docs: Add PLM policy source tutorial and copy edits for NGF WAF integration

content/includes/ngf/installation/nginx-plus/download-jwt.md

@@ -2,13 +2,15 @@
 f5-product: NGINX Gateway Fabric
 f5-files:
 - content/ngf/install/helm.md
-- content/ngf/install/manifests.md
+- content/ngf/install/manifests/plus.md
+- content/ngf/install/manifests/plus-experimental.md
 - content/ngf/install/nginx-plus.md
+- content/ngf/waf-integration/get-started-plm.md
 ---
 
 1. Log in to [MyF5](https://my.f5.com/manage/s/).
-2. Go to **My Products & Plans > Subscriptions** to see your active subscriptions.
-3. Find your NGINX products or services subscription, and select the **Subscription ID** for details.
+2. Go to **My Products & Plans** > **Subscriptions** to see your active subscriptions.
+3. Find your NGINX products or services subscription and select the **Subscription ID** for details.
 4. Download the **JSON Web Token (JWT)** from the subscription page.
 
-{{< call-out class="note" >}} The Connectivity Stack for Kubernetes JWT does not work with NGINX Plus reporting. A regular NGINX Plus instance JWT must be used. {{< /call-out >}}
+{{< call-out class="note" title="Note" >}} The Connectivity Stack for Kubernetes JWT does not work with NGINX Plus reporting. Use a regular NGINX Plus instance JWT. {{< /call-out >}}

content/includes/waf/plm-configure-logging.md

@@ -0,0 +1,34 @@
+---
+f5-product: F5 WAF for NGINX
+f5-files:
+- content/ngf/waf-integration/get-started-plm.md
+---
+
+<!-- Maintainer note: This include is product-agnostic. It defines an APLogConf resource. The security namespace is created in the parent tutorial before this include is referenced, in a required step that precedes this optional section. The securityLogs field that references this log profile lives on the product-specific policy attachment resource (WAFPolicy for NGF, Policy for NIC) — keep that configuration in the parent tutorial, not here. -->
+
+This section is typically owned by the security team. If you're not on the security team, share this section with them before continuing.
+
+PLM security logging profiles are defined as `APLogConf` custom resources. Define a log profile that logs illegal requests:
+
+```yaml
+kubectl apply -f - <<EOF
+apiVersion: appprotect.f5.com/v1
+kind: APLogConf
+metadata:
+  name: log-illegal
+  namespace: security
+spec:
+  filter:
+    request_type: illegal
+  content:
+    format: default
+    max_request_size: any
+    max_message_size: 15k
+EOF
+```
+
+PLM compiles the log profile automatically. Wait for `status.bundle.state` to report `ready` before referencing it:
+
+```shell
+kubectl wait --for=jsonpath='{.status.bundle.state}'=ready aplogconf/log-illegal -n security --timeout=60s
+```

content/includes/waf/plm-create-security-namespace.md

@@ -0,0 +1,15 @@
+---
+f5-product: F5 WAF for NGINX
+f5-files:
+- content/ngf/waf-integration/get-started-plm.md
+---
+
+<!-- Maintainer note: This include creates the security namespace used by APPolicy and APLogConf resources. It is product-agnostic and must be included before any include or section that applies resources to the security namespace. In the NGF and NIC tutorials, include this before the optional security logging section. Note: NGF tutorials also create a ReferenceGrant in this namespace, but that is product-specific and not referenced here. -->
+
+This section is typically owned by the security team. If you're not on the security team, share this section with them before continuing.
+
+Create the `security` namespace. The security team's `APPolicy` and `APLogConf` resources live here. In NGINX Gateway Fabric, the `ReferenceGrant` that permits cross-namespace WAFPolicy references also lives in this namespace.
+
+```shell
+kubectl create namespace security
+```

