




- NGINX One -
- -
- NGINX One Console -
-+ NGINX One +
+ +
+ NGINX One Console +
+



















Your support ID is: 11241918873745059631
[Go Back] ``` @@ -338,6 +339,6 @@ administrator.
Your support ID is: 11241918873745059631
This is mostly the same as the [examples/custom_resources/app-protect-waf-v5](https://github.com/nginx/kubernetes-ingress/tree/main/examples/custom-resources/app-protect-waf-v5) deployment in a single file with the policy bundle already set. -You now have a fully operational NGINX Ingress Controller instance with NGINX App Protect deployed in your Kubernetes environment. +You now have a fully operational NGINX Ingress Controller instance with NGINX App Protect deployed in your Kubernetes environment. For further details, troubleshooting, or support, refer to the [official NGINX documentation]({{< ref "/" >}}) or reach out directly to your F5/NGINX account team. diff --git a/content/nic/installation/installing-nic/installation-with-manifests.md b/content/nic/installation/installing-nic/installation-with-manifests.md index 61f457808..2f44611f6 100644 --- a/content/nic/installation/installing-nic/installation-with-manifests.md +++ b/content/nic/installation/installing-nic/installation-with-manifests.md @@ -4,7 +4,7 @@ toc: true weight: 200 type: how-to product: NIC -docs: DOCS-603 +nd-docs: DOCS-603 --- This guide explains how to use Manifests to install F5 NGINX Ingress Controller, then create both common and custom resources and set up role-based access control. diff --git a/content/nic/installation/installing-nic/installation-with-operator.md b/content/nic/installation/installing-nic/installation-with-operator.md index 3fc35a09f..459d7cfd1 100644 --- a/content/nic/installation/installing-nic/installation-with-operator.md +++ b/content/nic/installation/installing-nic/installation-with-operator.md @@ -4,7 +4,7 @@ toc: true weight: 300 type: how-to product: NIC -docs: DOCS-604 +nd-docs: DOCS-604 --- This document explains how to install F5 NGINX Ingress Controller using NGINX Ingress Operator. diff --git a/content/nic/installation/installing-nic/upgrade-to-v4.md b/content/nic/installation/installing-nic/upgrade-to-v4.md index 23382a540..36b3e798d 100644 --- a/content/nic/installation/installing-nic/upgrade-to-v4.md +++ b/content/nic/installation/installing-nic/upgrade-to-v4.md @@ -4,7 +4,7 @@ toc: true weight: 400 type: how-to product: NIC -docs: DOCS-000 +nd-docs: DOCS-1862 --- This document explains how to upgrade F5 NGINX Ingress Controller to 4.0.0. diff --git a/content/nic/installation/integrations/app-protect-dos/installation.md b/content/nic/installation/integrations/app-protect-dos/installation.md index 9471d48c5..75a4439ae 100644 --- a/content/nic/installation/integrations/app-protect-dos/installation.md +++ b/content/nic/installation/integrations/app-protect-dos/installation.md @@ -4,7 +4,7 @@ weight: 100 toc: true type: how-to product: NIC -docs: DOCS-583 +nd-docs: DOCS-583 --- This document explains how to build an image for F5 NGINX Ingress Controller with NGINX App Protect DoS from source code. diff --git a/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md b/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md index c34785d49..e21c90e4e 100644 --- a/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md +++ b/content/nic/installation/integrations/app-protect-waf-v5/compile-waf-policies.md @@ -4,7 +4,7 @@ weight: 300 toc: true nd-content-type: how-to nd-product: NIC -nd-docs: DOCS-000 +nd-docs: DOCS-1863 --- ## Overview diff --git a/content/nic/installation/integrations/app-protect-waf-v5/configuration.md b/content/nic/installation/integrations/app-protect-waf-v5/configuration.md index 748e56d79..d6cbc208a 100644 --- a/content/nic/installation/integrations/app-protect-waf-v5/configuration.md +++ b/content/nic/installation/integrations/app-protect-waf-v5/configuration.md @@ -4,7 +4,7 @@ weight: 200 toc: true nd-content-type: how-to nd-product: NIC -nd-docs: DOCS-000 +nd-docs: DOCS-1866 --- ## Overview diff --git a/content/nic/installation/integrations/app-protect-waf-v5/installation.md b/content/nic/installation/integrations/app-protect-waf-v5/installation.md index 40f638f1a..2cdc5964c 100644 --- a/content/nic/installation/integrations/app-protect-waf-v5/installation.md +++ b/content/nic/installation/integrations/app-protect-waf-v5/installation.md @@ -4,7 +4,7 @@ weight: 100 toc: true type: how-to product: NIC -docs: DOCS-000 +nd-docs: DOCS-1865 --- This document explains how to build a F5 NGINX Ingress Controller image with NGINX App Protect WAF v5 from source code. diff --git a/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md b/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md index 65594dcf6..aca3370d7 100644 --- a/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md +++ b/content/nic/installation/integrations/app-protect-waf-v5/troubleshoot-app-protect-waf.md @@ -4,7 +4,7 @@ weight: 400 toc: true nd-content-type: how-to nd-product: NIC -nd-docs: DOCS-000 +nd-docs: DOCS-1864 --- This document describes how to troubleshoot problems when using NGINX Ingress Controller and the NGINX App Protect WAF module version 5. diff --git a/content/nic/installation/integrations/app-protect-waf/configuration.md b/content/nic/installation/integrations/app-protect-waf/configuration.md index 50d2c6352..ce77de634 100644 --- a/content/nic/installation/integrations/app-protect-waf/configuration.md +++ b/content/nic/installation/integrations/app-protect-waf/configuration.md @@ -4,7 +4,7 @@ weight: 200 toc: true type: how-to product: NIC -docs: DOCS-578 +nd-docs: DOCS-578 --- This document explains how to use F5 NGINX Ingress Controller to configure NGINX App Protect WAF. diff --git a/content/nic/installation/integrations/app-protect-waf/installation.md b/content/nic/installation/integrations/app-protect-waf/installation.md index 08e7404e9..ed7732450 100644 --- a/content/nic/installation/integrations/app-protect-waf/installation.md +++ b/content/nic/installation/integrations/app-protect-waf/installation.md @@ -4,7 +4,7 @@ weight: 100 toc: true type: how-to product: NIC -docs: DOCS-579 +nd-docs: DOCS-579 --- This document explains how to build a F5 NGINX Ingress Controller image with F5 NGINX App Protect WAF from source code. diff --git a/content/nic/installation/integrations/f5-ingresslink.md b/content/nic/installation/integrations/f5-ingresslink.md index 1e06bbab7..887138ac3 100644 --- a/content/nic/installation/integrations/f5-ingresslink.md +++ b/content/nic/installation/integrations/f5-ingresslink.md @@ -1,5 +1,5 @@ --- -docs: DOCS-600 +nd-docs: DOCS-600 doctypes: - concept title: