E579 Add instructions for configuring MyF5 JWT as a docker registry secret… · nginx/kubernetes-ingress@73f3b22 · GitHub
[go: up one dir, main page]
Skip to content

Commit 73f3b22

Browse files
ciarams87nginx-bot
ciarams87
and
nginx-bot
committed
Add instructions for configuring MyF5 JWT as a docker registry secret (#1898)
* Add instructions for configuring MyF5 JWT as a docker registry secret * PR feedback Co-authored-by: nginx-bot <68849795+nginx-bot@users.noreply.github.com>
1 parent 9a630e1 commit 73f3b22

10 files changed

+111
-46
lines changed

‎deployments/helm-chart/README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,9 @@ This chart deploys the NGINX Ingress controller in your Kubernetes cluster.
1010
- Helm 3.0+.
1111
- Git.
1212
- If you’d like to use NGINX Plus:
13-
- Build an Ingress controller image with NGINX Plus and push it to your private registry by following the instructions from [here](../../build/README.md).
13+
- To pull from the F5 Container registry, configure a docker registry secret using your JWT token from the MyF5 portal by following the instructions from [here](https://docs.nginx.com/nginx-ingress-controller/installation/using-the-jwt-token-docker-secret). Make sure to specify the secret using `controller.serviceAccount.imagePullSecretName` parameter.
14+
- Alternatively, pull an Ingress controller image with NGINX Plus and push it to your private registry by following the instructions from [here](https://docs.nginx.com/nginx-ingress-controller/installation/pulling-ingress-controller-image).
15+
- Alternatively, you can build an Ingress controller image with NGINX Plus and push it to your private registry by following the instructions from [here](https://docs.nginx.com/nginx-ingress-controller/installation/building-ingress-controller-image).
1416
- Update the `controller.image.repository` field of the `values-plus.yaml` accordingly.
1517

1618
## Getting the Chart Sources
@@ -36,15 +38,13 @@ $ helm repo add nginx-stable https://helm.nginx.com/stable
3638
$ helm repo update
3739
```
3840

39-
**Note**: If you wish to use the experimental repository, replace `stable` with `edge`.
40-
4141
## Installing the Chart
4242

4343
### Installing the CRDs
4444

45-
By default, the Ingress Controller requires a number of custom resource definitions (CRDs) installed in the cluster. The Helm client will install those CRDs.
45+
By default, the Ingress Controller requires a number of custom resource definitions (CRDs) installed in the cluster. The Helm client will install those CRDs. If the CRDs are not installed, the Ingress Controller pods will not become `Ready`.
4646

47-
If you do not use the custom resources that require those CRDs (which corresponds to `controller.enableCustomResources` set to `false` and `controller.appprotect.enable` set to `false`). The installation of the CRDs can be skipped by specifying `--skip-crds` for the helm install command.
47+
If you do not use the custom resources that require those CRDs (which corresponds to `controller.enableCustomResources` set to `false` and `controller.appprotect.enable` set to `false`), the installation of the CRDs can be skipped by specifying `--skip-crds` for the helm install command.
4848

4949
### Installing via Helm Repository
5050

‎docs/content/app-protect/installation.md‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,22 +12,25 @@ This document provides an overview of the steps required to use NGINX App Protec
1212

1313
You can also [install the Ingress Controller with App Protect by using Helm](/nginx-ingress-controller/installation/installation-with-helm/). Use the `controller.appprotect.*` parameters of the chart.
1414

15-
## Pull the Docker Image
15+
## Using the Docker Images from the F5 Container registry
1616

17-
Take the steps below to pull the Docker image that you'll use to deploy NGINX Ingress Controller with App Protect in Kubernetes.
17+
Take the steps below to either configure a Docker Registry secret in your Kubernetes cluster, or to pull the Docker image that you'll use to deploy NGINX Ingress Controller with App Protect in Kubernetes.
1818

19-
- Follow the steps to [Pull the NGINX Ingress Controller image](/nginx-ingress-controller/installation/pulling-ingress-controller-image).
19+
- Follow the steps to [use the JWT token to create a docker registry secret](/nginx-ingress-controller/installation/using-the-jwt-token-docker-secret).
2020

21-
For NGINX Plus Ingress Controller with App Protect, pull from `docker-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress`:
21+
- Alternatively, follow the steps to [Pull the NGINX Ingress Controller image](/nginx-ingress-controller/installation/pulling-ingress-controller-image).
22+
23+
For NGINX Plus Ingress Controller with App Protect, pull from `private-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress`:
2224
```
23-
$ docker pull docker-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress:1.12.0
25+
$ docker pull private-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress:1.12.0
2426
```
25-
26-
`1.12.0` will pull down the Debian based image. The other available image tag is `1.12.0-ubi` for the UBI based image.
27+
`1.12.0` will pull down the Debian based image. The other available image tag is `1.12.0-ubi` for the UBI based image.
28+
29+
- Use the docker registry API to list the available image tags for the repository.
2730

2831
To list the available image tags for the repository, you can use the Docker registry API, e.g.:
2932
```
30-
$ curl https://docker-registry.nginx.com/v2/nginx-ic-nap/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq
33+
$ curl https://private-registry.nginx.com/v2/nginx-ic-nap/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq
3134
{
3235
"name": "nginx-ic-nap/nginx-plus-ingress",
3336
"tags": [

