim/monitoring/overview-metrics.md" >}}) for more details. ## Certificates diff --git a/content/nim/fundamentals/tech-specs.md b/content/nim/fundamentals/tech-specs.md index 7414293f8..d5035bac0 100644 --- a/content/nim/fundamentals/tech-specs.md +++ b/content/nim/fundamentals/tech-specs.md @@ -30,13 +30,13 @@ You can deploy NGINX Instance Manager in the following environments: ## Sizing recommendations for Managing NGINX Instances {#system-sizing} -The following recommendations provide the minimum guidelines for NGINX Instance Manager. These guidelines ensure adequate performance, but for optimal results, we strongly recommend using solid-state drives (SSDs) for storage. If you set up [deployments with NGINX App Protect](#system-sizing-app-protect), you may need additional memory and CPU. +The following recommendations provide the minimum guidelines for NGINX Instance Manager. These guidelines ensure adequate performance, but for optimal results, we strongly recommend using solid-state drives (SSDs) for storage. If you set up [deployments with NGINX App Protect](#system-sizing-app-protect), you may need additional memory and CPU. ### Standard NGINX configuration deployments This section outlines the recommendations for NGINX Instance Manager deployments with data plane instances using standard configurations, without NGINX App Protect. **Standard configurations** typically support up to **40 upstream servers** with associated location and server blocks, and up to **350 certificates**. This is ideal for medium-sized environments or applications with moderate traffic. -We recommend using SSDs to enhance storage performance. +We recommend using SSDs to enhance storage performance. {{}} | Number of Data Plane Instances | CPU | Memory | Network | Storage | @@ -61,11 +61,11 @@ For environments requiring more resources, **large configurations** are suitable ### NGINX configuration deployments with NGINX App Protect {#system-sizing-app-protect} -If using NGINX App Protect features in NGINX Instance Manager, this requires additional CPU and Memory for policy compilation and security monitoring features. At a minimum, 8gb Memory and 4 CPUs are required for a standard NGINX App Protect use case (under 20 NGINX Plus instances). The requirements are heavily dependent on the number of policies being managed, the frequency of updates and the number of events being that occur in the security monitoring feature. +If using NGINX App Protect features in NGINX Instance Manager, this requires additional CPU and Memory for policy compilation and security monitoring features. At a minimum, 8gb Memory and 4 CPUs are required for a standard NGINX App Protect use case (under 20 NGINX Plus instances). The requirements are heavily dependent on the number of policies being managed, the frequency of updates and the number of events being that occur in the security monitoring feature. ### License and usage reporting only {#reporting-sizing} -This section assumes you've configured NGINX Instance Manager to manage your NGINX instances for licensing and usage reporting only. NGINX commercial license and usage reporting is done in an “unmanaged” way, where NGINX sends a request periodically to NGINX Instance Manager solely for counting purposes. For more information, see how you would [Prepare your environment for reporting]({{< relref "/solutions/about-subscription-licenses.md#set-up-environment" >}}). +This section assumes you've configured NGINX Instance Manager to manage your NGINX instances for licensing and usage reporting only. NGINX commercial license and usage reporting is done in an “unmanaged” way, where NGINX sends a request periodically to NGINX Instance Manager solely for counting purposes. For more information, see how you would [Prepare your environment for reporting]({{< ref "/solutions/about-subscription-licenses.md#set-up-environment" >}}). Therefore, the requirements for NGINX Instance Manager when used solely for licensing and usage reporting are minimal. diff --git a/content/nim/monitoring/metrics-api.md b/content/nim/monitoring/metrics-api.md index ff3c3e112..50f214b27 100644 --- a/content/nim/monitoring/metrics-api.md +++ b/content/nim/monitoring/metrics-api.md @@ -31,7 +31,7 @@ You can use the Metrics API to query for desired metric names and fine-tune the ## Authentication -You can use basic authentication or JWT authentication to access the NGINX Instance Manager REST API, as described in the [NGINX Instance Manager API Overview]({{< relref "/nim/fundamentals/api-overview#authentication" >}}). +You can use basic authentication or JWT authentication to access the NGINX Instance Manager REST API, as described in the [NGINX Instance Manager API Overview]({{< ref "/nim/fundamentals/api-overview#authentication" >}}). The examples in this guide demonstrate using a "bearer" token for authentication. The token is sent using the "Authorization" request header field and "Bearer" schema. @@ -92,7 +92,7 @@ Likewise, you can get a full list of the available dimensions by querying the Ca curl -X GET --url "/api/platform/v1/analytics/catalogs/dimensions" -H "Authorization: Bearer " ``` -This information is also provided in the [Catalogs Reference]({{< relref "/nms/reference/catalogs//_index.md" >}})). +This information is also provided in the [Catalogs Reference]({{< ref "/nms/reference/catalogs//_index.md" >}})). ### Querying the Metrics API @@ -168,7 +168,7 @@ You must define a `startTime` when using aggregate functions. {{< /note >}} {{< see-also >}} -The list of supported aggregate functions for any particular metric is available in the [Metrics Catalog]({{< relref "/nms/reference/catalogs//metrics.md" >}})). +The list of supported aggregate functions for any particular metric is available in the [Metrics Catalog]({{< ref "/nms/reference/catalogs//metrics.md" >}})). {{< /see-also >}} For example, the following query returns a single value (per dimension set), which is the sum of the metric values for the last 12 hours. To get proper values, ensure that the `endTime` is greater than the `startTime`. diff --git a/content/nim/monitoring/overview-metrics.md b/content/nim/monitoring/overview-metrics.md index da37f3c81..3697df3c2 100644 --- a/content/nim/monitoring/overview-metrics.md +++ b/content/nim/monitoring/overview-metrics.md @@ -17,7 +17,7 @@ F5 NGINX Instance Manager collects two types of data: The NGINX Agent collects metrics every 15 seconds and publishes them every 60 seconds. -For a full list of available metrics, see the [Metrics Catalog Reference]({{< relref "/nms/reference/catalogs//metrics.md" >}}). +For a full list of available metrics, see the [Metrics Catalog Reference]({{< ref "/nms/reference/catalogs//metrics.md" >}}). ## How metrics are collected and reported @@ -36,7 +36,7 @@ NGINX Instance Manager stores historical data in an analytics database and appli ### NGINX Open Source metrics -{{< include "/use-cases/monitoring/enable-nginx-oss-stub-status.md" >}} +{{< include "/use-cases/monitoring/enable-nginx-oss-stub-status.md" >}} ### NGINX access log metrics diff --git a/content/nim/monitoring/view-events-metrics.md b/content/nim/monitoring/view-events-metrics.md index 1130d8466..1c1a970c7 100644 --- a/content/nim/monitoring/view-events-metrics.md +++ b/content/nim/monitoring/view-events-metrics.md @@ -25,7 +25,7 @@ To view events in the NGINX Instance Manager user interface, take the following ## Access Events data by using the REST API -You can use the Events API to view NGINX Instance Manager events data. You can use basic authentication or JWT authentication to access the NGINX Instance Manager REST API, as described in the [NGINX Instance Manager API Overview]({{< relref "/nim/fundamentals/api-overview#authentication" >}}). +You can use the Events API to view NGINX Instance Manager events data. You can use basic authentication or JWT authentication to access the NGINX Instance Manager REST API, as described in the [NGINX Instance Manager API Overview]({{< ref "/nim/fundamentals/api-overview#authentication" >}}). The examples in this guide demonstrate using a "bearer" token for authentication. The token is sent using the "Authorization" request header field and "Bearer" schema. diff --git a/content/nim/nginx-app-protect/manage-waf-security-policies.md b/content/nim/nginx-app-protect/manage-waf-security-policies.md index 915208c3c..71684b133 100644 --- a/content/nim/nginx-app-protect/manage-waf-security-policies.md +++ b/content/nim/nginx-app-protect/manage-waf-security-policies.md @@ -30,8 +30,8 @@ The following capabilities are only available via the Instance Manager REST API: Complete the following prerequisites before proceeding with this guide: -- [Set Up App Protect WAF Configuration Management]({{< relref "setup-waf-config-management" >}}) -- Verify that your user account has the [necessary permissions]({{< relref "/nim/admin-guide/rbac/overview-rbac.md" >}}) to access the Instance Manager REST API: +- [Set Up App Protect WAF Configuration Management]({{< ref "setup-waf-config-management" >}}) +- Verify that your user account has the [necessary permissions]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}) to access the Instance Manager REST API: - **Module**: Instance Manager - **Feature**: Instance Management @@ -42,8 +42,8 @@ Complete the following prerequisites before proceeding with this guide: The following are required to use support policy bundles: - You must have `UPDATE` permissions for the security policies specified in the request. -- The correct `nms-nap-compiler` packages for the NGINX App Protect WAF version you're using are [installed on Instance Manager]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}). -- The attack signatures and threat campaigns that you want to use are [installed on Instance Manager]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md#set-up-attack-signatures-and-threat-campaigns" >}}). +- The correct `nms-nap-compiler` packages for the NGINX App Protect WAF version you're using are [installed on Instance Manager]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}). +- The attack signatures and threat campaigns that you want to use are [installed on Instance Manager]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#set-up-attack-signatures-and-threat-campaigns" >}}). ### How to Access the Web Interface diff --git a/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md b/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md index 5b52c892a..45745bd24 100644 --- a/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md +++ b/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md @@ -30,7 +30,7 @@ Complete the following prerequisites before proceeding with the steps in this gu {{< include "nim/tech-specs/security-data-plane-dependencies.md" >}} 1. Determine your use case: **Security Monitoring only** or **Security Monitoring and Configuration Management**. -1. [Upload your license]({{< relref "/nim/admin-guide/license/add-license.md" >}}). +1. [Upload your license]({{< ref "/nim/admin-guide/license/add-license.md" >}}). --- @@ -222,7 +222,7 @@ Take the steps below to update your NGINX App Protect WAF configurations by usin The policy reference must use the `.tgz` file extension when using Instance Manager to perform precompiled publication of NGINX App Protect WAF policies and log profiles. The file path referenced must exist on the NGINX Instance Manager host, but it's ok if the policy file doesn't exist yet. If your Instance is not configured for precompiled publication, then use the `.json` file extension for polcies and log profiles. In this case, the file path referenced in the NGINX configuration must reside on the Instance. - If you are using custom security policies, at this stage, it's fine to use the default security policy shown in the example above. After completing the steps in this guide, refer to the instructions in [Set Up App Protect WAF Configuration Management]({{< relref "/nim/nginx-app-protect/setup-waf-config-management#add-waf-config" >}}) to add your custom security policy files to NGINX Instance Manager and update your NGINX configuration. + If you are using custom security policies, at this stage, it's fine to use the default security policy shown in the example above. After completing the steps in this guide, refer to the instructions in [Set Up App Protect WAF Configuration Management]({{< ref "/nim/nginx-app-protect/setup-waf-config-management#add-waf-config" >}}) to add your custom security policy files to NGINX Instance Manager and update your NGINX configuration. - Add the `app_protect_security_log_enable on` and the `app_protect_security_log` directive to any NGINX context where NGINX App Protect WAF is enabled and you want to be able to review attack data. @@ -241,4 +241,4 @@ You should now be able to view data from your NGINX App Protect WAF instances in ## See also - [Add user access to Security Monitoring dashboards]({{< ref "/nim/nginx-app-protect/security-monitoring/give-access-to-security-monitoring-dashboards.md" >}}) -- [Manage your app protect WAF configs]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md" >}}) +- [Manage your app protect WAF configs]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md" >}}) diff --git a/content/nim/nginx-app-protect/security-monitoring/update-signatures.md b/content/nim/nginx-app-protect/security-monitoring/update-signatures.md index a606dc797..a5f2abf96 100644 --- a/content/nim/nginx-app-protect/security-monitoring/update-signatures.md +++ b/content/nim/nginx-app-protect/security-monitoring/update-signatures.md @@ -28,7 +28,7 @@ Ensure the following prerequisites are met: ## Update the Signature Database 1. Open an SSH connection to the data plane host and log in. -1. Generate a Signature Report file using the [Attack Signature Report Tool]({{< relref "/nap-waf/v4/configuration-guide/configuration.md#attack-signature-report-tool" >}}). Save the file as `signature-report.json`: +1. Generate a Signature Report file using the [Attack Signature Report Tool]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#attack-signature-report-tool" >}}). Save the file as `signature-report.json`: ```bash sudo /opt/app_protect/bin/get-signatures -o ./signature-report.json diff --git a/content/nim/nginx-app-protect/setup-waf-config-management.md b/content/nim/nginx-app-protect/setup-waf-config-management.md index 69a5e856a..3c88a0aad 100644 --- a/content/nim/nginx-app-protect/setup-waf-config-management.md +++ b/content/nim/nginx-app-protect/setup-waf-config-management.md @@ -21,7 +21,7 @@ Complete the following prerequisites before proceeding with this guide. {{< note >}} If you are using configuration management and the NGINX Instance Manager Security Monitoring, follow the instructions in the [setup guide]({{< ref "/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md" >}}) to set up your NGINX App Protect instances before proceeding with this guide. {{}} -- You have Instance Manager v2.6.0 or later [installed]({{< relref "/nim/deploy/vm-bare-metal/_index.md" >}}), licensed, and running. +- You have Instance Manager v2.6.0 or later [installed]({{< ref "/nim/deploy/vm-bare-metal/_index.md" >}}), licensed, and running. If you have a subscription to NGINX App Protect WAF, you can find your Instance Manager license in the subscription details section of [MyF5](https://my.f5.com). ### Limitations @@ -41,9 +41,9 @@ Be sure to download and install the correct WAF compiler version for your enviro - Each NGINX App Protect version has a corresponding WAF compiler version. You must install the WAF compiler that matches the version of NGINX App Protect that you have running. - If you have different NGINX App Protect versions running, install the correct WAF compiler package for each on the management plane host. Instance Manager will use the correct WAF compiler for each version to bundle the security configurations. -- You can create [instance groups]({{< relref "/nim/nginx-instances/manage-instance-groups" >}}) to keep track of and manage all instances that have the same version installed. +- You can create [instance groups]({{< ref "/nim/nginx-instances/manage-instance-groups" >}}) to keep track of and manage all instances that have the same version installed. -For more information about the WAF compiler, refer to the [Security Bundle Compilation]({{< relref "/nim/nginx-app-protect/overview-nap-waf-config-management#security-bundle" >}}) section of the Policy Configuration overview topic. +For more information about the WAF compiler, refer to the [Security Bundle Compilation]({{< ref "/nim/nginx-app-protect/overview-nap-waf-config-management#security-bundle" >}}) section of the Policy Configuration overview topic. ### WAF Compiler and Supported App Protect Versions {#nap-waf-compiler-compatibility} @@ -241,7 +241,7 @@ You will need to use your NGINX repo certificates to setup automatic retrieval o } ``` -1. Send an HTTP POST request to the [Instance Manager REST API]({{< relref "/nim/fundamentals/api-overview" >}}) to upload the repo certificate and key. +1. Send an HTTP POST request to the [Instance Manager REST API]({{< ref "/nim/fundamentals/api-overview" >}}) to upload the repo certificate and key.
Example request @@ -361,7 +361,7 @@ error when creating the nginx repo retriever - NGINX repo certificates not found #### Upload packages to Instance Manager -You will need to use the [Instance Manager REST API]({{< relref "/nim/fundamentals/api-overview" >}}) to upload the bundled Attack Signatures and Threat Campaigns. +You will need to use the [Instance Manager REST API]({{< ref "/nim/fundamentals/api-overview" >}}) to upload the bundled Attack Signatures and Threat Campaigns.
Attack Signatures Example @@ -917,7 +917,7 @@ server { app_protect_security_log "/etc/nms/secops_dashboard.tgz" syslog:server=127.0.0.1:514; ``` -Refer to the [Security Monitoring setup guide]({{< relref "/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md" >}}) to learn more. {{}} +Refer to the [Security Monitoring setup guide]({{< ref "/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md" >}}) to learn more. {{}} {{}} NGINX configuration for NGINX App Protect Version 5 requires the following changes: @@ -1153,7 +1153,7 @@ nap_monitoring:
Verify access to the NGINX packages repository -To allow Instance Manager to automatically download the latest Attack Signatures and Threat Campaigns, you need to [upload the certificate and key files]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md#upload-nginx-app-protect-waf-certificate-and-key" >}}) included with your subscription to allow access to the package repository. +To allow Instance Manager to automatically download the latest Attack Signatures and Threat Campaigns, you need to [upload the certificate and key files]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md#upload-nginx-app-protect-waf-certificate-and-key" >}}) included with your subscription to allow access to the package repository. If you already uploaded your certificate and key files, use the command below to verify that they allow access to the package repo: @@ -1192,4 +1192,4 @@ The output looks similar to the following example: ## What's Next -Now that configuration management is set up, you can use the Instance Manager REST API to manage security policies, view system information about your NGINX App Protect WAF instances, and update Attack Signatures and Threat Campaigns. Learn more in [Manage App Protect WAF Configuration using the REST API]({{< relref "manage-waf-security-policies" >}}). +Now that configuration management is set up, you can use the Instance Manager REST API to manage security policies, view system information about your NGINX App Protect WAF instances, and update Attack Signatures and Threat Campaigns. Learn more in [Manage App Protect WAF Configuration using the REST API]({{< ref "manage-waf-security-policies" >}}). diff --git a/content/nim/nginx-app-protect/waf-config-management.md b/content/nim/nginx-app-protect/waf-config-management.md index 38a6ec6d4..5e76684d4 100644 --- a/content/nim/nginx-app-protect/waf-config-management.md +++ b/content/nim/nginx-app-protect/waf-config-management.md @@ -15,16 +15,16 @@ You can use NGINX Management Suite Instance Manager to publish configurations to 1. Set up your NGINX Management Suite Instance Manager instance: - - [Install the WAF Compiler]({{< relref "/nim/nginx-app-protect/setup-waf-config-management#install-the-waf-compiler" >}}) + - [Install the WAF Compiler]({{< ref "/nim/nginx-app-protect/setup-waf-config-management#install-the-waf-compiler" >}}) - - [Set up the Attack Signatures and Threat Campaigns]({{< relref "/nim/nginx-app-protect/setup-waf-config-management#set-up-attack-signatures-and-threat-campaigns" >}}) + - [Set up the Attack Signatures and Threat Campaigns]({{< ref "/nim/nginx-app-protect/setup-waf-config-management#set-up-attack-signatures-and-threat-campaigns" >}}) -2. In Instance Manager, [onboard the App Protect Instances]({{< relref "/nim/nginx-app-protect/setup-waf-config-management#onboard-nginx-app-protect-waf-instances" >}}) you want to publish policies and log profiles to. +2. In Instance Manager, [onboard the App Protect Instances]({{< ref "/nim/nginx-app-protect/setup-waf-config-management#onboard-nginx-app-protect-waf-instances" >}}) you want to publish policies and log profiles to. -3. [Create the security policies]({{< relref "/nim/nginx-app-protect/manage-waf-security-policies#create-security-policy" >}}). +3. [Create the security policies]({{< ref "/nim/nginx-app-protect/manage-waf-security-policies#create-security-policy" >}}). -4. [Create the security log profiles]({{< relref "/nim/nginx-app-protect/manage-waf-security-policies#create-security-log-profile" >}}). +4. [Create the security log profiles]({{< ref "/nim/nginx-app-protect/manage-waf-security-policies#create-security-log-profile" >}}). -5. [Add or edit a WAF Configuration]({{< relref "/nim/nginx-app-protect/setup-waf-config-management#add-waf-config" >}}) to your NGINX Instances, and publish using Instance Manager. +5. [Add or edit a WAF Configuration]({{< ref "/nim/nginx-app-protect/setup-waf-config-management#add-waf-config" >}}) to your NGINX Instances, and publish using Instance Manager. {{}}Map the App Protect directives on NGINX configuration to `.tgz` file extensions (not `.json`).{{< /note >}} diff --git a/content/nim/nginx-configs/config-templates/concepts/augment-templates.md b/content/nim/nginx-configs/config-templates/concepts/augment-templates.md index 42451b9d1..c829b410b 100644 --- a/content/nim/nginx-configs/config-templates/concepts/augment-templates.md +++ b/content/nim/nginx-configs/config-templates/concepts/augment-templates.md @@ -28,13 +28,13 @@ Augment templates add specific features or modify existing configurations genera ## How to use augment templates {{}} - For instructions on setting up and deploying config templates, including augment templates, see [Manage NGINX Configs with Templates]({{< relref "/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md" >}}).{{}} + For instructions on setting up and deploying config templates, including augment templates, see [Manage NGINX Configs with Templates]({{< ref "/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md" >}}).{{}} 1. **Identify needs**: Determine the additional functionalities or configuration segments needed beyond the base template. This could include specific NGINX modules, security enhancements, or custom routing requirements. 2. **Select or create augments**: Choose from existing augment templates provided by NGINX Instance Manager or create custom augment templates to meet your specific needs. Custom augment templates can be developed by defining JSON schemas and corresponding `.tmpl` files, similar to the base template. -3. **Apply augments**: Use the NGINX Instance Manager interface to apply the selected augment templates to your NGINX configuration. This can be done by specifying the augment templates to be included when [previewing and generating the config]({{< relref "/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md#preview-generate-config" >}}). +3. **Apply augments**: Use the NGINX Instance Manager interface to apply the selected augment templates to your NGINX configuration. This can be done by specifying the augment templates to be included when [previewing and generating the config]({{< ref "/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md#preview-generate-config" >}}). 4. **Customize inputs**: Provide any required inputs for the augment templates. This may involve specifying parameters such as paths, server names, or authentication keys, depending on the functionality being added. diff --git a/content/nim/nginx-configs/config-templates/concepts/config-templates.md b/content/nim/nginx-configs/config-templates/concepts/config-templates.md index 18b174df8..1e0f48fa6 100644 --- a/content/nim/nginx-configs/config-templates/concepts/config-templates.md +++ b/content/nim/nginx-configs/config-templates/concepts/config-templates.md @@ -42,7 +42,7 @@ Configuration templates include the following components: - **Auxiliary files**: Additional files required for configuration, such as JavaScript for added functionality, security certificates, or documentation (README.md). These files support the main configuration and provide necessary context or capabilities. -To learn more about the resources mentioned, refer to the [Template Resource Files]({{< relref "nim/nginx-configs/config-templates/concepts/template-resources.md" >}}) topic. +To learn more about the resources mentioned, refer to the [Template Resource Files]({{< ref "nim/nginx-configs/config-templates/concepts/template-resources.md" >}}) topic. ## Target {#target} diff --git a/content/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md b/content/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md index d0b0bb0e0..fc850509c 100644 --- a/content/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md +++ b/content/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md @@ -95,7 +95,7 @@ To create a new config template: - **Augment**: Choose this if the template will add to or enhance an existing configuration by introducing additional directives or settings. 6. Click **Submit** to create the template. -After creating a template, you'll need to add [resource files]({{< relref "/nim/nginx-configs/config-templates/concepts/template-resources.md" >}}) to define its structure and behavior: +After creating a template, you'll need to add [resource files]({{< ref "/nim/nginx-configs/config-templates/concepts/template-resources.md" >}}) to define its structure and behavior: - **Config File (.tmpl)**: This is the core template file that defines the structure and parameters of your NGINX configuration. If you're creating a base template, you'll add a **base.tmpl** file. For augment templates, select the appropriate augment file that corresponds to the functionality you wish to include. - **JSON Schema File (.json)**: JSON schema files are necessary for creating the dynamic web forms in the UI that users will interact with. These schemas define the valid format and type of user inputs for the template. diff --git a/content/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md b/content/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md index 1c013bb68..91ede35ae 100644 --- a/content/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md +++ b/content/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md @@ -20,8 +20,8 @@ With role-based access control (RBAC), administrators can determine who can crea ## Before You Begin -- Ensure the user is added as a [basic authentication]({{< relref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md" >}}) or [OpenID Connect (OIDC)]({{< relref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}) user in F5 NGINX Instance Manager. -- Familiarize yourself with the concepts of [Roles]({{< relref "/nim/admin-guide/rbac/assign-roles.md" >}}) and [Permissions]({{< relref "/nim/admin-guide/rbac/create-roles.md" >}}) within Instance Manager as they are crucial for managing access. +- Ensure the user is added as a [basic authentication]({{< ref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md" >}}) or [OpenID Connect (OIDC)]({{< ref "/nim/admin-guide/authentication/oidc/getting-started.md" >}}) user in F5 NGINX Instance Manager. +- Familiarize yourself with the concepts of [Roles]({{< ref "/nim/admin-guide/rbac/assign-roles.md" >}}) and [Permissions]({{< ref "/nim/admin-guide/rbac/create-roles.md" >}}) within Instance Manager as they are crucial for managing access. ## Assign Roles for Templates and Template Submissions @@ -34,7 +34,7 @@ To complete these steps, you need administrator access. 3. Select **Users** from the left menu to manage individual users or **User Groups** for managing access at a group level. 4. Define access to templates and template submissions: - - To ensure proper management of NGINX configurations, [create or edit roles]({{< relref "/nim/admin-guide/rbac/create-roles.md" >}}) to specify access to templates and template submissions. This may involve defining CRUD permissions specific to managing NGINX configurations. + - To ensure proper management of NGINX configurations, [create or edit roles]({{< ref "/nim/admin-guide/rbac/create-roles.md" >}}) to specify access to templates and template submissions. This may involve defining CRUD permissions specific to managing NGINX configurations. - **Restricting access to templates** is essential for controlling who can create and modify templates. This responsibility generally falls to administrators with a comprehensive understanding of NGINX configurations. diff --git a/content/nim/nginx-configs/config-templates/tutorials/round-robin-reverse-proxy.md b/content/nim/nginx-configs/config-templates/tutorials/round-robin-reverse-proxy.md index 073d46ff1..4f8a3412c 100644 --- a/content/nim/nginx-configs/config-templates/tutorials/round-robin-reverse-proxy.md +++ b/content/nim/nginx-configs/config-templates/tutorials/round-robin-reverse-proxy.md @@ -14,7 +14,7 @@ type: This tutorial guides you through setting up a round-robin reverse proxy using base and augment templates in NGINX Instance Manager. It's intended for network administrators and developers familiar with basic NGINX configurations. -Using templates, especially augment templates, provides significant advantages. Augment templates allow you to modify and extend configurations without altering the base template, making it easier to manage and update settings. This approach enhances modularity, enabling specific teams to control parts of the configuration while maintaining overall system integrity. For instance, using an augment template for round-robin reverse proxy settings allows you to efficiently distribute incoming traffic across multiple servers, enhancing load balancing and reliability. [Role-Based Access Control (RBAC) for templates and template submissions]({{< relref "/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md" >}}) ensures that only authorized users can make changes, promoting security and efficiency. This means that while administrators can manage the base configuration, development teams can independently manage specific proxy settings, improving collaboration and streamlining operations. +Using templates, especially augment templates, provides significant advantages. Augment templates allow you to modify and extend configurations without altering the base template, making it easier to manage and update settings. This approach enhances modularity, enabling specific teams to control parts of the configuration while maintaining overall system integrity. For instance, using an augment template for round-robin reverse proxy settings allows you to efficiently distribute incoming traffic across multiple servers, enhancing load balancing and reliability. [Role-Based Access Control (RBAC) for templates and template submissions]({{< ref "/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md" >}}) ensures that only authorized users can make changes, promoting security and efficiency. This means that while administrators can manage the base configuration, development teams can independently manage specific proxy settings, improving collaboration and streamlining operations. By the end, you'll be able to: @@ -34,7 +34,7 @@ F5 NGINX Instance Manager simplifies the management of NGINX configurations acro Before you start the tutorial, you should: -- [Install NGINX Instance Manager 2.16 or later]({{< relref "/nim/deploy/" >}}). If you're using an earlier version, you'll need to upgrade to access the features needed for this tutorial. +- [Install NGINX Instance Manager 2.16 or later]({{< ref "/nim/deploy/" >}}). If you're using an earlier version, you'll need to upgrade to access the features needed for this tutorial. - Have administrative access to NGINX Instance Manager. - Understand basic concepts of web servers and reverse proxies. - Have basic knowledge of [Go templates](https://pkg.go.dev/text/template), [JSON schema](https://json-schema.org), and the [NGINX configuration syntax](https://nginx.org/en/docs/beginners_guide.html). @@ -43,7 +43,7 @@ Before you start the tutorial, you should: ## Create the base template -In this section, you'll learn how to create a [base config template]({{< relref "nim/nginx-configs/config-templates/concepts/config-templates.md" >}}). +In this section, you'll learn how to create a [base config template]({{< ref "nim/nginx-configs/config-templates/concepts/config-templates.md" >}}). 