You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| nginx-plus-module-appprotect | 33+5.264.0-1 | NGINX Plus app protect dynamic module version 5.264.0 |
31
+
| app-protect-module-plus | 33+5.264.0-1 | App-Protect package for Nginx Plus, includes all of the default files and examples. NGINX App Protect provides web application firewall (WAF) security protection for your web applications, including OWASP Top 10 attacks. |
| nginx-plus-module-appprotect | 33+5.264.0-1 | NGINX Plus app protect dynamic module version 5.264.0 |
55
+
| app-protect-module-plus | 33+5.264.0-1 | App-Protect package for Nginx Plus, includes all of the default files and examples. NGINX App Protect provides web application firewall (WAF) security protection for your web applications, including OWASP Top 10 attacks. |
@@ -17,9 +17,9 @@ Starting with version 2.20.0, NGINX Instance Manager supports **lightweight mode
17
17
18
18
- Lightweight mode requires NGINX Agent v2.41.1 or later.
19
19
20
-
{{< call-out "note" "Chart renamed in NIM 2.20.0" >}}
21
-
The Helm chart has been renamed from `nginx-stable/nms-hybrid` to `nginx-stable/nim`.
22
-
Make sure to update your chart references if you’re using version 2.20.0 or later.
20
+
21
+
{{< call-out "note" "Chart renamed with new versioning from NGINX Instance Manager 2.20.0" >}}
22
+
Starting with version 2.20.0, the Helm chart was renamed from `nginx-stable/nms-hybrid` to `nginx-stable/nim`. Chart versioning was also reset; `v2.0.0` is the first release under the new name. Be sure to update your chart references if you’re using version `2.20.0` or later.
These values are required when pulling images from the NGINX private registry. The chart does not auto-resolve image tags. Update the tag: fields to match the NGINX Instance Manager version you want to install.
179
+
These values are required when pulling images from the NGINX private registry. The chart doesn't auto-resolve image tags. Set each `tag:` value to match the NGINX Instance Manager version you want to install. Refer to the Helm chart table for version details.
186
180
187
181
Use the file with the `-f values.yaml` flag when installing the chart.
188
182
@@ -236,6 +230,11 @@ helm status nim -n nim
236
230
237
231
You should see `STATUS: deployed` in the output.
238
232
233
+
234
+
To find the right NGINX Instance Manager chart version, see the following table:
235
+
236
+
{{< include "nim/kubernetes/nms-chart-supported-module-versions.md" >}}
237
+
239
238
---
240
239
241
240
## Access the web interface
@@ -346,6 +345,112 @@ networkPolicies:
346
345
347
346
---
348
347
348
+
## Helm deployment for NGINX Instance Manager 2.19
349
+
350
+
### Create a Helm deployment values.yaml file
351
+
352
+
The `values.yaml` file customizes the Helm chart installation without changing the chart itself. You can use it to set image repositories, environment variables, resource requests, and other options.
353
+
354
+
1. Create a `values.yaml` file like this example:
355
+
356
+
- In the `imagePullSecrets` section, add your private Docker registry credentials.
357
+
- Set the `tag:` field to the version of NGINX Instance Manager you want to install. You can find supported versions in the Helm chart table.
358
+
359
+
For details on creating a secret, see the Kubernetes [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) guide.
Run the `helm install` command to deploy NGINX Instance Manager:
403
+
404
+
1. Replace `<path-to-your-values.yaml>` with the path to your `values.yaml` file.
405
+
2. Replace `<your-password>` with a secure password (containing a mix of uppercase, lowercase letters, numbers, and special characters).
406
+
407
+
{{< important >}} Remember to save the password for future use. Only the encrypted password is stored, and there's no way to recover or reset it if lost. {{< /important >}}
1. [Update the Helm repository list](#add-repository).
427
+
2. [Adjust your `values.yaml` file](#create-a-helm-deployment-values.yaml-file) if needed.
428
+
3. To upgrade the NGINX Instance Manager deployment, run the following command. This command updates the `nms` deployment with a new version from the `nginx-stable/nms-hybrid` repository. It also hashes the provided password and uses the `values.yaml` file at the path you specify.
429
+
4. Replace `<chart-version>` with the desired chart version of NGINX Instance Manager 2.19.x referring the Helm chart table.
- Replace `<path-to-your-values.yaml>` with the path to the `values.yaml` file you created]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart">}}).
441
+
- Replace `<your-password>` with a secure password that includes uppercase and lowercase letters, numbers, and special characters.