content/includes/waf/plm-define-policy-methods.md

@@ -0,0 +1,213 @@
+---
+f5-product: F5 WAF for NGINX
+f5-files:
+- content/ngf/waf-integration/get-started-plm.md
+---
+
+<!-- Maintainer note: This include is product-agnostic. It covers all three APPolicy definition methods (inline, Git reference, precompiled bundle) in a tabbed UI. Content ends before any product-specific policy attachment resource (WAFPolicy for NGF, Policy for NIC). The ReferenceGrant required for cross-namespace WAFPolicy refs in NGF is not included here — add it in the parent tutorial after this include. The security namespace is created in plm-configure-logging.md, which runs before this include in the tutorial. -->
+
+The security team usually owns this section. They define the policy in the `security` namespace, separate from the Gateway namespace, so they can manage security resources independently from routing configuration. If you're not on the security team, share this section with them. You'll need the `APPolicy` name and namespace before continuing.
+
+The `APPolicy` resource defines the security policy. The PLM controller watches the resource, compiles the policy, and writes `status.bundle` with `state: ready` when the bundle is available.
+
+{{<tabs name="plm-policy-definition-methods">}}
+
+{{%tab name="Inline"%}}
+
+Create an `APPolicy` resource with an inline policy that blocks all attack signatures:
+
+```yaml
+kubectl apply -f - <<EOF
+apiVersion: appprotect.f5.com/v1
+kind: APPolicy
+metadata:
+  name: attack-signatures
+  namespace: security
+spec:
+  policy:
+    name: attack-signatures-blocking
+    template:
+      name: POLICY_TEMPLATE_NGINX_BASE
+    applicationLanguage: utf-8
+    enforcementMode: blocking
+    signature-sets:
+    - name: All Signatures
+      block: true
+      alarm: true
+    cookies:
+    - name: "*"
+      attackSignaturesCheck: true
+      enforcementType: enforce
+      maskValueInLogs: false
+EOF
+```
+
+Wait for the bundle to become ready:
+
+```shell
+kubectl wait --for=jsonpath='{.status.bundle.state}'=ready appolicy/attack-signatures -n security --timeout=60s
+```
+
+{{% /tab %}}
+
+{{%tab name="Git reference"%}}
+
+Store your policy JSON in a Git repository and reference the file from an `APPolicy` resource.
+
+#### Public repository
+
+Create an `APPolicy` resource that references the policy file by path. Replace `<POLICY_NAME>`, `<NAMESPACE>`, `<PATH/TO/POLICY.JSON>`, `<ORG>`, `<REPO>`, and `<TAG_OR_COMMIT>` with your values:
+
+```shell
+kubectl apply -f - <<'EOF'
+apiVersion: appprotect.f5.com/v1
+kind: APPolicy
+metadata:
+  name: <POLICY_NAME>
+  namespace: <NAMESPACE>
+spec:
+  policy:
+    $ref: <PATH/TO/POLICY.JSON>
+    externalReferenceDetails:
+      repositoryDetails:
+        repository: https://github.com/<ORG>/<REPO>.git
+        ref: "<TAG_OR_COMMIT>"
+EOF
+```
+
+{{< call-out class="caution" title="Pin ref to a tag in production" >}} Pin `ref` to a tag or commit SHA rather than a branch name in production environments. {{< /call-out >}}
+
+Check that the bundle compiled successfully:
+
+```shell
+kubectl get appolicy <POLICY_NAME> \
+  --namespace <NAMESPACE> \
+  --output jsonpath='State:    {.status.bundle.state}{"\n"}Bundle:   {.status.bundle.location}{"\n"}Compiler: {.status.bundle.compilerVersion}{"\n"}'
+```
+
+The output shows `State: ready` when compilation succeeds.
+
+#### Private repository
+
+For private repositories, create a Kubernetes Secret with your personal access token (PAT):
+
+```shell
+kubectl create secret generic git-token-secret \
+  --namespace <NAMESPACE> \
+  --from-literal=token=<GIT_PERSONAL_ACCESS_TOKEN>
+```
+
+Then reference the Secret in the `APPolicy` resource:
+
+```shell
+kubectl apply -f - <<'EOF'
+apiVersion: appprotect.f5.com/v1
+kind: APPolicy
+metadata:
+  name: <POLICY_NAME>
+  namespace: <NAMESPACE>
+spec:
+  policy:
+    $ref: <PATH/TO/POLICY.JSON>
+    externalReferenceDetails:
+      repositoryDetails:
+        repository: https://github.com/<ORG>/<REPO>.git
+        ref: "<TAG_OR_COMMIT>"
+      authentication:
+        token: git-token-secret
+EOF
+```
+
