Merge branch 'main' into update-icon-usage

Author: lamATnginx

_banners/agent-v3-release.md

@@ -1,7 +1,8 @@
 {{< banner "notice" "NGINX Agent 3.0 is now available" >}}
 
+The documentation in this section is for **NGINX Agent version 2.x**. For NGINX Agent 3.x content visit the [NGINX One Console documentation]({{< ref "/nginx-one/agent/" >}})
 
-F5 NGINX One Console and NGINX Instance Manager (NIM) do not currently support Agent 3.x. If you are using NGINX One Console or NGINX Instance Manager in your environment, upgrade to the latest Agent 2.x version by following the [Upgrade NGINX Agent](/nginx-agent/installation-upgrade/upgrade/) guide.
+F5 NGINX Instance Manager (NIM) does not currently support NGINX Agent 3.x. NGINX Instance Manager customers can upgrade to the latest NGINX Agent 2.x version by following the [Upgrade NGINX Agent](/nginx-agent/installation-upgrade/upgrade/) guide.
 
 Please see the [Technical specifications](/nginx-agent/technical-specifications/) for product compatibility.
 

content/includes/agent/about.md

@@ -40,4 +40,4 @@ Additionally, it collects system-level data, including CPU usage, memory consump
 deep observability into NGINX's behavior, enabling teams to troubleshoot issues effectively, optimize performance, and
 maintain high availability.
 
-Collected metrics can be seamlessly exported to NGINX One Console or integrated with third-party data aggregators.
+By default, the OpenTelemetry Collector is configured to send metrics to NGINX One Console.

content/nginx-one/agent/containers/run-agent-container.md

@@ -29,13 +29,10 @@ container image and create a configuration file.
 
 ### Pull the NGINX Agent container image
 
-The NGINX Agent container image must be downloaded from a trusted source such as Docker Hub or a private container registry.
-
 Run the following command to pull the official image:
 
 ```bash
-<!-- Registry HERE -->
-docker pull <Registry HERE>:latest
+docker pull private-registry.nginx.com/nginx-plus/agentv3:latest
 ```
 
 Ensure you are using the correct image version. Replace `latest` with the desired version tag if necessary.

content/nginx-one/connect-instances/connect-nginx-plus-container-images-to-nginx-one.md

@@ -42,13 +42,13 @@ sudo docker login private-registry.nginx.com --username=YOUR_JWT_HERE --password
 
 ### Pull the NGINX Plus image
 
-Pull the NGINX Plus image from the private registry. Replace `VERSION_TAG` with the desired version, such as `alpine`, `debian`, or `ubi`.
+Pull the NGINX Plus image from the private registry. Replace `<version-tag>` with the desired version, such as `alpine`, `debian`, or `ubi`.
 
 ```sh
-sudo docker pull private-registry.nginx.com/nginx-plus/agent:VERSION_TAG
+docker pull private-registry.nginx.com/nginx-plus/agentv3:<version-tag>
 ```
 
-You must specify a version tag. The `latest` tag is not supported. Learn more in the [Deploying NGINX and NGINX Plus on Docker]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}) guide.
+You must specify a version tag that matches your distribution. The `latest` tag is not supported. Learn more in the [Deploying NGINX and NGINX Plus on Docker]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}) guide.
 
 <br>
 
@@ -62,7 +62,7 @@ sudo docker pull private-registry.nginx.com/nginx-plus/agent:debian
 
 ### Start the NGINX Plus container
 
-Start the Docker container to connect it to NGINX One. Replace `YOUR_NGINX_ONE_DATA_PLANE_KEY_HERE` with your data plane key and `VERSION_TAG` with the version tag you pulled.
+Start the Docker container to connect it to NGINX One. Replace `YOUR_NGINX_ONE_DATA_PLANE_KEY_HERE` with your data plane key and `version-tag` with the version tag you pulled.
 
