Skip to content

Commit 4f70a15

Browse files
mjangmjang
committed
feature: incorporate NIC and NGF into NGINX 1 Console
1 parent 854ea90 commit 4f70a15

File tree

6 files changed

+192
-2
lines changed

6 files changed

+192
-2
lines changed

‎content/nginx-one/_index.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ F5 NGINX One Console makes it easy to manage NGINX instances across locations an
3636
{{<card title="Manage your NGINX instances" titleUrl="/nginx-one/nginx-configs/" >}}
3737
Manage one instance or groups of instances. Monitor certificates. Set up metrics.
3838
{{</card>}}
39+
{{<card title="Connect Kubernetes deployments" titleUrl="/nginx-one/k8s/">}}
40+
Monitor deployments for CVEs and certificates
41+
{{</ card >}}
3942
{{<card title="Organize users with RBAC" titleUrl="/nginx-one/rbac/" >}}
4043
Assign responsibilities with role-based access control
4144
{{</card>}}

‎content/nginx-one/api/_index.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Automate with the NGINX One API
33
description:
4-
weight: 700
4+
weight: 800
55
url: /nginx-one/api
66
---

‎content/nginx-one/glossary.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ description: ''
33
nd-docs: DOCS-1396
44
title: Glossary
55
toc: true
6-
weight: 800
6+
weight: 1000
77
type:
88
- reference
99
---

‎content/nginx-one/k8s/_index.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
title: Connect Kubernetes deployments
3+
description:
4+
weight: 700
5+
url: /nginx-one/k8s
6+
nd-product: NGINX One
7+
---
8+