+#### Update a Git-referenced policy
+
+The Policy Controller doesn't poll the Git repository for changes. It fetches the policy file when the `APPolicy` spec changes.
+
+To pick up a new version of the policy, push your changes to the repository. Then update `ref` in the `APPolicy` resource to the new tag or commit SHA and reapply the resource. Reapplying an unchanged `APPolicy` doesn't trigger a fetch. Changing an annotation doesn't trigger a fetch either.
+
+If you need to re-fetch the same `ref` (for example, after force-updating a tag), delete the `APPolicy` resource and recreate it.
+
+{{% /tab %}}
+
+{{%tab name="Precompiled bundle"%}}
+
+The precompiled-bundle method lets you reference a `.tgz` policy bundle stored in an artifact registry (for example, Artifactory or Nexus). The Policy Controller imports the bundle and stores it in the SeaweedFS object store without recompiling the bundle.
+
+Use this method when:
+
+- Your security team compiles and publishes bundles through an external pipeline.
+- You want to separate policy compilation from cluster operations.
+
+Create an `APPolicy` resource that references your bundle. Replace `<POLICY_NAME>`, `<ARTIFACT_REGISTRY_HOST>`, and `<PATH/TO/POLICY_BUNDLE>` with your values:
+
+```shell
+kubectl apply -f - <<'EOF'
+apiVersion: appprotect.f5.com/v1
+kind: APPolicy
+metadata:
+  name: <POLICY_NAME>
+  namespace: security
+spec:
+  policy:
+    $ref: "https://<ARTIFACT_REGISTRY_HOST>/<PATH/TO/POLICY_BUNDLE>.tgz"
+EOF
+```
+
+{{< call-out class="important" title="Configure CA trust for private registries" >}}
+The Policy Controller must reach the artifact registry over HTTPS. If the registry uses a private certificate authority (CA), mount the CA certificate into the Policy Controller pod and set the `SSL_CERT_FILE` environment variable to its path. `SSL_CERT_FILE` replaces the system trust store entirely. It doesn't append to the system trust store. If SeaweedFS TLS is also turned on, combine both CAs into a single file and reference that file.
+{{< /call-out >}}
+
+If the `APPolicy` status shows `x509: certificate signed by unknown authority`, the Policy Controller doesn't trust the artifact registry CA. Check the status for the full error:
+
+```shell
+kubectl describe appolicy <POLICY_NAME> --namespace security
+```
+
+#### Confirm the policy is ready
+
+The Policy Controller processes the bundle and updates the `APPolicy` status. Check the `bundle.state` field:
+
+```shell
+kubectl get appolicy <POLICY_NAME> \
+  --namespace security \
+  --output jsonpath='State:      {.status.bundle.state}{"\n"}Bundle:     {.status.bundle.location}{"\n"}isCompiled: {.status.processing.isCompiled}{"\n"}'
+```
+
+When the bundle is ready, the output looks like this:
+
+```text
+State:      ready
+Bundle:     s3://plm-system/bundles/<POLICY_NAME>_imported_<HASH>.tgz
+isCompiled: false
+```
+
+`isCompiled: false` confirms the bundle was imported without recompilation.
+
+`bundle.state` can be one of:
+
+| State | Meaning |
+|-------|---------|
+| `pending` | The Policy Controller hasn't yet processed the resource. |
+| `processing` | The Policy Controller is importing or storing the bundle. |
+| `ready` | The bundle is stored and ready to use. The Policy Controller has populated `bundle.location`. |
+| `invalid` | The Policy Controller couldn't import the bundle. Check the status for error detail. |
+
+#### Update a precompiled bundle
+
+The Policy Controller doesn't poll the artifact registry for changes. To pick up a new version of a bundle, update the `$ref` URL in your `APPolicy` resource and reapply the resource. Changing an annotation doesn't trigger a new download. If you need to re-fetch the same URL, delete the `APPolicy` resource and recreate it. Replace `<POLICY_NAME>`, `<ARTIFACT_REGISTRY_HOST>`, and `<PATH/TO/UPDATED_POLICY_BUNDLE>` with your values:
+
+```shell
+kubectl apply -f - <<'EOF'
+apiVersion: appprotect.f5.com/v1
+kind: APPolicy
+metadata:
+  name: <POLICY_NAME>
+  namespace: security
+spec:
+  policy:
+    $ref: "https://<ARTIFACT_REGISTRY_HOST>/<PATH/TO/UPDATED_POLICY_BUNDLE>.tgz"
+EOF
+```
+
+{{% /tab %}}
+
+{{</tabs>}}