 **For NGINX Plus R33 or later**:
 
@@ -79,7 +79,7 @@ sudo docker run \
 --env=NGINX_AGENT_TLS_ENABLE=true \
 --restart=always \
 --runtime=runc \
--d private-registry.nginx.com/nginx-plus/agent:<VERSION_TAG>
+-d private-registry.nginx.com/nginx-plus/agent:<version-tag>
 ```
 
 <br>

content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md

@@ -162,14 +162,9 @@ When adding a new NGINX instance that is not yet registered with NGINX One, you
    - From the **OS Type** list, choose the appropriate operating system for your Docker image.
    - After selecting the OS, run the provided command to pull the Docker image.
 
-   **Note**: Subject to availability, you can modify the `agent: <VERSION_TAG>` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}).
+   **Note**: Subject to availability, you can modify the `agentv3:<version-tag>` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agentv3:r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}).
 
 
-   - From the **OS Type** list, choose the appropriate operating system for your Docker image.
-   - After selecting the OS, run the provided command to pull the Docker image.
-
-   **Note**: Subject to availability, you can modify the `agent: <VERSION_TAG>` to match the specific NGINX Plus version, OS type, and OS version you need. For example, you might use `agent: r32-ubi-9`. For more details on version tags and how to pull an image, see [Deploying NGINX and NGINX Plus on Docker]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}).
-
 10. Run the provided command, which includes the data plane key, in your NGINX instance terminal to start the Docker container.
 
 11. Select **Done** to complete the process.

content/nginx/admin-guide/installing-nginx/installing-nginx-docker.md

@@ -156,24 +156,36 @@ For NGINX Plus, run:
 docker pull private-registry.nginx.com/nginx-plus/base:<version-tag>
 ```
 
-For NGINX Plus with NGINX Agent, run:
+For NGINX Plus with NGINX Agent version 2, run:
 
 ```shell
 docker pull private-registry.nginx.com/nginx-plus/agent:<version-tag>
 ```
 
+For NGINX Plus with NGINX Agent version 3, run:
+
+```shell
+docker pull private-registry.nginx.com/nginx-plus/agentv3:<version-tag>
+```
+
 For NGINX Plus installed from `nginx` user (rootless installation), run:
 
 ```shell
 docker pull private-registry.nginx.com/nginx-plus/rootless-base:<version-tag>
 ```
 
-For NGINX Plus with NGINX Agent installed from `nginx` user (rootless installation), run:
+For NGINX Plus with NGINX Agent version 2 installed from `nginx` user (rootless installation), run:
 
 ```shell
 docker pull private-registry.nginx.com/nginx-plus/rootless-agent:<version-tag>
 ```
 