1. Open your web browser, go to the Fully Qualified Domain Name (FQDN) of your NGINX Management Suite host, and log in. 2. From the Launchpad menu, choose **Instance Manager**. @@ -553,7 +553,7 @@ If you targeted a staged config: ## References -- [Understanding Config Templates]({{< relref "/nim/nginx-configs/config-templates/concepts/config-templates.md" >}}) -- [About Augment Templates]({{< relref "/nim/nginx-configs/config-templates/concepts/augment-templates.md" >}}) -- [Manage NGINX Configs with Config Templates]({{< relref "/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md" >}}) -- [RBAC for Templates and Template Submissions]({{< relref "/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md" >}}) +- [Understanding Config Templates]({{< ref "/nim/nginx-configs/config-templates/concepts/config-templates.md" >}}) +- [About Augment Templates]({{< ref "/nim/nginx-configs/config-templates/concepts/augment-templates.md" >}}) +- [Manage NGINX Configs with Config Templates]({{< ref "/nim/nginx-configs/config-templates/how-to/manage-nginx-configs-with-templates.md" >}}) +- [RBAC for Templates and Template Submissions]({{< ref "/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md" >}}) diff --git a/content/nim/nginx-configs/publish-configs.md b/content/nim/nginx-configs/publish-configs.md index 7df8966fc..4bf6e6b37 100644 --- a/content/nim/nginx-configs/publish-configs.md +++ b/content/nim/nginx-configs/publish-configs.md @@ -20,7 +20,7 @@ To complete the instructions in this guide, ensure: - NGINX Instance Manager is installed, licensed, and running. - You have one or more NGINX data plane instances. -{{< call-out "tip" "Interacting with the API">}} You can use tools such as `curl` or [Postman](https://www.postman.com) to interact with the Instance Manager REST API. The API URL follows the format `https:///api/nim/` and must include authentication information with each call. For more information about authentication options, refer to the [API Overview]({{< relref "/nim/fundamentals/api-overview.md" >}}).{{}} +{{< call-out "tip" "Interacting with the API">}} You can use tools such as `curl` or [Postman](https://www.postman.com) to interact with the Instance Manager REST API. The API URL follows the format `https:///api/nim/` and must include authentication information with each call. For more information about authentication options, refer to the [API Overview]({{< ref "/nim/fundamentals/api-overview.md" >}}).{{}} --- @@ -217,4 +217,4 @@ To view an instance group's config with a version-controlled hash, send an HTTP ## Publishing staged configs -For complete instructions on publishing staged configurations, see the [Stage NGINX configs]({{< relref "/nim/nginx-configs/stage-configs.md#publish-staged-configs" >}}) guide. +For complete instructions on publishing staged configurations, see the [Stage NGINX configs]({{< ref "/nim/nginx-configs/stage-configs.md#publish-staged-configs" >}}) guide. diff --git a/content/nim/nginx-configs/stage-configs.md b/content/nim/nginx-configs/stage-configs.md index 6c7e7e598..9ef7d9e3d 100644 --- a/content/nim/nginx-configs/stage-configs.md +++ b/content/nim/nginx-configs/stage-configs.md @@ -17,7 +17,7 @@ To complete the instructions in this guide, ensure: - NGINX Instance Manager is installed, licensed, and running. -{{}} You can use tools such as `curl` or [Postman](https://www.postman.com) to interact with the Instance Manager REST API. The API URL follows the format `https:///api/nim/` and must include authentication information with each call. For more information about authentication options, refer to the [API Overview]({{< relref "/nim/fundamentals/api-overview.md" >}}). {{}} +{{}} You can use tools such as `curl` or [Postman](https://www.postman.com) to interact with the Instance Manager REST API. The API URL follows the format `https:///api/nim/` and must include authentication information with each call. For more information about authentication options, refer to the [API Overview]({{< ref "/nim/fundamentals/api-overview.md" >}}). {{}} --- diff --git a/content/nim/nginx-instances/manage-instance-groups.md b/content/nim/nginx-instances/manage-instance-groups.md index 9887224ad..9f9fd8d39 100644 --- a/content/nim/nginx-instances/manage-instance-groups.md +++ b/content/nim/nginx-instances/manage-instance-groups.md @@ -20,7 +20,7 @@ You can easily manage multiple NGINX instances as a single entity by creating an To complete the instructions in this guide, you need the following: -- An installed version of [Instance Manager]({{< relref "/nim/deploy/vm-bare-metal/_index.md" >}}) +- An installed version of [Instance Manager]({{< ref "/nim/deploy/vm-bare-metal/_index.md" >}}) - One or more NGINX data plane instances --- @@ -62,7 +62,7 @@ You can assign NGINX instances to instance groups in the following ways: ### Specify Instance Group in Agent-Dynamic.Conf -You can easily add instances to a default instance group that you specify. To do so, [install the NGINX Agent on an instance]({{< relref "/nms/nginx-agent/install-nginx-agent.md" >}}), then edit the `/var/lib/nginx-agent/agent-dynamic.conf` file as described below. +You can easily add instances to a default instance group that you specify. To do so, [install the NGINX Agent on an instance]({{< ref "/nms/nginx-agent/install-nginx-agent.md" >}}), then edit the `/var/lib/nginx-agent/agent-dynamic.conf` file as described below. {{}}If you're running Instance Manager 2.10.1 or earlier or NGINX Agent 2.25.1 or earlier, the `agent-dynamic.conf` file is located in `/etc/nginx-agent/`.{{}} @@ -201,7 +201,7 @@ If the instance group you deleted was specified in the `agent-dynamic.conf` file ## Permission for Instance Groups -See [Set Up RBAC]({{< relref "/nim/admin-guide/rbac/overview-rbac.md" >}}), for detail information on setting up role-based access control (RBAC) for Instance Groups. +See [Set Up RBAC]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}), for detail information on setting up role-based access control (RBAC) for Instance Groups. {{}} Members of Instance Group automatically inherit role-based access control (RBAC) permissions from their parent. @@ -209,7 +209,7 @@ Members of Instance Group automatically inherit role-based access control (RBAC) ## Publishing to Instance Groups -- For instructions on publishing to instance groups, see the topic [Publish NGINX configs]({{< relref "/nim/nginx-configs/publish-configs.md" >}}). +- For instructions on publishing to instance groups, see the topic [Publish NGINX configs]({{< ref "/nim/nginx-configs/publish-configs.md" >}}). ## Additional Information Regarding Instance Groups diff --git a/content/nim/nginx-instances/scan-instances.md b/content/nim/nginx-instances/scan-instances.md index a18596d68..79d65505e 100644 --- a/content/nim/nginx-instances/scan-instances.md +++ b/content/nim/nginx-instances/scan-instances.md @@ -17,11 +17,11 @@ type: ## Prerequisites {#prerequisites} -1. [Install Instance Manager]({{< relref "/nim/deploy/vm-bare-metal/_index.md" >}}). +1. [Install Instance Manager]({{< ref "/nim/deploy/vm-bare-metal/_index.md" >}}). 2. Start and enable Instance Manager. {{}} -To update the CVE list manually or offline, refer to the [Offline Installation]({{}}) guide. +To update the CVE list manually or offline, refer to the [Offline Installation]({{}}) guide. {{}} Host discovery, the first stage in instance discovery, is used to enumerate live hosts on a given network. However, in certain environments, Internet Control Message Protocol (ICMP) echo requests are disabled. The Instance Manager API provides a method for disabling host discovery in scanning. @@ -281,7 +281,7 @@ The result looks similar to the following: #### Description -- When [scanning for NGINX instances]({{< relref "/nim/nginx-instances/scan-instances.md" >}}), the NGINX version is reported as `undefined` when NGINX App Protect is installed. +- When [scanning for NGINX instances]({{< ref "/nim/nginx-instances/scan-instances.md" >}}), the NGINX version is reported as `undefined` when NGINX App Protect is installed. #### Resolution diff --git a/content/nim/releases/known-issues.md b/content/nim/releases/known-issues.md index b6231e466..20fbafcbd 100644 --- a/content/nim/releases/known-issues.md +++ b/content/nim/releases/known-issues.md @@ -70,7 +70,7 @@ On Ubuntu 24.04, NGINX Instance Manager v2.18.0 and v2.19.0 fail to automaticall #### Workaround -Manually install the missing compiler by following the instructions in [Install the WAF compiler]({{< relref "nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}). +Manually install the missing compiler by following the instructions in [Install the WAF compiler]({{< ref "nim/nginx-app-protect/setup-waf-config-management.md#install-the-waf-compiler" >}}). {{}} @@ -340,7 +340,7 @@ Under certain conditions, instances that are not reporting request totals may no #### Workaround -Configure NGINX Plus or NGINX Stub Status APIs to send correctly the NGINX metrics using NGINX Agent. See the [Metrics]({{< relref "/nim/monitoring/overview-metrics.md" >}}) documentation to learn more. +Configure NGINX Plus or NGINX Stub Status APIs to send correctly the NGINX metrics using NGINX Agent. See the [Metrics]({{< ref "/nim/monitoring/overview-metrics.md" >}}) documentation to learn more. --- @@ -502,7 +502,7 @@ The default Attack Signature might be unavailable for publishing from Instance M #### Workaround -[Download another (latest recommended) version of the Attack Signature and publish it]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md" >}}). Attack Signature 2019.07.16 should be removed from the list when you refresh the web interface. +[Download another (latest recommended) version of the Attack Signature and publish it]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md" >}}). Attack Signature 2019.07.16 should be removed from the list when you refresh the web interface. --- @@ -788,7 +788,7 @@ When installing on CentOS 7, RHEL 7, and Amazon Linux 2, the package manager doe #### Workaround -Install a supported version of NGINX (v1.18 or later) or NGINX Plus (R22 or later). See the [Technical Specifications]({{< relref "/nim/fundamentals/tech-specs" >}}) guide for details. +Install a supported version of NGINX (v1.18 or later) or NGINX Plus (R22 or later). See the [Technical Specifications]({{< ref "/nim/fundamentals/tech-specs" >}}) guide for details. --- diff --git a/content/nim/releases/release-notes.md b/content/nim/releases/release-notes.md index fc1f94704..5852995b7 100644 --- a/content/nim/releases/release-notes.md +++ b/content/nim/releases/release-notes.md @@ -39,7 +39,7 @@ This release includes the following updates: ### Resolved Issues{#2-19-1-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Automatic downloading of NAP compiler versions 5.210.0 and 5.264.0 fails on Ubuntu 24 (45846) @@ -81,19 +81,19 @@ This release includes the following updates: NGINX Instance Manager can now be configured to use the CONNECT HTTP method to request that a proxy establish a HTTP(S) tunnel to an outbound server. This covers all use-cases that require outbound access such as App Protect Signature updates, licensing and usage reporting. - - Documentation: [Configure NGINX Instance Manager to use a forward proxy]({{< relref "nim/system-configuration/configure-forward-proxy.md" >}}) + - Documentation: [Configure NGINX Instance Manager to use a forward proxy]({{< ref "nim/system-configuration/configure-forward-proxy.md" >}}) - {{% icon-feature %}} **Support for OpenShift Deployments using Helm** Added an `OpenShift` flag to the Helm charts that creates a security context constraint resource to support NGINX Instance Manager in OpenShift. - - Documentation: [Deploy NGINX Instance Manager using Helm]({{< relref "nim/deploy/kubernetes/deploy-using-helm.md" >}}) + - Documentation: [Deploy NGINX Instance Manager using Helm]({{< ref "nim/deploy/kubernetes/deploy-using-helm.md" >}}) - {{% icon-feature %}} **VM-based active-passive HA Support with keepalived** This release includes documentation for a basic HA (High availability) setup with two nodes, for bare metal and VM based environments. This feature uses keepalived and a failover script if a primary NGINX Instance Manager node fails. - - Documentation: [Configure high availability (HA) for NGINX Instance Manager]({{< relref "nim/system-configuration/configure-high-availability.md" >}}) + - Documentation: [Configure high availability (HA) for NGINX Instance Manager]({{< ref "nim/system-configuration/configure-high-availability.md" >}}) - {{% icon-feature %}} **Added "Export" feature for templates** @@ -118,7 +118,7 @@ This release has the following changes in default behavior: Starting in 2.19.0, remote certificates that are expired are removed from the web interface after 30 days. ### Resolved Issues{#2-19-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} .tgz files are not accepted in templates (45301) @@ -134,7 +134,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-19-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -155,23 +155,23 @@ This release includes the following updates: - {{% icon-feature %}} **Adds support for NGINX App Protect WAF v5** - NGINX Instance Manager 2.18.0 adds support for [NGINX App Protect WAF v5.3 and v4.11]({{< relref "nap-waf/v5/admin-guide/overview.md" >}}). + NGINX Instance Manager 2.18.0 adds support for [NGINX App Protect WAF v5.3 and v4.11]({{< ref "nap-waf/v5/admin-guide/overview.md" >}}). NGINX App Protect WAF v5, designed for both NGINX Open Source and NGINX Plus environments, includes a dynamic NGINX module and containerized WAF services. It provides robust security and scalability. - {{% icon-feature %}} **Ridiculously easy NGINX Instance Manager installation script (Bash)** - Reduce the number of steps to deploy all NGINX Instance Manager components, including prerequisites, using a single [installation script]({{< relref "nim/deploy/vm-bare-metal/install.md" >}}). The script supports every OS that NGINX Instance Manager supports in the [technical specifications]({{< relref "nim/fundamentals/tech-specs.md" >}}). + Reduce the number of steps to deploy all NGINX Instance Manager components, including prerequisites, using a single [installation script]({{< ref "nim/deploy/vm-bare-metal/install.md" >}}). The script supports every OS that NGINX Instance Manager supports in the [technical specifications]({{< ref "nim/fundamentals/tech-specs.md" >}}). The script installs NGINX (Plus or Open Source), ClickHouse, and NGINX Instance Manager. Customers only need their NGINX Plus certificate, key, and, for NGINX Plus R33 or later, a JWT downloaded from MyF5. Support for offline installations will be added in a future update. - Support for [offline installations]({{< relref "nim/disconnected/offline-install-guide.md" >}}) is also available for air-gapped environments. + Support for [offline installations]({{< ref "nim/disconnected/offline-install-guide.md" >}}) is also available for air-gapped environments. - {{% icon-feature %}} **Entitlement and visibility for NGINX Plus R33 – Telemetry reporting for network-restricted environments** - If NGINX Instance Manager has internet access, customers can [automatically or manually send the usage data to F5]({{< relref "nim/admin-guide/license/report-usage-connected-deployment.md" >}}) as part of the new NGINX Plus R33 changes. + If NGINX Instance Manager has internet access, customers can [automatically or manually send the usage data to F5]({{< ref "nim/admin-guide/license/report-usage-connected-deployment.md" >}}) as part of the new NGINX Plus R33 changes. - For customers who have NGINX Instance Manager deployed in [network-restricted environments]({{< relref "nim/disconnected" >}}), this release also includes support for manual usage reporting. Customers can now manually license NGINX Instance Manager and export usage telemetry for fully disconnected environments. For usage reporting, customers can: + For customers who have NGINX Instance Manager deployed in [network-restricted environments]({{< ref "nim/disconnected" >}}), this release also includes support for manual usage reporting. Customers can now manually license NGINX Instance Manager and export usage telemetry for fully disconnected environments. For usage reporting, customers can: - **Export the usage report**: Manually export the usage report from NGINX Instance Manager. - **Send the report to F5**: Submit the report to F5 for verification from a location with internet access. @@ -179,7 +179,7 @@ This release includes the following updates: - {{% icon-feature %}} **Resilient Docker Compose NGINX Instance Manager deployment** - This [Docker Compose option]({{< relref "nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md" >}}) unlocks another easy, production-ready installation method for customers using Docker. It will also make upgrades easier when new Docker images are released by F5 NGINX. This option includes health checking, NGINX App Protect compilation support, and security monitoring. + This [Docker Compose option]({{< ref "nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md" >}}) unlocks another easy, production-ready installation method for customers using Docker. It will also make upgrades easier when new Docker images are released by F5 NGINX. This option includes health checking, NGINX App Protect compilation support, and security monitoring. ### Changes in Default Behavior{#2-18-0-changes-in-behavior} @@ -187,10 +187,10 @@ This release has the following changes in default behavior: - {{% icon-feature %}} **The NGINX Usage page now only shows instances configured with the NGINX Plus R33 mgmt block.** - The “NGINX Usage” page previously displayed instances connected to NGINX Instance Manager through multiple methods, including the NGINX Agent, health checks, and the `mgmt` block in NGINX Plus R31-R32. With the introduction of native reporting in NGINX Plus R33, only instances using this feature appear on the page, preventing duplicates. For more information on R33 usage reporting, see [About subscription licenses]({{< relref "solutions/about-subscription-licenses.md" >}}). + The “NGINX Usage” page previously displayed instances connected to NGINX Instance Manager through multiple methods, including the NGINX Agent, health checks, and the `mgmt` block in NGINX Plus R31-R32. With the introduction of native reporting in NGINX Plus R33, only instances using this feature appear on the page, preventing duplicates. For more information on R33 usage reporting, see [About subscription licenses]({{< ref "solutions/about-subscription-licenses.md" >}}). ### Resolved Issues{#2-18-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Mismatch in date formats in custom date selection on NGINX usage graph (45512) @@ -199,7 +199,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-18-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -225,7 +225,7 @@ This release includes the following updates: ### Known Issues{#2-17-4-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -251,7 +251,7 @@ This release includes the following updates: ### Known Issues{#2-17-3-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -277,7 +277,7 @@ This release includes the following updates: ### Known Issues{#2-17-2-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -303,7 +303,7 @@ This release includes the following updates: ### Known Issues{#2-17-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -332,7 +332,7 @@ This release includes the following updates: Prior to this release, users had to download NGINX Instance Manager docker images and push them to their local container registry for use in the Kubernetes Helm charts. This was not very turnkey and required multiple steps before being able to use the Helm charts. Now all Instance Manager container images are available from F5's public docker repository, simplifying the installation in Kubernetes. - See the [Deploy Instance Manager on Kubernetes]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}) documentation for more information. + See the [Deploy Instance Manager on Kubernetes]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}) documentation for more information. - {{% icon-feature %}} **Ansible role to deploy NGINX Instance Manager** @@ -340,7 +340,7 @@ This release includes the following updates: - {{% icon-feature %}} **NGINX Instance Manager IaC using Packer and Terraform** - This release improves the [Infrastructure as Code (IaC) project]({{< relref "/nim/deploy/infrastructure-as-code/overview.md#nginx-management-suite-infrastructure-as-code" >}}) to help you quickly get started with NGINX Instance Manager using Packer and Terraform. + This release improves the [Infrastructure as Code (IaC) project]({{< ref "/nim/deploy/infrastructure-as-code/overview.md#nginx-management-suite-infrastructure-as-code" >}}) to help you quickly get started with NGINX Instance Manager using Packer and Terraform. The project uses Packer to create images and Terraform to deploy these images to your preferred cloud provider, including GCP, Azure, or vSphere. @@ -353,7 +353,7 @@ This release has the following changes in default behavior: NGINX Instance Manager now collects and sends anonymized telemetry and interaction information for analysis by F5 NGINX. This information is used to improve our products and services. - Customers have the option to opt out of data collection by disabling the feature in the Instance Manager web interface, using the Account menu in the top-right corner of the screen. For more details, see [Configure Telemetry and Web Analytics]({{< relref "/nim/system-configuration/configure-telemetry.md" >}}). + Customers have the option to opt out of data collection by disabling the feature in the Instance Manager web interface, using the Account menu in the top-right corner of the screen. For more details, see [Configure Telemetry and Web Analytics]({{< ref "/nim/system-configuration/configure-telemetry.md" >}}). - {{% icon-feature %}} **Augment Template order now matches NGINX configuration structure** @@ -365,10 +365,10 @@ This release has the following changes in default behavior: Since these operating systems won't get any more updates or security patches, NGINX Instance Manager no longer supports them. - Please upgrade your environment to one of the [supported distributions]({{< relref "/nim/fundamentals/tech-specs.md#supported-distributions" >}}) to continue using NGINX Instance Manager. + Please upgrade your environment to one of the [supported distributions]({{< ref "/nim/fundamentals/tech-specs.md#supported-distributions" >}}) to continue using NGINX Instance Manager. ### Resolved Issues{#2-17-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Users receive login error when NGINX Management Suite is deployed in Kubernetes (44686) @@ -378,7 +378,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-17-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -399,9 +399,9 @@ This release includes the following updates: - {{% icon-feature %}} **Introducing configuration templates for simplifying NGINX configurations and self-service workflows** - This release of NGINX Instance Manager introduces [Config Templates]({{< relref "nim/nginx-configs/config-templates/concepts/config-templates.md" >}}). These templates use Go templating to make it easier to set up and standardize NGINX configurations. Now, you don't need to know all the details of NGINX syntax to create a working configuration. Just provide the required inputs for a template, and the system will do the rest. This makes setting up NGINX simpler and helps you follow best practices. + This release of NGINX Instance Manager introduces [Config Templates]({{< ref "nim/nginx-configs/config-templates/concepts/config-templates.md" >}}). These templates use Go templating to make it easier to set up and standardize NGINX configurations. Now, you don't need to know all the details of NGINX syntax to create a working configuration. Just provide the required inputs for a template, and the system will do the rest. This makes setting up NGINX simpler and helps you follow best practices. - To provide more control over your configurations, [augment templates]({{< relref "nim/nginx-configs/config-templates/concepts/default-base-template.md#augmenting-global-default-base-template" >}}) let you modify only specific segments of your NGINX configuration. This, when combined with [RBAC for template submissions]({{< relref "/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md" >}}), enables self-service workflows. Look for pre-built templates for common scenarios in our GitHub repositories soon. + To provide more control over your configurations, [augment templates]({{< ref "nim/nginx-configs/config-templates/concepts/default-base-template.md#augmenting-global-default-base-template" >}}) let you modify only specific segments of your NGINX configuration. This, when combined with [RBAC for template submissions]({{< ref "/nim/nginx-configs/config-templates/how-to/rbac-config-templates-and-submissions.md" >}}), enables self-service workflows. Look for pre-built templates for common scenarios in our GitHub repositories soon. - {{% icon-feature %}} **Stability and performance improvements** @@ -418,7 +418,7 @@ This release has the following changes in default behavior: ### Known Issues{#2-16-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -443,7 +443,7 @@ This release includes the following updates: ### Resolved Issues{#2-15-1-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Helm chart backup and restore is broken in NIM 2.15.0 (44758) @@ -451,7 +451,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-15-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -476,7 +476,7 @@ This release includes the following updates: ### Resolved Issues{#2-15-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Instances reporting incorrect memory utilization (44351) @@ -486,7 +486,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-15-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -512,7 +512,7 @@ This release includes the following updates: ### Known Issues{#2-14-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -533,12 +533,12 @@ This release includes the following updates: - {{% icon-feature %}} **Instance Manager Dashboard** - Monitor the health and performance of your NGINX instance fleet from a single page. Get insights and trends on CPU, memory, disk, and network traffic utilization. Quickly spot and mitigate common HTTP errors and TLS certificate issues. See the [Instance Manager Dashboard]({{< relref "nim/fundamentals/dashboard-overview.md" >}}) documentation to learn more. + Monitor the health and performance of your NGINX instance fleet from a single page. Get insights and trends on CPU, memory, disk, and network traffic utilization. Quickly spot and mitigate common HTTP errors and TLS certificate issues. See the [Instance Manager Dashboard]({{< ref "nim/fundamentals/dashboard-overview.md" >}}) documentation to learn more. - {{% icon-feature %}} **Work with NGINX App Protect Bundles from Instance Manager** Starting with Instance Manager 2.14, you can now use the "/security/policies/bundles" endpoint to create, read, update, and delete NGINX App Protect bundles, which allow faster deployment through pre-compilation of security policies, attack signatures, and threat-campaign. For additional information on how to use the API endpoint, refer to your product API documentation. - To learn more about this feature, see the [Manage WAF Security Policies]({{< relref "/nim/nginx-app-protect/manage-waf-security-policies.md" >}}) documentation. + To learn more about this feature, see the [Manage WAF Security Policies]({{< ref "/nim/nginx-app-protect/manage-waf-security-policies.md" >}}) documentation. - {{% icon-feature %}} **Clickhouse LTS 23.8 support** @@ -555,7 +555,7 @@ This release has the following changes in default behavior: ### Known Issues{#2-14-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -572,7 +572,7 @@ Instance Manager supports upgrades from these previous versions: If your Instance Manager version is older, you may need to upgrade to an intermediate version before upgrading to the target version. ### Resolved Issues{#2-13-1-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Validation errors in Resource Groups for certificates uploaded before 2.13 upgrade (44254) @@ -580,7 +580,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-13-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -601,7 +601,7 @@ This release includes the following updates: - {{% icon-feature %}} **Easily manage access to specific objects with Resource Groups** - With NGINX Instance Manager, you can now combine Instances, Instance Groups, and Certificates into a Resource Group. This grouping can be used when defining roles to grant access to those specific objects. When objects are added to or removed from the Resource Group, the changes are automatically reflected in any roles that use the Resource Group. For more details, refer to [Working with Resource Groups]({{< relref "/nim/admin-guide/rbac/manage-resource-groups.md" >}}). + With NGINX Instance Manager, you can now combine Instances, Instance Groups, and Certificates into a Resource Group. This grouping can be used when defining roles to grant access to those specific objects. When objects are added to or removed from the Resource Group, the changes are automatically reflected in any roles that use the Resource Group. For more details, refer to [Working with Resource Groups]({{< ref "/nim/admin-guide/rbac/manage-resource-groups.md" >}}). - {{% icon-feature %}} **Get version controlled NGINX configurations with an external commit hash** @@ -609,9 +609,9 @@ This release includes the following updates: To learn how to use a commit hash with NGINX configurations, refer to these topics: - - [Add Hash Versioning to Staged Configs]({{< relref "/nim/nginx-configs/stage-configs.md#hash-versioning-staged-configs" >}}) - - [Publish Configs with Hash Versioning to Instances]({{< relref "/nim/nginx-configs/publish-configs.md#publish-configs-instances-hash-versioning" >}}) - - [Publish Configs with Hash Versioning to Instance Groups]({{< relref "/nim/nginx-configs/publish-configs.md#publish-configs-instance-groups-hash-versioning" >}}) + - [Add Hash Versioning to Staged Configs]({{< ref "/nim/nginx-configs/stage-configs.md#hash-versioning-staged-configs" >}}) + - [Publish Configs with Hash Versioning to Instances]({{< ref "/nim/nginx-configs/publish-configs.md#publish-configs-instances-hash-versioning" >}}) + - [Publish