‎content/nginx-one/k8s/add-nic.md

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
---
2+
title: Connect to NGINX One Console
3+
toc: true
4+
weight: 200
5+
nd-content-type: how-to
6+
nd-product: NGINX One
7+
---
8+
9+
This document explains how to connect F5 NGINX Ingress Controller <!-- and F5 NGINX Gateway Fabric -->to F5 NGINX One Console using NGINX Agent.
10+
Connecting NGINX Ingress Controller to NGINX One Console enables centralized monitoring of all controller instances.
11+
12+
Once connected, you'll see a **read-only** configuration of NGINX Ingress Controller. For each instance, you can review:
13+
14+
- Read-only configuration file
15+
- SSL/TLS certificates
16+
- CVEs
17+
18+
## Prerequisites
19+
20+
Before connecting NGINX Ingress Controller to NGINX One Console, you need to create a Kubernetes Secret with the data plane key. Use the following command:
21+
22+
```shell
23+
kubectl create secret generic dataplane-key --from-literal=dataplane.key=<Your Dataplane Key> -n <namespace>
24+
```
25+
26+
When you create a Kubernetes Secret, use the same namespace where NGINX Ingress Controller is running.
27+
If you use `-watch-namespace` or `watch-secret-namespace` arguments with NGINX Ingress Controller,
28+
you need to add the dataplane key secret to the watched namespaces. This secret will take approximately 60 - 90 seconds to reload on the pod.
29+
30+
{{<note>}}
31+
You can also create a data plane key through the NGINX One Console. Once loggged in, select **Manage > Control Planes > Add Control Plane**, and follow the steps shown.
32+
{{</note>}}
33+
34+
## Deploy NGINX Ingress Controller with NGINX Agent
35+
36+
{{<tabs name="deploy-config-resource">}}
37+
{{%tab name="Helm"%}}
38+
39+
Edit your `values.yaml` file to enable NGINX Agent and configure it to connect to NGINX One Console:
40+
41+
```yaml
42+
nginxAgent:
43+
enable: true
44+
dataplaneKeySecretName: "<Your Dataplane Key Secret Name>"
45+
```
46+
47+
The `dataplaneKeySecretName` is used to authenticate the agent with NGINX One Console. See the [NGINX One Console Docs]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}})
48+
for instructions on to generate your dataplane key from the NGINX One Console.
49+
50+
Follow the [Installation with Helm]({{< ref "/nic/installation/installing-nic/installation-with-helm.md" >}}) instructions to deploy NGINX Ingress Controller.
51+
52+
{{%/tab%}}
53+
{{%tab name="Manifests"%}}
54+
55+
Add the following flag to the Deployment/DaemonSet file of NGINX Ingress Controller:
56+
57+
```yaml
58+
args:
59+
- -agent=true
60+
```
61+
62+
Create a `ConfigMap` with an `nginx-agent.conf` file:
63+
64+
```yaml
65+
kind: ConfigMap
66+
apiVersion: v1
67+
metadata:
68+
name: nginx-agent-config
69+
namespace: <namespace>
70+
data:
71+
nginx-agent.conf: |-
72+
log:
73+
# set log level (error, info, debug; default "info")
74+
level: info
75+
# set log path. if empty, don't log to file.
76+
path: ""
77+
78+
allowed_directories:
79+
- /etc/nginx
80+
- /usr/lib/nginx/modules
81+
82+
features:
83+
- certificates
84+
- connection
85+
- metrics
86+
- file-watcher
87+
88+
## command server settings
89+
command:
90+
server:
91+
host: product.connect.nginx.com
92+
port: 443
93+
auth:
94+
tokenpath: "/etc/nginx-agent/secrets/dataplane.key"
95+
tls:
96+
skip_verify: false
97+
```
98+
99+
Make sure to set the namespace in the nginx-agent.config to the same namespace as NGINX Ingress Controller.
100+
Mount the ConfigMap to the deployment/daemonset file of NGINX Ingress Controller:
101+
102+
```yaml
103+
volumeMounts:
104+
- name: nginx-agent-config
105+
mountPath: /etc/nginx-agent/nginx-agent.conf
106+
subPath: nginx-agent.conf
107+
- name: dataplane-key
108+
mountPath: /etc/nginx-agent/secrets
109+
volumes:
110+
- name: nginx-agent-config
111+
configMap:
112+
name: nginx-agent-config
113+
- name: dataplane-key
114+
secret:
115+
secretName: <Your Dataplane Key Secret Name>
116+
```
117+
118+
Follow the [Installation with Manifests]({{< ref "/nic/installation/installing-nic/installation-with-manifests.md" >}}) instructions to deploy NGINX Ingress Controller.
119+
120+
{{%/tab%}}
121+
{{</tabs>}}
122+
123+
## Verify a connection to NGINX One Console
124+
125+
After deploying NGINX Ingress Controller or NGINX Gateway Fabric with NGINX Agent, you can verify the connection to NGINX One Console.
126+
Log in to your F5 Distributed Console cloud account. Select **NGINX One > Visit Service**. In the dashboard that appears, navigate to **Manage > Instances**. Your instances should appear in the list, where the instance name is the hostname and also the pod name.
127+
128+
## Troubleshooting
129+
130+
If you encounter issues connecting your instances to NGINX One Console, try the following commands:
131+
132+
Check the NGINX Agent version:
133+
134+
```shell
135+
kubectl exec -it -n <namespace> <nginx-ingress-pod-name> -- nginx-agent -v
136+
```
137+
138+
If nginx-agent version is v3, continue with the following steps.
139+
Otherwise, make sure you are using an image that does not include NGINX App Protect.
140+
141+
Check the NGINX Agent configuration:
142+
143+
```shell
144+
kubectl exec -it -n <namespace> <nginx-ingress-pod-name> -- cat /etc/nginx-agent/nginx-agent.conf
145+
```
146+
147+
Check NGINX Agent logs:
148+
149+
```shell
150+
kubectl exec -it -n <namespace> <nginx-ingress-pod-name> -- nginx-agent
151+
```
152+
153+
Select the instance associated with your deployment of NGINX Ingress Controller. Under the **Details** tab, you'll see You'll see information associated with:
154+
155+
- SSL/TLS certificates
156+
- CVEs
157+
- Configuration recommendations
158+
159+
Under the **Configuration** tab, you'll see a **read-only** view of the configuration files.

‎content/nginx-one/k8s/overview.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
# We use sentence case and present imperative tone
3+
title: "Integrate Kubernetes control planes"
4+
# Weights are assigned in increments of 100: determines sorting order
5+
weight: 100
6+
# Creates a table of contents and sidebar, useful for large documents
7+
toc: false
8+
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
9+
nd-content-type: concept
10+
# Intended for internal catalogue and search, case sensitive:
11+
# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
12+
nd-product: NGINX One
13+
---
14+
15+
You can now include Kubernetes systems through the [control plane](https://www.f5.com/glossary/control-plane). In related documentation, you can learn how to:
16+
17+
- Set up a connection to F5 NGINX One Console through a data plane key.
18+
- Monitor each connected Kubernetes system for CVEs.
19+
- Review the NGINX Ingress Controller and NGINX Gateway Fabric instances that are part of your fleet
20+

0 commit comments

Comments
 (0)