+For NGINX Plus with NGINX Agent version 3 installed from `nginx` user (rootless installation), run:
+
+```shell
+docker pull private-registry.nginx.com/nginx-plus/rootless-agentv3:<version-tag>
+```
+
 For NGINX modules, run:<!-- Is this enough info?-->
 
 ```shell

content/nic/configuration/policy-resource.md

@@ -175,8 +175,14 @@ condition:
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
 |``jwt`` | defines a JWT condition to rate limit against. | [ratelimit.condition.jwt](#ratelimitconditionjwt) | No |
-|``default`` | sets the rate limit in this policy to be the default if no conditions are met. In a group of policies with the same JWT condition, only one policy can be the default. | ``bool`` | No |
+|``variables`` | defines a Variable condition to rate limit against. | [ratelimit.condition.variables](#ratelimitconditionvariables) | No |
+|``default`` | sets the rate limit in this policy to be the default if no conditions are met. In a group of policies with the same condition, only one policy can be the default. | ``bool`` | No |
 {{% /table %}}
+{{< note >}}
+ 
+One condition of type `jwt` or `variables` is required. Each Policy supports only one condition.
+
+{{< /note >}}
 
 The rate limit policy with condition is designed to be used in combination with one or more rate limit policies. For example, multiple rate limit policies with [RateLimit.Condition.JWT](#ratelimitconditionjwt) can be used to apply different tiers of rate limit based on the value of a JWT claim. For a practical example of tiered rate limiting by the value of a JWT claim, see the example in our [GitHub repository](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/rate-limit-tiered-jwt-claim/README.md).
 
@@ -213,6 +219,27 @@ The rate limit policy will only apply to requests that contain a JWT with the sp
 |``match`` | the value of the claim to match against. | ``string`` | Yes |
 {{% /table %}}
 
+### RateLimit.Condition.Variables
+
+RateLimit.Condition.Variables defines a condition for a rate limit by NGINX variable. The following example defines a condition for a rate limit policy that only applies to requests with the request method with a value `GET`:
+
+```yaml
+variables:
+  - name: $request_method
+    match: GET
+```
+
+{{< note >}}
+Only one variable at a time is supported at present.
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | the name of the NGINX variable to be rate limit by. | ``string`` | Yes |
+|``match`` | the value of the NGINX variable to match against.  Values prefixed with the `~` character denote the following is a [regular expression](https://nginx.org/en/docs/http/ngx_http_map_module.html#map).  | ``string`` | Yes |
+{{% /table %}}
+
 ### APIKey
 
 The API Key auth policy configures NGINX to authorize client requests based on the presence of a valid API Key in a header or query param specified in the policy.

content/nic/releases.md

@@ -5,6 +5,55 @@ toc: true
 nd-content-type: reference
 nd-product: NIC
 nd-docs: DOCS-616
+---
+## 5.1.0
+
+08 Jul 2025
+
+This release includes the ability to configure Rate Limiting for your APIs based on a specific NGINX variable and its value. This allows you more granular control over how frequently specific users access your resources.
+
+Lastly, in our previous v5.0.0 release, we removed support for Open Tracing. This release replaces that observability capability with native NGINX Open Telemetry traces, allowing you to monitor the internal traffic of your applications.
+
+### <i class="fa-solid fa-rocket"></i> Features
+- [7642](https://github.com/nginx/kubernetes-ingress/pull/7642) Add OpenTelemetry support
+- [7916](https://github.com/nginx/kubernetes-ingress/pull/7916) Add support for Agent V3
+- [7884](https://github.com/nginx/kubernetes-ingress/pull/7884) Tiered rate limits with variables
+- [7765](https://github.com/nginx/kubernetes-ingress/pull/7765) Add OIDC PKCE configuration through Policy
+- [7832](https://github.com/nginx/kubernetes-ingress/pull/7832) Add request_method to rate-limit Policy
+- [7695](https://github.com/nginx/kubernetes-ingress/pull/7695) Add ConfigMapKeys & MGMTConfigMapKeys to Telemetry
+- [7705](https://github.com/nginx/kubernetes-ingress/pull/7705) Add Context to logging for JSON and TEXT formats
+
+### <i class="fa-solid fa-bug-slash"></i> Fixes
+
+- [7651](https://github.com/nginx/kubernetes-ingress/pull/7651) Use pod labels as headless selector labels
+- [7691](https://github.com/nginx/kubernetes-ingress/pull/7691) Avoid applying updates on Ingress Controller shutdown
+- [7748](https://github.com/nginx/kubernetes-ingress/pull/7748) Add ; in oidc files