Configs with Hash Versioning to Instance Groups]({{< ref "/nim/nginx-configs/publish-configs.md#publish-configs-instance-groups-hash-versioning" >}}) - {{% icon-feature %}} **Configure analytics data retention with the nms.conf file** @@ -619,15 +619,15 @@ This release includes the following updates: - {{% icon-feature %}} **RBAC for security policies** - You can now use [Role-Based Access Control (RBAC)]({{< relref "/nim/admin-guide/rbac/overview-rbac.md" >}}) to allow or restrict the level of access to security policies according to your security governance model. + You can now use [Role-Based Access Control (RBAC)]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}) to allow or restrict the level of access to security policies according to your security governance model. - {{% icon-feature %}} **RBAC for log profiles** - You can now use [Role-Based Access Control (RBAC)]({{< relref "/nim/admin-guide/rbac/overview-rbac.md" >}}) to allow or restrict access to log profiles according to your security governance model. + You can now use [Role-Based Access Control (RBAC)]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}) to allow or restrict access to log profiles according to your security governance model. - {{% icon-feature %}} **Use NGINX Plus Health Checks to easily track NGINX Plus Usage with NGINX Instance Manager** - The NGINX Plus Health Check feature now allows you to monitor the count of both NGINX Plus and NGINX App Protect instances that you've deployed. You can view this information in the "NGINX Plus" area of the "Instance Manager" web interface, or through the `/inventory` API. For guidance on how to set this up, refer to the following documentation: [View Count of NGINX Plus Instances]({{< relref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}). + The NGINX Plus Health Check feature now allows you to monitor the count of both NGINX Plus and NGINX App Protect instances that you've deployed. You can view this information in the "NGINX Plus" area of the "Instance Manager" web interface, or through the `/inventory` API. For guidance on how to set this up, refer to the following documentation: [View Count of NGINX Plus Instances]({{< ref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}). - {{% icon-feature %}} **Improved log output for better JSON parsing** @@ -635,14 +635,14 @@ This release includes the following updates: ### Resolved Issues{#2-13-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} An "unregistered clickhouse-adapter" failure is logged every few seconds if logging is set to debug. (43438) ### Known Issues{#2-13-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -663,11 +663,11 @@ This release includes the following updates: - {{% icon-feature %}} **New support for license tokens for automatic entitlement updates, renewals, and Flexible Consumption Reporting** - NGINX Management Suite now supports license tokens formatted as a JSON Web Token (JWT). With JWT licensing, you can automatically update entitlements during subscription renewals or amendments, and you can automate reporting for the Flexible Consumption Program (FCP). For more information, see the [Add a License]({{< relref "/nim/admin-guide/license/add-license.md" >}}) topic. + NGINX Management Suite now supports license tokens formatted as a JSON Web Token (JWT). With JWT licensing, you can automatically update entitlements during subscription renewals or amendments, and you can automate reporting for the Flexible Consumption Program (FCP). For more information, see the [Add a License]({{< ref "/nim/admin-guide/license/add-license.md" >}}) topic. ### Resolved Issues{#2-12-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Filtering Analytics data with values that have double backslashes (`\\`) causes failures (42105) @@ -676,7 +676,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-12-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -749,7 +749,7 @@ This release has the following changes in default behavior: ### Resolved Issues{#2-11-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Count of NGINX Plus graph has a delay in being populated (37705) @@ -760,7 +760,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-11-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -777,14 +777,14 @@ Instance Manager supports upgrades from these previous versions: If your Instance Manager version is older, you may need to upgrade to an intermediate version before upgrading to the target version. ### Resolved Issues{#2-10-1-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Valid licenses incorrectly identified as invalid (42598) ### Known Issues{#2-10-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -850,7 +850,7 @@ This release has the following changes in default behavior: ### Resolved Issues{#2-10-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Installing NGINX Agent on FreeBSD fails with "error 2051: not implemented" (41157) @@ -858,7 +858,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-10-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -875,14 +875,14 @@ Instance Manager supports upgrades from these previous versions: If your Instance Manager version is older, you may need to upgrade to an intermediate version before upgrading to the target version. ### Resolved Issues{#2-9-1-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} NGINX configurations with special characters may not be editable from the web interface after upgrading Instance Manager (41557) ### Known Issues{#2-9-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -923,9 +923,9 @@ This release includes the following updates: For more information, see the following topics: - - [Add Hash Versioning to Staged Configs]({{< relref "/nim/nginx-configs/stage-configs.md#hash-versioning-staged-configs" >}}) - - [Publish Configs with Hash Versioning to Instances]({{< relref "/nim/nginx-configs/publish-configs.md#publish-configs-instances-hash-versioning" >}}) - - [Publish Configs with Hash Versioning to Instance Groups]({{< relref "/nim/nginx-configs/publish-configs.md#publish-configs-instance-groups-hash-versioning" >}}) + - [Add Hash Versioning to Staged Configs]({{< ref "/nim/nginx-configs/stage-configs.md#hash-versioning-staged-configs" >}}) + - [Publish Configs with Hash Versioning to Instances]({{< ref "/nim/nginx-configs/publish-configs.md#publish-configs-instances-hash-versioning" >}}) + - [Publish Configs with Hash Versioning to Instance Groups]({{< ref "/nim/nginx-configs/publish-configs.md#publish-configs-instance-groups-hash-versioning" >}}) ### Security Updates{#2-9-0-security-updates} @@ -946,7 +946,7 @@ This release includes the following security updates: #### Mitigation - - Avoid configuring trace-level logging in the NGINX Agent configuration file. For more information, refer to the [Configuring the NGINX Agent]({{< relref "/nms/nginx-agent/install-nginx-agent.md#configuring-the-nginx-agent ">}}) section of NGINX Management Suite documentation. If trace-level logging is required, ensure only trusted users have access to the log files. + - Avoid configuring trace-level logging in the NGINX Agent configuration file. For more information, refer to the [Configuring the NGINX Agent]({{< ref "/nms/nginx-agent/install-nginx-agent.md#configuring-the-nginx-agent ">}}) section of NGINX Management Suite documentation. If trace-level logging is required, ensure only trusted users have access to the log files. #### Fixed in @@ -1026,7 +1026,7 @@ This release has the following changes in default behavior: ### Resolved Issues{#2-9-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} After upgrading to NGINX Instance Manager 2.1.0, the web interface reports timeouts when NGINX Agent configs are published (32349) @@ -1038,7 +1038,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-9-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1063,11 +1063,11 @@ This release includes the following updates: - {{% icon-feature %}} **Automatic retrieval of Attack Signatures and Threat Campaign updates to Instance Manager** - Instance Manager now allows you to [set up automatic downloads of the most recent Attack Signature and Threat Campaign packages]({{< relref "/nim/nginx-app-protect/setup-waf-config-management.md##automatically-download-latest-packages" >}}). By publishing these updates to your App Protect instances from Instance Manager, you can ensure your applications are shielded from all recognized attack types. + Instance Manager now allows you to [set up automatic downloads of the most recent Attack Signature and Threat Campaign packages]({{< ref "/nim/nginx-app-protect/setup-waf-config-management.md##automatically-download-latest-packages" >}}). By publishing these updates to your App Protect instances from Instance Manager, you can ensure your applications are shielded from all recognized attack types. - {{% icon-feature %}} **Improved WAF Compiler error messages** - The messaging around [security policy compilation errors]({{< relref "/nim/nginx-app-protect/manage-waf-security-policies.md#check-for-compilation-errors" >}}) has been improved by providing more detailed information and alerting users if the required compiler version is missing. + The messaging around [security policy compilation errors]({{< ref "/nim/nginx-app-protect/manage-waf-security-policies.md#check-for-compilation-errors" >}}) has been improved by providing more detailed information and alerting users if the required compiler version is missing. ### Changes in Default Behavior{#2-8-0-changes-in-behavior} @@ -1075,7 +1075,7 @@ This release has the following changes in default behavior: - {{% icon-feature %}} **Switching between storing secrets on disk and using Vault migrates secrets** - When transitioning between storing secrets on disk or using HashiCorp Vault, any existing secrets can be easily migrated to the new storage method. For instructions, refer to the guide [Configure Vault for Storing Secrets]({{< relref "/nim/system-configuration/configure-vault.md" >}}). + When transitioning between storing secrets on disk or using HashiCorp Vault, any existing secrets can be easily migrated to the new storage method. For instructions, refer to the guide [Configure Vault for Storing Secrets]({{< ref "/nim/system-configuration/configure-vault.md" >}}). - {{% icon-feature %}} **Create roles using either an object name or UID** @@ -1096,7 +1096,7 @@ This release has the following changes in default behavior: ### Resolved Issues{#2-8-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Web interface reports no license found when a license is present (30647) @@ -1114,7 +1114,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-8-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1147,7 +1147,7 @@ This release has the following changes in default behavior: ### Resolved Issues{#2-7-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Instance Manager reports old NGINX version after upgrade (31225) @@ -1160,7 +1160,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-7-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1181,7 +1181,7 @@ This release includes the following updates: - {{% icon-feature %}} **Manage and deploy configurations to NGINX App Protect WAF Instances** - This release introduces the following features to [manage and deploy configurations to NGINX App Protect instances]({{< relref "/nim/nginx-app-protect/overview-nap-waf-config-management.md" >}}): + This release introduces the following features to [manage and deploy configurations to NGINX App Protect instances]({{< ref "/nim/nginx-app-protect/overview-nap-waf-config-management.md" >}}): - Create, upsert, and delete NGINX App Protect WAF security policies - Manage NGINX App Protect WAF security configurations by using the NGINX Management Suite user interface or REST API @@ -1190,7 +1190,7 @@ This release includes the following updates: - {{% icon-feature %}} **Adds support for RHEL 9** - Instance Manager 2.6 supports RHEL 9. See the [Technical Specifications Guide]({{< relref "/nim/fundamentals/tech-specs#distributions" >}}) for details. + Instance Manager 2.6 supports RHEL 9. See the [Technical Specifications Guide]({{< ref "/nim/fundamentals/tech-specs#distributions" >}}) for details. - {{% icon-feature %}} **Support for using HashiCorp Vault for storing secrets** @@ -1202,7 +1202,7 @@ This release includes the following updates: - {{% icon-feature %}} **Adds support for Oracle 8** - Oracle 8 is now [a supported distribution]({{< relref "/nim/fundamentals/tech-specs#distributions" >}}) starting with Instance Manager 2.6. You can use the RedHat/CentOS distro to install the Oracle 8 package. + Oracle 8 is now [a supported distribution]({{< ref "/nim/fundamentals/tech-specs#distributions" >}}) starting with Instance Manager 2.6. You can use the RedHat/CentOS distro to install the Oracle 8 package. ### Changes in Default Behavior{#2-6-0-changes-in-behavior} @@ -1214,7 +1214,7 @@ This release has the following changes in default behavior: ### Resolved Issues{#2-6-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Password error "option unknown" occurs when installing NGINX Instance Manager on Ubuntu with OpenSSL v1.1.0 (33055) @@ -1222,7 +1222,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-6-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1239,14 +1239,14 @@ Instance Manager supports upgrades from these previous versions: If your Instance Manager version is older, you may need to upgrade to an intermediate version before upgrading to the target version. ### Resolved Issues{#2-5-1-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Extended NGINX metrics aren't reported for NGINX Plus R26 and earlier (37738) ### Known Issues{#2-5-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1267,15 +1267,15 @@ This release includes the following updates: - {{% icon-feature %}} **Track NGINX Plus usage over time** - When viewing your NGINX Plus instances in the Instnace Manager web interface, you can set a date and time filter to review the [NGINX Plus instance count]({{< relref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}) for a specific period. Also, you can use the Instance Manager REST API to view the lowest, highest, and average number of NGINX Plus instances over time. + When viewing your NGINX Plus instances in the Instnace Manager web interface, you can set a date and time filter to review the [NGINX Plus instance count]({{< ref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}) for a specific period. Also, you can use the Instance Manager REST API to view the lowest, highest, and average number of NGINX Plus instances over time. - {{% icon-feature %}} **New helm charts for each release of Instance Manager** - Each release of Instance Manager now includes a helm chart, which you can use to easily [install Instance Manager on Kubernetes]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}). You can download the helm charts from [MyF5](https://my.f5.com/manage/s/downloads). + Each release of Instance Manager now includes a helm chart, which you can use to easily [install Instance Manager on Kubernetes]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}). You can download the helm charts from [MyF5](https://my.f5.com/manage/s/downloads). ### Resolved Issues{#2-5-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} OIDC is not supported for helm chart deployments (33248) @@ -1284,7 +1284,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-5-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1309,7 +1309,7 @@ This release includes the following updates: - {{% icon-feature %}} **See which of your NGINX Plus instances have NGINX App Protect installed** - Now, when you [view your NGINX Plus inventory]({{< relref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}), you can see which instances have [NGINX App Protect](https://www.nginx.com/products/nginx-app-protect/) installed. NGINX App Protect is a modern app‑security solution that works seamlessly in DevOps environments as a robust WAF or app‑level DoS defense, helping you deliver secure apps from code to customer + Now, when you [view your NGINX Plus inventory]({{< ref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}), you can see which instances have [NGINX App Protect](https://www.nginx.com/products/nginx-app-protect/) installed. NGINX App Protect is a modern app‑security solution that works seamlessly in DevOps environments as a robust WAF or app‑level DoS defense, helping you deliver secure apps from code to customer ### Changes in Default Behavior{#2-4-0-changes-in-behavior} @@ -1325,14 +1325,14 @@ This release has the following changes in default behavior: ### Resolved Issues{#2-4-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Unable to publish config changes to a custom nginx.conf location (35276) ### Known Issues{#2-4-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1367,7 +1367,7 @@ This release includes the following security updates: ### Known Issues{#2-3-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1401,7 +1401,7 @@ This release includes the following updates: - {{% icon-feature %}} **Track the details for your NGINX Plus instances** - Easily track your NGINX Plus instances from the new NGINX Plus inventory list page. [View the current count for all your NGINX Plus instances]({{< relref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}), as well as each instance's hostname, UID, version, and the last time each instance was reported to Instance Manager. Select the `Export` button to export the list of NGINX Plus instances to a `.csv` file. + Easily track your NGINX Plus instances from the new NGINX Plus inventory list page. [View the current count for all your NGINX Plus instances]({{< ref "/nim/admin-guide/license/report-usage-connected-deployment.md" >}}), as well as each instance's hostname, UID, version, and the last time each instance was reported to Instance Manager. Select the `Export` button to export the list of NGINX Plus instances to a `.csv` file. - {{% icon-feature %}} **Explore events in NGINX Instance Manager with the Events Catalogs API** @@ -1409,13 +1409,13 @@ This release includes the following updates: - {{% icon-feature %}} **Support for provisioning users and user groups with SCIM** - Now, you can [use SCIM to provision, update, or deprovision users and user groups]({{< relref "/nim/admin-guide/authentication/oidc/scim-provisioning.md" >}}) for your Identity Provider to NGINX Instance Manager. SCIM, short for "[System for Cross-domain Identity Management](http://www.simplecloud.info)," is an open API for managing identities. + Now, you can [use SCIM to provision, update, or deprovision users and user groups]({{< ref "/nim/admin-guide/authentication/oidc/scim-provisioning.md" >}}) for your Identity Provider to NGINX Instance Manager. SCIM, short for "[System for Cross-domain Identity Management](http://www.simplecloud.info)," is an open API for managing identities. - {{% icon-feature %}} **Adds support for Ubuntu 22.04** The NGINX Management Suite, which includes NGINX Instance Manager, now supports Ubuntu 22.04 (Jammy). - Refer to the [Technical Specifications Guide]({{< relref "/nim/fundamentals/tech-specs" >}}) for details. + Refer to the [Technical Specifications Guide]({{< ref "/nim/fundamentals/tech-specs" >}}) for details. ### Changes in Default Behavior{#2-3-0-changes-in-behavior} @@ -1427,14 +1427,14 @@ This release has the following changes in default behavior: ### Resolved Issues{#2-3-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Post-install steps to load SELinux policy are in the wrong order (34276) ### Known Issues{#2-3-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1455,19 +1455,19 @@ This release includes the following updates: - {{% icon-feature %}} **New events for NGINX processes and configuration rollbacks** - Now, you can use the [NGINX Instance Manager Events API]({{< relref "/nim/monitoring/view-events-metrics.md" >}}) or [web interface]({{< relref "/nim/monitoring/view-events-metrics.md" >}}) to view events when NGINX instances start and reload or when a configuration is rolled back. + Now, you can use the [NGINX Instance Manager Events API]({{< ref "/nim/monitoring/view-events-metrics.md" >}}) or [web interface]({{< ref "/nim/monitoring/view-events-metrics.md" >}}) to view events when NGINX instances start and reload or when a configuration is rolled back. - {{% icon-feature %}} **Filter events and metrics with custom date and time ranges** - Now you can filter [events]({{< relref "/nim/monitoring/view-events-metrics" >}}) and [metrics]({{< relref "/nim/monitoring/view-events-metrics" >}}) using a custom date and time range. Select **Custom time range** in the filter list, then specify the date and time range you want to use. + Now you can filter [events]({{< ref "/nim/monitoring/view-events-metrics" >}}) and [metrics]({{< ref "/nim/monitoring/view-events-metrics" >}}) using a custom date and time range. Select **Custom time range** in the filter list, then specify the date and time range you want to use. - {{% icon-feature %}} **Role-based access control added to Events and Metrics pages** - A warning message is shown when users try to view the Events and Metrics pages in the web interface if they don't have permission to access the Analytics feature. For instructions on assigning access to features using role-based access control (RBAC), see [Set Up RBAC]({{< relref "/nim/admin-guide/rbac/overview-rbac.md" >}}). + A warning message is shown when users try to view the Events and Metrics pages in the web interface if they don't have permission to access the Analytics feature. For instructions on assigning access to features using role-based access control (RBAC), see [Set Up RBAC]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}). - {{% icon-feature %}} **Modules field added to Metrics and Dimensions catalogs** - A `modules` field was added to the [Metics]({{< relref "nms/reference/catalogs/metrics.md" >}}) and [Dimensions]({{< relref "nms/reference/catalogs/dimensions.md" >}}) catalogs. This field indicates which module or modules the metric or dimension belongs to. + A `modules` field was added to the [Metics]({{< ref "nms/reference/catalogs/metrics.md" >}}) and [Dimensions]({{< ref "nms/reference/catalogs/dimensions.md" >}}) catalogs. This field indicates which module or modules the metric or dimension belongs to. - {{% icon-feature %}} **Adds reporting for NGINX worker metrics (API only)** @@ -1480,14 +1480,14 @@ This release includes the following updates: ### Resolved Issues{#2-2-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Running Agent install script with sh returns “not found” error (33385) ### Known Issues{#2-2-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1520,13 +1520,13 @@ This release includes the following updates: The metrics pages in the web interface have been revised and improved. - See the [View Metrics]({{< relref "/nim/monitoring/view-events-metrics" >}}) topic to get started. + See the [View Metrics]({{< ref "/nim/monitoring/view-events-metrics" >}}) topic to get started. - {{% icon-feature %}} **New RBAC lets you limit access to NGINX Instance Manager features** RBAC has been updated and improved. Add users to roles -- or add users to user groups if you're using an external identity provider -- to limit access to Instance Manager features. - For more information, see the tutorial [Set Up RBAC]({{< relref "/nim/admin-guide/rbac/overview-rbac.md" >}}). + For more information, see the tutorial [Set Up RBAC]({{< ref "/nim/admin-guide/rbac/overview-rbac.md" >}}). - {{% icon-feature %}} **Improved certificate handling** @@ -1536,7 +1536,7 @@ This release includes the following updates: Now you can use the Instance Manager API or web interface to view events for your NGINX instances. - See the [View Events]({{< relref "/nim/monitoring/view-events-metrics" >}}) and [View Events (API)]({{< relref "/nim/monitoring/view-events-metrics" >}}) topics for instructions. + See the [View Events]({{< ref "/nim/monitoring/view-events-metrics" >}}) and [View Events (API)]({{< ref "/nim/monitoring/view-events-metrics" >}}) topics for instructions. - {{% icon-feature %}} **Deploy NGINX Instance Manager on Kubernetes using a helm chart** @@ -1544,7 +1544,7 @@ This release includes the following updates: Among the benefits of deploying from a helm chart, the chart includes the required services, which you can scale independently as needed; upgrades can be done with a single helm command; and there's no requirement for root privileges. - For instructions, see [Install from a Helm Chart]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}). + For instructions, see [Install from a Helm Chart]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}). ### Changes in Default Behavior{#2-1-0-changes-in-behavior} @@ -1581,7 +1581,7 @@ This release has the following changes in default behavior: ### Resolved Issues{#2-1-0-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Unable to register multiple NGINX Agents in containers on the same host (30780) @@ -1592,7 +1592,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-1-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1609,7 +1609,7 @@ Instance Manager supports upgrades from these previous versions: If your Instance Manager version is older, you may need to upgrade to an intermediate version before upgrading to the target version. ### Resolved Issues{#2-0-1-resolved-issues} -This release fixes the following issues. Check the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. +This release fixes the following issues. Check the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic for more information on the latest resolved issues. Use your browser's search function to find the issue ID in the page. - {{% icon-resolved %}} Unable to access the NGINX Instance Manager web interface after loading SELinux policy (31583) @@ -1617,7 +1617,7 @@ This release fixes the following issues. Check the [Known Issues]({{< relref "/n ### Known Issues{#2-0-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. --- @@ -1633,7 +1633,7 @@ This release includes the following updates: - {{% icon-feature %}} **More metrics and instance dashboards** - Instance Manager now collects additional metrics from the NGINX instances. We also added pre-configured dashboards to the web interface for each NGINX instance managed by Instance Manager. See the [Catalog Reference]({{< relref "/nms/reference/catalogs/_index.md" >}}) documentation for a complete list of metrics. + Instance Manager now collects additional metrics from the NGINX instances. We also added pre-configured dashboards to the web interface for each NGINX instance managed by Instance Manager. See the [Catalog Reference]({{< ref "/nms/reference/catalogs/_index.md" >}}) documentation for a complete list of metrics. - {{% icon-feature %}} **New architecture!** @@ -1641,10 +1641,10 @@ This release includes the following updates: - {{% icon-feature %}} **Improved user access control** - Instance Manager 2.x. allows you to create user access controls with tags. Administrators can grant users read or write access to perform instance management tasks. And admins can grant or restrict access to the Settings options, such as managing licenses and creating users and roles. See the [Set up Authentication]({{< relref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md#rbac" >}}) guide for more details. + Instance Manager 2.x. allows you to create user access controls with tags. Administrators can grant users read or write access to perform instance management tasks. And admins can grant or restrict access to the Settings options, such as managing licenses and creating users and roles. See the [Set up Authentication]({{< ref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md#rbac" >}}) guide for more details. ### Known Issues{#2-0-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nim/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nim/releases/known-issues.md" >}}) topic. diff --git a/content/nim/support/k8s-support-package.md b/content/nim/support/k8s-support-package.md index 37bd1e2ef..3f4aee827 100644 --- a/content/nim/support/k8s-support-package.md +++ b/content/nim/support/k8s-support-package.md @@ -12,7 +12,7 @@ type: ## Overview -Use the Kubernetes support package script to collect system and service information for troubleshooting and debugging. The script packages the data into a tar archive that you can share with [NGINX Customer Support]({{< relref "nim/support/contact-support.md" >}}). +Use the Kubernetes support package script to collect system and service information for troubleshooting and debugging. The script packages the data into a tar archive that you can share with [NGINX Customer Support]({{< ref "nim/support/contact-support.md" >}}). --- diff --git a/content/nim/support/support-package.md b/content/nim/support/support-package.md index bee1da5df..eeeda2e74 100644 --- a/content/nim/support/support-package.md +++ b/content/nim/support/support-package.md @@ -14,7 +14,7 @@ type: The support package script can be used to collect information about your system for troubleshooting and debugging issues. -The script collects system and service information and then packages the data into a tar archive, which you can share with [NGINX Customer Support]({{< relref "/nms/support/contact-support.md" >}}). +The script collects system and service information and then packages the data into a tar archive, which you can share with [NGINX Customer Support]({{< ref "/nms/support/contact-support.md" >}}). ## Usage diff --git a/content/nim/system-configuration/configure-forward-proxy.md b/content/nim/system-configuration/configure-forward-proxy.md index 115038dc3..a5f961404 100644 --- a/content/nim/system-configuration/configure-forward-proxy.md +++ b/content/nim/system-configuration/configure-forward-proxy.md @@ -4,7 +4,7 @@ weight: 2 toc: true type: how-to product: NIM -docs: +docs: --- ## Overview @@ -13,14 +13,14 @@ This guide explains how to configure NGINX Instance Manager to use a third-party --- -## Before you begin +## Before you begin -Ensure you have: +Ensure you have: -- NGINX Instance Manager **2.19 or later** -- Access to a configured HTTP or HTTPS forward proxy -- Permissions to modify `/etc/nms/nms.conf` -- Proxy authentication credentials, if required +- NGINX Instance Manager **2.19 or later** +- Access to a configured HTTP or HTTPS forward proxy +- Permissions to modify `/etc/nms/nms.conf` +- Proxy authentication credentials, if required {{}} #### Proxy SSL verification @@ -75,7 +75,7 @@ To configure a forward proxy: 1. Edit the `/etc/nms/nms.conf` file. -2. Add or modify the `proxy_config` section to include the proxy configuration: +2. Add or modify the `proxy_config` section to include the proxy configuration: ```yaml proxy_config: @@ -96,14 +96,14 @@ To configure a forward proxy: - Set `proxy_protocol` to either `http` or `https`, depending on your proxy type. - If not explicitly set, `proxy_ssl_verify` **defaults to `true`**, meaning the proxy must have a valid certificate from a trusted Certificate Authority (CA). Note: This setting applies only when `proxy_protocol` is `https`. - + If the proxy uses a self-signed or untrusted certificate, you have two options: - **Recommended**: Follow the steps in the [Trust proxy certificates](#trust-proxy-certificates-if-required) section to add the proxy's CA certificate to the system's trusted store. - **Alternative (not recommended)**: Disable SSL verification by setting `proxy_ssl_verify=false`, which allows connections to proxies with untrusted or self-signed certificates. 