Skip to content

Commit 57ddc1e

Browse files
mjangmjang
committed
feat: Set up NGF integration to N1 Console
1 parent 24c3c86 commit 57ddc1e

File tree

5 files changed

+210
-3
lines changed

5 files changed

+210
-3
lines changed

‎content/includes/ngf/installation/install-oci-registry.md

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
nd-docs: "DOCS-0000"
3+
files:
4+
- content/nginx-one/k8s/add-ngf.md
5+
- content/ngf/install/helm.md
6+
---
7+
8+
The following steps install NGINX Gateway Fabric directly from the OCI helm registry. If you prefer, you can [install from sources](#install-from-sources) instead.
9+
10+
{{<tabs name="install-helm-oci">}}
11+
12+
{{%tab name="NGINX"%}}
13+
14+
To install the latest stable release of NGINX Gateway Fabric in the **nginx-gateway** namespace, run the following command:
15+
16+
```shell
17+
helm install ngf oci://ghcr.io/nginx/charts/nginx-gateway-fabric --create-namespace -n nginx-gateway
18+
```
19+
20+
{{% /tab %}}
21+
22+
{{%tab name="NGINX Plus"%}}
23+
24+
{{< note >}} If applicable, replace the F5 Container registry `private-registry.nginx.com` with your internal registry for your NGINX Plus image, and replace `nginx-plus-registry-secret` with your Secret name containing the registry credentials. If your NGINX Plus JWT Secret has a different name than the default `nplus-license`, then define that name using the `nginx.usage.secretName` flag. {{< /note >}}
25+
26+
To install the latest stable release of NGINX Gateway Fabric in the **nginx-gateway** namespace, run the following command:
27+
28+
```shell
29+
helm install ngf oci://ghcr.io/nginx/charts/nginx-gateway-fabric --set nginx.image.repository=private-registry.nginx.com/nginx-gateway-fabric/nginx-plus --set nginx.plus=true --set nginx.imagePullSecret=nginx-plus-registry-secret -n nginx-gateway
30+
```
31+
32+
{{% /tab %}}
33+
34+
{{</tabs>}}
35+
36+
`ngf` is the name of the release, and can be changed to any name you want. This name is added as a prefix to the Deployment name.
37+
38+
If you want the latest version from the **main** branch, add `--version 0.0.0-edge` to your install command.
39+
40+
To wait for the Deployment to be ready, you can either add the `--wait` flag to the `helm install` command, or run the following after installing:
41+
42+
```shell
43+
kubectl wait --timeout=5m -n nginx-gateway deployment/ngf-nginx-gateway-fabric --for=condition=Available

‎content/includes/nginx-one/data-plane-key-warning.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
files:
3+
- content/nginx-one/k8s/add-ngf.md
4+
- content/nginx-one/k8s/add-nic.md
5+
---
6+
{{<note>}}
7+
8+
{{</note>}}

‎content/nginx-one/connect-instances/create-manage-data-plane-keys.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,12 @@ Data plane keys are displayed only once and cannot be retrieved later. Be sure t
2424

2525
Data plane keys expire after one year. You can change this expiration date later by editing the key.
2626

27-
Revoking a data plane key disconnects all instances that were registered with that key.
27+
You can disconnect all instances associated with a data plane key in the following ways:
28+
29+
- Revoke the data plane key
30+
- Let the data plane key expire
31+
32+
Either action disconnects all instances registered with that key.
2833
{{</call-out>}}
2934

3035
## Create a new data plane key

‎content/nginx-one/k8s/add-ngf.md

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
---
2+
title: Connect NGINX Gateway Fabric
3+
toc: true
4+
weight: 300
5+
nd-content-type: how-to
6+
nd-product: NGINX One
7+
---
8+
9+
This document explains how to connect F5 NGINX Gateway Fabric to F5 NGINX One Console using NGINX Agent.
10+
Connecting NGINX Gateway Fabric to NGINX One Console enables centralized monitoring of all controller instances.
11+
12+
Once connected, you'll see a **read-only** configuration of NGINX Gateway Fabric. For each instance, you can review:
13+
14+
- Read-only configuration file
15+
- Unmanaged SSL/TLS certificates for Control Planes
16+
17+
## Before you begin
18+
19+
Log in to NGINX One Console. If you need more information, review our [Get started guide]({{< ref "/nginx-one/getting-started.md#before-you-begin" >}}).
20+
21+
You also need:
22+
23+
- Administrator access to a Kubernetes cluster.
24+
- [Helm](https://helm.sh) and [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) must be installed locally.
25+
26+
27+
### Create a data plane key
28+
29+
Data plane keys are displayed only once, when you create that key, and cannot be retrieved later.
30+
31+
If you've created and recorded one or more data plane keys, you can edit or revoke those keys. To do so, select **Manage > Data Plane Keys**. NGINX One Console does not store your actual data plane key.
32+
33+
If you've forgotten your data plane key, you can create a new one. Select **Manage > Data Plane Keys > Add Data Plane Key**.
34+
35+
For more options associated with data plane keys, see [Create and manage data plane keys]({{ ref "/nginx-one/connect-instances/create-manage-data-plane-keys" >}}).
36+
37+
### Create a Kubernetes secret with the data plane key
38+
<!-- Maybe this is wrong. I'm assuming that we need to follow this step from the current version of https://docs.nginx.com/nginx-one/k8s/add-nic/#before-you-begin -->
39+
To create a Kubernetes secret with the data play key, use the following command:
40+
41+
```shell
42+
kubectl create secret generic dataplane-key \
43+
--from-literal=dataplane.key=<Your Dataplane Key> \
44+
-n <namespace>
45+
```
46+
47+
### Install cert-manager
48+