‎docs/content/installation/building-ingress-controller-image.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
22
title: Building the Ingress Controller Image
33
description:
4-
weight: 2100
4+
weight: 2200
55
doctypes: [""]
66
toc: true
77
---
88

9-
This document explains how to build an Ingress Controller image using the source code. You can also use pre-built images: please see [here](/nginx-ingress-controller/installation/pulling-ingress-controller-image) for details on how to pull the NGINX Ingress Controller based on NGINX Plus from the F5 Docker registry; for NGINX Ingress Controller based on NGINX OSS, we provide the images through [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/).
9+
This document explains how to build an Ingress Controller image using the source code. You can also use pre-built images: please see [here](/nginx-ingress-controller/installation/using-the-jwt-token-docker-secret) and [here](/nginx-ingress-controller/installation/pulling-ingress-controller-image) for details on how to pull the NGINX Ingress Controller based on NGINX Plus from the F5 Docker registry; for NGINX Ingress Controller based on NGINX OSS, we provide the images through [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/).
1010

1111
## Prerequisites
1212

‎docs/content/installation/installation-with-helm.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Installation with Helm
33
description:
4-
weight: 1800
4+
weight: 1900
55
doctypes: [""]
66
toc: true
77
---
@@ -15,7 +15,8 @@ This document describes how to install the NGINX Ingress Controller in your Kube
1515
- Helm 3.0+.
1616
- Git.
1717
- If you’d like to use NGINX Plus:
18-
- Pull an Ingress controller image with NGINX Plus and push it to your private registry by following the instructions from [here](/nginx-ingress-controller/installation/pulling-ingress-controller-image).
18+
- To pull from the F5 Container registry, configure a docker registry secret using your JWT token from the MyF5 portal by following the instructions from [here](/nginx-ingress-controller/installation/using-the-jwt-token-docker-secret). Make sure to specify the secret using `controller.serviceAccount.imagePullSecretName` parameter.
19+
- Alternatively, pull an Ingress controller image with NGINX Plus and push it to your private registry by following the instructions from [here](/nginx-ingress-controller/installation/pulling-ingress-controller-image).
1920
- Alternatively, you can build an Ingress controller image with NGINX Plus and push it to your private registry by following the instructions from [here](/nginx-ingress-controller/installation/building-ingress-controller-image).
2021
- Update the `controller.image.repository` field of the `values-plus.yaml` accordingly.
2122