3. Save the configuration file. -4. Restart NGINX Instance Manager to apply changes: +4. Restart NGINX Instance Manager to apply changes: ```shell sudo systemctl restart nms @@ -126,7 +126,7 @@ kubectl edit cm nms-conf -n If you’re deploying NGINX Instance Manager with Docker Compose, update the `docker-compose.yaml` file to configure a forward proxy. -1. **Before you begin**: Follow the [Docker Compose deployment guide]({{< relref "nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md" >}}) to set up Docker for the NGINX container registry. The deployment guide also covers additional environment variables you may want to consider before deployment. +1. **Before you begin**: Follow the [Docker Compose deployment guide]({{< ref "nim/deploy/docker/deploy-nginx-instance-manager-docker-compose.md" >}}) to set up Docker for the NGINX container registry. The deployment guide also covers additional environment variables you may want to consider before deployment. 2. {{}} {{}} 3. Update `docker-compose.yaml` with the proxy settings: @@ -169,13 +169,13 @@ If you’re deploying NGINX Instance Manager with Docker Compose, update the `do - Replace `` with the filename of the proxy CA certificate. - Set `PROXY_PROTOCOL` to either `http` or `https`, depending on your proxy type. - If not explicitly set, **`PROXY_SSL_VERIFY` defaults to `true`**, meaning the proxy must have a valid certificate issued by a trusted Certificate Authority (CA). Note: This setting applies only when `PROXY_PROTOCOL` is `https`. - + If the proxy uses a self-signed or untrusted certificate, you have two options: - **Recommended**: Follow the steps in the [Trust proxy certificates](#trust-proxy-certificates-if-required) section to add the proxy's CA certificate to the system's trusted store. - **Alternative (not recommended)**: Disable SSL verification by setting `PROXY_SSL_VERIFY=false`, which allows connections to proxies with untrusted or self-signed certificates. -4. Deploy NGINX Instance Manager: +4. Deploy NGINX Instance Manager: ```shell docker compose up -d @@ -223,14 +223,14 @@ If your proxy uses HTTPS and `proxy_ssl_verify` is set to `true`, NGINX Instance After applying the configuration, verify that NGINX Instance Manager is using the proxy: -- **Check system logs:** Review logs for messages confirming that traffic is being routed through the proxy. The exact log message may vary but should indicate the configured proxy details. +- **Check system logs:** Review logs for messages confirming that traffic is being routed through the proxy. The exact log message may vary but should indicate the configured proxy details. - **Test outbound connectivity:** Use a tool such as `curl` or `wget` to confirm that requests are routed through the proxy. The exact command depends on your proxy configuration. - **Monitor network traffic:** If needed, use network debugging tools like `tcpdump` or `netstat` to verify that outbound requests are sent through the proxy. If proxy traffic is not working as expected, review the [troubleshooting section](#troubleshoot-common-issues) for possible causes. - + --- ## Troubleshoot common issues diff --git a/content/nim/system-configuration/configure-high-availability.md b/content/nim/system-configuration/configure-high-availability.md index ecff01f4b..e36f11d78 100644 --- a/content/nim/system-configuration/configure-high-availability.md +++ b/content/nim/system-configuration/configure-high-availability.md @@ -4,7 +4,7 @@ weight: 3 toc: true type: how-to product: NGINX Instance Manager -docs: +docs: --- ## Overview @@ -37,11 +37,11 @@ Some cloud platforms don’t allow direct IP management with `keepalived`. If yo ### Limitations This HA setup has the following restrictions: - + - This setup **supports only two nodes** — one active and one passive. Configurations with three or more nodes are not supported. - Active/active HA is not supported. This configuration works only in an active-passive setup. - Do not modify `keepalived`. Changes beyond what is documented may cause failures. -- OpenID Connect (OIDC) authentication is not supported when NGINX Instance Manager is running in [forward-proxy mode]({{< relref "nim/system-configuration/configure-forward-proxy.md" >}}). OIDC is configured on the NGINX Plus layer and cannot pass authentication requests through a forward proxy. +- OpenID Connect (OIDC) authentication is not supported when NGINX Instance Manager is running in [forward-proxy mode]({{< ref "nim/system-configuration/configure-forward-proxy.md" >}}). OIDC is configured on the NGINX Plus layer and cannot pass authentication requests through a forward proxy. --- @@ -94,7 +94,7 @@ check_nms_services=( ) ``` -{{}}If you switch between connected and disconnected modes, you must update **/etc/nms/nms.conf** on both the primary and secondary nodes if `nms-integrations` is included in `check_nms_services`. NGINX Instance Manager runs in connected mode by default. For instructions on changing the mode, see the [installation guide for disconnected environments]({{< relref "nim/disconnected/offline-install-guide.md#set-mode-disconnected" >}}).{{}} +{{}}If you switch between connected and disconnected modes, you must update **/etc/nms/nms.conf** on both the primary and secondary nodes if `nms-integrations` is included in `check_nms_services`. NGINX Instance Manager runs in connected mode by default. For instructions on changing the mode, see the [installation guide for disconnected environments]({{< ref "nim/disconnected/offline-install-guide.md#set-mode-disconnected" >}}).{{}} ### Configure keepalived diff --git a/content/nim/system-configuration/configure-selinux.md b/content/nim/system-configuration/configure-selinux.md index e7064b1a0..b9aa07184 100644 --- a/content/nim/system-configuration/configure-selinux.md +++ b/content/nim/system-configuration/configure-selinux.md @@ -25,7 +25,7 @@ Take these preparatory steps before configuring SELinux: 1. Enable SELinux on your system. 2. Install the tools `load_policy`, `semodule`, and `restorecon`. -3. [Install NGINX Instance Manager]({{< relref "/nim/deploy/_index.md" >}}) with SELinux module files in place. +3. [Install NGINX Instance Manager]({{< ref "/nim/deploy/_index.md" >}}) with SELinux module files in place. {{< important >}}SELinux can use `permissive` mode, where policy violations are logged instead of enforced. Verify which mode your configuration uses.{{< /important >}} diff --git a/content/nim/system-configuration/configure-telemetry.md b/content/nim/system-configuration/configure-telemetry.md index fdc0368f0..56bde9408 100644 --- a/content/nim/system-configuration/configure-telemetry.md +++ b/content/nim/system-configuration/configure-telemetry.md @@ -37,20 +37,20 @@ The table below shows the captured telemetry data points, the trigger conditions | Login | When a user logs in to NGINX Instance Manager. No data about the user is sent, only the fact that a user successfully authenticated and the timestamp of the login event. | To understand how often users or systems access NGINX Instance Manager. | | Start/Stop processes | When any NGINX Instance Manager processes are started or stopped. | To gauge how often users upgrade NGINX Instance Manager or troubleshoot issues. This information helps F5 Support diagnose issues. | | Adding Data Plane(s) | When NGINX Agent registers with NGINX Instance Manager for the first time. No data about the data plane is sent, just that an NGINX Agent registered with the platform. | To understand the frequency and quantity of data planes being added to NGINX Instance Manager. This information helps inform our scale and performance targets and helps F5 Support diagnose issues. | -| Product Usage | Data is sent daily or when Send Usage is selected from the Licenses page in the web interface or initiated using the API. (Requires a [JWT license]({{< relref "/nim/admin-guide/license/add-license.md#jwt-license" >}}).) | To track and report commercial usage in accordance with entitlement and Flexible Consumption Program (FCP) requirements. | +| Product Usage | Data is sent daily or when Send Usage is selected from the Licenses page in the web interface or initiated using the API. (Requires a [JWT license]({{< ref "/nim/admin-guide/license/add-license.md#jwt-license" >}}).) | To track and report commercial usage in accordance with entitlement and Flexible Consumption Program (FCP) requirements. | {{}} ### Enable or disable telemetry -Once you [apply a valid license]({{< relref "/nim/admin-guide/license/add-license.md" >}}), telemetry data starts transmitting. If the license is applied immediately after installation, the *Installation* data point is also sent. +Once you [apply a valid license]({{< ref "/nim/admin-guide/license/add-license.md" >}}), telemetry data starts transmitting. If the license is applied immediately after installation, the *Installation* data point is also sent. #### Disable telemetry You can disable telemetry anytime by: - Going to **Settings > License** in the web interface. -- Using the [`/license` API endpoint]({{< relref "/nim/fundamentals/api-overview.md" >}}). +- Using the [`/license` API endpoint]({{< ref "/nim/fundamentals/api-overview.md" >}}). Re-enable telemetry in the same way. diff --git a/content/nim/system-configuration/secure-traffic.md b/content/nim/system-configuration/secure-traffic.md index d22d1861f..e73472014 100644 --- a/content/nim/system-configuration/secure-traffic.md +++ b/content/nim/system-configuration/secure-traffic.md @@ -19,7 +19,7 @@ With NGINX Plus R33, telemetry data must be reported to a usage reporting endpoi {{< call-out "tip" "See also:" "fa-solid fa-book" >}} - To learn how to secure traffic for NGINX Agent, see [NGINX Agent TLS Settings](https://docs.nginx.com/nginx-agent/configuration/encrypt-communication/). -- For details on NGINX Plus entitlement and usage reporting, see [About subscription licenses]({{< relref "solutions/about-subscription-licenses.md" >}}).{{< /call-out >}} +- For details on NGINX Plus entitlement and usage reporting, see [About subscription licenses]({{< ref "solutions/about-subscription-licenses.md" >}}).{{< /call-out >}} --- @@ -63,7 +63,7 @@ server { ## Mutual Client Certificate Authentication Setup (mTLS) -Mutual TLS (mTLS) is a security method that uses client certificates to verify both the server and the client during communication. This ensures that both NGINX Instance Manager and NGINX Plus instances are securely authenticated, protecting your network from unauthorized access. +Mutual TLS (mTLS) is a security method that uses client certificates to verify both the server and the client during communication. This ensures that both NGINX Instance Manager and NGINX Plus instances are securely authenticated, protecting your network from unauthorized access. With mTLS, each NGINX instance has a unique client certificate that NGINX Instance Manager verifies before allowing communication. You can configure NGINX as a proxy to handle client certificates for this secure exchange. @@ -71,13 +71,13 @@ Follow these steps to set up mTLS using a Public Key Infrastructure (PKI) system ### Certificate Authority (CA) Setup -1. **Create a private Certificate Authority (CA)**: - - If you're testing, you can generate the CA on the same machine as NGINX Instance Manager. +1. **Create a private Certificate Authority (CA)**: + - If you're testing, you can generate the CA on the same machine as NGINX Instance Manager. - For production environments, follow your organization's security standards (these often require generating CAs on secure, offline machines). 2. **Set up root and intermediate CAs**: - The root CA issues certificates to an intermediate CA. The intermediate CA, in turn, issues certificates for clients and servers. This layered setup adds extra security by ensuring that the root CA is only used for top-level tasks. - + 3. **Issue Client and Server Certificates**: - The intermediate CA signs the certificate signing requests (CSRs) and issues certificates to NGINX clients and NGINX Instance Manager. @@ -471,7 +471,7 @@ To generate the necessary certificates, follow these steps. You can modify these Usage reporting for NGINX Plus R33 or later in network-restricted environments requires **NGINX Instance Manager version 2.18 or later**. {{}} -Starting with NGINX Plus R33, NGINX Plus must report usage data to a reporting endpoint, such as NGINX Instance Manager. For more information, see [About subscription licenses]({{< relref "solutions/about-subscription-licenses.md" >}}). +Starting with NGINX Plus R33, NGINX Plus must report usage data to a reporting endpoint, such as NGINX Instance Manager. For more information, see [About subscription licenses]({{< ref "solutions/about-subscription-licenses.md" >}}). The [`ssl_verify`](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_verify) directive in the [`mgmt`](https://nginx.org/en/docs/ngx_mgmt_module.html) block ensures that NGINX Plus connects only to trusted reporting endpoints by validating the server's SSL certificate. The `ssl_verify` directive is set to `on` by default. diff --git a/content/nim/troubleshooting.md b/content/nim/troubleshooting.md index 6feaceec3..74aa9cf5a 100644 --- a/content/nim/troubleshooting.md +++ b/content/nim/troubleshooting.md @@ -68,7 +68,7 @@ Ensure there isn't a process bound to port `80` or `443`. ### Description -When [scanning for NGINX instances]({{< relref "/nim/nginx-instances/scan-instances" >}}), the NGINX version is reported as `undefined` when NGINX App protect is installed. +When [scanning for NGINX instances]({{< ref "/nim/nginx-instances/scan-instances" >}}), the NGINX version is reported as `undefined` when NGINX App protect is installed. ### Resolution @@ -88,7 +88,7 @@ When Instance Manager is restarted, its internal API gateway may be assigned a n To update the NGINX Agent's configuration with the new Instance Manager IP address, run the NGINX Agent with the `--server-host` CLI parameter or edit the `nginx-agent.conf` file. Using the `--server-host` CLI parameter will ensure that the setting persists across restarts. -To learn more, refer to the [NGINX Agent documentation]({{< relref "/nms/nginx-agent/install-nginx-agent.md#nginx-agent-cli-flags-usage" >}}). +To learn more, refer to the [NGINX Agent documentation]({{< ref "/nms/nginx-agent/install-nginx-agent.md#nginx-agent-cli-flags-usage" >}}). --- diff --git a/content/nms/about.md b/content/nms/about.md index 1159cae2a..544c18e96 100644 --- a/content/nms/about.md +++ b/content/nms/about.md @@ -16,7 +16,7 @@ Explore the topics below to find out what the F5 NGINX Management Suite modules ## Instance Manager {#instance-manager} -[NGINX Instance Manager]({{< relref "/nim/">}}) allows you to configure, scale, and manage NGINX Open Source and NGINX Plus instances at scale. Instance Manager provides a [REST API]({{< relref "/nim/fundamentals/api-overview">}}) and web-based graphical user interface (GUI) for managing NGINX instances across multiple servers, making it easier to configure, monitor, and troubleshoot NGINX deployments. +[NGINX Instance Manager]({{< ref "/nim/">}}) allows you to configure, scale, and manage NGINX Open Source and NGINX Plus instances at scale. Instance Manager provides a [REST API]({{< ref "/nim/fundamentals/api-overview">}}) and web-based graphical user interface (GUI) for managing NGINX instances across multiple servers, making it easier to configure, monitor, and troubleshoot NGINX deployments. Instance Manager can be used to manage instances running on-premises, in the cloud, or in hybrid environments, and it supports the deployment of NGINX instances on a variety of operating systems and container platforms. @@ -26,13 +26,13 @@ Instance Manager also includes advanced features like health checks, rolling upd Instance Manager provides the following features: -- [View metrics and information]({{< relref "/nim/monitoring/view-events-metrics">}}) about data plane host systems and NGINX instances -- [View, edit, and publish NGINX configurations]({{< relref "/nim/nginx-configs/publish-configs">}}) -- [Save NGINX configurations]({{< relref "/nim/nginx-configs/publish-configs#stage-config">}}) for future deployment -- [Analyze NGINX configurations]({{< relref "/nim/nginx-configs/publish-configs">}}) for syntactic errors before publishing them -- [Scan the network]({{< relref "/nim/nginx-instances/scan-instances#scan-ui">}}) to find unmanaged NGINX instances. -- [Manage certificates]({{< relref "/nim/nginx-instances/manage-certificates">}}) -- [Create users, roles, and role permissions]({{< relref "/nim/admin-guide/rbac/overview-rbac">}}) for role-based access control +- [View metrics and information]({{< ref "/nim/monitoring/view-events-metrics">}}) about data plane host systems and NGINX instances +- [View, edit, and publish NGINX configurations]({{< ref "/nim/nginx-configs/publish-configs">}}) +- [Save NGINX configurations]({{< ref "/nim/nginx-configs/publish-configs#stage-config">}}) for future deployment +- [Analyze NGINX configurations]({{< ref "/nim/nginx-configs/publish-configs">}}) for syntactic errors before publishing them +- [Scan the network]({{< ref "/nim/nginx-instances/scan-instances#scan-ui">}}) to find unmanaged NGINX instances. +- [Manage certificates]({{< ref "/nim/nginx-instances/manage-certificates">}}) +- [Create users, roles, and role permissions]({{< ref "/nim/admin-guide/rbac/overview-rbac">}}) for role-based access control --- @@ -51,5 +51,5 @@ The Security Monitoring module provides the following features: ## What's Next? -- [Review the Technical Specifications]({{< relref "/nim/fundamentals/tech-specs.md">}}) -- [Install NGINX Management Suite]({{< relref "/nim/deploy/_index.md">}}) +- [Review the Technical Specifications]({{< ref "/nim/fundamentals/tech-specs.md">}}) +- [Install NGINX Management Suite]({{< ref "/nim/deploy/_index.md">}}) diff --git a/content/nms/acm/about/api-overview.md b/content/nms/acm/about/api-overview.md index 8c873cfa0..d3089ebce 100644 --- a/content/nms/acm/about/api-overview.md +++ b/content/nms/acm/about/api-overview.md @@ -43,7 +43,7 @@ To access the API Docs, take the steps below: API Connectivity Manager supports authentication by using basic authentication or a JSON Web Token (JWT). You can get a JWT by logging in with an OpenID Connect (OIDC) Identity Provider. -For more information about the available authentication options for NGINX Management Suite, refer to [Set Up Authentication]({{< relref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md" >}}). +For more information about the available authentication options for NGINX Management Suite, refer to [Set Up Authentication]({{< ref "/nim/admin-guide/authentication/basic-auth/set-up-basic-authentication.md" >}}). ### Basic Authentication diff --git a/content/nms/acm/about/introduction.md b/content/nms/acm/about/introduction.md index f9d8c79d9..fab861c3d 100644 --- a/content/nms/acm/about/introduction.md +++ b/content/nms/acm/about/introduction.md @@ -4,9 +4,9 @@ title: Introduction weight: 100 --- -[API Connectivity Manager]({{< relref "/nms/acm/">}}) enables self-service and automation of API delivery. API Connectivity Manager allows you to deploy, configure, secure, monitor, and govern API gateways at scale. +[API Connectivity Manager]({{< ref "/nms/acm/">}}) enables self-service and automation of API delivery. API Connectivity Manager allows you to deploy, configure, secure, monitor, and govern API gateways at scale. -The API Connectivity Manager module provides a [REST API]({{< relref "/nms/acm/about/api-overview">}}) that uses standard authentication methods, HTTP response codes, and verbs. +The API Connectivity Manager module provides a [REST API]({{< ref "/nms/acm/about/api-overview">}}) that uses standard authentication methods, HTTP response codes, and verbs. You can use the API Connectivity Manager API to connect, secure, and govern your APIs. In addition, API Connectivity Manager lets you separate infrastructure lifecycle management from the API lifecycle, allowing your IT/Ops teams and application developers to work independently. @@ -14,10 +14,10 @@ You can use the API Connectivity Manager API to connect, secure, and govern your The API Connectivity Manager module provides the following features: -- [Create and manage isolated workspaces]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#create-a-workspace">}}) -- [Create and manage API infrastructure]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-an-environment">}}) in isolated workspaces -- [Enforce uniform security policies]({{< relref "/nms/acm/how-to/policies/tls-policies.md" >}}) across workspaces using global policies -- [Create Developer Portals]({{< relref "/nms/acm/how-to/infrastructure/publish-developer-portal.md" >}}) with custom color themes, logos, and favicons -- [Onboard APIs to an API Gateway]({{< relref "/nms/acm/how-to/infrastructure/publish-developer-portal.md#add-an-api-doc" >}}) and [publish API documentation]({{< relref "/nms/acm/how-to/infrastructure/publish-developer-portal.md#publish-the-api-documentation-and-api-proxy" >}}) to the Developer Portal -- [Apply policies to API proxies]({{< relref "/nms/acm/how-to/policies/manage-policies.md#configure-proxy-policies" >}}) to provide custom quality of service for individual applications -- [Issue API keys]({{< relref "/nms/acm/how-to/infrastructure/enable-sso-devportal" >}}) or basic authentication credentials for access to the API +- [Create and manage isolated workspaces]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#create-a-workspace">}}) +- [Create and manage API infrastructure]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-an-environment">}}) in isolated workspaces +- [Enforce uniform security policies]({{< ref "/nms/acm/how-to/policies/tls-policies.md" >}}) across workspaces using global policies +- [Create Developer Portals]({{< ref "/nms/acm/how-to/infrastructure/publish-developer-portal.md" >}}) with custom color themes, logos, and favicons +- [Onboard APIs to an API Gateway]({{< ref "/nms/acm/how-to/infrastructure/publish-developer-portal.md#add-an-api-doc" >}}) and [publish API documentation]({{< ref "/nms/acm/how-to/infrastructure/publish-developer-portal.md#publish-the-api-documentation-and-api-proxy" >}}) to the Developer Portal +- [Apply policies to API proxies]({{< ref "/nms/acm/how-to/policies/manage-policies.md#configure-proxy-policies" >}}) to provide custom quality of service for individual applications +- [Issue API keys]({{< ref "/nms/acm/how-to/infrastructure/enable-sso-devportal" >}}) or basic authentication credentials for access to the API diff --git a/content/nms/acm/about/rbac-roles.md b/content/nms/acm/about/rbac-roles.md index db97de627..c42a585fa 100644 --- a/content/nms/acm/about/rbac-roles.md +++ b/content/nms/acm/about/rbac-roles.md @@ -17,7 +17,7 @@ API Connectivity Manager comes pre-configured with roles suitable for API Owners {{< include "acm/rbac/api-owner-role.md" >}} -{{}}The tutorial [Set Up RBAC for API Owners]({{< relref "/nms/acm/tutorials/rbac-api-owners.md">}}) provides an example of how to configure RBAC for API owners.{{}} +{{}}The tutorial [Set Up RBAC for API Owners]({{< ref "/nms/acm/tutorials/rbac-api-owners.md">}}) provides an example of how to configure RBAC for API owners.{{}}
@@ -25,4 +25,4 @@ API Connectivity Manager comes pre-configured with roles suitable for API Owners {{< include "acm/rbac/infra-admin-role.md" >}} -{{}}The tutorial [Set Up RBAC for Infra Admins]({{< relref "/nms/acm/tutorials/rbac-infra-admins.md">}}) provides an example of how to configure RBAC for Infrastructure Administrators.{{}} +{{}}The tutorial [Set Up RBAC for Infra Admins]({{< ref "/nms/acm/tutorials/rbac-infra-admins.md">}}) provides an example of how to configure RBAC for Infrastructure Administrators.{{}} diff --git a/content/nms/acm/about/technical-specifications.md b/content/nms/acm/about/technical-specifications.md index 0585a3605..6dc89dd94 100644 --- a/content/nms/acm/about/technical-specifications.md +++ b/content/nms/acm/about/technical-specifications.md @@ -8,7 +8,7 @@ weight: 200 {{< include "tech-specs/acm-nim-dependencies.md" >}} -{{< important >}} If you're [installing API Connectivity Manager in an offline environment]({{< relref "/nim/disconnected/offline-install-guide.md#install-acm-offline" >}}) and the minimum required version of Instance Manager is not installed, the API Connectivity Manager installer will exit. You'll need to [install Instance Manager manually]({{< relref "/nim/disconnected/offline-install-guide.md#install-nim-offline" >}}) before installing API Connectivity Manager.{{< /important >}} +{{< important >}} If you're [installing API Connectivity Manager in an offline environment]({{< ref "/nim/disconnected/offline-install-guide.md#install-acm-offline" >}}) and the minimum required version of Instance Manager is not installed, the API Connectivity Manager installer will exit. You'll need to [install Instance Manager manually]({{< ref "/nim/disconnected/offline-install-guide.md#install-nim-offline" >}}) before installing API Connectivity Manager.{{< /important >}} ### API Connectivity Manager Supported NGINX Versions {#acm-supported-nginx} diff --git a/content/nms/acm/getting-started/add-api-gateway.md b/content/nms/acm/getting-started/add-api-gateway.md index 18a4fe78e..05c2c2cce 100644 --- a/content/nms/acm/getting-started/add-api-gateway.md +++ b/content/nms/acm/getting-started/add-api-gateway.md @@ -16,7 +16,7 @@ These clusters are managed under **Infrastructure Workspaces** and are part of * ### Before You Begin -Before proceeding with this guide, you should familiarize yourself with the [API Overview]({{< relref "/nms/acm/about/api-overview" >}}) and the [Get Started]({{< relref "/nms/acm/getting-started/overview" >}}) section of this series. +Before proceeding with this guide, you should familiarize yourself with the [API Overview]({{< ref "/nms/acm/about/api-overview" >}}) and the [Get Started]({{< ref "/nms/acm/getting-started/overview" >}}) section of this series. ## Add an Infrastructure Workspace diff --git a/content/nms/acm/getting-started/add-devportal.md b/content/nms/acm/getting-started/add-devportal.md index e83ed5cf2..e209f982c 100644 --- a/content/nms/acm/getting-started/add-devportal.md +++ b/content/nms/acm/getting-started/add-devportal.md @@ -18,11 +18,11 @@ These clusters are managed under **Infrastructure Workspaces** and are part of * You should complete the following Quick Start Guide(s) before proceeding with the steps in this guide: -- [Configure an API Gateway]({{< relref "add-api-gateway" >}}) +- [Configure an API Gateway]({{< relref "./add-api-gateway" >}}) ## Add a Developer Portal -Complete the steps in this guide to add a Developer Portal to the Environment you created in the [previous guide]({{< relref "add-api-gateway" >}}). +Complete the steps in this guide to add a Developer Portal to the Environment you created in the [previous guide]({{< relref "./add-api-gateway" >}}). When a Developer Portal environment is created, the API Connectivity Manager configures a virtual server through which the developer portal service and API Connectivity Manager communicate. By default, the hostname for this server is the @@ -156,7 +156,7 @@ Next, open the Developer Portal in a browser window and make sure the portal loa In this step, you'll apply a set of customizations to the Developer Portal. Because these settings are applied at the Infrastructure level, they are considered "global", meaning they apply to each Dev Portal Proxy that you associate with the cluster. -{{}}Refer to [Customize the Developer Portal]({{< relref "/nms/acm/how-to/infrastructure/customize-devportal.md" >}}) to learn more about the available customization options and how to customize a Dev Portal via the API Connectivity Manager user interface.{{}} +{{}}Refer to [Customize the Developer Portal]({{< ref "/nms/acm/how-to/infrastructure/customize-devportal.md" >}}) to learn more about the available customization options and how to customize a Dev Portal via the API Connectivity Manager user interface.{{}} {{}} diff --git a/content/nms/acm/getting-started/overview.md b/content/nms/acm/getting-started/overview.md index 80200c86c..49e8ccb3d 100644 --- a/content/nms/acm/getting-started/overview.md +++ b/content/nms/acm/getting-started/overview.md @@ -40,9 +40,9 @@ By completing the guides in this Quick Start series, you can easily get up and r This series covers the following topics: -1. Setting up an environment with [API Gateway]({{< relref "add-api-gateway" >}}) & [Developer Portal]({{< relref "add-devportal" >}}) clusters. +1. Setting up an environment with [API Gateway]({{< relref "./add-api-gateway" >}}) & [Developer Portal]({{< ref "add-devportal" >}}) clusters. 2. Onboarding F5 NGINX Plus instances onto the clusters. -3. [Publishing an API proxy]({{< relref "publish-api-proxy" >}}) with or without an OpenAPI spec. +3. [Publishing an API proxy]({{< ref "publish-api-proxy" >}}) with or without an OpenAPI spec. --- @@ -50,8 +50,8 @@ This series covers the following topics: To complete the instructions in this series, you must meet the following requirements: -1. [Install API Connectivity Manager and Developer Portal]({{< relref "/nim/deploy/_index.md" >}}) on [separate hosts]({{< relref "tech-specs.md" >}}). -2. [Install a supported version of NGINX Plus]({{< relref "tech-specs.md" >}}) on one or more hosts to serve as the API Gateway. +1. [Install API Connectivity Manager and Developer Portal]({{< ref "/nim/deploy/_index.md" >}}) on [separate hosts]({{< ref "/nim/fundamentals/tech-specs.md" >}}). +2. [Install a supported version of NGINX Plus]({{< ref "/nim/fundamentals/tech-specs.md" >}}) on one or more hosts to serve as the API Gateway. 3. [Install the `njs` module](https://docs.nginx.com/nginx/admin-guide/dynamic-modules/nginscript/) on your NGINX data plane and Dev Portal hosts. 4. You have SSH access and `sudo` permissions for the NGINX data plane host(s). 5. You have an API Connectivity Manager user account with permission to READ, CREATE, UPDATE, and DELETE on the following API Connectivity Manager features: diff --git a/content/nms/acm/getting-started/publish-api-proxy.md b/content/nms/acm/getting-started/publish-api-proxy.md index 6e613aac7..77b9eda10 100644 --- a/content/nms/acm/getting-started/publish-api-proxy.md +++ b/content/nms/acm/getting-started/publish-api-proxy.md @@ -19,8 +19,8 @@ This guide provides instructions and examples for publishing an API and a Develo You should complete the following Quick Start Guides before proceeding with the steps in this guide: -1. [Set Up an API Gateway Environment]({{< relref "add-api-gateway" >}}) -1. [Set Up a Developer Portal Environment]({{< relref "add-devportal" >}}) +1. [Set Up an API Gateway Environment]({{< relref "./add-api-gateway" >}}) +1. [Set Up a Developer Portal Environment]({{< ref "add-devportal" >}}) ## Create a service workspace Services workspaces is a logical grouping of APIs. A user can created multiple workspaces that match an organizational structure. @@ -433,7 +433,7 @@ Take the steps below to add an API Proxy with an OpenAPI spec using either versi Next, you can publish API Docs to your Developer Portal. API Connectivity Manager uses the `portalConfig.hostname` setting to connect your Dev Portal Proxy to the Developer Portal. -You should define this field using the hostname that you assigned to the Developer Portal in the [Set Up a Developer Portal]({{< relref "add-devportal" >}}) guide. +You should define this field using the hostname that you assigned to the Developer Portal in the [Set Up a Developer Portal]({{< ref "add-devportal" >}}) guide. {{}} diff --git a/content/nms/acm/how-to/backup-recovery.md b/content/nms/acm/how-to/backup-recovery.md index 957e82830..77452a614 100644 --- a/content/nms/acm/how-to/backup-recovery.md +++ b/content/nms/acm/how-to/backup-recovery.md @@ -20,7 +20,7 @@ To complete the instructions in this guide, you need the following: - An installed version of Instance Manager - An installed version of API Connectivity Manager -- Instance Manager versions older than 2.15.0 will require an installed version of SQLite. Refer to the [Install SQLite]({{< relref "/nim/admin-guide/maintenance/sqlite-installation.md" >}}) guide for installation instructions. +- Instance Manager versions older than 2.15.0 will require an installed version of SQLite. Refer to the [Install SQLite]({{< ref "/nim/admin-guide/maintenance/sqlite-installation.md" >}}) guide for installation instructions. - The NGINX Management Suite services must be running: ```shell @@ -139,7 +139,7 @@ To complete the instructions in this guide, you need the following: - An installed version of NGINX Management Suite and Instance Manager - An installed version of API Connectivity Manager -- Instance Manager versions older than 2.15.0 will require an installed version of SQLite. Refer to the [Install SQLite]({{< relref "/nim/admin-guide/maintenance/sqlite-installation.md" >}}) guide for installation instructions. +- Instance Manager versions older than 2.15.0 will require an installed version of SQLite. Refer to the [Install SQLite]({{< ref "/nim/admin-guide/maintenance/sqlite-installation.md" >}}) guide for installation instructions. @@ -168,7 +168,7 @@ To complete the instructions in this guide, you need the following: To back up and restore NGINX Management Suite in a Kubernetes cluster, you need to install the `utility` pod in your Kubernetes cluster. For each module you want to back up and restore, you need to configure the `utility` pod accordingly: - 1. Update your [Helm Deployment values.yaml file]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}), add the `utility: true` line under `global` to enable the utility pod, and the required sections under `nmsModules` to back up and restore API Connectivity Manager. Example below: + 1. Update your [Helm Deployment values.yaml file]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}), add the `utility: true` line under `global` to enable the utility pod, and the required sections under `nmsModules` to back up and restore API Connectivity Manager. Example below: ```yaml global: @@ -179,7 +179,7 @@ To complete the instructions in this guide, you need the following: addClaimsToUtility: true ``` - 1. [Upgrade your NGINX Management Suite deployment]({{< relref "/nim/deploy/kubernetes/deploy-using-helm#helm-upgrade-nim" >}}) to apply the changes. + 1. [Upgrade your NGINX Management Suite deployment]({{< ref "/nim/deploy/kubernetes/deploy-using-helm#helm-upgrade-nim" >}}) to apply the changes. 