Skip to content

Commit fcb0ea5

Browse files
ADubhlaoichADubhlaoich
authored
Merge branch 'main' into nic/upgrade-instructions
2 parents cab2b43 + 44bd9f6 commit fcb0ea5

File tree

6 files changed

+161
-163
lines changed

6 files changed

+161
-163
lines changed

‎content/nginx-one/k8s/add-nic.md

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,27 @@ You can also create a data plane key through the NGINX One Console. Once loggged
3737
{{<tabs name="deploy-config-resource">}}
3838
{{%tab name="Helm"%}}
3939

40-
Edit your `values.yaml` file to enable NGINX Agent and configure it to connect to NGINX One Console:
40+
Upgrade or install NGINX Ingress Controller with the following command to configure NGINX Agent and connect to NGINX One Console:
4141

42-
```yaml
43-
nginxAgent:
44-
enable: true
45-
dataplaneKeySecretName: "<data_plane_key_secret_name>"
46-
```
42+
- For NGINX:
43+
44+
```shell
45+
helm upgrade --install my-release oci://ghcr.io/nginx/charts/nginx-ingress --version {{< nic-helm-version >}} \
46+
--set nginxAgent.enable=true \
47+
--set nginxAgent.dataplaneKeySecretName=<data_plane_key_secret_name> \
48+
--set nginxAgent.endpointHost=agent.connect.nginx.com
49+
```
50+
51+
- For NGINX Plus: (This assumes you have pushed NGINX Ingress Controller image `nginx-plus-ingress` to your private registry `myregistry.example.com`)
52+
53+
```shell
54+
helm upgrade --install my-release oci://ghcr.io/nginx/charts/nginx-ingress --version {{< nic-helm-version >}} \
55+
--set controller.image.repository=myregistry.example.com/nginx-plus-ingress \
56+
--set controller.nginxplus=true \
57+
--set nginxAgent.enable=true \
58+
--set nginxAgent.dataplaneKeySecretName=<data_plane_key_secret_name> \
59+
--set nginxAgent.endpointHost=agent.connect.nginx.com
60+
```
4761

4862
The `dataplaneKeySecretName` is used to authenticate the agent with NGINX One Console. See the [NGINX One Console Docs]({{< ref "/nginx-one/connect-instances/create-manage-data-plane-keys.md" >}})
4963
for instructions on how to generate your dataplane key from the NGINX One Console.
@@ -89,7 +103,7 @@ data:
89103
## command server settings
90104
command:
91105
server:
92-
host: product.connect.nginx.com
106+
host: agent.connect.nginx.com
93107
port: 443
94108
auth:
95109
tokenpath: "/etc/nginx-agent/secrets/dataplane.key"

‎content/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md

Lines changed: 80 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ When you plan Config Sync Groups, consider the following factors:
8181

8282
- **Single Config Sync Group membership**: You can add an instance to only one Config Sync Group.
8383

84-
- **NGINX Agent configuration file location**: When you run the NGINX Agent installation script to register an instance with NGINX One, the script creates the `agent-dynamic.conf` file, which contains settings for the NGINX Agent, including the specified Config Sync Group. This file is typically located in `/var/lib/nginx-agent/` on most systems; however, on FreeBSD, it's located at `/var/db/nginx-agent/`.
84+
- **NGINX Agent configuration file location**: When you run the NGINX Agent installation script to register an instance with NGINX One, the script creates the `nginx-agent.conf` (or `agent-dynamic.conf` if you are using NGINX Agent 2.x) file, which contains settings for the NGINX Agent, including the specified Config Sync Group. This file is typically located in `/etc/nginx-agent/` on most systems.
8585

8686
- **Mixing NGINX Open Source and NGINX Plus instances**: You can add both NGINX Open Source and NGINX Plus instances to the same Config Sync Group, but there are limitations. If your configuration includes features exclusive to NGINX Plus, synchronization will fail on NGINX Open Source instances because they don't support these features. NGINX One allows you to mix NGINX instance types for flexibility, but it’s important to ensure that the configurations you're applying are compatible with all instances in the group.
8787

@@ -104,6 +104,28 @@ Any instance that joins the group afterwards inherits that configuration.
104104