F5 BIG-IP diff --git a/content/nic/installation/integrations/opentracing.md b/content/nic/installation/integrations/opentracing.md index 55c6efd2a..9b131dc8c 100644 --- a/content/nic/installation/integrations/opentracing.md +++ b/content/nic/installation/integrations/opentracing.md @@ -1,5 +1,5 @@ --- -docs: DOCS-618 +nd-docs: DOCS-618 doctypes: - '' title: OpenTracing (Deprecated in v5.0.0) diff --git a/content/nic/installation/nic-images/get-registry-image.md b/content/nic/installation/nic-images/get-registry-image.md index 9fadafa08..9cf8dd08a 100644 --- a/content/nic/installation/nic-images/get-registry-image.md +++ b/content/nic/installation/nic-images/get-registry-image.md @@ -7,7 +7,7 @@ nd-product: NIC nd-docs: DOCS-605 --- -Learn how to pull an F5 NGINX Plus Ingress Controller image from the official F5 Docker registry and upload it to your private registry. +Learn how to pull an F5 NGINX Plus Ingress Controller image from the official F5 Docker registry and upload it to your private registry. The F5 Registry images include versions with NGINX App Protect WAF and NGINX App Protect DoS. diff --git a/content/nic/installation/nic-images/use-aws-image.md b/content/nic/installation/nic-images/use-aws-image.md index 38178778c..4198e253c 100644 --- a/content/nic/installation/nic-images/use-aws-image.md +++ b/content/nic/installation/nic-images/use-aws-image.md @@ -1,5 +1,5 @@ --- -docs: DOCS-607 +nd-docs: DOCS-607 doctypes: - '' title: Use the AWS Marketplace NGINX Ingress Controller image @@ -107,7 +107,7 @@ Follow this guide to set up NGINX Ingress Controller using AWS Marketplace. This
- Ensure the service account name matches the one in your _values.yaml_ file for helm deployment. + Ensure the service account name matches the one in your _values.yaml_ file for helm deployment. Ensure the EKS `role-arn` matches the service account annotation in your _values.yaml_ file for helm deployment. You can use this command to retrieve the `role-arn` ``` shell aws iam list-roles | jq -r --arg role "my-cluster-sa" '.Roles[] | select(.RoleName==$role) | .Arn' diff --git a/content/nic/installation/nic-images/use-gcp-image.md b/content/nic/installation/nic-images/use-gcp-image.md index 2c38c8cff..2eb4e2f76 100644 --- a/content/nic/installation/nic-images/use-gcp-image.md +++ b/content/nic/installation/nic-images/use-gcp-image.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1455 +nd-docs: DOCS-1455 doctypes: - '' title: Use the GCP Marketplace NGINX Ingress Controller image diff --git a/content/nic/installation/run-multiple-ingress-controllers.md b/content/nic/installation/run-multiple-ingress-controllers.md index 3c2bd7116..98f3417b8 100644 --- a/content/nic/installation/run-multiple-ingress-controllers.md +++ b/content/nic/installation/run-multiple-ingress-controllers.md @@ -1,5 +1,5 @@ --- -docs: DOCS-606 +nd-docs: DOCS-606 doctypes: - '' title: Run multiple NGINX Ingress Controllers diff --git a/content/nic/logging-and-monitoring/prometheus.md b/content/nic/logging-and-monitoring/prometheus.md index 3d56d486f..17f32abe5 100644 --- a/content/nic/logging-and-monitoring/prometheus.md +++ b/content/nic/logging-and-monitoring/prometheus.md @@ -1,5 +1,5 @@ --- -docs: DOCS-614 +nd-docs: DOCS-614 doctypes: - concept title: Prometheus diff --git a/content/nic/overview/about.md b/content/nic/overview/about.md index f6231c24a..ef6bdeaf6 100644 --- a/content/nic/overview/about.md +++ b/content/nic/overview/about.md @@ -8,7 +8,7 @@ nd-docs: DOCS-612 This document describes the F5 NGINX Ingress Controller, an Ingress Controller implementation for NGINX and NGINX Plus. -NGINX Ingress Controller is an [Ingress Controller]({{< ref "/nic/glossary.md#ingress-controller">}}) implementation for [NGINX](https://nginx.org) and [NGINX Plus](https://www.f5.com/products/nginx/nginx-plus) that can load balance Websocket, gRPC, TCP and UDP applications. NGINX Ingress Controller gives you a way to manage NGINX through the [Kubernetes](https://kubernetes.io/) API, and is built to handle the continuous change that happens in Kubernetes environments. +NGINX Ingress Controller is an [Ingress Controller]({{< ref "/nic/glossary.md#ingress-controller">}}) implementation for [NGINX](https://nginx.org) and [NGINX Plus](https://www.f5.com/products/nginx/nginx-plus) that can load balance Websocket, gRPC, TCP and UDP applications. NGINX Ingress Controller gives you a way to manage NGINX through the [Kubernetes](https://kubernetes.io/) API, and is built to handle the continuous change that happens in Kubernetes environments. It supports standard [Ingress]({{< ref "/nic/glossary.md#ingress">}}) features such as content-based routing and TLS/SSL termination.Several NGINX and NGINX Plus features are available as extensions to Ingress resources through [Annotations]({{< ref "/nic/configuration/ingress-resources/advanced-configuration-with-annotations">}}) and the [ConfigMap]({{< ref "/nic/configuration/global-configuration/configmap-resource">}}) resource. diff --git a/content/nic/overview/nginx-plus.md b/content/nic/overview/nginx-plus.md index 67adfa515..07316c039 100644 --- a/content/nic/overview/nginx-plus.md +++ b/content/nic/overview/nginx-plus.md @@ -1,5 +1,5 @@ --- -docs: DOCS-611 +nd-docs: DOCS-611 doctypes: - concept title: Extensibility with NGINX Plus diff --git a/content/nic/overview/product-telemetry.md b/content/nic/overview/product-telemetry.md index f6421b1f1..29f1ad409 100644 --- a/content/nic/overview/product-telemetry.md +++ b/content/nic/overview/product-telemetry.md @@ -2,6 +2,7 @@ title: Product telemetry toc: true weight: 500 +nd-docs: DOCS-1857 --- Learn why, what and how F5 NGINX Ingress Controller collects telemetry. diff --git a/content/nic/releases.md b/content/nic/releases.md index 4738b69be..cfed5b4ab 100644 --- a/content/nic/releases.md +++ b/content/nic/releases.md @@ -18,7 +18,7 @@ With the removal of the OpenTracing dynamic module from [NGINX Plus R34](({{< re We have extended the rate-limit Policy to allow tiered rate limit groups with JWT claims. This will also allow users to apply different rate limits to their `VirtualServer` or `VirtualServerRoutes` with the value of a JWT claim. See [here](https://github.com/nginx/kubernetes-ingress/tree/v5.0.0/examples/custom-resources/rate-limit-tiered-jwt-claim/) for a working example. -We introduced NGINX Plus Zone Sync as a managed service within NGINX Ingress Controller in this release. In previous releases, we had examples using `stream-snippets` for OIDC support, users can now enable `zone-sync` without the need for `snippets`. NGINX Plus Zone Sync is available when utilising two or more replicas, it