1. Download the NGINX Management Suite Helm chart for your currently installed version of NGINX Management Suite: @@ -245,7 +245,7 @@ To restore NGINX Management Suite and the installed modules deployed in the same In the command above, `/etc/kubernetes/admin.conf` is the default configuration location of a Kubernetes cluster. If the configuration location is different for the target Kubernetes cluster, update the command accordingly. - {{< note >}}The restore script [needs root access]({{< relref "/nms/acm/how-to/backup-recovery.md#root-access" >}}) to Kubernetes for the restore operation.{{< /note >}} + {{< note >}}The restore script [needs root access]({{< ref "/nms/acm/how-to/backup-recovery.md#root-access" >}}) to Kubernetes for the restore operation.{{< /note >}} 1. The script will ask for the NGINX Management Suite namespace. Once the namespace has been provided, the script will use the specified backup archive. @@ -281,7 +281,7 @@ To restore NGINX Management Suite and the installed modules into a different Kub In the command above, `/etc/kubernetes/admin.conf` is the default configuration location of a Kubernetes cluster. If the configuration location is different for the target Kubernetes cluster, update the command accordingly. - {{< note >}}The restore script [needs root access]({{< relref "/nms/acm/how-to/backup-recovery.md#root-access" >}}) to Kubernetes for the restore operation.{{< /note >}} + {{< note >}}The restore script [needs root access]({{< ref "/nms/acm/how-to/backup-recovery.md#root-access" >}}) to Kubernetes for the restore operation.{{< /note >}} 1. The script will ask for the NGINX Management Suite namespace. Once the namespace has been provided, the script will use the specified backup archive. diff --git a/content/nms/acm/how-to/deploy-api-connectivity-manager.md b/content/nms/acm/how-to/deploy-api-connectivity-manager.md index 0647479df..b8a4a8352 100644 --- a/content/nms/acm/how-to/deploy-api-connectivity-manager.md +++ b/content/nms/acm/how-to/deploy-api-connectivity-manager.md @@ -17,7 +17,7 @@ Review the following requirements for API Connectivity Manager before continuing {{< important >}}To install API Connectivity Manager, you must first install Instance Manager. This is because API Connectivity Manager relies on features that are included with Instance Manager.{{< /important >}} -- [Deploy Instance Manager on Kubernetes]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}) +- [Deploy Instance Manager on Kubernetes]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}) ### Dependencies with Instance Manager @@ -161,7 +161,7 @@ To enable the API Connectivity Manager Module, take the following steps: Run the following command to upgrade the NGINX instance deployment: -- Replace `` with the path to the [values.yaml file you created]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}). +- Replace `` with the path to the [values.yaml file you created]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}). - Replace `YourPassword123#` with a secure password that contains a combination of uppercase and lowercase letters, numbers, and special characters. {{< important >}}Make sure to copy and save the password for future reference. Only the encrypted password is stored in Kubernetes. There's no way to recover or reset a lost password.{{< /important >}} @@ -198,7 +198,7 @@ If you've already deployed API Connectivity Manager and would like to upgrade to A valid license is required to make full use of all the features in API Connectivity Manager. -Refer to the [Add a License]({{< relref "/nim/admin-guide/license/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license. +Refer to the [Add a License]({{< ref "/nim/admin-guide/license/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license. --- @@ -224,8 +224,8 @@ To modify a configuration for an existing release, run the `helm upgrade` comman | `nms-acm.acm.resources.requests.memory` | Memory resource limits to allow for the `api` pods. | `512Mi` | | `nms-acm.acm.persistence.enabled` | Optionally disable persistent storage, used for database data. | `true` | | `nms-acm.acm.persistence.claims` | An array of persistent volume claims, can be modified to use an existing PVC. | See the [Dqlite](#acm-dqlite-configuration) configuration section below. | -| `nms-acm.acm.devportal.credentials.enabled` | Enables the [Create Credentials Endpoint on the Developer Portal]({{< relref "/nms/acm/how-to/infrastructure/enable-create-credentials.md" >}}) | `false` | -| `nms-acm.acm.devportal.credentials.ssl` | This should be set to true if mTLS has been configured between API Connectivity Manager and the Developer Portal, for more information see [Create Credentials Endpoint on the Developer Portal]({{< relref "/nms/acm/how-to/infrastructure/enable-create-credentials.md" >}}) | `false` | +| `nms-acm.acm.devportal.credentials.enabled` | Enables the [Create Credentials Endpoint on the Developer Portal]({{< ref "/nms/acm/how-to/infrastructure/enable-create-credentials.md" >}}) | `false` | +| `nms-acm.acm.devportal.credentials.ssl` | This should be set to true if mTLS has been configured between API Connectivity Manager and the Developer Portal, for more information see [Create Credentials Endpoint on the Developer Portal]({{< ref "/nms/acm/how-to/infrastructure/enable-create-credentials.md" >}}) | `false` | | `nms-acm.acm.devportal.client.caSecret.name` | This should be set if an unknown Certificate Authority is needed for communication with the Developer Portal in order to provide a CA certificate. This should be set to the name of the secret in the release namespace that contains the CA certificate. | Blank | | `nms-acm.acm.devportal.client.caSecret.key` | This should be set if an unknown Certificate Authority is needed for communication with the Developer Portal in order to provide a CA certificate. This should be set to the key of the secret in the release namespace that contains the CA certificate. | Blank | @@ -247,6 +247,6 @@ To modify a configuration for an existing release, run the `helm upgrade` comman -For guidance on how to create a support package containing system and service details to share with NGINX Customer Support, refer to the guide [Create a Support Package from a Helm Installation]({{< relref "/nms/support/k8s-support-package.md" >}}). +For guidance on how to create a support package containing system and service details to share with NGINX Customer Support, refer to the guide [Create a Support Package from a Helm Installation]({{< ref "/nms/support/k8s-support-package.md" >}}). --- diff --git a/content/nms/acm/how-to/devportals/devportal-support-package.md b/content/nms/acm/how-to/devportals/devportal-support-package.md index 09add8b2c..96bc5f35a 100644 --- a/content/nms/acm/how-to/devportals/devportal-support-package.md +++ b/content/nms/acm/how-to/devportals/devportal-support-package.md @@ -15,7 +15,7 @@ type: The support package script can be used to collect information about your system for troubleshooting and debugging issues. -The script collects system and service information and then packages the data into a tar archive, which you can share with [NGINX Customer Support]({{< relref "/nms/support/contact-support.md" >}}). +The script collects system and service information and then packages the data into a tar archive, which you can share with [NGINX Customer Support]({{< ref "/nms/support/contact-support.md" >}}). ## Usage diff --git a/content/nms/acm/how-to/devportals/installation/configure-devportal-helm-options.md b/content/nms/acm/how-to/devportals/installation/configure-devportal-helm-options.md index 95ff8679e..8a0056786 100644 --- a/content/nms/acm/how-to/devportals/installation/configure-devportal-helm-options.md +++ b/content/nms/acm/how-to/devportals/installation/configure-devportal-helm-options.md @@ -13,7 +13,7 @@ type: ## Default Developer Portal Helm Settings {#default-devportal-helm-settings} -This topic lists the default values that are used when [installing the Developer Portal from a Helm chart]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}). You can change these values to meet your specific needs. +This topic lists the default values that are used when [installing the Developer Portal from a Helm chart]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}). You can change these values to meet your specific needs. {{< include "installation/helm/acm/dev-portal-helm-configurations/configuration-options.md" >}} diff --git a/content/nms/acm/how-to/devportals/installation/devportal-helm-chart.md b/content/nms/acm/how-to/devportals/installation/devportal-helm-chart.md index e01e40848..4ac539659 100644 --- a/content/nms/acm/how-to/devportals/installation/devportal-helm-chart.md +++ b/content/nms/acm/how-to/devportals/installation/devportal-helm-chart.md @@ -31,7 +31,7 @@ To complete the steps in this section, you need the following: - Take a few minutes to review the [Configurable Helm Settings](#configuration-options) at the end of this topic. You can change these settings to customize your installation to meet your needs. -- Check out the [Deployment Patterns for Developer Portal]({{< relref "/nms/acm/how-to/infrastructure/configure-devportal-backend.md" >}}) topic if you're considering installing the Developer Portal on a single host or on a cluster for high availability. +- Check out the [Deployment Patterns for Developer Portal]({{< ref "/nms/acm/how-to/infrastructure/configure-devportal-backend.md" >}}) topic if you're considering installing the Developer Portal on a single host or on a cluster for high availability. {{}} diff --git a/content/nms/acm/how-to/devportals/installation/install-dev-portal.md b/content/nms/acm/how-to/devportals/installation/install-dev-portal.md index a0e557c75..aee4305b4 100644 --- a/content/nms/acm/how-to/devportals/installation/install-dev-portal.md +++ b/content/nms/acm/how-to/devportals/installation/install-dev-portal.md @@ -211,7 +211,7 @@ echo 'DB_PATH="/var/lib/nginx-devportal"' | sudo tee -a /etc/nginx-devportal/dev ## Secure Developer Portal API communication -Depending on your [deployment pattern for the Developer Portal]({{< relref "/nms/acm/how-to/infrastructure/configure-devportal-backend.md" >}}), you may have either a single host installation(default) or a multi-host installation for high availability. We recommend using mTLS for the communication between the NGINX reverse proxy and the Developer Portal APIs to provide maximum security. +Depending on your [deployment pattern for the Developer Portal]({{< ref "/nms/acm/how-to/infrastructure/configure-devportal-backend.md" >}}), you may have either a single host installation(default) or a multi-host installation for high availability. We recommend using mTLS for the communication between the NGINX reverse proxy and the Developer Portal APIs to provide maximum security. 1. On the Developer Portal Service host or hosts, edit the Dev Portal configuration file located at `/etc/nginx-devportal/devportal.conf` 1. Add the location of the server certificate and certificate key, as shown in the example below. @@ -235,7 +235,7 @@ Depending on your [deployment pattern for the Developer Portal]({{< relref "/nms - The Developer Portal Cluster (Used for communication from users to the Developer Portal API) - The Developer Portal Internal Cluster (For communication from the API Connectivity Manager to your Devportal Portal API to publish and maintain information) {{< note >}} -To add a TLS Backend Policy to both clusters. Follow the [TLS Policies]({{< relref "/nms/acm/how-to/policies/tls-policies.md#add-tls-listener" >}}) documentation. +To add a TLS Backend Policy to both clusters. Follow the [TLS Policies]({{< ref "/nms/acm/how-to/policies/tls-policies.md#add-tls-listener" >}}) documentation. {{< /note >}} --- @@ -261,4 +261,4 @@ Follow the steps below to make sure NGINX Management Suite host can verify the c sudo nginx -s reload ``` -1. Follow the steps in the [TLS Policies]({{< relref "/nms/acm/how-to/policies/tls-policies.md#/#tls-internal-cluster" >}}) documentation to add TLS policies that will enforce mTLS using these the correct client keys to connect to the NGINX Management Suite host. +1. Follow the steps in the [TLS Policies]({{< ref "/nms/acm/how-to/policies/tls-policies.md#/#tls-internal-cluster" >}}) documentation to add TLS policies that will enforce mTLS using these the correct client keys to connect to the NGINX Management Suite host. diff --git a/content/nms/acm/how-to/devportals/publish-to-devportal.md b/content/nms/acm/how-to/devportals/publish-to-devportal.md index 8b993c62a..8e81b40e2 100644 --- a/content/nms/acm/how-to/devportals/publish-to-devportal.md +++ b/content/nms/acm/how-to/devportals/publish-to-devportal.md @@ -24,9 +24,9 @@ This document will guide you through the process of publishing API documentation To complete the steps in this guide, you need the following: -- [API Connectivity Manager is installed]({{< relref "/nim/deploy/_index.md" >}}) and running -- One or more environments with a [configured Developer Portal]({{< relref "/nms/acm/getting-started/add-devportal.md" >}}) -- (Optional) [Customize the Developer Portal]({{< relref "/nms/acm/how-to/infrastructure/customize-devportal.md" >}}) +- [API Connectivity Manager is installed]({{< ref "/nim/deploy/_index.md" >}}) and running +- One or more environments with a [configured Developer Portal]({{< ref "/nms/acm/getting-started/add-devportal.md" >}}) +- (Optional) [Customize the Developer Portal]({{< ref "/nms/acm/how-to/infrastructure/customize-devportal.md" >}}) --- diff --git a/content/nms/acm/how-to/infrastructure/configure-devportal-backend.md b/content/nms/acm/how-to/infrastructure/configure-devportal-backend.md index 49e469db2..47b90144b 100644 --- a/content/nms/acm/how-to/infrastructure/configure-devportal-backend.md +++ b/content/nms/acm/how-to/infrastructure/configure-devportal-backend.md @@ -25,7 +25,7 @@ The following deployment patterns are supported: Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with a [Developer Portal]({{< relref "/nms/acm/getting-started/add-devportal" >}}) cluster. +- You have one or more Environments with a [Developer Portal]({{< ref "/nms/acm/getting-started/add-devportal" >}}) cluster. - You have verified that you can access the Developer Portal using the configured hostname. ### How to Access the User Interface diff --git a/content/nms/acm/how-to/infrastructure/customize-devportal.md b/content/nms/acm/how-to/infrastructure/customize-devportal.md index 9fde11aaf..342c753d1 100644 --- a/content/nms/acm/how-to/infrastructure/customize-devportal.md +++ b/content/nms/acm/how-to/infrastructure/customize-devportal.md @@ -19,7 +19,7 @@ You can customize the Dev Portal website's landing page, All APIs page, and Docs Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with a [Developer Portal]({{< relref "/nms/acm/getting-started/add-devportal" >}}) cluster. +- You have one or more Environments with a [Developer Portal]({{< ref "/nms/acm/getting-started/add-devportal" >}}) cluster. - You have verified that you can access the Developer Portal using the configured hostname. ### How to Access the User Interface diff --git a/content/nms/acm/how-to/infrastructure/enable-create-credentials.md b/content/nms/acm/how-to/infrastructure/enable-create-credentials.md index 3043fb385..1afcaa341 100644 --- a/content/nms/acm/how-to/infrastructure/enable-create-credentials.md +++ b/content/nms/acm/how-to/infrastructure/enable-create-credentials.md @@ -40,7 +40,7 @@ API Connectivity manager supports public API workflows. Public APIs are open for To complete the steps in this guide, you need to the following: - API Connectivity Manager is installed, licensed, and running. -- You have one or more environments with [API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}) or [Dev Portal]({{< relref "/nms/acm/getting-started/add-devportal" >}}) clusters. +- You have one or more environments with [API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}) or [Dev Portal]({{< ref "/nms/acm/getting-started/add-devportal" >}}) clusters. ### How to Access the User Interface @@ -71,7 +71,7 @@ As mTLS is not enabled by default, the Credentials endpoint is disabled initiall To enable the Credentials endpoint on the API Connectivity Manager host, take the following steps: -1. Make sure mTLS server and client certificates have been configured for Devportal to F5 NGINX Management Suite by following these [instructions]({{< relref "/nms/acm/how-to/devportals/installation/install-dev-portal.md#secure-communication-from-the-developer-portal-to-nginx-management-suite-host-with-mtls" >}}) to add your server certs, CA file and enforce mTLS. +1. Make sure mTLS server and client certificates have been configured for Devportal to F5 NGINX Management Suite by following these [instructions]({{< ref "/nms/acm/how-to/devportals/installation/install-dev-portal.md#secure-communication-from-the-developer-portal-to-nginx-management-suite-host-with-mtls" >}}) to add your server certs, CA file and enforce mTLS. 1. Open an SSH connection into the API Connectivity Manager host and log in. @@ -106,7 +106,7 @@ To enable the Credentials endpoint on the API Connectivity Manager host, take th ### Enable SSO on the Developer Portal -1. Follow the instructions to [enable single sign-on (SSO) for the Developer Portal]({{< relref "/nms/acm/how-to/infrastructure/enable-sso-devportal.md" >}}) with an OIDC policy. +1. Follow the instructions to [enable single sign-on (SSO) for the Developer Portal]({{< ref "/nms/acm/how-to/infrastructure/enable-sso-devportal.md" >}}) with an OIDC policy. ### Publish and Secure the API Proxy diff --git a/content/nms/acm/how-to/infrastructure/enable-sso-devportal.md b/content/nms/acm/how-to/infrastructure/enable-sso-devportal.md index 9cbe9f323..4d1595d06 100644 --- a/content/nms/acm/how-to/infrastructure/enable-sso-devportal.md +++ b/content/nms/acm/how-to/infrastructure/enable-sso-devportal.md @@ -39,8 +39,8 @@ Single sign-on is enabled by applying an OpenID Connect (OIDC) policy on the Dev Complete the following prerequisites before proceeding with this guide: -- API Connectivity Manager is installed, licensed, and running. See [API Connectivity Manager Install Guide]({{< relref "/nim/deploy/_index.md" >}}). -- You have one or more Environments with [API Gateways]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}) or [Developer Portals]({{< relref "/nms/acm/getting-started/add-devportal" >}}). +- API Connectivity Manager is installed, licensed, and running. See [API Connectivity Manager Install Guide]({{< ref "/nim/deploy/_index.md" >}}). +- You have one or more Environments with [API Gateways]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}) or [Developer Portals]({{< ref "/nms/acm/getting-started/add-devportal" >}}). ### Terminology diff --git a/content/nms/acm/how-to/infrastructure/manage-api-infrastructure.md b/content/nms/acm/how-to/infrastructure/manage-api-infrastructure.md index ac9db37c6..2b6c2d5a9 100644 --- a/content/nms/acm/how-to/infrastructure/manage-api-infrastructure.md +++ b/content/nms/acm/how-to/infrastructure/manage-api-infrastructure.md @@ -25,7 +25,7 @@ Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, running, and licensed. - You have SSH access to the host where API Connectivity Manager is running and can use the `sudo` command. -- You have installed a [supported version]({{< ref "tech-specs" >}}) of F5 NGINX Plus on each host that you want to add to a Cluster. +- You have installed a [supported version]({{< ref "/nim/fundamentals/tech-specs.md" >}}) of F5 NGINX Plus on each host that you want to add to a Cluster. - You know the IP address or FQDN for each host that you want to add to a cluster. - You have SSH access to each of the hosts that you want to allocate to a cluster and can use the `sudo` command. - You have installed the [`njs`](https://docs.nginx.com/nginx/admin-guide/dynamic-modules/nginscript/) module on each host that you want to add to the cluster. @@ -160,7 +160,7 @@ Take the steps below to add an Environment. {{}} ## Onboard an NGINX Instance {#register-nginx-instance} -[Install the NGINX Agent]({{< relref "/nms/nginx-agent/install-nginx-agent" >}}) on each host to register the instance with API Connectivity Manager as part of the cluster. +[Install the NGINX Agent]({{< ref "/nms/nginx-agent/install-nginx-agent" >}}) on each host to register the instance with API Connectivity Manager as part of the cluster. Take the steps below to add an NGINX instance to an API Gateway. diff --git a/content/nms/acm/how-to/infrastructure/publish-developer-portal.md b/content/nms/acm/how-to/infrastructure/publish-developer-portal.md index 333af3171..34dc99020 100644 --- a/content/nms/acm/how-to/infrastructure/publish-developer-portal.md +++ b/content/nms/acm/how-to/infrastructure/publish-developer-portal.md @@ -13,7 +13,7 @@ type: ## Overview -You can use API Connectivity Manager to create and publish Developer Portals (or, "Dev Portals") to host your APIs and documentation. API Connectivity Manager Dev Portals provide a [framework for customization]({{< relref "/nms/acm/how-to/infrastructure/customize-devportal.md" >}}) that lets you match your Dev Portal to your brand's or business' requirements. +You can use API Connectivity Manager to create and publish Developer Portals (or, "Dev Portals") to host your APIs and documentation. API Connectivity Manager Dev Portals provide a [framework for customization]({{< ref "/nms/acm/how-to/infrastructure/customize-devportal.md" >}}) that lets you match your Dev Portal to your brand's or business' requirements. You can also modify and delete your Developer Portals using API Connectivity Manager. @@ -22,7 +22,7 @@ You can also modify and delete your Developer Portals using API Connectivity Man Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- Your [Infrastructure]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md" >}}) has one or more Environments with a [Developer Portal]({{< relref "/nms/acm/getting-started/add-devportal" >}}) cluster. +- Your [Infrastructure]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md" >}}) has one or more Environments with a [Developer Portal]({{< ref "/nms/acm/getting-started/add-devportal" >}}) cluster. - You have verified that you can access the Developer Portal using the configured hostname. diff --git a/content/nms/acm/how-to/install-acm-offline.md b/content/nms/acm/how-to/install-acm-offline.md index d164d3585..690520ea9 100644 --- a/content/nms/acm/how-to/install-acm-offline.md +++ b/content/nms/acm/how-to/install-acm-offline.md @@ -135,7 +135,7 @@ To upgrade API Connectivity Manager to a newer version, take the following steps sudo systemctl restart nginx ``` -6. (Optional) If you use SELinux, follow the steps in the [Configure SELinux]({{< relref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts (`restorecon`) for the files and directories related to NGINX Management Suite. +6. (Optional) If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore SELinux contexts (`restorecon`) for the files and directories related to NGINX Management Suite. ### Set Up the Data Plane {#acm-offline-dependencies} diff --git a/content/nms/acm/how-to/install-acm.md b/content/nms/acm/how-to/install-acm.md index ad799099e..3aa0e760f 100644 --- a/content/nms/acm/how-to/install-acm.md +++ b/content/nms/acm/how-to/install-acm.md @@ -81,13 +81,13 @@ type: A valid license is required to make full use of all the features in API Connectivity Manager. -Refer to the [Add a License]({{< relref "/nim/admin-guide/license/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license. +Refer to the [Add a License]({{< ref "/nim/admin-guide/license/add-license.md" >}}) topic for instructions on how to download and apply a trial license, subscription license, or Flexible Consumption Program license. --- ## Upgrade API Connectivity Manager {#upgrade-acm} -{{}}When you confirm the upgrade, the upgrade process will automatically upgrade dependent packages as needed, including Instance Manager. If you prefer to [back up NGINX Management Suite]({{< relref "/nim/admin-guide/maintenance/backup-and-recovery.md" >}}) before upgrading, you can cancel the upgrade when prompted.{{}} +{{}}When you confirm the upgrade, the upgrade process will automatically upgrade dependent packages as needed, including Instance Manager. If you prefer to [back up NGINX Management Suite]({{< ref "/nim/admin-guide/maintenance/backup-and-recovery.md" >}}) before upgrading, you can cancel the upgrade when prompted.{{}}
@@ -134,7 +134,7 @@ Refer to the [Add a License]({{< relref "/nim/admin-guide/license/add-license.md sudo systemctl restart nginx ``` -5. (Optional) If you use SELinux, follow the steps in the [Configure SELinux]({{< relref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore the default SELinux labels (`restorecon`) for the files and directories related to NGINX Management Suite. +5. (Optional) If you use SELinux, follow the steps in the [Configure SELinux]({{< ref "/nim/system-configuration/configure-selinux.md" >}}) guide to restore the default SELinux labels (`restorecon`) for the files and directories related to NGINX Management Suite. --- ## What's Next @@ -147,12 +147,12 @@ Complete the following steps for each data plane instance you want to use with A 1. [Install NGINX Plus R24 or later](https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-plus/) 2. [Install NGINX njs module](https://docs.nginx.com/nginx/admin-guide/dynamic-modules/nginscript/) -3. [Install the NGINX Agent]({{< relref "/nms/nginx-agent/install-nginx-agent.md" >}}) on your data plane instances to register them with NGINX Management Suite. +3. [Install the NGINX Agent]({{< ref "/nms/nginx-agent/install-nginx-agent.md" >}}) on your data plane instances to register them with NGINX Management Suite. ### Install the Developer Portal -- [Install the Developer Portal]({{< relref "/nms/acm/how-to/devportals/installation/install-dev-portal.md" >}}) +- [Install the Developer Portal]({{< ref "/nms/acm/how-to/devportals/installation/install-dev-portal.md" >}}) ### Get Started with API Connectivity Manager -- [Create Workspaces and Environments for your API Infrastructure]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md" >}}) +- [Create Workspaces and Environments for your API Infrastructure]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md" >}}) diff --git a/content/nms/acm/how-to/policies/access-control-routing.md b/content/nms/acm/how-to/policies/access-control-routing.md index 03101c632..dbac16e74 100644 --- a/content/nms/acm/how-to/policies/access-control-routing.md +++ b/content/nms/acm/how-to/policies/access-control-routing.md @@ -20,8 +20,8 @@ type: Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with [API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}) or [Dev Portal]({{< relref "/nms/acm/getting-started/add-devportal" >}}) clusters. -- You have published one or more [API Gateways or Developer Portals]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}) with either JSON Web Token Assertion or OAuth2 Introspection enabled. +- You have one or more Environments with [API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}) or [Dev Portal]({{< ref "/nms/acm/getting-started/add-devportal" >}}) clusters. +- You have published one or more [API Gateways or Developer Portals]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}) with either JSON Web Token Assertion or OAuth2 Introspection enabled. ### How to Access the User Interface diff --git a/content/nms/acm/how-to/policies/advanced-security.md b/content/nms/acm/how-to/policies/advanced-security.md index 69abe2942..a9c5b2b0f 100644 --- a/content/nms/acm/how-to/policies/advanced-security.md +++ b/content/nms/acm/how-to/policies/advanced-security.md @@ -33,9 +33,9 @@ This will allow enforcement of rules to *Block* or *Monitor* security events tri To complete the steps in this guide, you need the following: - API Connectivity Manager is installed, licensed, and running. -- You have one or more [Environments with an API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}). -- You have [published one or more API Gateways]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}). -- You have [installed and set up NGINX App Protect]({{< relref "/nap-waf/v4/admin-guide/install-nms" >}}). +- You have one or more [Environments with an API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}). +- You have [published one or more API Gateways]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}). +- You have [installed and set up NGINX App Protect]({{< ref "/nap-waf/v4/admin-guide/install-nms" >}}). --- @@ -51,7 +51,7 @@ To create a new policy or modify an existing policy, you can navigate to the *Ap For information on how to configure an *App Protect* policy, please visit - [Configure NGINX App Protect WAF](https://docs.nginx.com/nginx-app-protect/configuration-guide/configuration/#policy-configuration-overview) -To create an NGINX App Protect WAF policy to use in your Advanced Security policy, please see the [Create a Policy]({{< relref "/nim/nginx-app-protect/manage-waf-security-policies#create-security-policy" >}}) documentation. +To create an NGINX App Protect WAF policy to use in your Advanced Security policy, please see the [Create a Policy]({{< ref "/nim/nginx-app-protect/manage-waf-security-policies#create-security-policy" >}}) documentation. {{< /note >}} --- diff --git a/content/nms/acm/how-to/policies/allowed-http-methods.md b/content/nms/acm/how-to/policies/allowed-http-methods.md index a6f186ace..7107e1582 100644 --- a/content/nms/acm/how-to/policies/allowed-http-methods.md +++ b/content/nms/acm/how-to/policies/allowed-http-methods.md @@ -30,8 +30,8 @@ Use the *Allowed HTTP Methods* policy to specify which methods you want to allow To complete the steps in this guide, you need the following: - API Connectivity