49+
Add the Helm repository:
50+
51+
```shell
52+
helm repo add jetstack https://charts.jetstack.io
53+
helm repo update
54+
```
55+
56+
Install cert-manager:
57+
58+
```shell
59+
helm install \
60+
cert-manager jetstack/cert-manager \
61+
--namespace cert-manager \
62+
--create-namespace \
63+
--set config.apiVersion="controller.config.cert-manager.io/v1alpha1" \
64+
--set config.kind="ControllerConfiguration" \
65+
--set config.enableGatewayAPI=true \
66+
--set crds.enabled=true
67+
```
68+
69+
This also enables Gateway API features for cert-manager, which can be useful for [securing your workload traffic]({{< ref "/ngf/traffic-security/integrate-cert-manager.md" >}}).
70+
71+
## Install the Gateway API resources
72+
<!-- Corresponds to step 2 in the UX -->
73+
{{< include "/ngf/installation/install-gateway-api-resources.md" >}}
74+
75+
## Install from the OCI registry
76+
<!-- Corresponds to step 3 in the UX -->
77+
{{< include "/ngf/installation/install-oci-registry.md" >}}
78+
79+
### Install from sources {#install-from-sources}
80+
<!-- Corresponds to step 4 in the UX -->
81+
If you prefer to install directly from sources, instead of through the OCI helm registry, use the following steps.
82+
83+
{{< include "/ngf/installation/helm/pulling-the-chart.md" >}}
84+
85+
{{<tabs name="install-helm-src">}}
86+
87+
{{%tab name="NGINX"%}}
88+
89+
To install the chart into the **nginx-gateway** namespace, run the following command:
90+
91+
```shell
92+
helm install ngf . --create-namespace -n nginx-gateway
93+
```
94+
95+
{{% /tab %}}
96+
97+
{{%tab name="NGINX Plus"%}}
98+
99+
{{< note >}} If applicable, replace the F5 Container registry `private-registry.nginx.com` with your internal registry for your NGINX Plus image, and replace `nginx-plus-registry-secret` with your Secret name containing the registry credentials. If your NGINX Plus JWT Secret has a different name than the default `nplus-license`, then define that name using the `nginx.usage.secretName` flag. {{< /note >}}
100+
101+
To install the chart into the **nginx-gateway** namespace, run the following command:
102+
103+
```shell
104+
helm install ngf . --set nginx.image.repository=private-registry.nginx.com/nginx-gateway-fabric/nginx-plus --set nginx.plus=true --set nginx.imagePullSecret=nginx-plus-registry-secret -n nginx-gateway
105+
```
106+
107+
{{% /tab %}}
108+
109+
{{</tabs>}}
110+
111+
`ngf` is the name of the release, and can be changed to any name you want. This name is added as a prefix to the Deployment name.
112+
113+
To wait for the Deployment to be ready, you can either add the `--wait` flag to the `helm install` command, or run the following after installing:
114+
115+
```shell
116+
kubectl wait --timeout=5m -n nginx-gateway deployment/ngf-nginx-gateway-fabric --for=condition=Available
117+
```
118+
119+
## Verify a connection to NGINX One Console
120+
121+
After deploying NGINX Gateway Fabric with NGINX Agent, you can verify the connection to NGINX One Console.
122+
Log in to your F5 Distributed Cloud Console account. Select **NGINX One > Visit Service**. In the dashboard, go to **Manage > Instances**. You should see your instances listed by name. The instance name matches both the hostname and the pod name.
123+
124+
## Troubleshooting
125+
126+
If you encounter issues connecting your instances to NGINX One Console, try the following commands:
127+
128+
Check the NGINX Agent version:
129+
130+
```shell
131+
kubectl exec -it -n <namespace> <nginx_ingress_pod_name> -- nginx-agent -v
132+
```
133+
134+
If nginx-agent version is v3, continue with the following steps.
135+
Otherwise, make sure you are using an image that does not include NGINX App Protect.
136+
137+
Check the NGINX Agent configuration:
138+
139+
```shell
140+
kubectl exec -it -n <namespace> <nginx_pod_name> -- cat /etc/nginx-agent/nginx-agent.conf
141+
```
142+
143+
Check NGINX Agent logs:
144+
145+
```shell
146+
kubectl exec -it -n <namespace> <nginx_pod_name> -- nginx-agent
147+
```

‎content/nginx-one/k8s/add-nic.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
2-
title: Connect to NGINX One Console
2+
title: Connect NGINX Ingress Controller
33
toc: true
44
weight: 200
55
nd-content-type: how-to
66
nd-product: NGINX One
77
---
88

9-
This document explains how to connect F5 NGINX Ingress Controller <!-- and F5 NGINX Gateway Fabric -->to F5 NGINX One Console using NGINX Agent.
9+
This document explains how to connect F5 NGINX Ingress Controller to F5 NGINX One Console using NGINX Agent.
1010
Connecting NGINX Ingress Controller to NGINX One Console enables centralized monitoring of all controller instances.
1111

1212
Once connected, you'll see a **read-only** configuration of NGINX Ingress Controller. For each instance, you can review:
@@ -16,6 +16,10 @@ Once connected, you'll see a **read-only** configuration of NGINX Ingress Contro
1616

1717
## Before you begin
1818

19+
If you do not already have a [data plane key]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}}), you can create one. Pay attention to the expiration date of that key. Any instance that's connected to a data plane key that's expired or revoked will stop working.
20+
21+
You can create a data plane key through the NGINX One Console. Once loggged in, select **Manage > Control Planes > Add Control Plane**, and follow the steps shown.
22+
1923
Before connecting NGINX Ingress Controller to NGINX One Console, you need to create a Kubernetes Secret with the data plane key. Use the following command:
2024

2125
```shell

0 commit comments

Comments
 (0)