supports OIDC & rate limiting. +We introduced NGINX Plus Zone Sync as a managed service within NGINX Ingress Controller in this release. In previous releases, we had examples using `stream-snippets` for OIDC support, users can now enable `zone-sync` without the need for `snippets`. NGINX Plus Zone Sync is available when utilising two or more replicas, it supports OIDC & rate limiting. {{< note >}} For users who have previously installed OIDC or used the `zone_sync` directive with `stream-snippets`, please see the note in the [Configmap resources]({{< ref "/nic/configuration/global-configuration/configmap-resource.md#zone-sync" >}}) topic to use the new `zone-sync` ConfigMap option. diff --git a/content/nic/technical-specifications.md b/content/nic/technical-specifications.md index ad9d5b2e4..524cbd358 100644 --- a/content/nic/technical-specifications.md +++ b/content/nic/technical-specifications.md @@ -4,7 +4,7 @@ toc: true weight: 200 doctype: reference product: NIC -docs: DOCS-617 +nd-docs: DOCS-617 --- This page describes technical specifications for F5 NGINX Ingress Controller, such as its version compatibility with Kubernetes and other NGINX software. diff --git a/content/nic/troubleshooting/troubleshoot-common.md b/content/nic/troubleshooting/troubleshoot-common.md index 23438408c..4207917a9 100644 --- a/content/nic/troubleshooting/troubleshoot-common.md +++ b/content/nic/troubleshooting/troubleshoot-common.md @@ -92,7 +92,7 @@ args: - -log-level=debug ``` -**ConfigMap settings** +**ConfigMap settings** You can configure `error-log-level` in NGINX Ingress Controller `configMap`: ```yaml diff --git a/content/nic/troubleshooting/troubleshoot-configmap-policy.md b/content/nic/troubleshooting/troubleshoot-configmap-policy.md index fa5f44059..32169d55c 100644 --- a/content/nic/troubleshooting/troubleshoot-configmap-policy.md +++ b/content/nic/troubleshooting/troubleshoot-configmap-policy.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1457 +nd-docs: DOCS-1457 doctypes: - '' title: Troubleshooting Policy resources diff --git a/content/nic/troubleshooting/troubleshoot-ingress.md b/content/nic/troubleshooting/troubleshoot-ingress.md index e970b2548..3fccf4aec 100644 --- a/content/nic/troubleshooting/troubleshoot-ingress.md +++ b/content/nic/troubleshooting/troubleshoot-ingress.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1458 +nd-docs: DOCS-1458 doctypes: - '' title: Troubleshooting Ingress resources diff --git a/content/nic/troubleshooting/troubleshoot-support.md b/content/nic/troubleshooting/troubleshoot-support.md index 37308268b..340796320 100644 --- a/content/nic/troubleshooting/troubleshoot-support.md +++ b/content/nic/troubleshooting/troubleshoot-support.md @@ -1,7 +1,7 @@ --- title: Commercial support weight: 100 -docs: DOCS-000 +nd-docs: DOCS-1867 --- F5 NGINX Ingress Controller adheres to the support policy detailed in the following knowledge base article: [K000140156](https://my.f5.com/manage/s/article/K000140156). diff --git a/content/nic/troubleshooting/troubleshoot-virtualserver.md b/content/nic/troubleshooting/troubleshoot-virtualserver.md index 72af8d32c..b671aa00e 100644 --- a/content/nic/troubleshooting/troubleshoot-virtualserver.md +++ b/content/nic/troubleshooting/troubleshoot-virtualserver.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1461 +nd-docs: DOCS-1461 doctypes: - '' title: Troubleshooting VirtualServer resources diff --git a/content/nic/tutorials/custom-listen-ports.md b/content/nic/tutorials/custom-listen-ports.md index a2ab3347f..5e263f288 100644 --- a/content/nic/tutorials/custom-listen-ports.md +++ b/content/nic/tutorials/custom-listen-ports.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1449 +nd-docs: DOCS-1449 doctypes: - concept title: Customizing NGINX Ingress Controller Ports diff --git a/content/nic/tutorials/oidc-custom-configuration.md b/content/nic/tutorials/oidc-custom-configuration.md index 460f88070..a38143ad4 100644 --- a/content/nic/tutorials/oidc-custom-configuration.md +++ b/content/nic/tutorials/oidc-custom-configuration.md @@ -4,7 +4,7 @@ weight: 1800 toc: true type: how-to product: NIC -docs: DOCS-000 +nd-docs: DOCS-1448 --- The F5 NGINX Ingress Controller implements OpenID Connect (OIDC) using the NGINX OpenID Connect Reference implementation: [nginx-openid-connect](https://github.com/nginxinc/nginx-openid-connect). @@ -46,7 +46,6 @@ Annotations:
{{
diff --git a/content/includes/nap-waf/config/common/graphql-response-pages.md b/content/includes/nap-waf/config/common/graphql-response-pages.md index 511058ef9..73ed50f16 100644 --- a/content/includes/nap-waf/config/common/graphql-response-pages.md +++ b/content/includes/nap-waf/config/common/graphql-response-pages.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1557" +nd-docs: "DOCS-1557" --- A GraphQL error response page is returned when a request is blocked. This GraphQL response page, like other blocking response pages, can be customized, but the GraphQL JSON syntax must be preserved for them to be displayed correctly. The default page returns the GraphQL status code Blocking Response Page (BRP) and a short JSON error message which includes the support ID. diff --git a/content/includes/nap-waf/config/common/graphql-security.md b/content/includes/nap-waf/config/common/graphql-security.md index 2342ca0f9..067eb4833 100644 --- a/content/includes/nap-waf/config/common/graphql-security.md +++ b/content/includes/nap-waf/config/common/graphql-security.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1566" +nd-docs: "DOCS-1566" --- Securing GraphQL APIs with NGINX App Protect WAF involves using WAF to monitor and protect against security threats and attacks. GraphQL, like REST, is usually [served over HTTP](http://graphql.org/learn/serving-over-http/), using GET and POST requests and a proprietary [query language](https://graphql.org/learn/schema/#the-query-and-mutation-types). It is prone to the typical Web APIs security vulnerabilities, such as injection attacks, Denial of Service (DoS) attacks and abuse of flawed authorization. diff --git a/content/includes/nap-waf/config/common/graphql-violations.md b/content/includes/nap-waf/config/common/graphql-violations.md index 0045ec2c1..288fa29a4 100644 --- a/content/includes/nap-waf/config/common/graphql-violations.md +++ b/content/includes/nap-waf/config/common/graphql-violations.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1578" +nd-docs: "DOCS-1578" --- NGINX App Protect WAF introduces four new violations specific to GraphQL: `VIOL_GRAPHQL_FORMAT`, `VIOL_GRAPHQL_MALFORMED`, `VIOL_GRAPHQL_INTROSPECTION_QUERY` and `VIOL_GRAPHQL_ERROR_RESPONSE`.
