diff --git a/content/nic/configuration/global-configuration/command-line-arguments.md b/content/nic/configuration/global-configuration/command-line-arguments.md index 06f5766e1..39c0a8f6e 100644 --- a/content/nic/configuration/global-configuration/command-line-arguments.md +++ b/content/nic/configuration/global-configuration/command-line-arguments.md @@ -479,6 +479,42 @@ Enables App Protect IP Intelligence. Defaults to `false`. *Only applies to WAF s Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect](#cmdoption-enable-app-protect). + + +### -plm-storage-url + +SeaweedFS S3 endpoint from which NGINX Ingress Controller fetches the policy and logconf bundle. Leave empty to turn off PLM support. + + + +### -plm-storage-credentials-secret + +A Secret containing the SeaweedFS admin secret in the `seaweedfs_admin_secret` key. + +Format: `/` + + + +### -plm-storage-ca-secret + +An optional Secret containing `ca.crt` for SeaweedFS TLS verification. + +Format: `/` + + + +### -plm-storage-client-ssl-secret + +An optional Secret containing `tls.crt` and `tls.key` for SeaweedFS mTLS. + +Format: `/` + + + +### -plm-storage-insecure-skip-verify + +Turns off SeaweedFS TLS verification. For development and testing only. + ### -ready-status diff --git a/content/nic/configuration/policy-resource.md b/content/nic/configuration/policy-resource.md index 4f0523494..b94e3fcf8 100644 --- a/content/nic/configuration/policy-resource.md +++ b/content/nic/configuration/policy-resource.md @@ -1294,7 +1294,7 @@ waf: |Field | Description | Type | Required | | ---| ---| ---| --- | |``enable`` | Enables F5 WAF for NGINX. | ``bool`` | Yes | -|``apPolicy`` | The [F5 WAF for NGINX policy]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-policies" >}}) of the WAF. Accepts an optional namespace. Mutually exclusive with ``apBundle``. | ``string`` | No | +|``apPolicy`` | The [F5 WAF for NGINX policy]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-policies" >}}) of the WAF. References an APPolicy CR by `[/]`. When the Ingress Controller is started with `-plm-storage-url`, the referenced APPolicy must have been compiled by PLM (status.bundle.state == ready). Mutually exclusive with `apBundle`. | `string` | No | |``apBundle`` | The [F5 WAF for NGINX policy bundle]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-bundles" >}}). Mutually exclusive with ``apPolicy`` and ``apBundleSource``. | ``string`` | No | |``apBundleSource`` | [Remote source]({{< ref "/nic/integrations/app-protect-waf-v5/bundle-sources.md" >}}) for fetching the WAF policy bundle. Mutually exclusive with ``apBundle`` and ``apPolicy``. | [waf.apBundleSource](#wafapbundlesource) | No | |``securityLog.enable`` | **Deprecated:** Enables security log. | ``bool`` | No | @@ -1312,7 +1312,7 @@ waf: |Field | Description | Type | Required | | ---| ---| ---| --- | |``enable`` | Enables security log. | ``bool`` | No | -|``apLogConf`` | The [App Protect WAF log conf]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. Accepts an optional namespace. Only works with ``apPolicy``. | ``string`` | No | +|``apLogConf`` | The [App Protect WAF log conf]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. `apLogConf` references an APPolicy CR by `[/]`. When you start the Ingress Controller with `-plm-storage-url`, PLM must have compiled the referenced APLogConf (`status.bundle.state == ready`). Only works with `apPolicy`. | ``string`` | No | |``apLogBundle`` | The [App Protect WAF log bundle]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-bundles" >}}) resource. Only works with ``apBundle``. Mutually exclusive with ``apLogBundleSource``. | ``string`` | No | |``apLogBundleSource`` | [Remote source]({{< ref "/nic/integrations/app-protect-waf-v5/bundle-sources.md" >}}) for fetching the log profile bundle. Mutually exclusive with ``apLogBundle``. | [waf.apBundleSource](#wafapbundlesource) | No | |``logDest`` | The log destination for the security log. Only accepted variables are ``syslog:server=; localhost; :``, ``stderr``, ````. | ``string`` | No | diff --git a/content/nic/install/helm/parameters.md b/content/nic/install/helm/parameters.md index a044a5921..012376501 100644 --- a/content/nic/install/helm/parameters.md +++ b/content/nic/install/helm/parameters.md @@ -140,6 +140,11 @@ The [values.schema.json](https://github.com/nginx/kubernetes-ingress/blob/main/c | **controller.pod.extraLabels** | The additional extra labels of the NGINX Ingress Controller pod. | {} | | **controller.appprotect.enable** | Enables the F5 WAF for NGINX module in the NGINX Ingress Controller. | false | | **controller.appprotect.v5** | Enables F5 WAF for NGINX v5. | false | +| **controller.appprotect.plmStorage.url** | SeaweedFS S3 endpoint from which NGINX Ingress Controller fetches the policy and logconf bundle. Leave empty to turn off PLM support. Requires `controller.appprotect.v5` to be `true`. | "" | +| **controller.appprotect.plmStorage.credentialsSecret** | Secret containing the SeaweedFS admin secret in the `seaweedfs_admin_secret` key. Format: `/`. | "" | +| **controller.appprotect.plmStorage.caSecret** | Optional Secret containing the SeaweedFS admin secret under `seaweedfs_admin_secret`. Format: `/`. | "" | +| **controller.appprotect.plmStorage.clientSSLSecret** | Optional Secret containing `tls.crt` and `tls.key` for SeaweedFS mTLS. Format: `/`. | "" | +| **controller.appprotect.plmStorage.insecureSkipVerify** | Turns off SeaweedFS TLS verification. For development and testing only. | false | | **controller.appprotect.volumes** | Volumes for F5 WAF for NGINX v5. | [{"name": "app-protect-bd-config", "emptyDir": {}},{"name": "app-protect-config", "emptyDir": {}},{"name": "app-protect-bundles", "emptyDir": {}}] | | **controller.appprotect.enforcer.host** | Host that the F5 WAF for NGINX v5 Enforcer runs on. | "127.0.0.1" | | **controller.appprotect.enforcer.port** | Port that the F5 WAF for NGINX v5 Enforcer runs on. | 50000 |