Manager is installed, licensed, and running. -- You have one or more [Environments with an API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}). -- You have [published one or more API Gateways]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}). +- You have one or more [Environments with an API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}). +- You have [published one or more API Gateways]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}). --- diff --git a/content/nms/acm/how-to/policies/api-access-control-lists.md b/content/nms/acm/how-to/policies/api-access-control-lists.md index bbfd54874..d8f995ab5 100644 --- a/content/nms/acm/how-to/policies/api-access-control-lists.md +++ b/content/nms/acm/how-to/policies/api-access-control-lists.md @@ -18,8 +18,8 @@ title: API Access Control Lists Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with [API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}) or [Dev Portal]({{< relref "/nms/acm/getting-started/add-devportal" >}}) clusters. -- You have published one or more [API Gateways or Developer]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}) +- You have one or more Environments with [API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}) or [Dev Portal]({{< ref "/nms/acm/getting-started/add-devportal" >}}) clusters. +- You have published one or more [API Gateways or Developer]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}) ### How to Access the User Interface diff --git a/content/nms/acm/how-to/policies/apikey-authn.md b/content/nms/acm/how-to/policies/apikey-authn.md index 57a51c0dd..629ad56b1 100644 --- a/content/nms/acm/how-to/policies/apikey-authn.md +++ b/content/nms/acm/how-to/policies/apikey-authn.md @@ -32,8 +32,8 @@ API Connectivity Manager API owners can restrict access to their APIs with API k Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with an [API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}). -- You have published one or more [API Gateways]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}) +- You have one or more Environments with an [API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}). +- You have published one or more [API Gateways]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}) ### How to Access the User Interface diff --git a/content/nms/acm/how-to/policies/basic-authn.md b/content/nms/acm/how-to/policies/basic-authn.md index d89997ca3..f14e04dc1 100644 --- a/content/nms/acm/how-to/policies/basic-authn.md +++ b/content/nms/acm/how-to/policies/basic-authn.md @@ -32,8 +32,8 @@ API Connectivity Manager API owners can restrict access to their APIs with usern Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with an [API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}). -- You have published one or more [API Gateways]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}) +- You have one or more Environments with an [API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}). +- You have published one or more [API Gateways]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}) ### How to Access the User Interface diff --git a/content/nms/acm/how-to/policies/cluster-zone-sync.md b/content/nms/acm/how-to/policies/cluster-zone-sync.md index 6a880cdf1..25b2eadc8 100644 --- a/content/nms/acm/how-to/policies/cluster-zone-sync.md +++ b/content/nms/acm/how-to/policies/cluster-zone-sync.md @@ -394,7 +394,7 @@ Confirm that the policy has been set up and configured correctly by taking these ## Troubleshooting -For help resolving common issues when setting up and configuring the policy, follow the steps in this section. If you cannot find a solution to your specific issue, reach out to [NGINX Customer Support]({{< relref "/nms/support/contact-support.md" >}}) for assistance. +For help resolving common issues when setting up and configuring the policy, follow the steps in this section. If you cannot find a solution to your specific issue, reach out to [NGINX Customer Support]({{< ref "/nms/support/contact-support.md" >}}) for assistance. ### Issue 1 diff --git a/content/nms/acm/how-to/policies/cors.md b/content/nms/acm/how-to/policies/cors.md index fe97ecc65..a06a60c09 100644 --- a/content/nms/acm/how-to/policies/cors.md +++ b/content/nms/acm/how-to/policies/cors.md @@ -30,8 +30,8 @@ The CORS policy allows users to configure API Gateways to set the required heade To complete the steps in this guide, you need the following: - API Connectivity Manager is installed, licensed, and running. -- An [API gateway environment]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}) -- A [published API Gateway]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}) +- An [API gateway environment]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}) +- A [published API Gateway]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}) --- diff --git a/content/nms/acm/how-to/policies/error-response-format.md b/content/nms/acm/how-to/policies/error-response-format.md index 6d0a35904..5351886d7 100644 --- a/content/nms/acm/how-to/policies/error-response-format.md +++ b/content/nms/acm/how-to/policies/error-response-format.md @@ -32,7 +32,7 @@ The Error Response Format policy is applied by default to any new environment. To apply the policy or make changes to it, follow these steps: -- [Edit an existing environment or create a new one]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). +- [Edit an existing environment or create a new one]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). - Review the advanced settings for the environment to confirm if the policy has been applied. - Edit the policy to make changes for each environment. Save and publish the changes. diff --git a/content/nms/acm/how-to/policies/grpc-policies.md b/content/nms/acm/how-to/policies/grpc-policies.md index 5e111fc34..67f130e5c 100644 --- a/content/nms/acm/how-to/policies/grpc-policies.md +++ b/content/nms/acm/how-to/policies/grpc-policies.md @@ -15,7 +15,7 @@ type: {{< include "acm/how-to/policies-intro.md" >}} -Refer to the [Set Up Policies]({{< relref "/nms/acm/how-to/policies/manage-policies.md" >}}) topic for instructions on how to configure policies for your API Gateway and Developer Portal clusters and API Proxies. +Refer to the [Set Up Policies]({{< ref "/nms/acm/how-to/policies/manage-policies.md" >}}) topic for instructions on how to configure policies for your API Gateway and Developer Portal clusters and API Proxies. --- diff --git a/content/nms/acm/how-to/policies/health-check.md b/content/nms/acm/how-to/policies/health-check.md index 4faf0f2f9..eff95cb71 100644 --- a/content/nms/acm/how-to/policies/health-check.md +++ b/content/nms/acm/how-to/policies/health-check.md @@ -36,8 +36,8 @@ More information on NGINX health checks can be found at: To complete the steps in this guide, you need the following: - API Connectivity Manager is installed, licensed, and running -- You have [one or more Environments with an API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway.md" >}}) -- You have [published one or more API Gateways]({{< relref "/nms/acm/getting-started/publish-api-proxy.md" >}}) +- You have [one or more Environments with an API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway.md" >}}) +- You have [published one or more API Gateways]({{< ref "/nms/acm/getting-started/publish-api-proxy.md" >}}) - Your backend service(s) has an HTTP health check endpoint and/or can return status codes in the range from 200 through 399 for health check requests. ### Policy Settings @@ -196,8 +196,8 @@ Confirm that the policy has been set up and configured correctly by taking these To complete the steps in this guide, you need the following: - API Connectivity Manager is installed, licensed, and running -- You have [one or more Environments with a gRPC API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway.md" >}}) -- You have [published one or more gRPC API Gateways]({{< relref "/nms/acm/how-to/services/publish-grpc-proxy.md" >}}) +- You have [one or more Environments with a gRPC API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway.md" >}}) +- You have [published one or more gRPC API Gateways]({{< ref "/nms/acm/how-to/services/publish-grpc-proxy.md" >}}) - Your backend service(s) implements the [gRPC health checking protocol](https://github.com/grpc/grpc/blob/master/doc/health-checking.md#grpc-health-checking-protocol) and/or returns a status code (normally `12` for `unimplemented`) for health check requests. ### Policy Settings diff --git a/content/nms/acm/how-to/policies/http-backend-configuration.md b/content/nms/acm/how-to/policies/http-backend-configuration.md index d3afba4da..fdf1100b4 100644 --- a/content/nms/acm/how-to/policies/http-backend-configuration.md +++ b/content/nms/acm/how-to/policies/http-backend-configuration.md @@ -42,8 +42,8 @@ Later sections of this guide will cover each of these areas in turn. Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with an [API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}). -- You have published one or more [API Gateways]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}) +- You have one or more Environments with an [API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}). +- You have published one or more [API Gateways]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}) --- @@ -51,7 +51,7 @@ Complete the following prerequisites before proceeding with this guide: To apply the policy or make changes to it, here's what you need to do: -- [Edit an existing environment or create a new one]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). +- [Edit an existing environment or create a new one]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). - Check the advanced settings for the environment to see if the policy has been applied. - Edit the policy to make changes for each environment. Save and publish the changes. diff --git a/content/nms/acm/how-to/policies/jwt-assertion.md b/content/nms/acm/how-to/policies/jwt-assertion.md index d8333220e..ab3ec974d 100644 --- a/content/nms/acm/how-to/policies/jwt-assertion.md +++ b/content/nms/acm/how-to/policies/jwt-assertion.md @@ -68,8 +68,8 @@ A JWT is considered to be valid when the following conditions are met: Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with an [API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}). -- You have published one or more [API Gateways]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}) +- You have one or more Environments with an [API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}). +- You have published one or more [API Gateways]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}) ### How to Access the User Interface diff --git a/content/nms/acm/how-to/policies/log-format.md b/content/nms/acm/how-to/policies/log-format.md index bab1e1737..76c9be6fe 100644 --- a/content/nms/acm/how-to/policies/log-format.md +++ b/content/nms/acm/how-to/policies/log-format.md @@ -30,7 +30,7 @@ The Log Format policy enables Infrastructure Admins to set the format for access To apply the policy or make changes to it, here's what you need to do: -- [Edit an existing environment or create a new one]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). +- [Edit an existing environment or create a new one]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). - Check the advanced settings for the environment to see if the policy has been applied. - Edit the policy to make changes for each environment. Save and publish the changes. diff --git a/content/nms/acm/how-to/policies/manage-policies.md b/content/nms/acm/how-to/policies/manage-policies.md index a47949481..ddfb9b6e0 100644 --- a/content/nms/acm/how-to/policies/manage-policies.md +++ b/content/nms/acm/how-to/policies/manage-policies.md @@ -22,7 +22,7 @@ type: Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with [API Gateways]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}) or [Developer Portals]({{< relref "/nms/acm/getting-started/add-devportal" >}}). +- You have one or more Environments with [API Gateways]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}) or [Developer Portals]({{< ref "/nms/acm/getting-started/add-devportal" >}}). ### How to Access the User Interface @@ -135,8 +135,8 @@ The following table shows the available Cluster Policies you can use when creati | Policy Name | HTTP Environment | gRPC Environment | Applied On | Description | |-------------------------------------------------------------------|-------------------------------------------------|-------------------------------------------------|-----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [Cluster Wide Config Setting]({{< relref "/nms/acm/how-to/policies/cluster-wide-config.md" >}}) | | | inbound | Fine tune the settings to speed up data processing and improve the performance of the API proxy for large number of connections. When applied, the settings are applicable to all the instances in a proxy cluster. If the proxy cluster is shared between environments, the changes made in any environment will be reflected in all the other environments. | -| [Cluster Zone Sync]({{< relref "/nms/acm/how-to/policies/cluster-zone-sync.md" >}}) | | | inbound | Enables runtime state sharing between the instances belonging to a proxy cluster. Options configured through this policy affect other policies such as rate limit and OIDC. This policy is applied to all the instances in a proxy cluster. If the proxy cluster is shared between environments, any changes made to this policy will affect all the other environments. | +| [Cluster Wide Config Setting]({{< ref "/nms/acm/how-to/policies/cluster-wide-config.md" >}}) | | | inbound | Fine tune the settings to speed up data processing and improve the performance of the API proxy for large number of connections. When applied, the settings are applicable to all the instances in a proxy cluster. If the proxy cluster is shared between environments, the changes made in any environment will be reflected in all the other environments. | +| [Cluster Zone Sync]({{< ref "/nms/acm/how-to/policies/cluster-zone-sync.md" >}}) | | | inbound | Enables runtime state sharing between the instances belonging to a proxy cluster. Options configured through this policy affect other policies such as rate limit and OIDC. This policy is applied to all the instances in a proxy cluster. If the proxy cluster is shared between environments, any changes made to this policy will affect all the other environments. | {{}} diff --git a/content/nms/acm/how-to/policies/openID-connect.md b/content/nms/acm/how-to/policies/openID-connect.md index 97bab246a..478215f6b 100644 --- a/content/nms/acm/how-to/policies/openID-connect.md +++ b/content/nms/acm/how-to/policies/openID-connect.md @@ -50,7 +50,7 @@ The Developer Portal supports both PCKE and AuthCode [authorization code flows]( To apply the OpenID Connect (OIDC) policy or make changes to it, here's what you need to do: -- [Edit an existing environment or create a new one]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). +- [Edit an existing environment or create a new one]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). - Select the cluster on which to apply the policy. - Check the advanced settings to see if the policy has been applied. - Edit the policy as needed. diff --git a/content/nms/acm/how-to/policies/proxy-request-headers.md b/content/nms/acm/how-to/policies/proxy-request-headers.md index ac06e5490..40667eefd 100644 --- a/content/nms/acm/how-to/policies/proxy-request-headers.md +++ b/content/nms/acm/how-to/policies/proxy-request-headers.md @@ -19,7 +19,7 @@ type: The Proxy Request Headers policy allows users to pass default and custom request headers to backend services. -This policy is enabled by default when you [publish an API Proxy]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}). +This policy is enabled by default when you [publish an API Proxy]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}). ### Intended Audience @@ -32,8 +32,8 @@ This policy is enabled by default when you [publish an API Proxy]({{< relref "/n To complete the steps in this guide, you need the following: - API Connectivity Manager is installed, licensed, and running. -- An [API gateway environment]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}) -- A [published API Gateway]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}) +- An [API gateway environment]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}) +- A [published API Gateway]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}) --- @@ -46,9 +46,9 @@ The following table lists the configurable settings and their default values for | Field | Type | Possible Values | Description | Required | Default | |-------------------------------------------------|----------|----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|---------| -| `proxyDefaultHeadersToBackend` | boolean | `true`,
`false` |

When set to `true`, the default headers are passed to backend services.

For more information, refer to the [Default Headers]({{< relref "#default-headers" >}}) section.

| No | `True` | +| `proxyDefaultHeadersToBackend` | boolean | `true`,
`false` |

When set to `true`, the default headers are passed to backend services.

For more information, refer to the [Default Headers]({{< ref "#default-headers" >}}) section.

| No | `True` | | `proxyCustomHeadersToBackend.`
`key` | string | Example: `my-header` | The name of the HTTP header. | Yes | N/A | -| `proxyCustomHeadersToBackend.`
`value` | string | Example: `var.test` |

The value of the HTTP header.

For more information, refer to the [Header Value Prefixes]({{< relref "#value-prefixes" >}}) section.

| Yes | N/A | +| `proxyCustomHeadersToBackend.`
`value` | string | Example: `var.test` |

The value of the HTTP header.

For more information, refer to the [Header Value Prefixes]({{< ref "#value-prefixes" >}}) section.

| Yes | N/A | | `proxyCustomHeadersToBackend.`
`isSensitive` | boolean | `true`,
`false` | When set to `false`, the header will not appear in logs. | No | `False` | {{< /bootstrap-table >}} @@ -82,9 +82,9 @@ The following table lists the configurable settings and their default values for |---------------|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `var` | var.content_length | Pass a [valid NGINX variable](http://nginx.org/en/docs/varindex.html). | | `header` | header.referrer | Pass a header from the client request. | -| `client` | client.IP | Pass a value from the client if a [Basic Auth]({{< relref "/nms/acm/how-to/policies/basic-authn" >}}) or [API Key]({{< relref "/nms/acm/how-to/policies/apikey-authn" >}}) policy has been configured. | +| `client` | client.IP | Pass a value from the client if a [Basic Auth]({{< ref "/nms/acm/how-to/policies/basic-authn" >}}) or [API Key]({{< ref "/nms/acm/how-to/policies/apikey-authn" >}}) policy has been configured. | | `stringValue` | stringValue.MyString | Pass a static string. | -| `token` | token.sub | Pass a value from the JSON Web Token (JWT) if the [OAuth2 JWT Assertion]({{< relref "/nms/acm/how-to/policies/jwt-assertion" >}}) policy has been configured. | +| `token` | token.sub | Pass a value from the JSON Web Token (JWT) if the [OAuth2 JWT Assertion]({{< ref "/nms/acm/how-to/policies/jwt-assertion" >}}) policy has been configured. | {{< /bootstrap-table >}} diff --git a/content/nms/acm/how-to/policies/rate-limit.md b/content/nms/acm/how-to/policies/rate-limit.md index 3b05dd928..46a7c87f6 100644 --- a/content/nms/acm/how-to/policies/rate-limit.md +++ b/content/nms/acm/how-to/policies/rate-limit.md @@ -34,8 +34,8 @@ This guide is meant for F5 NGINX Management Suite Administrators who can modify Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with an [API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}). -- You have published one or more [API Gateways]({{< relref "/nms/acm/getting-started/publish-api-proxy" >}}). +- You have one or more Environments with an [API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}). +- You have published one or more [API Gateways]({{< ref "/nms/acm/getting-started/publish-api-proxy" >}}). ## Policy Settings diff --git a/content/nms/acm/how-to/policies/request-body-size-limit.md b/content/nms/acm/how-to/policies/request-body-size-limit.md index 3add4e7a0..8b62e00b0 100644 --- a/content/nms/acm/how-to/policies/request-body-size-limit.md +++ b/content/nms/acm/how-to/policies/request-body-size-limit.md @@ -29,7 +29,7 @@ The *Request Body Size Limit* policy, which by default is set to 1 MB, is applie To apply the policy or make changes to it, here's what you need to do: -- [Edit an existing environment or create a new one]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). +- [Edit an existing environment or create a new one]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). - Check the advanced settings for the environment to see if the policy has been applied. - Edit the policy to make changes for each environment. Save and publish the changes. diff --git a/content/nms/acm/how-to/policies/request-correlation-id.md b/content/nms/acm/how-to/policies/request-correlation-id.md index c5c8da065..cf88aa86b 100644 --- a/content/nms/acm/how-to/policies/request-correlation-id.md +++ b/content/nms/acm/how-to/policies/request-correlation-id.md @@ -30,7 +30,7 @@ Use the Request Correlation ID policy to add a unique identifier to each request To apply the policy or make changes to it, here's what you need to do: -- [Edit an existing environment or create a new one]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). +- [Edit an existing environment or create a new one]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). - Check the advanced settings for the environment to see if the policy has been applied. - Edit the policy to make changes for each environment. Save and publish the changes. diff --git a/content/nms/acm/how-to/policies/request-header-specification.md b/content/nms/acm/how-to/policies/request-header-specification.md index e0ebf7286..7c60fba7f 100644 --- a/content/nms/acm/how-to/policies/request-header-specification.md +++ b/content/nms/acm/how-to/policies/request-header-specification.md @@ -29,7 +29,7 @@ Use the Request Header Specification policy to allow headers that would normally To apply the policy or make changes to it, here's what you need to do: -- [Edit an existing environment or create a new one]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). +- [Edit an existing environment or create a new one]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#add-environment" >}}). - Check the advanced settings for the environment to see if the policy has been applied. - Edit the policy to make changes for each environment. Save and publish the changes. diff --git a/content/nms/acm/how-to/policies/tls-policies.md b/content/nms/acm/how-to/policies/tls-policies.md index 3e9d5772b..a70c82ae5 100644 --- a/content/nms/acm/how-to/policies/tls-policies.md +++ b/content/nms/acm/how-to/policies/tls-policies.md @@ -28,7 +28,7 @@ The types of communication you can apply TLS policies to includes: Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with [API Gateway]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}) or [Dev Portal]({{< relref "/nms/acm/getting-started/add-devportal" >}}) clusters. +- You have one or more Environments with [API Gateway]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}) or [Dev Portal]({{< ref "/nms/acm/getting-started/add-devportal" >}}) clusters. ### How to Access the User Interface diff --git a/content/nms/acm/how-to/services/publish-api.md b/content/nms/acm/how-to/services/publish-api.md index c89393471..f7b57e439 100644 --- a/content/nms/acm/how-to/services/publish-api.md +++ b/content/nms/acm/how-to/services/publish-api.md @@ -22,7 +22,7 @@ This topic describes how to publish an API config to a cluster. Complete the following prerequisites before proceeding with this guide: - API Connectivity Manager is installed, licensed, and running. -- You have one or more Environments with [API Gateway]({{}}) or [Dev Portal]({{< relref "/nms/acm/getting-started/add-devportal" >}}) clusters. +- You have one or more Environments with [API Gateway]({{}}) or [Dev Portal]({{< ref "/nms/acm/getting-started/add-devportal" >}}) clusters. ### How to Access the User Interface @@ -93,7 +93,7 @@ You can also set [DNS](https://en.wikipedia.org/wiki/Domain_Name_System) resolve This section ensures you can set policies at the individual API level. -Check the [Manage Policies]({{< relref "/nms/acm/how-to/policies/manage-policies.md" >}}) documentation for more information. +Check the [Manage Policies]({{< ref "/nms/acm/how-to/policies/manage-policies.md" >}}) documentation for more information. ## Publish an API Proxy using an OpenAPI Spec @@ -121,5 +121,5 @@ Certain sections can't be modified for API Proxies created with OpenAPI Specs, f ## What's Next -- [Manage Policies]({{< relref "/nms/acm/how-to/policies/manage-policies.md" >}}) -- [Publish a Developer Portal]({{< relref "/nms/acm/getting-started/add-devportal.md" >}}) +- [Manage Policies]({{< ref "/nms/acm/how-to/policies/manage-policies.md" >}}) +- [Publish a Developer Portal]({{< ref "/nms/acm/getting-started/add-devportal.md" >}}) diff --git a/content/nms/acm/how-to/services/publish-gRPC-proxy.md b/content/nms/acm/how-to/services/publish-gRPC-proxy.md index 0c865a29a..458100693 100644 --- a/content/nms/acm/how-to/services/publish-gRPC-proxy.md +++ b/content/nms/acm/how-to/services/publish-gRPC-proxy.md @@ -320,7 +320,7 @@ You can also set [DNS](https://en.wikipedia.org/wiki/Domain_Name_System) resolve This section ensures you can set policies at the individual API level. -For more information, refer to the [Manage Policies]({{< relref "/nms/acm/how-to/policies/manage-policies.md" >}}) documentation. +For more information, refer to the [Manage Policies]({{< ref "/nms/acm/how-to/policies/manage-policies.md" >}}) documentation. ## Update a Published API Proxy diff --git a/content/nms/acm/releases/known-issues.md b/content/nms/acm/releases/known-issues.md index 65029c749..84de38c97 100644 --- a/content/nms/acm/releases/known-issues.md +++ b/content/nms/acm/releases/known-issues.md @@ -151,7 +151,7 @@ If you add a Developer Portal cluster to an environment that has WAF enabled, th On the Developer Portal: 1. Open an SSH connection to the Developer Portal and log in. -2. [Install F5 NGINX App Protect]({{< relref "/nap-waf/v4/admin-guide/install.md" >}}). +2. [Install F5 NGINX App Protect]({{< ref "/nap-waf/v4/admin-guide/install.md" >}}). 3. Stop the NGINX Agent: ```bash diff --git a/content/nms/acm/releases/release-notes.md b/content/nms/acm/releases/release-notes.md index d11f62504..d66dc5893 100644 --- a/content/nms/acm/releases/release-notes.md +++ b/content/nms/acm/releases/release-notes.md @@ -43,7 +43,7 @@ This release includes the following updates: ### Known Issues{#1-9-3-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -82,11 +82,11 @@ This release includes the following updates: ### Resolved Issues{#1-9-2-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} JWT tokens are overwritten when multiple proxies are assigned to one gateway [(44636)]({{< relref "/nms/acm/releases/known-issues.md#44636" >}}) +- {{% icon-resolved %}} JWT tokens are overwritten when multiple proxies are assigned to one gateway [(44636)]({{< ref "/nms/acm/releases/known-issues.md#44636" >}}) ### Known Issues{#1-9-2-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -125,11 +125,11 @@ This release includes the following updates: ### Resolved Issues{#1-9-1-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} Module crashes when an OpenAPI spec is uploaded with a global security requirement that contains an empty security requirement object [(44393)]({{< relref "/nms/acm/releases/known-issues.md#44393" >}}) +- {{% icon-resolved %}} Module crashes when an OpenAPI spec is uploaded with a global security requirement that contains an empty security requirement object [(44393)]({{< ref "/nms/acm/releases/known-issues.md#44393" >}}) ### Known Issues{#1-9-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -186,21 +186,21 @@ This release includes the following updates: - {{% icon-feature %}} **Backend server configuration from OpenAPI specification file** - You can provide the backend server configuration for upstream servers in an OpenAPI specification file using extensions specific to API Connectivity Manager. See the [Publish an API Proxy]({{< relref "/nms/acm/getting-started/publish-api-proxy.md#publish-api-proxy-with-spec" >}}) documentation. + You can provide the backend server configuration for upstream servers in an OpenAPI specification file using extensions specific to API Connectivity Manager. See the [Publish an API Proxy]({{< ref "/nms/acm/getting-started/publish-api-proxy.md#publish-api-proxy-with-spec" >}}) documentation. ### Resolved Issues{#1-9-0-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} A proxy deployed with a `specRef` field (OAS) and `basePathVersionAppendRule` set to other than `NONE` may cause versions to appear twice in the deployed location block [(36666)]({{< relref "/nms/acm/releases/known-issues.md#36666" >}}) -- {{% icon-resolved %}} Resources deployed to a Developer Portal which has had its database reset cannot be updated or removed [(43140)]({{< relref "/nms/acm/releases/known-issues.md#43140" >}}) -- {{% icon-resolved %}} Certificates associated with empty instance groups can be deleted, resulting in a broken reference in the API Connectivity Manager module [(43671)]({{< relref "/nms/acm/releases/known-issues.md#43671" >}}) -- {{% icon-resolved %}} Deployment fails due to duplicate locations [(43673)]({{< relref "/nms/acm/releases/known-issues.md#43673" >}}) -- {{% icon-resolved %}} Cannot use TLS enabled backend with HTTP backend-config policy [(44212)]({{< relref "/nms/acm/releases/known-issues.md#44212" >}}) +- {{% icon-resolved %}} A proxy deployed with a `specRef` field (OAS) and `basePathVersionAppendRule` set to other than `NONE` may cause versions to appear twice in the deployed location block [(36666)]({{< ref "/nms/acm/releases/known-issues.md#36666" >}}) +- {{% icon-resolved %}} Resources deployed to a Developer Portal which has had its database reset cannot be updated or removed [(43140)]({{< ref "/nms/acm/releases/known-issues.md#43140" >}}) +- {{% icon-resolved %}} Certificates associated with empty instance groups can be deleted, resulting in a broken reference in the API Connectivity Manager module [(43671)]({{< ref "/nms/acm/releases/known-issues.md#43671" >}}) +- {{% icon-resolved %}} Deployment fails due to duplicate locations [(43673)]({{< ref "/nms/acm/releases/known-issues.md#43673" >}}) +- {{% icon-resolved %}} Cannot use TLS enabled backend with HTTP backend-config policy [(44212)]({{< ref "/nms/acm/releases/known-issues.md#44212" >}}) ### Known Issues{#1-9-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -233,7 +233,7 @@ This release includes the following updates: - {{% icon-feature %}} **Advanced security policy for proxies** - You can use the [Advanced Security policy]({{< relref "/nms/acm/how-to/policies/advanced-security.md" >}}) to add a pre-defined NGINX App Protect to your deployment. This enhancement allows you to specify the rules for each API. + You can use the [Advanced Security policy]({{< ref "/nms/acm/how-to/policies/advanced-security.md" >}}) to add a pre-defined NGINX App Protect to your deployment. This enhancement allows you to specify the rules for each API. - {{% icon-feature %}} **Publish APIs using OpenAPI Specification version 3.0 or 3.1** @@ -257,11 +257,11 @@ This release has the following changes in default behavior: ### Resolved Issues{#1-8-0-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} Environments with WAF enabled may transition to a Failed status when a Developer Portal cluster is added. [(43231)]({{< relref "/nms/acm/releases/known-issues.md#43231" >}}) +- {{% icon-resolved %}} Environments with WAF enabled may transition to a Failed status when a Developer Portal cluster is