diff --git a/content/includes/nap-waf/config/common/grpc-bidirectional-stream-enforcement.md b/content/includes/nap-waf/config/common/grpc-bidirectional-stream-enforcement.md index d8d14d0f6..468da8b55 100644 --- a/content/includes/nap-waf/config/common/grpc-bidirectional-stream-enforcement.md +++ b/content/includes/nap-waf/config/common/grpc-bidirectional-stream-enforcement.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1606" +nd-docs: "DOCS-1606" --- #### Client Request Flow diff --git a/content/includes/nap-waf/config/common/grpc-content-profiles.md b/content/includes/nap-waf/config/common/grpc-content-profiles.md index 2f5ec344c..dbdffe203 100644 --- a/content/includes/nap-waf/config/common/grpc-content-profiles.md +++ b/content/includes/nap-waf/config/common/grpc-content-profiles.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1616" +nd-docs: "DOCS-1616" --- The gRPC Content Profile contains all the definitions for protecting a gRPC service. It is similar in nature to the **JSON and XML profiles** handling JSON and XML traffic respectively. Roughly it includes: diff --git a/content/includes/nap-waf/config/common/grpc-handling-slow-post-attacks.md b/content/includes/nap-waf/config/common/grpc-handling-slow-post-attacks.md index 1a7189010..78c430827 100644 --- a/content/includes/nap-waf/config/common/grpc-handling-slow-post-attacks.md +++ b/content/includes/nap-waf/config/common/grpc-handling-slow-post-attacks.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1599" +nd-docs: "DOCS-1599" --- Slow POST attack mitigation - A client sending messages very slowly for a long time may be cut off by resetting the connection. diff --git a/content/includes/nap-waf/config/common/grpc-message-compression.md b/content/includes/nap-waf/config/common/grpc-message-compression.md index 7fdf1b923..ff28c8674 100644 --- a/content/includes/nap-waf/config/common/grpc-message-compression.md +++ b/content/includes/nap-waf/config/common/grpc-message-compression.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1574" +nd-docs: "DOCS-1574" --- Currently, Message Compression is not supported. Therefore, a violation `VIOL_GRPC_MALFORMED` will be raised and the connection will be blocked if a compressed message is sent. \ No newline at end of file diff --git a/content/includes/nap-waf/config/common/grpc-protection-unary-traffic.md b/content/includes/nap-waf/config/common/grpc-protection-unary-traffic.md index a9de83d0e..dac89ee48 100644 --- a/content/includes/nap-waf/config/common/grpc-protection-unary-traffic.md +++ b/content/includes/nap-waf/config/common/grpc-protection-unary-traffic.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1558" +nd-docs: "DOCS-1558" --- gRPC is a remote API standard and is an alternative to OpenAPI. If your applications expose gRPC APIs, NGINX App Protect WAF can protect them by parsing the messages; making sure they comply with the API definition; and enforcing security restrictions - such as size limits, detecting attack signatures, threat campaigns, and suspicious metacharacters in message string field values. diff --git a/content/includes/nap-waf/config/common/grpc-response-pages.md b/content/includes/nap-waf/config/common/grpc-response-pages.md index 14529e719..11f7efc51 100644 --- a/content/includes/nap-waf/config/common/grpc-response-pages.md +++ b/content/includes/nap-waf/config/common/grpc-response-pages.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1597" +nd-docs: "DOCS-1597" --- A gRPC error response page is returned when a request is blocked. The default page returns gRPC status code `UNKNOWN` (numeric value of 2) and a short textual message that includes the support ID. You can customize any of these two by configuring a custom gRPC response page in your policy. diff --git a/content/includes/nap-waf/config/common/grpc-server-reflection.md b/content/includes/nap-waf/config/common/grpc-server-reflection.md index 0d27f1f8e..e8cab8f9e 100644 --- a/content/includes/nap-waf/config/common/grpc-server-reflection.md +++ b/content/includes/nap-waf/config/common/grpc-server-reflection.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1610" +nd-docs: "DOCS-1610" --- [gRPC Server Reflection](https://grpc.github.io/grpc/core/md_doc_server_reflection_tutorial.html) provides information about publicly-accessible gRPC services on a server, and assists clients at runtime to construct RPC requests and responses without precompiled service information. gRPC Server reflection is not currently supported in App Protect. If Server Reflection support is required, App Protect must be disabled on the reflection URIs by adding a location block such as this: diff --git a/content/includes/nap-waf/config/common/grpc-size-limits.md b/content/includes/nap-waf/config/common/grpc-size-limits.md index bb9439081..407f6cb2c 100644 --- a/content/includes/nap-waf/config/common/grpc-size-limits.md +++ b/content/includes/nap-waf/config/common/grpc-size-limits.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1619" +nd-docs: "DOCS-1619" --- The maximum total request size is applied to each message on its own, rather than to the total stream messages. By default, the maximum gRPC message size is 4MB. diff --git a/content/includes/nap-waf/config/common/grpc-slow-post-attacks.md b/content/includes/nap-waf/config/common/grpc-slow-post-attacks.md index 744878c1c..55dc41ed9 100644 --- a/content/includes/nap-waf/config/common/grpc-slow-post-attacks.md +++ b/content/includes/nap-waf/config/common/grpc-slow-post-attacks.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1637" +nd-docs: "DOCS-1637" --- A Slow POST attack or Slow HTTP POST attack is a type of denial of service attack. The attacker sends a legitimate HTTP POST request with the header Content-Length specified. The attacker then proceeds to send this content slowly. The server establishes a connection to the client and keeps it open to receive the request that it thinks is legitimate. diff --git a/content/includes/nap-waf/config/common/grpc-violations.md b/content/includes/nap-waf/config/common/grpc-violations.md index 9eb2d75bf..e93bac516 100644 --- a/content/includes/nap-waf/config/common/grpc-violations.md +++ b/content/includes/nap-waf/config/common/grpc-violations.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1562" +nd-docs: "DOCS-1562" --- There are three violations that are specific to gRPC. They are all enabled in the default policy. See also the [Violations](#violations) section. diff --git a/content/includes/nap-waf/config/common/handling-xml-and-json-content.md b/content/includes/nap-waf/config/common/handling-xml-and-json-content.md index 32285a4e2..a8a54c409 100644 --- a/content/includes/nap-waf/config/common/handling-xml-and-json-content.md +++ b/content/includes/nap-waf/config/common/handling-xml-and-json-content.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1545" +nd-docs: "DOCS-1545" --- #### XML and JSON Content Profiles diff --git a/content/includes/nap-waf/config/common/http-compliance-subviolations.md b/content/includes/nap-waf/config/common/http-compliance-subviolations.md index 77f6f144d..c9482ea62 100644 --- a/content/includes/nap-waf/config/common/http-compliance-subviolations.md +++ b/content/includes/nap-waf/config/common/http-compliance-subviolations.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1576" +nd-docs: "DOCS-1576" --- The following table specifies the HTTP Compliance sub-violation settings. All are supported in NGINX App Protect WAF, but not all are enabled in the default App Protect security template. The table specifies which. Some of the checks are enforced by NGINX Plus and App Protect only gets a notification. **Note:** In this case, the request is **always** blocked regardless of the App Protect policy. diff --git a/content/includes/nap-waf/config/common/important-things-override-rules.md b/content/includes/nap-waf/config/common/important-things-override-rules.md index dd17232f5..c065639cb 100644 --- a/content/includes/nap-waf/config/common/important-things-override-rules.md +++ b/content/includes/nap-waf/config/common/important-things-override-rules.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1549" +nd-docs: "DOCS-1549" --- Here are some key points to remember regarding the Override Rules feature: diff --git a/content/includes/nap-waf/config/common/json-web-token-overview.md b/content/includes/nap-waf/config/common/json-web-token-overview.md index 9e5ee5741..76cf116ba 100644 --- a/content/includes/nap-waf/config/common/json-web-token-overview.md +++ b/content/includes/nap-waf/config/common/json-web-token-overview.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1550" +nd-docs: "DOCS-1550" --- JSON Web Token (JWT) is a compact and self-contained way to represent information between two parties in a JSON (JavaScript Object Notation) format and is commonly used for authentication and authorization. With NGINX App Protect now it is possible to control access to its application using JWT validation. NGINX App Protect WAF validates the authenticity and well-formedness of JWTs coming from a client, denying access to the service exclusively when the validation process fails. JWT is mainly used for API access. diff --git a/content/includes/nap-waf/config/common/json-web-tokens-attack-sigs.md b/content/includes/nap-waf/config/common/json-web-tokens-attack-sigs.md index 76e8255a2..4ad55d12e 100644 --- a/content/includes/nap-waf/config/common/json-web-tokens-attack-sigs.md +++ b/content/includes/nap-waf/config/common/json-web-tokens-attack-sigs.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1602" +nd-docs: "DOCS-1602" --- Attack signatures are detected within the JSON values of the token, i.e. the header and claims parts, but not on the digital signature part of the token. The detection of signatures, and specifically which signatures are recognized, depends on the configuration entity within the Policy. Typically, this configuration entity is the Authorization HTTP header or else, the header or parameter entity configured as the location of the token in the access profile. diff --git a/content/includes/nap-waf/config/common/json-web-tokens-other-references.md b/content/includes/nap-waf/config/common/json-web-tokens-other-references.md index e07b94a20..c79eb0dd0 100644 --- a/content/includes/nap-waf/config/common/json-web-tokens-other-references.md +++ b/content/includes/nap-waf/config/common/json-web-tokens-other-references.