442
+
443
+
{{<call-out "important""Save the password!""">}} Save this password forfuture use. Only the encrypted password is storedin Kubernetes, and you can’t recover or reset it later. {{</call-out>}}
444
+
445
+
{{< call-out "note""Upgrading from 2.18.0 or earlier to 2.19.x">}}
446
+
If you're upgrading from version 2.18.0 or earlier to 2.19.x, note the following changes:
447
+
448
+
- If you used the legacy `nms` chart or release name, update the chart reference and adjust the release name if needed.
449
+
- The structure of the `values.yaml` file has changed in this release.
450
+
{{< /call-out >}}
451
+
452
+
---
453
+
349
454
## Helm Deployment for NGINX Instance Manager 2.18 or lower
350
455
351
456
### Create a Helm deployment values.yaml file
@@ -414,10 +519,6 @@ nms nginx-stable/nms \
414
519
--wait
415
520
```
416
521
417
-
To help you choose the right NGINX Instance Manager chart version, see the table in:
418
-
419
-
{{< include "nim/kubernetes/nms-chart-supported-module-versions.md" >}}
420
-
421
522
---
422
523
423
524
### Upgrade NGINX Instance Manager
@@ -462,9 +563,14 @@ openshift:
462
563
463
564
This ensures pods can run with the user IDs required by NGINX Instance Manager services.
464
565
465
-
{{< call-out "note" "Note" >}}
466
-
If you see permission errors during deployment, your user account might not have access to manage SCCs. Contact a cluster administrator to request access.
467
-
{{< /call-out >}}
566
+
567
+
When `openshift.enabled: true` is setin the `values.yaml` file, the NGINX Instance Manager deployment automatically creates a custom [Security Context Constraints (SCC)](https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/authentication_and_authorization/managing-pod-security-policies) object and links it to the Service Account used by all pods.
568
+
569
+
By default, OpenShift enforces strict security policies that require containers to run as **non-root** users. The deployment needs specific user IDs (UIDs) for certain services—**1000**for`nms`, and **101**for`nginx` and `clickhouse`. Since the default SCCs don’t allow these UIDs, the deployment creates a custom SCC. This SCC sets the `runAsUser` field to allow the necessary UIDs while still complying with OpenShift’s security standards.
570
+
571
+
This deployment has been tested with OpenShift v4.13.0 Server.
572
+
573
+
If you see permission errors during deployment, your account might not have access to manage SCCs. Ask a cluster administrator for access.
468
574
469
575
To verify that the SCC was created after installing the Helm chart, run:
Copy file name to clipboardExpand all lines: documentation/style-guide.md
+4-4Lines changed: 4 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,6 @@ This document provides guidelines specific to documenting F5 NGINX products and
20
20
21
21
When writing documentation for our project, align with the default guide's voice and tone.
22
22
23
-
24
23
## F5 brand trademarks and product names
25
24
26
25
- On the first mention of an enterprise NGINX product in a document, use the full product name. For example:
@@ -48,8 +47,11 @@ When writing documentation for our project, align with the default guide's voice
48
47
49
48
- Using NGINX Plus Docker images with NGINX Instance Manager
50
49
51
-
- Don't use articles ("the", "a") in front of product names. For example, use
50
+
- Don't use articles ("the", "a") in front of product names. For example, use:
52
51
- NGINX Agent (not "the NGINX Agent").
52
+
- An article can be used if the product name is qualifying another noun. For example, use:
53
+
- Edit the NGINX Agent configuration file (not "Edit NGINX Agent configuration file"): In this case, "NGINX Agent" is a descriptor for the term "configuration file".
54
+
- Expose NGINX Agent's REST API: In this case, NGINX Agent is a standalone noun phrase, and it "possesses" the REST API.
53
55
- Always use the full brand name in the meta description. The meta description does not count as first mention of the product in the document.
54
56
55
57
@@ -343,7 +345,6 @@ The table provides guidelines about the terms you should and should not use for
343
345
| Wizard and wizard | When documenting the GUI, you can capitalize Wizard if appropriate, such as for the Network Access Setup Wizard. When writing about wizards in general, or when a page title of a dialog box or GUI does not show Wizard in uppercase format, you can leave wizard in lowercase format. ||
344
346
| WWW or www | Do not include www. in web addresses In text, do not use WWW, but use Internet instead. Of course, you can use www as part of a URL. Although we're moving away from that, too. ||
345
347
346
-
---
347
348
348
349
## Topic types and templates
349
350
@@ -466,7 +467,6 @@ Before reloading or restarting NGINX, always check the syntax of the NGINX confi
466
467
sudo nginx -t
467
468
```
468
469
469
-
470
470
-**sudo systemctl nginx reload**
471
471
Use `reload` to apply configuration changes without stopping active connections. This keeps the NGINX service running while updating the configuration. It’s the preferred option for most changes because it avoids downtime and doesn’t interrupt users.
0 commit comments