105105
You can add existing NGINX instances that are already registered with NGINX One to a Config Sync Group.
106106

107+
{{< tabs name="Add existing instance to Config Sync Group" >}}
108+
109+
{{%tab name="NGINX Agent 3.x"%}}
110+
111+
1. Open a command-line terminal on the NGINX instance.
112+
2. Open the `/etc/nginx-agent/nginx-agent.conf` file in a text editor.
113+
3. Find or create the `labels` section and change the `config_sync_group` label to the name of the new Config Sync Group.
114+
115+
``` text
116+
labels:
117+
config_sync_group: <config_sync_group>
118+
```
119+
120+
4. Restart NGINX Agent:
121+
122+
``` shell
123+
sudo systemctl restart nginx-agent
124+
```
125+
126+
{{%/tab%}}
127+
{{%tab name="NGINX Agent 2.x"%}}
128+
107129
1. Open a command-line terminal on the NGINX instance.
108130
2. Open the `/var/lib/nginx-agent/agent-dynamic.conf` file in a text editor.
109131
3. At the end of the file, add a new line beginning with `instance_group:`, followed by the Config Sync Group name.
@@ -118,6 +140,9 @@ You can add existing NGINX instances that are already registered with NGINX One
118140
sudo systemctl restart nginx-agent
119141
```
120142

143+
{{%/tab%}}
144+
{{< /tabs >}}
145+
121146
### Add a new instance to a Config Sync Group {#add-a-new-instance-to-a-config-sync-group}
122147

123148
When adding a new NGINX instance that is not yet registered with NGINX One, you need a data plane key to securely connect the instance. You can generate a new data plane key during the process or use an existing one if you already have it.
@@ -185,6 +210,29 @@ For more details on creating and managing data plane keys, see [Create and manag
185210

186211
If you need to move an NGINX instance to a different Config Sync Group, follow these steps:
187212

213+
{{< tabs name="Move instance to Config Sync Group" >}}
214+
215+
{{%tab name="NGINX Agent 3.x"%}}
216+
217+
1. Open a command-line terminal on the NGINX instance.
218+
2. Open the `/etc/nginx-agent/nginx-agent.conf` file in a text editor.
219+
3. Find the `labels` section and change the `config_sync_group` label to the name of the new Config Sync Group.
220+
221+
``` text
222+
labels:
223+
config-sync-group: <new_config_sync_group>
224+
```
225+
226+
4. Restart NGINX Agent by running the following command:
227+
228+
```shell
229+
sudo systemctl restart nginx-agent
230+
```
231+
232+
{{%/tab%}}
233+
{{%tab name="NGINX Agent 2.x"%}}
234+
235+
188236
1. Open a command-line terminal on the NGINX instance.
189237
2. Open the `/var/lib/nginx-agent/agent-dynamic.conf` file in a text editor.
190238
3. Locate the line that begins with `instance_group:` and change it to the name of the new Config Sync Group.
@@ -199,12 +247,39 @@ If you need to move an NGINX instance to a different Config Sync Group, follow t
199247
sudo systemctl restart nginx-agent
200248
```
201249

250+
{{%/tab%}}
251+
{{< /tabs >}}
252+
253+
202254
If you move an instance with certificates from one Config Sync Group to another, NGINX One adds or removes those certificates from the data plane, to synchronize with the deployed certificates of the group.
203255

204256
### Remove an instance from a Config Sync Group
205257

206258
If you need to remove an NGINX instance from a Config Sync Group without adding it to another group, follow these steps:
207259