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1573" +nd-docs: "DOCS-1573" --- For more information about JSON Web Token (JWT) see below reference links: diff --git a/content/includes/nap-waf/config/common/json-web-tokens-violation-rating.md b/content/includes/nap-waf/config/common/json-web-tokens-violation-rating.md index f0ef872b8..67875b1b9 100644 --- a/content/includes/nap-waf/config/common/json-web-tokens-violation-rating.md +++ b/content/includes/nap-waf/config/common/json-web-tokens-violation-rating.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1584" +nd-docs: "DOCS-1584" --- The default violation rating is set to the level of **5** regardless of any violation. Any changes to these violation settings here will override the default settings. The details regarding logs will be recorded in the security log. All violations will be disabled on upgrade. diff --git a/content/includes/nap-waf/config/common/json-web-tokens-violations.md b/content/includes/nap-waf/config/common/json-web-tokens-violations.md index c161e93b4..b04d82780 100644 --- a/content/includes/nap-waf/config/common/json-web-tokens-violations.md +++ b/content/includes/nap-waf/config/common/json-web-tokens-violations.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1594" +nd-docs: "DOCS-1594" --- NGINX App Protect WAF introduces three new violations specific to JWT: `VIOL_ACCESS_INVALID`, `VIOL_ACCESS_MISSING` and `VIOL_ACCESS_MALFORMED`. diff --git a/content/includes/nap-waf/config/common/modifying-configurations.md b/content/includes/nap-waf/config/common/modifying-configurations.md index 41341a7ad..557d97eae 100644 --- a/content/includes/nap-waf/config/common/modifying-configurations.md +++ b/content/includes/nap-waf/config/common/modifying-configurations.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1591" +nd-docs: "DOCS-1591" --- What we have been seeing so far has been related to making changes by actually overriding specific configuration values. What would happen in the case we wanted to remove a specific configuration entity from the policy. For example, let's say we have added file types "aaa", "bbb", and "ccc", and now we wish to remove "bbb" from the list of disallowed file types. Deleting this entity from the declarative configuration file will simply mean that this entity will be left intact when the policy is rebuilt, meaning that the entity is still in the disallowed file types list. To resolve such situations, we have a `modifications` section where we can force modification where otherwise it is not possible using direct declarative configuration. diff --git a/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md b/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md index 54db35538..f1f28bb0c 100644 --- a/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md +++ b/content/includes/nap-waf/config/common/nginx-app-protect-waf-terminology.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1605" +nd-docs: "DOCS-1605" --- This guide assumes that you have some familiarity with various Layer 7 (L7) Hypertext Transfer Protocol (HTTP) concepts, such as Uniform Resource Identifier (URI)/Uniform Resource Locator (URL), method, header, cookie, status code, request, response, and parameters. diff --git a/content/includes/nap-waf/config/common/override-rules-errors-warnings.md b/content/includes/nap-waf/config/common/override-rules-errors-warnings.md index d0795f339..cea216022 100644 --- a/content/includes/nap-waf/config/common/override-rules-errors-warnings.md +++ b/content/includes/nap-waf/config/common/override-rules-errors-warnings.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1600" +nd-docs: "DOCS-1600" --- #### Missing Policy Name diff --git a/content/includes/nap-waf/config/common/override-rules-logging-reporting.md b/content/includes/nap-waf/config/common/override-rules-logging-reporting.md index 814d95b17..250065b66 100644 --- a/content/includes/nap-waf/config/common/override-rules-logging-reporting.md +++ b/content/includes/nap-waf/config/common/override-rules-logging-reporting.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1583" +nd-docs: "DOCS-1583" --- If a request matches an override rule, the `json_log` field will include a new block named 'overrideRule'. However, if no rules match the request, the log will not contain any related information. When the 'actionType' flag is set to "replace-policy", the 'originalPolicyName' field in the log will reflect the name of the original policy name (the one that contains override rules), and the `policy_name` field will reflect the policy that was enforced. diff --git a/content/includes/nap-waf/config/common/override-rules-overview.md b/content/includes/nap-waf/config/common/override-rules-overview.md index d67e14240..59d547719 100644 --- a/content/includes/nap-waf/config/common/override-rules-overview.md +++ b/content/includes/nap-waf/config/common/override-rules-overview.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1553" +nd-docs: "DOCS-1553" --- The **Override Rules** feature allows overriding of the **default policy** settings. Each override rule consists of a condition followed by changes to the original policy applied to requests that meet the respective condition. This feature provides the ability to include the override rules within a declarative policy such that all incoming requests are verified against those rules. diff --git a/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md b/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md index de4214a29..53aa7f98d 100644 --- a/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md +++ b/content/includes/nap-waf/config/common/parameters-and-user-defined-urls.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1618" +nd-docs: "DOCS-1618" --- When configuring handling of parameters, it is a bit different from other configurations we have dealt with earlier, where we enable a violation and configure its details. With parameters, there are a number of independent violations that need to be enabled on their own, as well as a parameter section to define further customization. The full list of parameter violations can be extracted from the above violation list. diff --git a/content/includes/nap-waf/config/common/partial-masking-of-data.md b/content/includes/nap-waf/config/common/partial-masking-of-data.md index 207e04921..86769895e 100644 --- a/content/includes/nap-waf/config/common/partial-masking-of-data.md +++ b/content/includes/nap-waf/config/common/partial-masking-of-data.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1559" +nd-docs: "DOCS-1559" --- Here is an example showing partial masking on custom patterns. Custom patterns are specified in `customPatternsList`, number of unmasked leading and trailing characters are defined in `firstCustomCharactersToExpose` and `lastCustomCharactersToExpose` parameters. diff --git a/content/includes/nap-waf/config/common/policy-authoring-and-tuning.md b/content/includes/nap-waf/config/common/policy-authoring-and-tuning.md index ca16dc85f..59d7b39cb 100644 --- a/content/includes/nap-waf/config/common/policy-authoring-and-tuning.md +++ b/content/includes/nap-waf/config/common/policy-authoring-and-tuning.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1564" +nd-docs: "DOCS-1564" --- The policy JSON file specifies the settings that are different from the base template, such as enabling more signatures, disabling some violations, adding server technologies, etc. These will be shown in the next sections. diff --git a/content/includes/nap-waf/config/common/policy-configuration.md b/content/includes/nap-waf/config/common/policy-configuration.md index 9ef118bdc..a58c4464e 100644 --- a/content/includes/nap-waf/config/common/policy-configuration.md +++ b/content/includes/nap-waf/config/common/policy-configuration.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1548" +nd-docs: "DOCS-1548" --- The NGINX App Protect WAF ships with two reference policies, both with a default enforcement mode set to Blocking: diff --git a/content/includes/nap-waf/config/common/protocol-buffers-supported-version.md b/content/includes/nap-waf/config/common/protocol-buffers-supported-version.md index c71632671..1e17edc7d 100644 --- a/content/includes/nap-waf/config/common/protocol-buffers-supported-version.md +++ b/content/includes/nap-waf/config/common/protocol-buffers-supported-version.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1598" +nd-docs: "DOCS-1598" --- The supported Protocol Buffer version is 3 i.e. only proto3 is supported. Version 2 is not supported. Hence any obsolete feature of version 2, such as message extensions in the IDL files, will be rejected. IDL files that have the `syntax = "proto2";` statement is also rejected. \ No newline at end of file diff --git a/content/includes/nap-waf/config/common/signature-sets-in-default-policy.md b/content/includes/nap-waf/config/common/signature-sets-in-default-policy.md index 0beb9f005..39fe22e09 100644 --- a/content/includes/nap-waf/config/common/signature-sets-in-default-policy.md +++ b/content/includes/nap-waf/config/common/signature-sets-in-default-policy.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1587" +nd-docs: "DOCS-1587" --- The following signature sets are included in the default policy. Most of the sets are defined by the Attack Type they protect from. In all sets the **Alarm** flag is enabled and **Block** disabled except High Accuracy Signatures, which are set to **blocked** (`block` parameter is enabled). diff --git a/content/includes/nap-waf/config/common/signature-sets.md b/content/includes/nap-waf/config/common/signature-sets.md index 4afb8fe65..fb07dca5e 100644 --- a/content/includes/nap-waf/config/common/signature-sets.md +++ b/content/includes/nap-waf/config/common/signature-sets.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1580" +nd-docs: "DOCS-1580" --- The default and strict policies include and enable common signature sets, which are categorized groups of [signatures](#attack-signatures-overview) applied to the policy. However, you may wish to modify the list of signature sets and their logging and enforcement settings via the `signature-sets` array property. There are several ways to configure the enforced signature sets. diff --git a/content/includes/nap-waf/config/common/signature-settings.md b/content/includes/nap-waf/config/common/signature-settings.md index 9f2121af7..39fff1ce4 100644 --- a/content/includes/nap-waf/config/common/signature-settings.md +++ b/content/includes/nap-waf/config/common/signature-settings.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1554" +nd-docs: "DOCS-1554" --- {{
The violation details will note what happened and the found length, depth or which value is too long and by what.