+- [7786](https://github.com/nginx/kubernetes-ingress/pull/7786) Correct namespace for mgmt secrets
+- [7853](https://github.com/nginx/kubernetes-ingress/pull/7853) Update template for custom redirect URI
+- [7865](https://github.com/nginx/kubernetes-ingress/pull/7865) Maintain HeadlessService on upgrade
+
+### <i class="fa-solid fa-upload"></i> Dependencies
+
+- [7647](https://github.com/nginx/kubernetes-ingress/pull/7647), [7666](https://github.com/nginx/kubernetes-ingress/pull/7666), [7711](https://github.com/nginx/kubernetes-ingress/pull/7711), [7767](https://github.com/nginx/kubernetes-ingress/pull/7767), [7798](https://github.com/nginx/kubernetes-ingress/pull/7798), [7824](https://github.com/nginx/kubernetes-ingress/pull/7824), [7854](https://github.com/nginx/kubernetes-ingress/pull/7854), [7900](https://github.com/nginx/kubernetes-ingress/pull/7900), [7918](https://github.com/nginx/kubernetes-ingress/pull/7918), [7926](https://github.com/nginx/kubernetes-ingress/pull/7926) Bump Go dependancies
+- [7714](https://github.com/nginx/kubernetes-ingress/pull/7714), [7788](https://github.com/nginx/kubernetes-ingress/pull/7788), [7825](https://github.com/nginx/kubernetes-ingress/pull/7825), [7855](https://github.com/nginx/kubernetes-ingress/pull/7855), [7890](https://github.com/nginx/kubernetes-ingress/pull/7890), [7888](https://github.com/nginx/kubernetes-ingress/pull/7888), [7893](https://github.com/nginx/kubernetes-ingress/pull/7893), [7903](https://github.com/nginx/kubernetes-ingress/pull/7903) Bump Docker dependencies
+- [7808](https://github.com/nginx/kubernetes-ingress/pull/7808) Update kubernetes version to v1.33.1 in helm schema
+- [7896](https://github.com/nginx/kubernetes-ingress/pull/7896) Update go version to 1.24.4
+
+### <i class="fa-solid fa-download"></i> Upgrade
+
+- For NGINX, use the 5.1.0 images from our
+[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=5.1.0),
+[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
+[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the 5.1.0 images from the F5 Container registry or build your own image using the 5.1.0 source code
+- For Helm, use version 2.2.0 of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
+its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
+versions: 1.25-1.33.
+
 ---
 ## 5.0.0
 

content/nic/technical-specifications.md

@@ -19,7 +19,8 @@ We test NGINX Ingress Controller on a range of Kubernetes platforms for each rel
 {{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
 | NIC version | Kubernetes versions tested  | NIC Helm Chart version | NIC Operator version | NGINX / NGINX Plus version | End of Technical Support |
 | --- | --- | --- | --- | --- | --- |
-| {{< nic-version >}} | 1.25 - 1.32 | {{< nic-helm-version >}} | {{< nic-operator-version >}} | 1.27.4 / R34 | - |
+| {{< nic-version >}} | 1.25 - 1.33 | {{< nic-helm-version >}} | {{< nic-operator-version >}} | 1.27.5 / R34 P1 | - |
+| 5.0.0 | 1.25 - 1.32 | 2.1.0 | 3.1.0 | 1.27.4 / R34 | Apr 16, 2027 |
 | 4.0.1 | 1.25 - 1.32 | 2.0.1 | 3.0.1 | 1.27.4 / R33 P2 | Feb 7, 2027 |
 | 3.7.2 | 1.25 - 1.31 | 1.4.2 | 2.4.2 | 1.27.2 / R32 P1 | Nov 25, 2026 |
 | 3.6.2 | 1.25 - 1.31 | 1.3.2 | 2.3.2 | 1.27.1 / R32 P1 | Aug 19, 2026 |
@@ -41,13 +42,13 @@ We provide the following Docker images, which include NGINX or NGINX Plus bundle
 From release `v5.1.0` onwards, NGINX Ingress Controller will no longer provide binaries for the `armv7`, `s390x` & `ppc64le` architectures.
 {{< /important >}}
 
-_All images include NGINX 1.27.4._
+_All images include NGINX 1.27.5._
 
 {{< bootstrap-table "table table-bordered table-responsive" >}}
 |<div style="width:200px">Name</div> | <div style="width:100px">Base image</div> | DockerHub image | Architectures |
 | ---| --- | --- | --- |
-|Alpine-based image | ``nginx:1.27.4-alpine``,<br>based on on ``alpine:3.21`` | ``nginx/nginx-ingress:{{< nic-version >}}-alpine`` | arm64<br>amd64 |
-|Debian-based image | ``nginx:1.27.4``,<br>based on on ``debian:12-slim`` | ``nginx/nginx-ingress:{{< nic-version >}}`` | arm64<br>amd64 |
+|Alpine-based image | ``nginx:1.27.5-alpine``,<br>based on on ``alpine:3.21`` | ``nginx/nginx-ingress:{{< nic-version >}}-alpine`` | arm64<br>amd64 |
+|Debian-based image | ``nginx:1.27.5``,<br>based on on ``debian:12-slim`` | ``nginx/nginx-ingress:{{< nic-version >}}`` | arm64<br>amd64 |
 |Ubi-based image | ``redhat/ubi9-minimal`` | ``nginx/nginx-ingress:{{< nic-version >}}-ubi`` | arm64<br>amd64 |
 {{% /bootstrap-table %}}
 

layouts/shortcodes/nic-helm-version.html

@@ -1 +1 @@
-2.1.0
+2.2.0