260+
261+
{{< tabs name="Remove instance from Config Sync Group" >}}
262+
263+
{{%tab name="NGINX Agent 3.x"%}}
264+
265+
1. Open a command-line terminal on the NGINX instance.
266+
2. Open the `/etc/nginx-agent/nginx-agent.conf` file in a text editor.
267+
3. Locate the line that begins with `labels:` section and either remove the `config-sync-group` line or comment it out by adding a `#` at the beginning of the line.
268+
269+
```text
270+
labels:
271+
# config-sync-group: <new_config_sync_group>
272+
```
273+
274+
4. Restart NGINX Agent:
275+
276+
```shell
277+
sudo systemctl restart nginx-agent
278+
```
279+
280+
{{%/tab%}}
281+
{{%tab name="NGINX Agent 2.x"%}}
282+
208283
1. Open a command-line terminal on the NGINX instance.
209284
2. Open the `/var/lib/nginx-agent/agent-dynamic.conf` file in a text editor.
210285
3. Locate the line that begins with `instance_group:` and either remove it or comment it out by adding a `#` at the beginning of the line.
@@ -219,6 +294,10 @@ If you need to remove an NGINX instance from a Config Sync Group without adding
219294
sudo systemctl restart nginx-agent
220295
```
221296

297+
{{%/tab%}}
298+
{{< /tabs >}}
299+
300+
222301
By removing or commenting out this line, the instance will no longer be associated with any Config Sync Group.
223302

224303
## Publish the Config Sync Group configuration {#publish-the-config-sync-group-configuration}

‎content/nic/installation/installing-nic/installation-with-helm.md

Lines changed: 19 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -298,21 +298,25 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
298298
| **serviceNameOverride** | Used to prevent cloud load balancers from being replaced due to service name change during helm upgrades. | "" |
299299
| **nginxServiceMesh.enable** | Enable integration with NGINX Service Mesh. See the NGINX Service Mesh docs for more details. Requires `controller.nginxplus`. | false |
300300
| **nginxServiceMesh.enableEgress** | Enable NGINX Service Mesh workloads to route egress traffic through the Ingress Controller. See the NGINX Service Mesh docs for more details. Requires `nginxServiceMesh.enable`. | false |
301-
|**nginxAgent.enable** | Enable NGINX Agent to integrate the Security Monitoring and App Protect WAF modules. Requires `controller.appprotect.enable`. | false |
302-
|**nginxAgent.instanceGroup** | Set a custom Instance Group name for the deployment, shown when connected to NGINX Instance Manager. `nginx-ingress.controller.fullname` will be used if not set. | "" |
303-
|**nginxAgent.logLevel** | Log level for NGINX Agent. | "error |
304-
|**nginxAgent.instanceManager.host** | FQDN or IP for connecting to NGINX Ingress Controller. Required when `nginxAgent.enable` is set to `true` | "" |
305-
|**nginxAgent.instanceManager.grpcPort** | Port for connecting to NGINX Ingress Controller. | 443 |
306-
|**nginxAgent.instanceManager.sni** | Server Name Indication for Instance Manager. See the NGINX Agent [docs]({{< ref "/agent/configuration/encrypt-communication.md" >}}) for more details. | "" |
307-
|**nginxAgent.instanceManager.tls.enable** | Enable TLS for Instance Manager connection. | true |
308-
|**nginxAgent.instanceManager.tls.skipVerify** | Skip certification verification for Instance Manager connection. | false |
309-
|**nginxAgent.instanceManager.tls.caSecret** | Name of `nginx.org/ca` secret used for verification of Instance Manager TLS. | "" |
310-
|**nginxAgent.instanceManager.tls.secret** | Name of `kubernetes.io/tls` secret with a TLS certificate and key for using mTLS between NGINX Agent and Instance Manager. See the NGINX Instance Manager [docs]({{< ref "/nim/system-configuration/secure-traffic.md#mutual-client-certificate-authentication-setup-mtls" >}}) and the NGINX Agent [docs]({{< ref "/agent/configuration/encrypt-communication.md" >}}) for more details. | "" |
311-
|**nginxAgent.syslog.host** | Address for NGINX Agent to run syslog listener. | 127.0.0.1 |
312-
|**nginxAgent.syslog.port** | Port for NGINX Agent to run syslog listener. | 1514 |
313-
|**nginxAgent.napMonitoring.collectorBufferSize** | Buffer size for collector. Will contain log lines and parsed log lines. | 50000 |
314-
|**nginxAgent.napMonitoring.processorBufferSize** | Buffer size for processor. Will contain log lines and parsed log lines. | 50000 |
315-
|**nginxAgent.customConfigMap** | The name of a custom ConfigMap to use instead of the one provided by default. | "" |
301+
|**nginxAgent.enable** | Enable NGINX Agent 3.x to allow [connecting to NGINX One Console]({{< ref "/nginx-one/k8s/add-nic.md" >}}) or to integrate NGINX Agent 2.x for [Security Monitoring]({{< ref "/nic/tutorials/security-monitoring.md" >}}) . | false |
302+
|**nginxAgent.logLevel** | Log level for NGINX Agent. | "error" |
303+
|**nginxAgent.dataplaneKeySecretName** | Name of the Kubernetes Secret containing the Data Plane key used to authenticate to NGINX One Console. Learn more [here]({{< ref "/nginx-one/k8s/add-nic.md" >}}). Required when `nginxAgent.enable` is set to `true`. Requires NGINX Agent 3.x. | "" |