The depth violation is not learnable. The reason is that we don't know the actual depth of the query - we stop parsing at the max depth.
Note that the values will be used on the variables JSON part as well as the query. In a way, we can see these values as a JSON profile attributes just for the variables. | | |VIOL_GRAPHQL_INTROSPECTION_QUERY| GraphQL introspection Query | Alarm & Block | This violation will be issued when an introspection query was seen. | | |VIOL_GRAPHQL_ERROR_RESPONSE | GraphQL Error Response | Alarm & Block | GraphQL disallowed pattern in response. | | -|VIOL_GRPC_FORMAT | gRPC data does not comply with format settings | Alarm | The system checks that the request contains gRPC content and complies with the various request limits within the defense configuration in the security policy's gRPC Content Profile. Enforces valid gRPC requests and protects the server from Protocol Buffers parser attacks. This violation is generated when a gRPC request does not meet restrictive conditions in the gRPC Content Profile, such as the message length or existence of unknown fields. | | -|VIOL_GRPC_MALFORMED | Malformed gRPC data | Alarm & Block | The system checks that the request contains gRPC content that is well-formed. Enforces parsable gRPC requests. | | -|VIOL_GRPC_METHOD | Illegal gRPC method | Alarm | The system checks that the gRPC service method invoked matches one of the methods defined in the IDL file. The violation is triggered if the method does not appear there. | | -|VIOL_HEADER_LENGTH | Illegal header length | Alarm | The system checks that the request includes a total HTTP header length that does not exceed the length specified in the security policy. | The actual size in default policy is 4 KB | -|VIOL_HEADER_METACHAR | Illegal meta character in header | Alarm | The system checks that the values of all headers within the request only contain meta characters defined as allowed in the security policy. | | -|VIOL_HTTP_PROTOCOL | HTTP protocol compliance failed | Alarm | This category contains a list of validation checks that the system performs on HTTP requests to ensure that the requests are formatted properly. | | -|VIOL_HTTP_RESPONSE_STATUS | Illegal HTTP response status | Alarm | The server response contains an HTTP status code that is not defined as valid in the security policy. | | -|VIOL_JSON_FORMAT | JSON data does not comply with format settings | Alarm | The system checks that the request contains JSON content and complies with the various request limits within the defense configuration in the security policy's JSON profile. Enforces valid JSON requests and protects the server from JSON parser attacks. This violation is generated when a problem is detected in a JSON request, generally checking the message according to boundaries such as the message's size and meta characters in parameter value. | Controlled from the default JSON profile. | -|VIOL_JSON_MALFORMED | Malformed JSON data | Alarm & Block | The system checks that the request contains JSON content that is well-formed. Enforces parsable JSON requests. | | -|VIOL_JSON_SCHEMA | JSON data does not comply with JSON schema | Alarm | The system checks that the incoming request contains JSON data that matches the schema file that is part of a JSON profile configured in the security policy. Enforces proper JSON requests defined by the schema. | | -|VIOL_MANDATORY_PARAMETER | Mandatory parameter is missing | Alarm | The system checks that parameter marked as mandatory exists in the request. | | -|VIOL_MANDATORY_REQUEST_BODY | Mandatory request body is missing | Alarm | The system checks that the body exists in the request | | -|VIOL_METHOD | Illegal method | Alarm | The system checks that the request references an HTTP request method that is found in the security policy. Enforces desired HTTP methods; GET and POST are always allowed. | These HTTP methods are supported:
- GET
- HEAD
- POST
- PUT
- PATCH
- DELETE
- OPTIONS
- If that parameter is configured in the policy as `Ignore value`.
- If that parameter is configured in the security policy as `user-input file-upload`.
- If the parameter has a content-type that contains the string 'XML' and the parameter value contains a valid UTF16 encoded XML document (the encoding is valid). In this case NULL is allowed as it is part of the UTF16 encoding.
- GET
- HEAD
- POST
- PUT
- PATCH
- DELETE
- OPTIONS
- If that parameter is configured in the policy as `Ignore value`.
- If that parameter is configured in the security policy as `user-input file-upload`.
- If the parameter has a content-type that contains the string 'XML' and the parameter value contains a valid UTF16 encoded XML document (the encoding is valid). In this case NULL is allowed as it is part of the UTF16 encoding.
