Skip to content

nic: plm cli options #2196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vepatel wants to merge 7 commits into
base: nic-release-5.6
Choose a base branch
from
+43 −2
Open

nic: plm cli options #2196

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0a69275
feat: plm cli options
vepatel Aug 10, 2026
d9eb218
feat: update helm parameters for PLM
vepatel Aug 10, 2026
bdeac36
Apply suggestions from code review
vepatel Aug 11, 2026
710f2b3
Apply suggestions from code review
y82 Aug 12, 2026
5ea51f1
Apply suggestion from @JTorreG
vepatel Aug 12, 2026
2c18672
Tech Writer agents per the F5 Technical Writing Style Guide
travisamartin Aug 13, 2026
4e0c05c
Merge branch 'nic-release-5.6' into nic/plm-options-args
vepatel Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions content/nic/configuration/global-configuration/command-line-arguments.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,6 +479,42 @@ Enables App Protect IP Intelligence. Defaults to `false`. *Only applies to WAF s

Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect](#cmdoption-enable-app-protect).

<a name="cmdoption-plm-storage-url"></a>

### -plm-storage-url
Comment on lines +482 to +484

@JTorreG JTorreG Aug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a way to do this without HTML (and we very much prefer not using HTML)

Suggested change
<a name="cmdoption-plm-storage-url"></a>
### -plm-storage-url
### -plm-storage-url {#cmdoption-plm-storage-url}

By default Hugo adds anchors to every header. If not custom anchor is added, ### -plm-storage-url will create the #-plm-storage-url anchor automatically.

Apply the same structure to the other anchors

@vepatel vepatel Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we do it as a separate PR since it involved unrelated changes?


SeaweedFS S3 endpoint from which NGINX Ingress Controller fetches the policy and logconf bundle. Leave empty to turn off PLM support.

<a name="cmdoption-plm-storage-credentials-secret"></a>

### -plm-storage-credentials-secret

A Secret containing the SeaweedFS admin secret in the `seaweedfs_admin_secret` key.

Format: `<namespace>/<name>`

<a name="cmdoption-plm-storage-ca-secret"></a>

### -plm-storage-ca-secret

An optional Secret containing `ca.crt` for SeaweedFS TLS verification.

Format: `<namespace>/<name>`

<a name="cmdoption-plm-storage-client-ssl-secret"></a>

### -plm-storage-client-ssl-secret

An optional Secret containing `tls.crt` and `tls.key` for SeaweedFS mTLS.

Format: `<namespace>/<name>`

<a name="cmdoption-plm-storage-insecure-skip-verify"></a>

### -plm-storage-insecure-skip-verify

Turns off SeaweedFS TLS verification. For development and testing only.

<a name="cmdoption-ready-status"></a>

### -ready-status
Expand Down
4 changes: 2 additions & 2 deletions content/nic/configuration/policy-resource.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1294,7 +1294,7 @@ waf:
|Field | Description | Type | Required |
| ---| ---| ---| --- |
|``enable`` | Enables F5 WAF for NGINX. | ``bool`` | Yes |
|``apPolicy`` | The [F5 WAF for NGINX policy]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-policies" >}}) of the WAF. Accepts an optional namespace. Mutually exclusive with ``apBundle``. | ``string`` | No |
|``apPolicy`` | The [F5 WAF for NGINX policy]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-policies" >}}) of the WAF. References an APPolicy CR by `[<namespace>/]<name>`. When the Ingress Controller is started with `-plm-storage-url`, the referenced APPolicy must have been compiled by PLM (status.bundle.state == ready). Mutually exclusive with `apBundle`. | `string` | No |
|``apBundle`` | The [F5 WAF for NGINX policy bundle]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-bundles" >}}). Mutually exclusive with ``apPolicy`` and ``apBundleSource``. | ``string`` | No |
|``apBundleSource`` | [Remote source]({{< ref "/nic/integrations/app-protect-waf-v5/bundle-sources.md" >}}) for fetching the WAF policy bundle. Mutually exclusive with ``apBundle`` and ``apPolicy``. | [waf.apBundleSource](#wafapbundlesource) | No |
|``securityLog.enable`` | **Deprecated:** Enables security log. | ``bool`` | No |
Expand All @@ -1312,7 +1312,7 @@ waf:
|Field | Description | Type | Required |
| ---| ---| ---| --- |
|``enable`` | Enables security log. | ``bool`` | No |
|``apLogConf`` | The [App Protect WAF log conf]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. Accepts an optional namespace. Only works with ``apPolicy``. | ``string`` | No |
|``apLogConf`` | The [App Protect WAF log conf]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. `apLogConf` references an APPolicy CR by `[<NAMESPACE>/]<NAME>`. When you start the Ingress Controller with `-plm-storage-url`, PLM must have compiled the referenced APLogConf (`status.bundle.state == ready`). Only works with `apPolicy`. | ``string`` | No |
|``apLogBundle`` | The [App Protect WAF log bundle]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-bundles" >}}) resource. Only works with ``apBundle``. Mutually exclusive with ``apLogBundleSource``. | ``string`` | No |
|``apLogBundleSource`` | [Remote source]({{< ref "/nic/integrations/app-protect-waf-v5/bundle-sources.md" >}}) for fetching the log profile bundle. Mutually exclusive with ``apLogBundle``. | [waf.apBundleSource](#wafapbundlesource) | No |
|``logDest`` | The log destination for the security log. Only accepted variables are ``syslog:server=<ip-address>; localhost; <fqdn>:<port>``, ``stderr``, ``<absolute path to file>``. | ``string`` | No |
Expand Down
5 changes: 5 additions & 0 deletions content/nic/install/helm/parameters.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,11 @@ The [values.schema.json](https://github.com/nginx/kubernetes-ingress/blob/main/c
| **controller.pod.extraLabels** | The additional extra labels of the NGINX Ingress Controller pod. | {} |
| **controller.appprotect.enable** | Enables the F5 WAF for NGINX module in the NGINX Ingress Controller. | false |
| **controller.appprotect.v5** | Enables F5 WAF for NGINX v5. | false |
| **controller.appprotect.plmStorage.url** | SeaweedFS S3 endpoint from which NGINX Ingress Controller fetches the policy and logconf bundle. Leave empty to turn off PLM support. Requires `controller.appprotect.v5` to be `true`. | "" |
| **controller.appprotect.plmStorage.credentialsSecret** | Secret containing the SeaweedFS admin secret in the `seaweedfs_admin_secret` key. Format: `<NAMESPACE>/<NAME>`. | "" |
| **controller.appprotect.plmStorage.caSecret** | Optional Secret containing the SeaweedFS admin secret under `seaweedfs_admin_secret`. Format: `<NAMESPACE>/<NAME>`. | "" |
| **controller.appprotect.plmStorage.clientSSLSecret** | Optional Secret containing `tls.crt` and `tls.key` for SeaweedFS mTLS. Format: `<NAMESPACE>/<NAME>`. | "" |
| **controller.appprotect.plmStorage.insecureSkipVerify** | Turns off SeaweedFS TLS verification. For development and testing only. | false |
| **controller.appprotect.volumes** | Volumes for F5 WAF for NGINX v5. | [{"name": "app-protect-bd-config", "emptyDir": {}},{"name": "app-protect-config", "emptyDir": {}},{"name": "app-protect-bundles", "emptyDir": {}}] |
| **controller.appprotect.enforcer.host** | Host that the F5 WAF for NGINX v5 Enforcer runs on. | "127.0.0.1" |
| **controller.appprotect.enforcer.port** | Port that the F5 WAF for NGINX v5 Enforcer runs on. | 50000 |
Expand Down
Loading