304+
|**nginxAgent.endpointHost** | Domain or IP address for the NGINX One Console. Requires NGINX Agent 3.x. | "agent.connect.nginx.com" |
305+
|**nginxAgent.endpointPort** | Port for the NGINX One Console endpoint. Requires NGINX Agent 3.x. | 443 |
306+
|**nginxAgent.tlsSkipVerify** | Skip TLS verification for the NGINX One Console endpoint. Requires NGINX Agent 3.x. | false |
307+
|**nginxAgent.instanceGroup** | Set a custom Instance Group name for the deployment, shown when connected to NGINX Instance Manager. `nginx-ingress.controller.fullname` will be used if not set. Requires NGINX Agent 2.x. | "" |
308+
|**nginxAgent.instanceManager.host** | FQDN or IP for connecting to NGINX Ingress Controller. Required when `nginxAgent.enable` is set to `true`. Requires NGINX Agent 2.x. | "" |
309+
|**nginxAgent.instanceManager.grpcPort** | Port for connecting to NGINX Ingress Controller. Requires NGINX Agent 2.x. | 443 |
310+
|**nginxAgent.instanceManager.sni** | Server Name Indication for Instance Manager. See the NGINX Agent [docs]({{< ref "/agent/configuration/encrypt-communication.md" >}}) for more details. Requires NGINX Agent 2.x. | "" |
311+
|**nginxAgent.instanceManager.tls.enable** | Enable TLS for Instance Manager connection. Requires NGINX Agent 2.x. | true |
312+
|**nginxAgent.instanceManager.tls.skipVerify** | Skip certification verification for Instance Manager connection. Requires NGINX Agent 2.x. | false |
313+
|**nginxAgent.instanceManager.tls.caSecret** | Name of `nginx.org/ca` secret used for verification of Instance Manager TLS. Requires NGINX Agent 2.x. | "" |
314+
|**nginxAgent.instanceManager.tls.secret** | Name of `kubernetes.io/tls` secret with a TLS certificate and key for using mTLS between NGINX Agent and Instance Manager. See the NGINX Instance Manager [docs]({{< ref "/nim/system-configuration/secure-traffic.md#mutual-client-certificate-authentication-setup-mtls" >}}) and the NGINX Agent [docs]({{< ref "/agent/configuration/encrypt-communication.md" >}}) for more details. Requires NGINX Agent 2.x. | "" |
315+
|**nginxAgent.syslog.host** | Address for NGINX Agent to run syslog listener. Requires NGINX Agent 2.x. | 127.0.0.1 |
316+
|**nginxAgent.syslog.port** | Port for NGINX Agent to run syslog listener. Requires NGINX Agent 2.x. | 1514 |
317+
|**nginxAgent.napMonitoring.collectorBufferSize** | Buffer size for collector. Will contain log lines and parsed log lines. Requires NGINX Agent 2.x. | 50000 |
318+
|**nginxAgent.napMonitoring.processorBufferSize** | Buffer size for processor. Will contain log lines and parsed log lines. Requires NGINX Agent 2.x. | 50000 |
319+
|**nginxAgent.customConfigMap** | The name of a custom ConfigMap to use instead of the one provided by default. Requires NGINX Agent 2.x.| "" |
316320
{{</bootstrap-table>}}
317321

318322
## Uninstall NGINX Ingress Controller

‎content/nic/installation/integrations/nic-n1-console.md

Lines changed: 0 additions & 130 deletions
This file was deleted.

‎content/nic/releases.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,15 @@ nd-docs: DOCS-616
1010

1111
08 Jul 2025
1212

13-
This release includes the ability to configure Rate Limiting for your APIs based on a specific NGINX variable and its value. This allows you more granular control over how frequently specific users access your resources.
13+
This NGINX Ingress Controller release brings initial connectivity to the NGINX One Console! You can now use NGINX One Console to manage NGINX instances that are part of your NGINX Ingress Controller cluster. See [here]({{< ref "/nginx-one/k8s/add-nic.md" >}}) to configure NGINX One Console with NGINX Ingress Controller.
14+
15+
This release also includes the ability to configure Rate Limiting for your APIs based on a specific NGINX variable and its value. This allows you more granular control over how frequently specific users access your resources.
1416

1517
Lastly, in our previous v5.0.0 release, we removed support for Open Tracing. This release replaces that observability capability with native NGINX Open Telemetry traces, allowing you to monitor the internal traffic of your applications.
1618

1719
### <i class="fa-solid fa-rocket"></i> Features
1820
- [7642](https://github.com/nginx/kubernetes-ingress/pull/7642) Add OpenTelemetry support
19-
- [7916](https://github.com/nginx/kubernetes-ingress/pull/7916) Add support for Agent V3
21+
- [7916](https://github.com/nginx/kubernetes-ingress/pull/7916) Add support for NGINX Agent version 3 and Connecting to NGINX One Console
2022
- [7884](https://github.com/nginx/kubernetes-ingress/pull/7884) Tiered rate limits with variables
2123
- [7765](https://github.com/nginx/kubernetes-ingress/pull/7765) Add OIDC PKCE configuration through Policy
2224
- [7832](https://github.com/nginx/kubernetes-ingress/pull/7832) Add request_method to rate-limit Policy

0 commit comments

Comments
 (0)