For example: diff --git a/content/includes/nap-waf/nginx-conf-hostname-docker.md b/content/includes/nap-waf/nginx-conf-hostname-docker.md index f4e4dea4b..301738d44 100644 --- a/content/includes/nap-waf/nginx-conf-hostname-docker.md +++ b/content/includes/nap-waf/nginx-conf-hostname-docker.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1516" +nd-docs: "DOCS-1516" --- ```nginx diff --git a/content/includes/nap-waf/nginx-conf-localhost.md b/content/includes/nap-waf/nginx-conf-localhost.md index a87a5b16a..018bcba33 100644 --- a/content/includes/nap-waf/nginx-conf-localhost.md +++ b/content/includes/nap-waf/nginx-conf-localhost.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1518" +nd-docs: "DOCS-1518" --- ```nginx diff --git a/content/includes/nap-waf/setup-docker-registry.md b/content/includes/nap-waf/setup-docker-registry.md index fc2896154..9ace0cb63 100644 --- a/content/includes/nap-waf/setup-docker-registry.md +++ b/content/includes/nap-waf/setup-docker-registry.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1508" +nd-docs: "DOCS-1508" --- Configure Docker to interact with the F5 Container Registry at `private-registry.nginx.com`: diff --git a/content/includes/nap-waf/upgrade-recompile-warning.md b/content/includes/nap-waf/upgrade-recompile-warning.md index aeb993e2a..970b58e72 100644 --- a/content/includes/nap-waf/upgrade-recompile-warning.md +++ b/content/includes/nap-waf/upgrade-recompile-warning.md @@ -1,10 +1,10 @@ --- -docs: DOCS-000 +nd-docs: DOCS-000 --- {{< warning >}} -When upgrading, you must recompile all policy and log bundles using the latest WAF compiler. +When upgrading, you must recompile all policy and log bundles using the latest WAF compiler. Older bundles will be detected and disallowed. diff --git a/content/includes/ngf/installation/delay-pod-termination/delay-pod-termination-overview.md b/content/includes/ngf/installation/delay-pod-termination/delay-pod-termination-overview.md index b22a14342..5979df586 100644 --- a/content/includes/ngf/installation/delay-pod-termination/delay-pod-termination-overview.md +++ b/content/includes/ngf/installation/delay-pod-termination/delay-pod-termination-overview.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1441" +nd-docs: "DOCS-1441" --- To avoid client service interruptions when upgrading NGINX Gateway Fabric, you can configure [`PreStop` hooks](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/) to delay terminating the NGINX Gateway Fabric pod, allowing the pod to complete certain actions before shutting down. This ensures a smooth upgrade without any downtime, also known as a zero downtime upgrade. diff --git a/content/includes/ngf/installation/delay-pod-termination/termination-grace-period.md b/content/includes/ngf/installation/delay-pod-termination/termination-grace-period.md index 8b2b3f473..6f21d5702 100644 --- a/content/includes/ngf/installation/delay-pod-termination/termination-grace-period.md +++ b/content/includes/ngf/installation/delay-pod-termination/termination-grace-period.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1440" +nd-docs: "DOCS-1440" --- Set `terminationGracePeriodSeconds` to a value that is equal to or greater than the `sleep` duration specified in the `preStop` hook (default is `30`). This setting prevents Kubernetes from terminating the pod before before the `preStop` hook has completed running. diff --git a/content/includes/ngf/installation/expose-nginx-gateway-fabric.md b/content/includes/ngf/installation/expose-nginx-gateway-fabric.md index 9ae213ed8..7820399a0 100644 --- a/content/includes/ngf/installation/expose-nginx-gateway-fabric.md +++ b/content/includes/ngf/installation/expose-nginx-gateway-fabric.md @@ -1,7 +1,7 @@ --- title: "Expose NGINX Gateway Fabric" weight: 300 -docs: "DOCS-1427" +nd-docs: "DOCS-1427" --- There are two options for accessing NGINX Gateway Fabric depending on the type of LoadBalancer service you chose during installation: diff --git a/content/includes/ngf/installation/helm/pulling-the-chart.md b/content/includes/ngf/installation/helm/pulling-the-chart.md index b82b2f809..e42fb7f6a 100644 --- a/content/includes/ngf/installation/helm/pulling-the-chart.md +++ b/content/includes/ngf/installation/helm/pulling-the-chart.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1439" +nd-docs: "DOCS-1439" --- ```shell diff --git a/content/includes/ngf/installation/install-gateway-api-experimental-features.md b/content/includes/ngf/installation/install-gateway-api-experimental-features.md index aa95d1eb9..aec27817e 100644 --- a/content/includes/ngf/installation/install-gateway-api-experimental-features.md +++ b/content/includes/ngf/installation/install-gateway-api-experimental-features.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-000" +nd-docs: "DOCS-000" --- To use Gateway API experimental resources, the Gateway API resources from the experimental channel must be installed before deploying NGINX Gateway Fabric. Additionally, NGINX Gateway Fabric must have experimental features enabled. diff --git a/content/includes/ngf/installation/install-gateway-api-resources.md b/content/includes/ngf/installation/install-gateway-api-resources.md index 3932dad32..bab5a44bd 100644 --- a/content/includes/ngf/installation/install-gateway-api-resources.md +++ b/content/includes/ngf/installation/install-gateway-api-resources.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1438" +nd-docs: "DOCS-1438" --- {{< note >}} The [Gateway API resources](https://github.com/kubernetes-sigs/gateway-api) from the standard channel must be installed before deploying NGINX Gateway Fabric. If they are already installed in your cluster, please ensure they are the correct version as supported by the NGINX Gateway Fabric - [see the Technical Specifications](https://github.com/nginx/nginx-gateway-fabric/blob/v{{< version-ngf >}}/README.md#technical-specifications). {{ note >}} diff --git a/content/includes/ngf/installation/jwt-password-note.md b/content/includes/ngf/installation/jwt-password-note.md index 4cfeec8b9..6cc40d962 100644 --- a/content/includes/ngf/installation/jwt-password-note.md +++ b/content/includes/ngf/installation/jwt-password-note.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-000" +nd-docs: "DOCS-000" --- {{< note >}} For security, follow these practices with JSON Web Tokens (JWTs), passwords, and shell history: diff --git a/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md b/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md index 0bfceec95..0ad007efa 100644 --- a/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md +++ b/content/includes/ngf/installation/nginx-plus/docker-registry-secret.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-000" +nd-docs: "DOCS-000" --- {{< note >}} If you would rather pull the NGINX Plus image and push to a private registry, you can skip this specific step and instead follow [this step]({{< ref "/ngf/install/nginx-plus.md#pull-an-image-for-local-use" >}}). {{< /note >}} diff --git a/content/includes/ngf/installation/nginx-plus/download-jwt.md b/content/includes/ngf/installation/nginx-plus/download-jwt.md index d89c65a43..78ad1cbf8 100644 --- a/content/includes/ngf/installation/nginx-plus/download-jwt.md +++ b/content/includes/ngf/installation/nginx-plus/download-jwt.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-000" +nd-docs: "DOCS-000" --- 1. Log in to [MyF5](https://my.f5.com/manage/s/). diff --git a/content/includes/ngf/installation/nginx-plus/nginx-plus-secret.md b/content/includes/ngf/installation/nginx-plus/nginx-plus-secret.md index 1a5beb474..be8a0b9f4 100644 --- a/content/includes/ngf/installation/nginx-plus/nginx-plus-secret.md +++ b/content/includes/ngf/installation/nginx-plus/nginx-plus-secret.