added. [(43231)]({{< ref "/nms/acm/releases/known-issues.md#43231" >}}) ### Known Issues{#1-8-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -294,11 +294,11 @@ This release includes the following updates: - {{% icon-feature %}} **Advanced Security Policy** - The new [Advanced Security policy]({{< relref "/nms/acm/how-to/policies/advanced-security.md" >}}) can be used to add a pre-defined NGINX App Protect configuration to your deployment. Doing so will apply the rules specified in the policy to your APIs. + The new [Advanced Security policy]({{< ref "/nms/acm/how-to/policies/advanced-security.md" >}}) can be used to add a pre-defined NGINX App Protect configuration to your deployment. Doing so will apply the rules specified in the policy to your APIs. - {{% icon-feature %}} **Option added to allow API proxy to ignore invalid headers** - The [Request Header Specification policy]({{< relref "/nms/acm/how-to/policies/request-header-specification.md" >}}) allows headers with (.) and (\_) characters to be proxied to backend services. + The [Request Header Specification policy]({{< ref "/nms/acm/how-to/policies/request-header-specification.md" >}}) allows headers with (.) and (\_) characters to be proxied to backend services. By default, NGINX server will drop all headers that contain (.) and (\_) characters in the header name. Though not common, it is a legal character in headers. This feature will allow users to instruct NGINX to allow such headers to be proxied. @@ -314,12 +314,12 @@ This release includes the following updates: ### Resolved Issues{#1-7-0-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} The routes filter under the proxy metrics page won’t work with params [(42471)]({{< relref "/nms/acm/releases/known-issues.md#42471" >}}) -- {{% icon-resolved %}} Multiple entries selected when gateway proxy hostnames are the same [(42515)]({{< relref "/nms/acm/releases/known-issues.md#42515" >}}) +- {{% icon-resolved %}} The routes filter under the proxy metrics page won’t work with params [(42471)]({{< ref "/nms/acm/releases/known-issues.md#42471" >}}) +- {{% icon-resolved %}} Multiple entries selected when gateway proxy hostnames are the same [(42515)]({{< ref "/nms/acm/releases/known-issues.md#42515" >}}) ### Known Issues{#1-7-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -366,14 +366,14 @@ This release includes the following updates: ### Resolved Issues{#1-6-0-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} CORS policy doesn't support proxying preflight requests to the backend when combined with an authentication policy [(34449)]({{< relref "/nms/acm/releases/known-issues.md#34449" >}}) -- {{% icon-resolved %}} TLS setting on listener is not reset when TLS policy is removed [(41426)]({{< relref "/nms/acm/releases/known-issues.md#41426" >}}) -- {{% icon-resolved %}} Developer Portal: When typing the links to use for the footer, the text boxes keep losing focus [(41626)]({{< relref "/nms/acm/releases/known-issues.md#41626" >}}) -- {{% icon-resolved %}} Array values in token claims are treated as string values [(42388)]({{< relref "/nms/acm/releases/known-issues.md#42388" >}}) +- {{% icon-resolved %}} CORS policy doesn't support proxying preflight requests to the backend when combined with an authentication policy [(34449)]({{< ref "/nms/acm/releases/known-issues.md#34449" >}}) +- {{% icon-resolved %}} TLS setting on listener is not reset when TLS policy is removed [(41426)]({{< ref "/nms/acm/releases/known-issues.md#41426" >}}) +- {{% icon-resolved %}} Developer Portal: When typing the links to use for the footer, the text boxes keep losing focus [(41626)]({{< ref "/nms/acm/releases/known-issues.md#41626" >}}) +- {{% icon-resolved %}} Array values in token claims are treated as string values [(42388)]({{< ref "/nms/acm/releases/known-issues.md#42388" >}}) ### Known Issues{#1-6-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -406,11 +406,11 @@ This release includes the following updates: - {{% icon-feature %}} **Use role-based access control for enhanced security and governance** - With new [built-in RBAC roles for API Connectivity Manager]({{< relref "/nim/admin-guide/rbac/overview-rbac.md#build-in-roles" >}}), administrators can grant or restrict user access to workspaces and features, empowering teams to manage their own workflows. + With new [built-in RBAC roles for API Connectivity Manager]({{< ref "/nim/admin-guide/rbac/overview-rbac.md#build-in-roles" >}}), administrators can grant or restrict user access to workspaces and features, empowering teams to manage their own workflows. {{}} - - [Set Up RBAC for API Owners]({{< relref "/nms/acm/tutorials/rbac-api-owners.md" >}}) - - [Set Up RBAC for Infra Admins]({{< relref "/nms/acm/tutorials/rbac-infra-admins.md" >}}) + - [Set Up RBAC for API Owners]({{< ref "/nms/acm/tutorials/rbac-api-owners.md" >}}) + - [Set Up RBAC for Infra Admins]({{< ref "/nms/acm/tutorials/rbac-infra-admins.md" >}}) {{}} - {{% icon-feature %}} **Multiple hostname support** @@ -423,7 +423,7 @@ This release includes the following updates: - {{% icon-feature %}} **Runtime state sharing in an API gateway or Developer Portal** - Administrators can use [cluster-wide policies]({{< relref "/nms/acm/how-to/policies/cluster-wide-config.md" >}}) to configure uniform settings across all instances in the cluster, such as worker connections, hash table size, and keepalive settings, to optimize performance. Furthermore, using the [Cluster Zone Sync policy]({{< relref "/nms/acm/how-to/policies/cluster-zone-sync.md" >}}), the cluster can be configured to share the runtime state and sync data across all instances, allowing for cluster-wide rate limits and sticky sessions. + Administrators can use [cluster-wide policies]({{< ref "/nms/acm/how-to/policies/cluster-wide-config.md" >}}) to configure uniform settings across all instances in the cluster, such as worker connections, hash table size, and keepalive settings, to optimize performance. Furthermore, using the [Cluster Zone Sync policy]({{< ref "/nms/acm/how-to/policies/cluster-zone-sync.md" >}}), the cluster can be configured to share the runtime state and sync data across all instances, allowing for cluster-wide rate limits and sticky sessions. - {{% icon-feature %}} **Performance improvements for the web interface** @@ -431,7 +431,7 @@ This release includes the following updates: - {{% icon-feature %}} **Add a Health Check policy to your gRPC proxy to ensure optimal performance** - The [gRPC proxy can be enabled with a Health Check policy]({{< relref "/nms/acm/how-to/policies/grpc-policies.md#health-check" >}}), allowing it to check the health status of backend gRPC services and route requests accordingly. + The [gRPC proxy can be enabled with a Health Check policy]({{< ref "/nms/acm/how-to/policies/grpc-policies.md#health-check" >}}), allowing it to check the health status of backend gRPC services and route requests accordingly. - {{% icon-feature %}} **Improved certificate handling** @@ -456,7 +456,7 @@ This release includes the following security updates: - Mitigation: - - Avoid configuring trace-level logging in the NGINX Agent configuration file. For more information, refer to the [Configuring the NGINX Agent]({{< relref "/nms/nginx-agent/install-nginx-agent.md#configuring-the-nginx-agent ">}}) section of NGINX Management Suite documentation. If trace-level logging is required, ensure only trusted users have access to the log files. + - Avoid configuring trace-level logging in the NGINX Agent configuration file. For more information, refer to the [Configuring the NGINX Agent]({{< ref "/nms/nginx-agent/install-nginx-agent.md#configuring-the-nginx-agent ">}}) section of NGINX Management Suite documentation. If trace-level logging is required, ensure only trusted users have access to the log files. - Fixed in: @@ -477,12 +477,12 @@ This release has the following changes in default behavior: ### Resolved Issues{#1-5-0-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} Configurations aren't pushed to newly onboarded instances if another instance is offline [(40035)]({{< relref "/nms/acm/releases/known-issues.md#40035" >}}) -- {{% icon-resolved %}} The Proxy Cluster API isn't ready to be used [(40097)]({{< relref "/nms/acm/releases/known-issues.md#40097" >}}) +- {{% icon-resolved %}} Configurations aren't pushed to newly onboarded instances if another instance is offline [(40035)]({{< ref "/nms/acm/releases/known-issues.md#40035" >}}) +- {{% icon-resolved %}} The Proxy Cluster API isn't ready to be used [(40097)]({{< ref "/nms/acm/releases/known-issues.md#40097" >}}) ### Known Issues{#1-5-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -521,11 +521,11 @@ This release includes the following updates: ### Resolved Issues{#1-4-1-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} Cluster and Environment deletion issues when Portal Docs are published [(40163)]({{< relref "/nms/acm/releases/known-issues.md#40163" >}}) +- {{% icon-resolved %}} Cluster and Environment deletion issues when Portal Docs are published [(40163)]({{< ref "/nms/acm/releases/known-issues.md#40163" >}}) ### Known Issues{#1-4-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -566,18 +566,18 @@ This release includes the following updates: - {{% icon-feature %}} **Adds support for NGINX Plus R28** - API Connectivity Manager 1.4.0 is compatible with NGINX Plus R28. For requirements related to NGINX Management Suite and API Connectivity Manager, please refer to the [Technical Specifications]({{< relref "/nim/fundamentals/tech-specs.md" >}}) guide. + API Connectivity Manager 1.4.0 is compatible with NGINX Plus R28. For requirements related to NGINX Management Suite and API Connectivity Manager, please refer to the [Technical Specifications]({{< ref "/nim/fundamentals/tech-specs.md" >}}) guide. ### Resolved Issues{#1-4-0-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} A JWT token present in a query parameter is not proxied to the backend for advanced routes [(39328)]({{< relref "/nms/acm/releases/known-issues.md#39328" >}}) -- {{% icon-resolved %}} OIDC policy cannot be applied alongside a proxy authentication policy [(39604)]({{< relref "/nms/acm/releases/known-issues.md#39604" >}}) +- {{% icon-resolved %}} A JWT token present in a query parameter is not proxied to the backend for advanced routes [(39328)]({{< ref "/nms/acm/releases/known-issues.md#39328" >}}) +- {{% icon-resolved %}} OIDC policy cannot be applied alongside a proxy authentication policy [(39604)]({{< ref "/nms/acm/releases/known-issues.md#39604" >}}) ### Known Issues{#1-4-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -616,13 +616,13 @@ This release includes the following updates: ### Resolved Issues{#1-3-1-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} Developer Portal backend information is unintentionally updated when editing clusters within an environment [(39409)]({{< relref "/nms/acm/releases/known-issues.md#39409" >}}) -- {{% icon-resolved %}} The Inbound TLS policy breaks when upgrading from API Connectivity Manager 1.2.0 to 1.3.0. [(39426)]({{< relref "/nms/acm/releases/known-issues.md#39426" >}}) -- {{% icon-resolved %}} The web interface doesn't pass the `enableSNI` property for the TLS backend policy [(39445)]({{< relref "/nms/acm/releases/known-issues.md#39445" >}}) +- {{% icon-resolved %}} Developer Portal backend information is unintentionally updated when editing clusters within an environment [(39409)]({{< ref "/nms/acm/releases/known-issues.md#39409" >}}) +- {{% icon-resolved %}} The Inbound TLS policy breaks when upgrading from API Connectivity Manager 1.2.0 to 1.3.0. [(39426)]({{< ref "/nms/acm/releases/known-issues.md#39426" >}}) +- {{% icon-resolved %}} The web interface doesn't pass the `enableSNI` property for the TLS backend policy [(39445)]({{< ref "/nms/acm/releases/known-issues.md#39445" >}}) ### Known Issues{#1-3-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -665,11 +665,11 @@ This release includes the following updates: Routing decisions can be made based on headers in the incoming requests. API owners can configure rules and conditions that must be matched before routing requests. - See [Configure Access Control Routing]({{< relref "/nms/acm/how-to/policies/access-control-routing.md" >}}) to learn how to restrict access to your application servers based on JWT claims or header values. + See [Configure Access Control Routing]({{< ref "/nms/acm/how-to/policies/access-control-routing.md" >}}) to learn how to restrict access to your application servers based on JWT claims or header values. - {{% icon-feature %}} **Use the web interface to publish and manage gRPC services** - With API Connectivity Manager 1.2, we introduced support for [publishing and managing gRPC services]({{< relref "/nms/acm/how-to/policies/grpc-policies.md" >}}). Now, in this release, we extend that capability to the web interface. + With API Connectivity Manager 1.2, we introduced support for [publishing and managing gRPC services]({{< ref "/nms/acm/how-to/policies/grpc-policies.md" >}}). Now, in this release, we extend that capability to the web interface. You can secure gRPC services with the following policies: @@ -722,15 +722,15 @@ This release includes the following updates: ### Resolved Issues{#1-3-0-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} No validation when conflicting policies are added [(34531)]({{< relref "/nms/acm/releases/known-issues.md#34531" >}}) -- {{% icon-resolved %}} Installing NGINX Agent on Ubuntu 22.04 LTS fails with `404 Not Found` error [(35339)]({{< relref "/nms/acm/releases/known-issues.md#35339" >}}) -- {{% icon-resolved %}} New users are unable to see pages even though they have been given access. [(36607)]({{< relref "/nms/acm/releases/known-issues.md#36607" >}}) -- {{% icon-resolved %}} Portals secured with TLS policy require additional environment configuration prior to publishing API docs [(38028)]({{< relref "/nms/acm/releases/known-issues.md#38028" >}}) -- {{% icon-resolved %}} The user interface is erroneously including irrelevant information on the TLS inbound policy workflow [(38046)]({{< relref "/nms/acm/releases/known-issues.md#38046" >}}) +- {{% icon-resolved %}} No validation when conflicting policies are added [(34531)]({{< ref "/nms/acm/releases/known-issues.md#34531" >}}) +- {{% icon-resolved %}} Installing NGINX Agent on Ubuntu 22.04 LTS fails with `404 Not Found` error [(35339)]({{< ref "/nms/acm/releases/known-issues.md#35339" >}}) +- {{% icon-resolved %}} New users are unable to see pages even though they have been given access. [(36607)]({{< ref "/nms/acm/releases/known-issues.md#36607" >}}) +- {{% icon-resolved %}} Portals secured with TLS policy require additional environment configuration prior to publishing API docs [(38028)]({{< ref "/nms/acm/releases/known-issues.md#38028" >}}) +- {{% icon-resolved %}} The user interface is erroneously including irrelevant information on the TLS inbound policy workflow [(38046)]({{< ref "/nms/acm/releases/known-issues.md#38046" >}}) ### Known Issues{#1-3-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -763,13 +763,13 @@ This release includes the following updates: - {{% icon-feature %}} **Restrict access to APIs based on IP address** - Using the [ACL-IP policy]({{< relref "/nms/acm/how-to/policies/api-access-control-lists.md" >}}), API owners can now restrict access to APIs based on IP addresses. APIs can be protected by quickly blocking rogue requests from certain IPs or allowing access to only known IPs. + Using the [ACL-IP policy]({{< ref "/nms/acm/how-to/policies/api-access-control-lists.md" >}}), API owners can now restrict access to APIs based on IP addresses. APIs can be protected by quickly blocking rogue requests from certain IPs or allowing access to only known IPs. - {{% icon-feature %}} **Secure API access with OAuth2 tokens** - API Owners can [restrict access to their APIs with OAuth2 tokens]({{< relref "/nms/acm/how-to/policies/introspection.md" >}}) by swapping an opaque token for claims or a JWT token to be proxied to the backend service. The policy can be configured to grant access to APIs after having the tokens introspected. In addition, the claims in the token can be extracted and forwarded to the backend service. + API Owners can [restrict access to their APIs with OAuth2 tokens]({{< ref "/nms/acm/how-to/policies/introspection.md" >}}) by swapping an opaque token for claims or a JWT token to be proxied to the backend service. The policy can be configured to grant access to APIs after having the tokens introspected. In addition, the claims in the token can be extracted and forwarded to the backend service. - {{}}Learn how to [set up an OAuth2 Introspection policy with Keycloak]({{< relref "/nms/acm/tutorials/introspection-keycloak.md" >}}) as the authorization server.{{}} + {{}}Learn how to [set up an OAuth2 Introspection policy with Keycloak]({{< ref "/nms/acm/tutorials/introspection-keycloak.md" >}}) as the authorization server.{{}} - {{% icon-feature %}} **Enhanced API documentation on developer portal** @@ -777,7 +777,7 @@ This release includes the following updates: - {{% icon-feature %}} **Support for HTTP/2** - To improve the performance and efficiency of client-server interactions, HTTP/2 can be enabled on the [API proxies]({{< relref "/nms/acm/getting-started/publish-api-proxy.md#set-up-api-proxy" >}}). With HTTP/2 enabled, API Proxies will continue to maintain backward compatibility with older browsers. + To improve the performance and efficiency of client-server interactions, HTTP/2 can be enabled on the [API proxies]({{< ref "/nms/acm/getting-started/publish-api-proxy.md#set-up-api-proxy" >}}). With HTTP/2 enabled, API Proxies will continue to maintain backward compatibility with older browsers. - {{% icon-feature %}} **Improved visualizations for resource credentials** @@ -791,13 +791,13 @@ This release includes the following updates: - {{% icon-feature %}} **Database backup included in support packages** - The [Developer Portal support package]({{< relref "/nms/support/support-package.md" >}}) now includes the option to back up the PostgreSQL database. + The [Developer Portal support package]({{< ref "/nms/support/support-package.md" >}}) now includes the option to back up the PostgreSQL database. - {{% icon-feature %}} **Publish and manage gRPC services - preview release** {{}}This is a **preview** feature for you to try out. You shouldn't use preview features for production purposes.{{}} - To handle gRPC traffic, you can now [publish and manage gRPC proxies]({{< relref "/nms/acm/how-to/services/publish-grpc-proxy.md" >}}). + To handle gRPC traffic, you can now [publish and manage gRPC proxies]({{< ref "/nms/acm/how-to/services/publish-grpc-proxy.md" >}}). Publish gRPC proxies and route gRPC traffic to support the following use cases: @@ -833,16 +833,16 @@ This release includes the following updates: ### Resolved Issues{#1-2-0-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} Enums are not supported in Advanced Routing. [(34854)]({{< relref "/nms/acm/releases/known-issues.md#34854" >}}) -- {{% icon-resolved %}} Unable to delete an environment that is stuck in a Configuring state. [(35546)]({{< relref "/nms/acm/releases/known-issues.md#35546" >}}) -- {{% icon-resolved %}} Credentials endpoint is disabled by default [(35630)]({{< relref "/nms/acm/releases/known-issues.md#35630" >}}) -- {{% icon-resolved %}} Ratelimit policy cannot be applied with OAuth2 JWT Assertion policy. [(36095)]({{< relref "/nms/acm/releases/known-issues.md#36095" >}}) -- {{% icon-resolved %}} Using labels to specify the backend is partially available [(36317)]({{< relref "/nms/acm/releases/known-issues.md#36317" >}}) -- {{% icon-resolved %}} To see updates to the Listener's table, forced refresh of the cluster details page is required. [(36540)]({{< relref "/nms/acm/releases/known-issues.md#36540" >}}) +- {{% icon-resolved %}} Enums are not supported in Advanced Routing. [(34854)]({{< ref "/nms/acm/releases/known-issues.md#34854" >}}) +- {{% icon-resolved %}} Unable to delete an environment that is stuck in a Configuring state. [(35546)]({{< ref "/nms/acm/releases/known-issues.md#35546" >}}) +- {{% icon-resolved %}} Credentials endpoint is disabled by default [(35630)]({{< ref "/nms/acm/releases/known-issues.md#35630" >}}) +- {{% icon-resolved %}} Ratelimit policy cannot be applied with OAuth2 JWT Assertion policy. [(36095)]({{< ref "/nms/acm/releases/known-issues.md#36095" >}}) +- {{% icon-resolved %}} Using labels to specify the backend is partially available [(36317)]({{< ref "/nms/acm/releases/known-issues.md#36317" >}}) +- {{% icon-resolved %}} To see updates to the Listener's table, forced refresh of the cluster details page is required. [(36540)]({{< ref "/nms/acm/releases/known-issues.md#36540" >}}) ### Known Issues{#1-2-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -881,13 +881,13 @@ This release includes the following updates: ### Resolved Issues{#1-1-1-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} OIDC policy doesn't work with Auth0 Identity Providers [(36058)]({{< relref "/nms/acm/releases/known-issues.md#36058" >}}) -- {{% icon-resolved %}} Traffic is not secured between the API Proxy and backend servers [(36714)]({{< relref "/nms/acm/releases/known-issues.md#36714" >}}) -- {{% icon-resolved %}} Advanced routing ignores the Context Root setting for backend proxies [(36775)]({{< relref "/nms/acm/releases/known-issues.md#36775" >}}) +- {{% icon-resolved %}} OIDC policy doesn't work with Auth0 Identity Providers [(36058)]({{< ref "/nms/acm/releases/known-issues.md#36058" >}}) +- {{% icon-resolved %}} Traffic is not secured between the API Proxy and backend servers [(36714)]({{< ref "/nms/acm/releases/known-issues.md#36714" >}}) +- {{% icon-resolved %}} Advanced routing ignores the Context Root setting for backend proxies [(36775)]({{< ref "/nms/acm/releases/known-issues.md#36775" >}}) ### Known Issues{#1-1-1-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -920,33 +920,33 @@ This release includes the following updates: - {{% icon-feature %}} **Advanced Cluster Management** - Including more than one proxy cluster with the same hostname in an environment replicates configuration across all clusters and assists with blue-green deployments. With advanced cluster management, you can use a load balancer in front of the clusters to slowly move to the newer version of the API gateway. For example, one cluster may belong to NGINX Plus version R26 and another to R27. See the [Technical Specifications]({{< relref "/nim/fundamentals/tech-specs.md#data-plane-dev-portal" >}}). + Including more than one proxy cluster with the same hostname in an environment replicates configuration across all clusters and assists with blue-green deployments. With advanced cluster management, you can use a load balancer in front of the clusters to slowly move to the newer version of the API gateway. For example, one cluster may belong to NGINX Plus version R26 and another to R27. See the [Technical Specifications]({{< ref "/nim/fundamentals/tech-specs.md#data-plane-dev-portal" >}}). - {{% icon-feature %}} **Advanced Routing feature is available now** - Advanced routing feature is available now. You can use it to publish an API Proxy and route specific URIs/endpoints precisely to a backend service. Advanced routing with OAS Specification allows you to import a specification file, parse all the URIs/endpoints in the file and publish API proxy by routing each URI/endpoint precisely to a backend service. To use the advanced routing feature without an OAS specification file, add the URI/endpoints while publishing the API proxy. See the [Advanced Configurations]({{< relref "/nms/acm/how-to/services/publish-api.md#advanced-configurations" >}}) section. + Advanced routing feature is available now. You can use it to publish an API Proxy and route specific URIs/endpoints precisely to a backend service. Advanced routing with OAS Specification allows you to import a specification file, parse all the URIs/endpoints in the file and publish API proxy by routing each URI/endpoint precisely to a backend service. To use the advanced routing feature without an OAS specification file, add the URI/endpoints while publishing the API proxy. See the [Advanced Configurations]({{< ref "/nms/acm/how-to/services/publish-api.md#advanced-configurations" >}}) section. - {{% icon-feature %}} **SQLite is supported for Developer Portal** - SQLite is now supported as a database for [Developer Portal installations]({{< relref "/nms/acm/getting-started/add-devportal.md" >}}). + SQLite is now supported as a database for [Developer Portal installations]({{< ref "/nms/acm/getting-started/add-devportal.md" >}}). - {{% icon-feature %}} **Support for NGINX Plus Release 27 (R27)** - This release supports NGINX Plus Release 27 (R27) version for Data Plane instances. See the [Technical Specifications]({{< relref "tech-specs.md" >}}). + This release supports NGINX Plus Release 27 (R27) version for Data Plane instances. See the [Technical Specifications]({{< ref "/nim/fundamentals/tech-specs.md" >}}). ### Resolved Issues{#1-1-0-resolved-issues} This release fixes the following issues. Select an issue's ID link to view its details. -- {{% icon-resolved %}} JWT Assertion policy accepts an empty string value for tokenName property [(35419)]({{< relref "/nms/acm/releases/known-issues.md#35419" >}}) -- {{% icon-resolved %}} Environment is in a premature success state even though all proxy clusters may not be onboarded [(35430)]({{< relref "/nms/acm/releases/known-issues.md#35430" >}}) -- {{% icon-resolved %}} Cannot add, remove, or edit proxy clusters from an environment that has a published API proxy [(35463)]({{< relref "/nms/acm/releases/known-issues.md#35463" >}}) -- {{% icon-resolved %}} Features in the web interface are not displayed after uploading license [(35525)]({{< relref "/nms/acm/releases/known-issues.md#35525" >}}) -- {{% icon-resolved %}} DEVPORTAL_OPTS in /etc/{default,sysconfig}/nginx-devportal does not work if value has multiple words [(36040)]({{< relref "/nms/acm/releases/known-issues.md#36040" >}}) +- {{% icon-resolved %}} JWT Assertion policy accepts an empty string value for tokenName property [(35419)]({{< ref "/nms/acm/releases/known-issues.md#35419" >}}) +- {{% icon-resolved %}} Environment is in a premature success state even though all proxy clusters may not be onboarded [(35430)]({{< ref "/nms/acm/releases/known-issues.md#35430" >}}) +- {{% icon-resolved %}} Cannot add, remove, or edit proxy clusters from an environment that has a published API proxy [(35463)]({{< ref "/nms/acm/releases/known-issues.md#35463" >}}) +- {{% icon-resolved %}} Features in the web interface are not displayed after uploading license [(35525)]({{< ref "/nms/acm/releases/known-issues.md#35525" >}}) +- {{% icon-resolved %}} DEVPORTAL_OPTS in /etc/{default,sysconfig}/nginx-devportal does not work if value has multiple words [(36040)]({{< ref "/nms/acm/releases/known-issues.md#36040" >}}) ### Known Issues{#1-1-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. --- @@ -984,5 +984,5 @@ This release includes the following updates: ### Known Issues{#1-0-0-known-issues} -You can find information about known issues in the [Known Issues]({{< relref "/nms/acm/releases/known-issues.md" >}}) topic. +You can find information about known issues in the [Known Issues]({{< ref "/nms/acm/releases/known-issues.md" >}}) topic. diff --git a/content/nms/acm/tutorials/advanced-routing.md b/content/nms/acm/tutorials/advanced-routing.md index d00abf3ee..0531a0eb1 100644 --- a/content/nms/acm/tutorials/advanced-routing.md +++ b/content/nms/acm/tutorials/advanced-routing.md @@ -20,7 +20,7 @@ This guide is meant for NGINX Management Suite users who can add/modify Proxy de ### How do I publish a Proxy with Advanced Routing? -Follow the steps on the [Publish an HTTP API]({{< relref "/nms/acm/how-to/services/publish-api.md" >}}) section to publish a proxy. +Follow the steps on the [Publish an HTTP API]({{< ref "/nms/acm/how-to/services/publish-api.md" >}}) section to publish a proxy. --- @@ -43,15 +43,15 @@ In the steps that follow, we will: To complete the instructions in this guide, you need the following: -- [API Connectivity Manager is installed]({{< relref "/nms/acm/how-to/install-acm.md" >}}), [licensed]({{< relref "/nim/admin-guide/license/add-license.md" >}}), and running -- One or more [Service workspaces]({{< relref "/nms/acm/how-to/services/publish-api.md#create-a-service-workspace" >}}) -- One or more [Proxies]({{< relref "/nms/acm/how-to/services/publish-api.md" >}}) +- [API Connectivity Manager is installed]({{< ref "/nms/acm/how-to/install-acm.md" >}}), [licensed]({{< ref "/nim/admin-guide/license/add-license.md" >}}), and running +- One or more [Service workspaces]({{< ref "/nms/acm/how-to/services/publish-api.md#create-a-service-workspace" >}}) +- One or more [Proxies]({{< ref "/nms/acm/how-to/services/publish-api.md" >}}) --- ## Built-In Role -API Connectivity Manager comes pre-configured with an [ACM API Owner]({{< relref "/nms/acm/tutorials/rbac-api-owners.md" >}}) role suitable for API Owners (The individuals or teams who are responsible for designing, creating, and maintaining APIs). +API Connectivity Manager comes pre-configured with an [ACM API Owner]({{< ref "/nms/acm/tutorials/rbac-api-owners.md" >}}) role suitable for API Owners (The individuals or teams who are responsible for designing, creating, and maintaining APIs). --- diff --git a/content/nms/acm/tutorials/aws-deploy.md b/content/nms/acm/tutorials/aws-deploy.md index 54d9314e0..829cf9e14 100644 --- a/content/nms/acm/tutorials/aws-deploy.md +++ b/content/nms/acm/tutorials/aws-deploy.md @@ -18,11 +18,11 @@ Keep in mind that production environments may require larger instance sizes and - Make sure you have an AWS account. -{{< important >}}Because the [minimum requirement for the F5 NGINX Management Suite host]({{< relref "/nim/fundamentals/tech-specs#system-sizing" >}}) requires 2 CPU and 4GB RAM (NOT a free tier size), completing this deployment guide will incur charges from AWS according to their price plan.{{< /important >}} +{{< important >}}Because the [minimum requirement for the F5 NGINX Management Suite host]({{< ref "/nim/fundamentals/tech-specs#system-sizing" >}}) requires 2 CPU and 4GB RAM (NOT a free tier size), completing this deployment guide will incur charges from AWS according to their price plan.{{< /important >}} ### Hosts Specs -The AWS instance types and storage capacity used in this guide are based on the [NGINX Management Suite Technical Specs]({{< relref "/nim/fundamentals/tech-specs#system-sizing" >}}). +The AWS instance types and storage capacity used in this guide are based on the [NGINX Management Suite Technical Specs]({{< ref "/nim/fundamentals/tech-specs#system-sizing" >}}). {{}} @@ -187,21 +187,21 @@ Take the steps below to create a security group for access. Repeat these steps t #### Create EC2 Instance -Take the steps below to create an EC2 Instance. Repeat these steps three times, once for each host shown in [Table 1.1]({{< relref "#hosts-specs" >}}). +Take the steps below to create an EC2 Instance. Repeat these steps three times, once for each host shown in [Table 1.1]({{< relref "./aws-deploy.md#hosts-specs" >}}). 1. Go to the **EC2** Service. 1. On the left menu, select **Instances > Instances**. 1. Select **Launch Instances**. 1. Provide the **Name** of your instance. -1. In the **Application and OS Images** section, select your [supported OS of choice]({{< relref "/nim/fundamentals/tech-specs#distributions" >}}). -1. Select your instance size in the **Instance Type** section. Refer to [Table 1.1]({{< relref "#hosts-specs" >}}) for the suggested size of your host. Refer to [Technical Specifications]({{< relref "/nim/fundamentals/tech-specs#system-sizing" >}}) for additional information. +1. In the **Application and OS Images** section, select your [supported OS of choice]({{< ref "/nim/fundamentals/tech-specs#distributions" >}}). +1. Select your instance size in the **Instance Type** section. Refer to [Table 1.1]({{< relref "./aws-deploy.md#hosts-specs" >}}) for the suggested size of your host. Refer to [Technical Specifications]({{< ref "/nim/fundamentals/tech-specs#system-sizing" >}}) for additional information. 