Guide for permission issue when using NIC with NGINX Agent

[0jsong]

Hi. I've been trying to use NGINX Agent with NIC to integrate NAP WAF V5 with NIM Security Monitoring. When I tried to run NGINX Agent with -agent=true args, I found out this error.

level=fatal msg="Unable to load properties from config files (/etc/nginx-agent/nginx-agent.conf, /var/lib/nginx-agent/agent-dynamic.conf) - error attempting to open dynamic config (/var/lib/nginx-agent/agent-dynamic.conf): open /var/lib/nginx-agent/agent-dynamic.conf: permission denied"

This appears to happen because NIC pod runs with 101 User(nginx) and doesn't have permission to read /var/lib/nginx-agent dir.
So I changed the pod's security context(not container's) to fsGroup: 101 and mounted emptyDir to /var/lib/nginx-agent.

The following are some of the contents of the deployment.yaml

spec:
  template:
    spec:
      securityContext:
        # Added fsGroup to grant nginx user (101) access to mounted volumes
        fsGroup: 101               
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: nginx-plus-ingress
        args:
        - -nginx-plus
        - -nginx-configmaps=$(POD_NAMESPACE)/nginx-config
        - -mgmt-configmap=$(POD_NAMESPACE)/nginx-config-mgmt
        # Activate NGINX Agent
        - -agent=true
        - -agent-instance-group=nginx-ingress
        - -report-ingress-status
        - -external-service=nginx-ingress
        - -enable-app-protect
        - -enable-prometheus-metrics
        - -global-configuration=$(POD_NAMESPACE)/nginx-configuration
        - -log-level=error
        # Maintain container security constraints
        securityContext: 
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL
          runAsNonRoot: true
          runAsUser: 101
        volumeMounts:
        - mountPath: /opt/app_protect/bd_config
          name: app-protect-bd-config
        - mountPath: /opt/app_protect/config
          name: app-protect-config
        - mountPath: /etc/app_protect/bundles
          name: app-protect-bundles
        - mountPath: /etc/nginx-agent/nginx-agent.conf
          name: agent-config
          subPath: nginx-agent.conf
        # Mount directory for permission
        - mountPath: /var/lib/nginx-agent
          name: agent-lib-dir
      volumes:
      - name: app-protect-bd-config
        emptyDir: {}
      - name: app-protect-config
        emptyDir: {}      
      - name: app-protect-bundles
        persistentVolumeClaim:
          claimName: waf-bundle-pvc
      - name: agent-config
        configMap:
          name: agent-config
      # Mount directory for permission
      - name: agent-lib-dir  
        emptyDir: {}
        

If there's better solution for this, please let me know. And it would be nice to have some guide for using NIC with NGINX Agent.

[github-actions]

Hi @0jsong thanks for reporting!

Be sure to check out the docs and the Contributing Guidelines while you wait for a human to take a look at this 🙂

Cheers!

[danielnginx]

@0jsong could you please try to follow the manifest documentation here and see if it solves your problem? https://docs.nginx.com/nginx-ingress-controller/tutorials/security-monitoring/

[0jsong]

Hello @danielnginx , sorry for late respond.
If I follow the documentation, only setting volumeMounts on /etc/nginx-agent/nginx-agent.conf, agent fails to start.

time="2025-09-17T06:30:25Z" level=fatal msg="Unable to load properties from config files (/etc/nginx-agent/nginx-agent.conf, /var/lib/nginx-agent/agent-dynamic.conf) - error attempting to open dynamic config (/var/lib/nginx-agent/agent-dynamic.conf): open /var/lib/nginx-agent/agent-dynamic.conf: permission denied"

It seems like NGINX Ingress Controller container doesn't have permission to make /var/lib/nginx-agent directory and write agent-dynamic.conf file at startup.

If I try to start nginx-agent manually inside container, same error occurs.

nginx@nginx-plus-ingress-waf-665465f84c-gbntz:/$ nginx-agent

FATA[0000] Unable to load properties from config files (/etc/nginx-agent/nginx-agent.conf, /var/lib/nginx-agent/agent-dynamic.conf) - error attempting to open dynamic config (/var/lib/nginx-agent/agent-dynamic.conf): open /var/lib/nginx-agent/agent-dynamic.conf: permission denied

That's the reason why I mounted /var/lib/nginx-agent directory with emptyDir inside container.

        volumeMounts:
        - name: agent-config
          mountPath: /etc/nginx-agent                                                                                                                                                      
          subPath: nginx-agent.conf                                                                                                                                    
        - name: agent-var-dir  
          mountPath: /var/lib/nginx-agent

      volumes:       
      - name: agent-config                                                                                                                                                                             
        configMap:                                                                                                                                                            
          defaultMode: 420                                                                                                                                                    
          name: agent-config                                                                                                                                                  
      - name: agent-var-dir                                                                                                                                                      
        emptyDir: {}  

[AlexFenlon]

Hi @0jsong,

Thanks for bringing this to our attention,

NGINX Agent should have already been stated within the pod,

This is exactly the solution, we must have missed this in our documentation. I will update this and reply.

[AlexFenlon]

The doc has been updated, thank you for submitting and hope that solved your issue.

https://docs.nginx.com/nginx-ingress-controller/tutorials/security-monitoring/#deploying-nginx-ingress-controller-with-nginx-agent-configuration