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-000" +nd-docs: "DOCS-000" --- Place the JWT in a file called `license.jwt`. Create a Kubernetes Secret using the contents of the JWT file. diff --git a/content/includes/ngf/installation/uninstall-gateway-api-resources.md b/content/includes/ngf/installation/uninstall-gateway-api-resources.md index d5631d1f5..92a857ff6 100644 --- a/content/includes/ngf/installation/uninstall-gateway-api-resources.md +++ b/content/includes/ngf/installation/uninstall-gateway-api-resources.md @@ -1,5 +1,5 @@ --- -docs: "DOCS-1436" +nd-docs: "DOCS-1436" --- {{< warning >}} This will remove all corresponding custom resources in your entire cluster, across all namespaces. Double-check to make sure you don't have any custom resources you need to keep, and confirm that there are no other Gateway API implementations active in your cluster. {{ warning >}} diff --git a/content/includes/ngf/installation/upgrade-api-resources.md b/content/includes/ngf/installation/upgrade-api-resources.md index c8ad3d706..adaed0b1a 100644 --- a/content/includes/ngf/installation/upgrade-api-resources.md +++ b/content/includes/ngf/installation/upgrade-api-resources.md @@ -1,10 +1,10 @@ --- -docs: DOCS-000 +nd-docs: DOCS-000 --- To upgrade your Gateway API resources, take the following steps: -- Use [Technical specifications]({{< ref "/ngf/reference/technical-specifications.md" >}}) to verify your Gateway API resources are compatible with your NGINX Gateway Fabric version. +- Use [Technical specifications]({{< ref "/ngf/reference/technical-specifications.md" >}}) to verify your Gateway API resources are compatible with your NGINX Gateway Fabric version. - Review the [release notes](https://github.com/kubernetes-sigs/gateway-api/releases) for any important upgrade-specific information. To upgrade the Gateway API resources, run the following command: diff --git a/content/includes/nginx-one/staged-config-overview.md b/content/includes/nginx-one/staged-config-overview.md index 9d5a6fe35..f47aec5d5 100644 --- a/content/includes/nginx-one/staged-config-overview.md +++ b/content/includes/nginx-one/staged-config-overview.md @@ -1,5 +1,5 @@ --- -docs: DOCS-000 +nd-docs: DOCS-000 files: - content/nginx-one/how-to/staged-configs/add-staged-config.md - content/nginx-one/how-to/staged-configs/edit-staged-config.md diff --git a/content/includes/nginx-plus/install/pin-to-version/pin-debian-ubuntu-R32.md b/content/includes/nginx-plus/install/pin-to-version/pin-debian-ubuntu-R32.md index 126379d99..4f082614c 100644 --- a/content/includes/nginx-plus/install/pin-to-version/pin-debian-ubuntu-R32.md +++ b/content/includes/nginx-plus/install/pin-to-version/pin-debian-ubuntu-R32.md @@ -1,5 +1,5 @@ --- -docs: DOCS-000 +nd-docs: DOCS-000 --- To pin NGINX Plus to a specific version (for example, R33): diff --git a/content/includes/nginx-plus/install/pin-to-version/pin-rhel7-R32.md b/content/includes/nginx-plus/install/pin-to-version/pin-rhel7-R32.md index 763f8f7d3..6e38a6922 100644 --- a/content/includes/nginx-plus/install/pin-to-version/pin-rhel7-R32.md +++ b/content/includes/nginx-plus/install/pin-to-version/pin-rhel7-R32.md @@ -1,11 +1,11 @@ --- -docs: DOCS-000 +nd-docs: DOCS-000 --- To pin NGINX Plus to a specific version (for example, R32): 1. Edit the `/etc/yum.repos.d/nginx-plus-7.4.repo` file. -1. Update the repository base URL to the desired version: +1. Update the repository base URL to the desired version: ```shell baseurl=https://pkgs.nginx.com/plus/R32/centos/7/$basearch/ diff --git a/content/includes/nginx-plus/install/pin-to-version/pin-rhel8-R32.md b/content/includes/nginx-plus/install/pin-to-version/pin-rhel8-R32.md index 369a9ebb9..d970d82c2 100644 --- a/content/includes/nginx-plus/install/pin-to-version/pin-rhel8-R32.md +++ b/content/includes/nginx-plus/install/pin-to-version/pin-rhel8-R32.md @@ -1,11 +1,11 @@ --- -docs: DOCS-000 +nd-docs: DOCS-000 --- To pin NGINX Plus to a specific version (for example, R33): 1. Edit the `/etc/yum.repos.d/nginx-plus-8.repo` file. -1. Update the repository base URL to the desired version: +1. Update the repository base URL to the desired version: ```shell baseurl=https://pkgs.nginx.com/plus/R33/centos/8/$basearch/ diff --git a/content/includes/nginx-plus/install/pin-to-version/pin-rhel9-R32.md b/content/includes/nginx-plus/install/pin-to-version/pin-rhel9-R32.md index 6085a8c7d..80b5571db 100644 --- a/content/includes/nginx-plus/install/pin-to-version/pin-rhel9-R32.md +++ b/content/includes/nginx-plus/install/pin-to-version/pin-rhel9-R32.md @@ -1,11 +1,11 @@ --- -docs: DOCS-000 +nd-docs: DOCS-000 --- To pin NGINX Plus to a specific version (for example, R33): 1. Edit the `/etc/yum.repos.d/plus-9.repo` file. -1. Update the repository base URL to the desired version: +1. Update the repository base URL to the desired version: ```shell baseurl=https://pkgs.nginx.com/plus/R33/centos/9/$basearch/ diff --git a/content/includes/nginx-plus/usage-tracking/agentless-reporting.md b/content/includes/nginx-plus/usage-tracking/agentless-reporting.md index 0cbdce2f4..55af846c6 100644 --- a/content/includes/nginx-plus/usage-tracking/agentless-reporting.md +++ b/content/includes/nginx-plus/usage-tracking/agentless-reporting.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1408 +nd-docs: DOCS-1408 --- Since [Release 31]({{< ref "/nginx/releases.md#nginxplusrelease-31-r31" >}}), NGINX Plus provides a built-in support for reporting of your NGINX Plus instances to NGINX Instance Manager without the need of installing NGINX Agent or tuning HTTP Health checks. If you participate in the [F5 Flex Consumption Program](https://www.f5.com/products/get-f5/flex-consumption-program), you will no longer need to manually track your NGINX Plus instances. diff --git a/content/includes/nginx-plus/usage-tracking/get-list-k8s-deployments.md b/content/includes/nginx-plus/usage-tracking/get-list-k8s-deployments.md index 41caaa2d1..2f8a092b1 100644 --- a/content/includes/nginx-plus/usage-tracking/get-list-k8s-deployments.md +++ b/content/includes/nginx-plus/usage-tracking/get-list-k8s-deployments.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1352 +nd-docs: DOCS-1352 --- To report your NGINX Ingress Controller clusters to F5, follow these steps: diff --git a/content/includes/nginx-plus/usage-tracking/http-health-check.md b/content/includes/nginx-plus/usage-tracking/http-health-check.md index 0a0e0a90d..7cf3e8cd6 100644 --- a/content/includes/nginx-plus/usage-tracking/http-health-check.md +++ b/content/includes/nginx-plus/usage-tracking/http-health-check.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1351 +nd-docs: DOCS-1351 --- You can track NGINX Plus instances using an [HTTP Health Check]({{< ref "nginx/admin-guide/load-balancer/http-health-check" >}}) without installing NGINX Agent. This involves updating the NGINX Plus configuration file. Follow these steps: diff --git a/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md b/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md index 9779c6c38..855a4b90d 100644 --- a/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md +++ b/content/includes/nginx-plus/usage-tracking/install-nginx-agent.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1354 +nd-docs: DOCS-1354 --- When you install NGINX Agent on an NGINX Plus instance, it will establish a connection with Instance Manager and begin transmitting usage data. diff --git a/content/includes/nginx-plus/usage-tracking/install-nim.md b/content/includes/nginx-plus/usage-tracking/install-nim.md index b5d048227..cdbb7f7b4 100644 --- a/content/includes/nginx-plus/usage-tracking/install-nim.md +++ b/content/includes/nginx-plus/usage-tracking/install-nim.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1355 +nd-docs: DOCS-1355 --- {{
diff --git a/content/includes/nim/webui-nim-login.md b/content/includes/nim/webui-nim-login.md index 65b5bfd19..85bbf101d 100644 --- a/content/includes/nim/webui-nim-login.md +++ b/content/includes/nim/webui-nim-login.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1334 +nd-docs: DOCS-1334 --- In a web browser, go to the FQDN for your NGINX Instance Manager host and log in. Then, select **Instance Manager** from the Launchpad menu. diff --git a/content/includes/nms/services/platform-services.md b/content/includes/nms/services/platform-services.md index 33224eeea..4c9a58d6a 100644 --- a/content/includes/nms/services/platform-services.md +++ b/content/includes/nms/services/platform-services.md @@ -1,5 +1,5 @@ --- -docs: DOCS-1186 +nd-docs: DOCS-1186 --- {{