1. In the **Key pair (login)** section, select the key pair that was created above. 1. In the **Network settings** section, select the **Edit** button. - Provide your **VPC** and **Subnet** information. - Select **Enable** for **Auto-assign public IP**. - Select **Select existing security group**. - Provide the security group created above shown in Table 1.4 that corresponds to your host for **Common security groups**. -1. In the **Configure Storage** section, select the storage amount required by your host. Refer to [Table 1.1]({{< relref "#hosts-specs" >}}) for guidance to determine the suggested size. GP2 storage is suitable. Refer to [Technical Specifications]({{< relref "/nim/fundamentals/tech-specs#system-sizing" >}}) for additional information. +1. In the **Configure Storage** section, select the storage amount required by your host. Refer to [Table 1.1]({{< relref "./aws-deploy.md#hosts-specs" >}}) for guidance to determine the suggested size. GP2 storage is suitable. Refer to [Technical Specifications]({{< ref "/nim/fundamentals/tech-specs#system-sizing" >}}) for additional information. #### Access EC2 Instance @@ -215,15 +215,15 @@ Take the steps below to obtain the public IP so you can access the instance thro ## NGINX Management Suite Host Installation -Follow the [NGINX Management Suite Installation Guide]({{< relref "/nim/deploy/_index.md" >}}) to install both the **Instance Manager Module** and the **API Connectivity Manager Module**. The **Security Module** is not required for this demo. +Follow the [NGINX Management Suite Installation Guide]({{< ref "/nim/deploy/_index.md" >}}) to install both the **Instance Manager Module** and the **API Connectivity Manager Module**. The **Security Module** is not required for this demo. ## NGINX Data Plane host -Follow the steps in the [Set Up an API Gateway Environment]({{< relref "/nms/acm/getting-started/add-api-gateway" >}}) guide to create an API Gateway and deploy it to your NGINX data plane host. +Follow the steps in the [Set Up an API Gateway Environment]({{< ref "/nms/acm/getting-started/add-api-gateway" >}}) guide to create an API Gateway and deploy it to your NGINX data plane host. ## NGINX Developer Portal host -Follow the steps in the [Set Up a Developer Portal Environment]({{< relref "/nms/acm/getting-started/add-devportal" >}}) guide to create a Developer Portal and deploy it to your NGINX Dev Portal host. +Follow the steps in the [Set Up a Developer Portal Environment]({{< ref "/nms/acm/getting-started/add-devportal" >}}) guide to create a Developer Portal and deploy it to your NGINX Dev Portal host. ## Terminal Access Using Session Manager (Optional) {#session-manager} diff --git a/content/nms/acm/tutorials/enable-metrics.md b/content/nms/acm/tutorials/enable-metrics.md index 7d8312fe2..35d83348e 100644 --- a/content/nms/acm/tutorials/enable-metrics.md +++ b/content/nms/acm/tutorials/enable-metrics.md @@ -19,7 +19,7 @@ Currently, only the following metric is available: - [Count of proxies in an environment](#count-proxies-in-env) -As we add new metrics, we'll let you know in the [API Connectivity Manager release notes]({{< relref "/nms/acm/releases/release-notes.md" >}}) and update this topic accordingly. +As we add new metrics, we'll let you know in the [API Connectivity Manager release notes]({{< ref "/nms/acm/releases/release-notes.md" >}}) and update this topic accordingly. --- @@ -59,7 +59,7 @@ This section configures the hosts used in this tutorial. In the following table, ### Install NGINX Management Suite & API Connectivity Manager {#install-nsm-acm} -Follow the steps in the [Installation Guide]({{< relref "/nim/deploy/_index.md" >}}) to set up NGINX Management Suite and API Connectivity Manager. You do not need to configure a Developer Portal for this tutorial. +Follow the steps in the [Installation Guide]({{< ref "/nim/deploy/_index.md" >}}) to set up NGINX Management Suite and API Connectivity Manager. You do not need to configure a Developer Portal for this tutorial. ### Enable Metrics for API Connectivity Manager @@ -86,7 +86,7 @@ curl --insecure https://192.0.2.2/install/nginx-agent > install.sh \ && sudo systemctl start nginx-agent ``` -To ensure that the advanced metrics modules are installed across all data plane hosts, please follow the steps in the [Install NGINX Plus Metrics Module]({{< relref "/nms/nginx-agent/install-nginx-plus-advanced-metrics.md" >}}) guide. +To ensure that the advanced metrics modules are installed across all data plane hosts, please follow the steps in the [Install NGINX Plus Metrics Module]({{< ref "/nms/nginx-agent/install-nginx-plus-advanced-metrics.md" >}}) guide. --- diff --git a/content/nms/acm/tutorials/introspection-keycloak.md b/content/nms/acm/tutorials/introspection-keycloak.md index adad6db81..7cccaa006 100644 --- a/content/nms/acm/tutorials/introspection-keycloak.md +++ b/content/nms/acm/tutorials/introspection-keycloak.md @@ -15,7 +15,7 @@ This tutorial walks through configuring an OAuth2 Introspection policy on an API {{}}The configuration presented in this guide is for demonstration purposes only. The secure configuration of Environments and Proxies in API Connectivity Manager, or the secure configuration of Keycloak as the authorization server, is not in scope for this tutorial and should be given full attention when planning for production use.{{}} -{{}}See the [OAuth2 Introspection Policy]({{< relref "/nms/acm/how-to/policies/introspection.md" >}}) reference guide for a detailed overview of the policy.{{}} +{{}}See the [OAuth2 Introspection Policy]({{< ref "/nms/acm/how-to/policies/introspection.md" >}}) reference guide for a detailed overview of the policy.{{}} --- @@ -58,7 +58,7 @@ This section configures the hosts used in this tutorial. In the following table, ### Install NGINX Management Suite & API Connectivity Manager {#install-nsm-acm} -1. Follow the steps in the [Installation Guide]({{< relref "/nim/deploy/_index.md" >}}) to set up NGINX Management Suite and API Connectivity Manager. You do not need to configure a Developer Portal for this tutorial. +1. Follow the steps in the [Installation Guide]({{< ref "/nim/deploy/_index.md" >}}) to set up NGINX Management Suite and API Connectivity Manager. You do not need to configure a Developer Portal for this tutorial. ### Install NGINX Agent on Data Plane Host {#install-agent} @@ -328,7 +328,7 @@ curl -L -X POST 'http://192.0.2.5:8080/realms/nginx/protocol/openid-connect/toke -H "Authorization: Bearer " \ -H "Accept: application/json" \ -H "Content-Type: application/x-www-form-urlencoded" \ - --data-urlencode 'token=' + --data-urlencode 'token=' | jq ``` diff --git a/content/nms/acm/tutorials/rbac-api-owners.md b/content/nms/acm/tutorials/rbac-api-owners.md index e34af92cc..c9604d295 100644 --- a/content/nms/acm/tutorials/rbac-api-owners.md +++ b/content/nms/acm/tutorials/rbac-api-owners.md @@ -44,7 +44,7 @@ To complete the instructions in this guide, you need the following: {{}}Confirm pre-reqs and add links to topics.{{}} - API Connectivity Manager is installed, licensed, and running -- One or more [Service workspaces]({{< relref "/nms/acm/how-to/services/publish-api.md#create-a-service-workspace" >}}) +- One or more [Service workspaces]({{< ref "/nms/acm/how-to/services/publish-api.md#create-a-service-workspace" >}}) --- diff --git a/content/nms/acm/tutorials/rbac-infra-admins.md b/content/nms/acm/tutorials/rbac-infra-admins.md index 0f55856b4..4a70c2a7e 100644 --- a/content/nms/acm/tutorials/rbac-infra-admins.md +++ b/content/nms/acm/tutorials/rbac-infra-admins.md @@ -47,7 +47,7 @@ To complete the instructions in this guide, you need the following: {{}}Confirm pre-reqs and add links to topics.{{}} - API Connectivity Manager is installed, licensed, and running -- One or more [Infrastructure workspaces]({{< relref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#create-workspace" >}}) +- One or more [Infrastructure workspaces]({{< ref "/nms/acm/how-to/infrastructure/manage-api-infrastructure.md#create-workspace" >}}) --- diff --git a/content/nms/nginx-agent/install-nginx-agent.md b/content/nms/nginx-agent/install-nginx-agent.md index 64a18ac64..279f2dcd9 100644 --- a/content/nms/nginx-agent/install-nginx-agent.md +++ b/content/nms/nginx-agent/install-nginx-agent.md @@ -13,7 +13,7 @@ type: This section lists the prerequisites for installing and configuring NGINX Agent. Follow the steps below to complete the requirements: -1. [F5 NGINX Management Suite is installed on a server]({{< relref "/nim/deploy/_index.md" >}}). +1. [F5 NGINX Management Suite is installed on a server]({{< ref "/nim/deploy/_index.md" >}}). {{}} When installing and configuring NGINX Management Suite, take note of the fully qualified domain name (FQDN) and gRPC port number. You'll need this information to properly configure NGINX Agent to communicate with NGINX Management Suite. {{}} @@ -50,7 +50,7 @@ To see if `nginx_agent_selinux` is installed, run the following command: {{%/tab%}} {{}} -5. Review the [Technical Specifications]({{< relref "/nim/fundamentals/tech-specs.md" >}}) guide for system requirements. +5. Review the [Technical Specifications]({{< ref "/nim/fundamentals/tech-specs.md" >}}) guide for system requirements. --- @@ -394,7 +394,7 @@ Additionally, you can use the agent installation script to add these fields: ### Enable NGINX Plus Advanced Metrics -- To enable NGINX Plus advanced metrics, follow the steps in the [Install NGINX Plus Metrics Module]({{< relref "/nms/nginx-agent/install-nginx-plus-advanced-metrics.md" >}}) guide. +- To enable NGINX Plus advanced metrics, follow the steps in the [Install NGINX Plus Metrics Module]({{< ref "/nms/nginx-agent/install-nginx-plus-advanced-metrics.md" >}}) guide. --- @@ -438,7 +438,7 @@ For instructions on how configure mTLS to secure communication between NGINX Age ## NGINX Metrics -After you register an NGINX instance with NGINX Management Suite, the NGINX Agent will collect and report metrics. For more information about the metrics that are reported, see [Overview: Instance Metrics]({{< relref "/nim/monitoring/overview-metrics.md" >}}). +After you register an NGINX instance with NGINX Management Suite, the NGINX Agent will collect and report metrics. For more information about the metrics that are reported, see [Overview: Instance Metrics]({{< ref "/nim/monitoring/overview-metrics.md" >}}). ## Container Support NGINX Agent is a companion daemon for NGINX Open Source or NGINX Plus instances and must run in the same container to work. diff --git a/content/nms/nginx-agent/install-nginx-plus-advanced-metrics.md b/content/nms/nginx-agent/install-nginx-plus-advanced-metrics.md index afd021fbd..68ed6465a 100644 --- a/content/nms/nginx-agent/install-nginx-plus-advanced-metrics.md +++ b/content/nms/nginx-agent/install-nginx-plus-advanced-metrics.md @@ -18,7 +18,7 @@ See our End of Sale announcement for more details. {{< /eol-call-out >}} The F5 NGINX Plus metrics module is a dynamic module that you can install on your NGINX Plus data plane instances for use with API Connectivity Manager. The metrics module reports advanced, app-centric metrics and dimensions like “application name” or “gateway” to the NGINX Agent, which then aggregates and publishes the data to API Connectivity Manager. Advanced, app-centric metrics are used by particular API Connectivity Manager for features associated with HTTP requests. -This module is not required or necessary for NGINX Instance Manager. +This module is not required or necessary for NGINX Instance Manager. --- @@ -53,7 +53,7 @@ Complete the following prerequisites before proceeding with the steps in this gu
-- Verify that [NGINX Agent]({{< relref "/nms/nginx-agent/install-nginx-agent.md" >}}) is installed on each NGINX Plus instance. +- Verify that [NGINX Agent]({{< ref "/nms/nginx-agent/install-nginx-agent.md" >}}) is installed on each NGINX Plus instance. --- @@ -142,7 +142,7 @@ advanced_metrics: priority_table_threshold: 1000 ``` -{{< see-also >}} See the [NGINX Agent CLI Flags & Usage]({{< relref "/nms/nginx-agent/install-nginx-agent.md#nginx-agent-cli-flags--usage" >}}) topic for a description of each of these flags. {{< /see-also >}} +{{< see-also >}} See the [NGINX Agent CLI Flags & Usage]({{< ref "/nms/nginx-agent/install-nginx-agent.md#nginx-agent-cli-flags--usage" >}}) topic for a description of each of these flags. {{< /see-also >}}
@@ -154,4 +154,4 @@ After you install the NGINX Plus metrics module, run the command below to start sudo systemctl start nginx-agent ``` -After completing the steps in this guide, you will start to see app-centric metrics displayed in the NGINX Management Suite user interface. You can also collect metrics by using the REST API. To learn more, refer to [Using the Metrics API]({{< relref "/nim/monitoring/metrics-api" >}}). +After completing the steps in this guide, you will start to see app-centric metrics displayed in the NGINX Management Suite user interface. You can also collect metrics by using the REST API. To learn more, refer to [Using the Metrics API]({{< ref "/nim/monitoring/metrics-api" >}}). diff --git a/content/nms/nim/getting-started/waf-config-management.md b/content/nms/nim/getting-started/waf-config-management.md index 90eb37df5..28119e9e8 100644 --- a/content/nms/nim/getting-started/waf-config-management.md +++ b/content/nms/nim/getting-started/waf-config-management.md @@ -15,16 +15,16 @@ You can use F5 NGINX Management Suite Instance Manager to publish configurations 1. Set up your NGINX Management Suite Instance Manager instance: - - [Install the WAF Compiler]({{< relref "/nim/nginx-app-protect/setup-waf-config-management#install-the-waf-compiler" >}}) + - [Install the WAF Compiler]({{< ref "/nim/nginx-app-protect/setup-waf-config-management#install-the-waf-compiler" >}}) - - [Set up the Attack Signatures and Threat Campaigns]({{< relref "/nim/nginx-app-protect/setup-waf-config-management#set-up-attack-signatures-and-threat-campaigns" >}}) + - [Set up the Attack Signatures and Threat Campaigns]({{< ref "/nim/nginx-app-protect/setup-waf-config-management#set-up-attack-signatures-and-threat-campaigns" >}}) -2. In Instance Manager, [onboard the App Protect Instances]({{< relref "/nim/nginx-app-protect/setup-waf-config-management#onboard-nginx-app-protect-waf-instances" >}}) you want to publish policies and log profiles to. +2. In Instance Manager, [onboard the App Protect Instances]({{< ref "/nim/nginx-app-protect/setup-waf-config-management#onboard-nginx-app-protect-waf-instances" >}}) you want to publish policies and log profiles to. -3. [Create the security policies]({{< relref "/nim/nginx-app-protect/manage-waf-security-policies#create-security-policy" >}}). +3. [Create the security policies]({{< ref "/nim/nginx-app-protect/manage-waf-security-policies#create-security-policy" >}}). -4. [Create the security log profiles]({{< relref "/nim/nginx-app-protect/manage-waf-security-policies#create-security-log-profile" >}}). +4. [Create the security log profiles]({{< ref "/nim/nginx-app-protect/manage-waf-security-policies#create-security-log-profile" >}}). -5. [Add or edit a WAF Configuration]({{< relref "/nim/nginx-app-protect/setup-waf-config-management#add-waf-config" >}}) to your NGINX Instances, and publish using Instance Manager. +5. [Add or edit a WAF Configuration]({{< ref "/nim/nginx-app-protect/setup-waf-config-management#add-waf-config" >}}) to your NGINX Instances, and publish using Instance Manager. {{}}Map the App Protect directives on NGINX configuration to `.tgz` file extensions (not `.json`).{{< /note >}} diff --git a/content/nms/nms-resilience.md b/content/nms/nms-resilience.md index 5e1d397fc..251860c3c 100644 --- a/content/nms/nms-resilience.md +++ b/content/nms/nms-resilience.md @@ -11,7 +11,7 @@ type: ## Overview -The F5 NGINX Management Suite platform includes four services (described below) that work together to monitor NGINX data plane instances. These platform services feature self-monitoring capabilities, allowing them to detect unresolvable issues and shut down automatically. When you [install NGINX Management Suite on Kubernetes]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md">}}), you get the benefits of fault tolerance and automated recovery: when a platform service fails, Kubernetes will create new pods and restart the affected services without disruption to the data plane. +The F5 NGINX Management Suite platform includes four services (described below) that work together to monitor NGINX data plane instances. These platform services feature self-monitoring capabilities, allowing them to detect unresolvable issues and shut down automatically. When you [install NGINX Management Suite on Kubernetes]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md">}}), you get the benefits of fault tolerance and automated recovery: when a platform service fails, Kubernetes will create new pods and restart the affected services without disruption to the data plane. --- @@ -27,7 +27,7 @@ As the control plane for NGINX Open Source and NGINX Plus instances, the NGINX M ### Platform Services -NGINX Management Suite includes the following four platform services that work together to monitor and manage NGINX data plane instances through APIs and web dashboards. When you [install NGINX Management Suite on Kubernetes]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}), these platform services are deployed as [Kubernetes Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) and are monitored by the [Kubernetes control plane](https://kubernetes.io/docs/concepts/overview/components/#control-plane-components) to ensure consistent and reliable operation. +NGINX Management Suite includes the following four platform services that work together to monitor and manage NGINX data plane instances through APIs and web dashboards. When you [install NGINX Management Suite on Kubernetes]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}), these platform services are deployed as [Kubernetes Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) and are monitored by the [Kubernetes control plane](https://kubernetes.io/docs/concepts/overview/components/#control-plane-components) to ensure consistent and reliable operation. {{< include "nms/services/platform-services.md" >}} @@ -73,7 +73,7 @@ In an environment with the following specifications, we observed the following r - NGINX Management Suite 2.9.0 -- ClickHouse pod as defined in the [NGINX Management Suite helm chart]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md">}}) +- ClickHouse pod as defined in the [NGINX Management Suite helm chart]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md">}}) ### Recovery Times @@ -128,4 +128,4 @@ When integrating NGINX Management Suite into your existing Business Continuity a ### Install NGINX Management Suite on Kubernetes -For resilient deployments, we recommend [installing NGINX Management Suite on Kubernetes]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}). With Kubernetes, you'll get the benefits of persistent volumes and automated recovery for a reliable control plane. +For resilient deployments, we recommend [installing NGINX Management Suite on Kubernetes]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md" >}}). With Kubernetes, you'll get the benefits of persistent volumes and automated recovery for a reliable control plane. diff --git a/content/nms/support/k8s-support-package.md b/content/nms/support/k8s-support-package.md index cc1ec7658..2b47c38ad 100644 --- a/content/nms/support/k8s-support-package.md +++ b/content/nms/support/k8s-support-package.md @@ -16,7 +16,7 @@ type: Use the Kubernetes support package script to collect information about your system for troubleshooting and debugging issues. -The script collects system and service information and then packages the data into a tar archive, which you can share with [NGINX Customer Support]({{< relref "/nms/support/contact-support.md" >}}). +The script collects system and service information and then packages the data into a tar archive, which you can share with [NGINX Customer Support]({{< ref "/nms/support/contact-support.md" >}}). --- diff --git a/content/nms/support/support-package.md b/content/nms/support/support-package.md index ffa1954e6..93405f0b3 100644 --- a/content/nms/support/support-package.md +++ b/content/nms/support/support-package.md @@ -15,7 +15,7 @@ type: The support package script can be used to collect information about your system for troubleshooting and debugging issues. -The script collects system and service information and then packages the data into a tar archive, which you can share with [NGINX Customer Support]({{< relref "/nms/support/contact-support.md" >}}). +The script collects system and service information and then packages the data into a tar archive, which you can share with [NGINX Customer Support]({{< ref "/nms/support/contact-support.md" >}}). ## Usage diff --git a/content/ossc.md b/content/ossc.md index 2d9a5f51d..7d4f55a82 100644 --- a/content/ossc.md +++ b/content/ossc.md @@ -59,6 +59,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI --- -License information for open source components included in the [NGINX Plus]({{< relref "/nginx/" >}}) software: +License information for open source components included in the [NGINX Plus]({{< ref "/nginx/" >}}) software: -- [NGINX Plus Open Source Components]({{< relref "/nginx/open-source-components.md" >}}) +- [NGINX Plus Open Source Components]({{< ref "/nginx/open-source-components.md" >}}) diff --git a/content/solutions/about-subscription-licenses.md b/content/solutions/about-subscription-licenses.md index 5c4cff681..1a964d7c7 100644 --- a/content/solutions/about-subscription-licenses.md +++ b/content/solutions/about-subscription-licenses.md @@ -12,7 +12,7 @@ docs: DOCS-000 We’re updating NGINX Plus to align with F5’s entitlement and visibility policy, bringing benefits like fair and compliant usage, better visibility into license management, and improved customer support. -Starting with NGINX Plus R33, all **NGINX Plus instances require a valid JSON Web Token (JWT) license**. This license is tied to your subscription (not individual instances) and is used to validate your subscription and automatically send usage reports to F5's licensing endpoint (`product.connect.nginx.com`), as required by your subscription agreement. In offline environments, usage reporting is [routed through NGINX Instance Manager]({{< relref "nim/disconnected/report-usage-disconnected-deployment.md" >}}). +Starting with NGINX Plus R33, all **NGINX Plus instances require a valid JSON Web Token (JWT) license**. This license is tied to your subscription (not individual instances) and is used to validate your subscription and automatically send usage reports to F5's licensing endpoint (`product.connect.nginx.com`), as required by your subscription agreement. In offline environments, usage reporting is [routed through NGINX Instance Manager]({{< ref "nim/disconnected/report-usage-disconnected-deployment.md" >}}). ### Important changes @@ -23,7 +23,7 @@ Starting with NGINX Plus R33, all **NGINX Plus instances require a valid JSON We ##### NGINX Plus will **stop processing traffic** if: -- It can't submit an initial usage report to F5's licensing endpoint or NGINX Instance Manager. +- It can't submit an initial usage report to F5's licensing endpoint or NGINX Instance Manager. If the first report fails, NGINX Plus immediately stops processing traffic and logs an `EMERG` message. NGINX Plus will attempt to report every minute, and traffic processing will resume once the initial report succeeds. If you need time to prepare for usage reporting, see [Postpone reporting enforcement](#postpone-reporting-enforcement). @@ -37,7 +37,7 @@ Starting with NGINX Plus R33, all **NGINX Plus instances require a valid JSON We When installing or upgrading to NGINX Plus R33 or later, take the following steps: - **[Download and add a valid JWT license](#download-jwt)** to each NGINX Plus instance. -- **[Set up your environment](#set-up-environment)** to allow NGINX Plus to send usage reports. +- **[Set up your environment](#set-up-environment)** to allow NGINX Plus to send usage reports. --- @@ -46,7 +46,7 @@ When installing or upgrading to NGINX Plus R33 or later, take the following step Before you install or upgrade to NGINX Plus R33 or later, make sure to: ### Download the license from MyF5 {#download-jwt} - + {{< include "licensing-and-reporting/download-jwt-from-myf5.md" >}} ### Copy the license to each NGINX Plus instance @@ -117,7 +117,7 @@ mgmt { #### NGINX Plus installation guide -For detailed instructions on installing or upgrading NGINX Plus, visit the [NGINX Plus installation guide]({{< relref "nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). +For detailed instructions on installing or upgrading NGINX Plus, visit the [NGINX Plus installation guide]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-plus.md" >}}). #### `mgmt` module and directives @@ -129,13 +129,13 @@ The instructions below use the terms "internet-connected" and "network-restricte #### License NGINX Instance Manager -- **Internet-connected**: Follow the steps in [Add license]({{< relref "nim/admin-guide/license/add-license.md" >}}). -- **Network-restricted**: Follow the steps in [Add a license in a disconnected environment]({{< relref "nim/disconnected/add-license-disconnected-deployment.md" >}}). +- **Internet-connected**: Follow the steps in [Add license]({{< ref "nim/admin-guide/license/add-license.md" >}}). +- **Network-restricted**: Follow the steps in [Add a license in a disconnected environment]({{< ref "nim/disconnected/add-license-disconnected-deployment.md" >}}). #### Submit usage reports to F5 from NGINX Instance Manager {#submit-usage-reports-from-nim} -- **Internet-connected**: Follow the steps in [Report usage to F5]({{< relref "nim/admin-guide/license/report-usage-connected-deployment.md" >}}). -- **Network-restricted**: Follow the steps in [Report usage to F5 in a disconnected environment]({{< relref "nim/disconnected/report-usage-disconnected-deployment.md" >}}). +- **Internet-connected**: Follow the steps in [Report usage to F5]({{< ref "nim/admin-guide/license/report-usage-connected-deployment.md" >}}). +- **Network-restricted**: Follow the steps in [Report usage to F5 in a disconnected environment]({{< ref "nim/disconnected/report-usage-disconnected-deployment.md" >}}). ### NGINX App Protect WAF diff --git a/content/solutions/r33-pre-release-guidance-for-automatic-upgrades.md b/content/solutions/r33-pre-release-guidance-for-automatic-upgrades.md index 41ef829f9..9df56014b 100644 --- a/content/solutions/r33-pre-release-guidance-for-automatic-upgrades.md +++ b/content/solutions/r33-pre-release-guidance-for-automatic-upgrades.md @@ -12,16 +12,16 @@ docs: DOCS-000 --- {{}} -NGINX Plus R33 requires a valid JSON Web Token (JWT) to start and accept new connections. +NGINX Plus R33 requires a valid JSON Web Token (JWT) to start and accept new connections.
-If automatic upgrades are enabled, apply the JWT and configure your network now to avoid downtime when R33 is released. +If automatic upgrades are enabled, apply the JWT and configure your network now to avoid downtime when R33 is released. {{}} ## What to know before upgrading to NGINX Plus R33 ### What's new -Starting with NGINX Plus R33, expected in **Q4 of 2024**, all **NGINX Plus instances will require a valid JSON Web Token (JWT)**. The JWT is tied to your subscription, not individual instances, and is used to **validate your subscription** and **report telemetry data**. In internet-connected environments, telemetry is sent to F5’s licensing endpoint. In offline environments, telemetry is routed through [NGINX Instance Manager]({{< relref "/nim" >}}). +Starting with NGINX Plus R33, expected in **Q4 of 2024**, all **NGINX Plus instances will require a valid JSON Web Token (JWT)**. The JWT is tied to your subscription, not individual instances, and is used to **validate your subscription** and **report telemetry data**. In internet-connected environments, telemetry is sent to F5’s licensing endpoint. In offline environments, telemetry is routed through [NGINX Instance Manager]({{< ref "/nim" >}}). This change is part of F5's broader licensing program, designed to make subscription renewals and usage reporting easier. The [telemetry data](#telemetry) helps us improve our products and services to better meet your needs. @@ -29,23 +29,23 @@ This change is part of F5's broader licensing program, designed to make subscrip If you’ve enabled automatic upgrades, you need to act **before** NGINX Plus R33 releases to ensure a smooth upgrade: -- [**Download and apply a valid JSON Web Token (JWT)**](#jwt) to each NGINX Plus instance. +- [**Download and apply a valid JSON Web Token (JWT)**](#jwt) to each NGINX Plus instance. **Without this token, NGINX Plus won’t start**, and the upgrade won’t complete. -- [**Configure your network**](#configure-network) to allow NGINX Plus to report telemetry data. - **If telemetry reporting fails, NGINX Plus will stop accepting new connections**. +- [**Configure your network**](#configure-network) to allow NGINX Plus to report telemetry data. + **If telemetry reporting fails, NGINX Plus will stop accepting new connections**. There’s an exception for previously reported instances — refer to [handling outages](#handling-outages) for more details. Follow the [pre-release steps](#steps) below to complete the process. ##### Impacts to NGINX Ingress Controller -- **Don’t upgrade to NGINX Plus R33 until the next version of NGINX Ingress Controller is released.** +- **Don’t upgrade to NGINX Plus R33 until the next version of NGINX Ingress Controller is released.** NGINX Plus R33 isn’t compatible with NGINX Ingress Controller v3.7.0. ##### Impacts to previous NGINX Plus versions -- **No action needed**: +- **No action needed**: If you use NGINX Plus before R33 and haven’t enabled automatic upgrades, no action is required. --- @@ -72,7 +72,7 @@ To ensure NGINX Plus R33 can report telemetry data, follow these steps based on #### For internet-connected environments: -1. **Open port 443**: +1. **Open port 443**: Allow outbound HTTPS traffic on TCP port 443 to communicate with F5's licensing endpoint (`product.connect.nginx.com`). Ensure that the following IP addresses are allowed: - `3.135.72.139` @@ -87,10 +87,10 @@ To ensure NGINX Plus R33 can report telemetry data, follow these steps based on usage_report endpoint= interval=1hr; ``` -1. **Open port 443 for NGINX Instance Manager**: +1. **Open port 443 for NGINX Instance Manager**: Ensure NGINX Plus can connect to NGINX Instance Manager to report usage data. -If NGINX Instance Manager has internet access, it will automatically report usage data to F5. If it doesn't doesn't have internet access, you can manually [submit usage reports to F5 for verification and acknowledgement]({{< relref "nim/disconnected/report-usage-disconnected-deployment.md" >}}). +If NGINX Instance Manager has internet access, it will automatically report usage data to F5. If it doesn't doesn't have internet access, you can manually [submit usage reports to F5 for verification and acknowledgement]({{< ref "nim/disconnected/report-usage-disconnected-deployment.md" >}}). #### For fully disconnected environments: @@ -105,7 +105,7 @@ Starting with **NGINX Instance Manager 2.18** (**coming soon**), you’ll be abl If a temporary outage occurs, either on your side or F5’s: -- As long as your instance has successfully reported at least once, you’ll have a **180-day grace period** to resolve the issue. +- As long as your instance has successfully reported at least once, you’ll have a **180-day grace period** to resolve the issue. During this grace period, NGINX Plus will continue running without any restrictions. ---