‎docs/content/installation/installation-with-manifests.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Installation with Manifests
33
description:
4-
weight: 1700
4+
weight: 1800
55
doctypes: [""]
66
aliases:
77
- /installation/
@@ -16,8 +16,9 @@ This document describes how to install the NGINX Ingress Controller in your Kube
1616
1. Make sure you have access to the Ingress controller image:
1717
* For NGINX Ingress controller, use the image `nginx/nginx-ingress` from [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress).
1818
* For NGINX Plus Ingress controller, see [here](/nginx-ingress-controller/installation/pulling-ingress-controller-image) for details on how to pull the image from the F5 Docker registry.
19+
* To pull from the F5 Container registry in your Kubernetes cluster, configure a docker registry secret using your JWT token from the MyF5 portal by following the instructions from [here](/nginx-ingress-controller/installation/using-the-jwt-token-docker-secret).
1920
* It is also possible to build your own image and push it to your private Docker registry by following the instructions from [here](/nginx-ingress-controller/installation/building-ingress-controller-image).
20-
1. Clone the Ingress controller repo and change into the deployments folder:
21+
2. Clone the Ingress controller repo and change into the deployments folder:
2122
```
2223
$ git clone https://github.com/nginxinc/kubernetes-ingress/
2324
$ cd kubernetes-ingress/deployments
@@ -120,7 +121,7 @@ We include two options for deploying the Ingress controller:
120121
$ kubectl apply -f deployment/nginx-plus-ingress.yaml
121122
```
122123
123-
**Note**: Update the `nginx-plus-ingress.yaml` with the container image that you have built.
124+
**Note**: Update the `nginx-plus-ingress.yaml` with the chosen image from the F5 Container registry; or the container image that you have built.
124125
125126
* *Use a DaemonSet*:
126127
When you run the Ingress Controller by using a DaemonSet, Kubernetes will create an Ingress controller pod on every node of the cluster.
@@ -137,7 +138,7 @@ We include two options for deploying the Ingress controller:
137138
$ kubectl apply -f daemon-set/nginx-plus-ingress.yaml
138139
```
139140
140-
**Note**: Update the `nginx-plus-ingress.yaml` with the container image that you have built.
141+
**Note**: Update the `nginx-plus-ingress.yaml` with the chosen image from the F5 Container registry; or the container image that you have built.
141142
142143
### 3.2 Check that the Ingress Controller is Running
143144

‎docs/content/installation/installation-with-operator.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Installation with the NGINX Ingress Operator
33

44
description:
5-
weight: 1900
5+
weight: 2000
66
doctypes: [""]
77
toc: true
88
---
@@ -15,6 +15,7 @@ This document describes how to install the NGINX Ingress Controller in your Kube
1515
1. Make sure you have access to the Ingress Controller image:
1616
* For NGINX Ingress Controller, use the image `nginx/nginx-ingress` from [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress).
1717
* For NGINX Plus Ingress controller, see [here](/nginx-ingress-controller/installation/pulling-ingress-controller-image) for details on how to pull the image from the F5 Docker registry.
18+
* To pull from the F5 Container registry, configure a docker registry secret using your JWT token from the MyF5 portal by following the instructions from [here](/nginx-ingress-controller/installation/using-the-jwt-token-docker-secret).
1819
* It is also possible to build your own image and push it to your private Docker registry by following the instructions from [here](/nginx-ingress-controller/installation/building-ingress-controller-image).
1920
1. Install the NGINX Ingress Operator following the [instructions](https://github.com/nginxinc/nginx-ingress-operator/blob/master/docs/installation.md).
2021

‎docs/content/installation/pulling-ingress-controller-image.md‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,50 @@
11
---
22
title: Pulling the Ingress Controller Image
33
description:
4-
weight: 1600
4+
weight: 1700
55
doctypes: [""]
66
toc: true
77
---
88

9-
This document explains how to pull an NGINX Plus Ingress Controller image from the F5 Docker registry. Please see [here](/nginx-ingress-controller/installation/building-ingress-controller-image) for information on how to build an Ingress Controller image using the source code and your NGINX Plus license certificate and key. Note that for NGINX Ingress Controller based on NGINX OSS, we provide the image through [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/).
9+
This document explains how to pull an NGINX Plus Ingress Controller image from the F5 Docker registry using your NGINX Ingress Controller subscription certificate and key. **Please note that an NGINX Plus subscription certificate and key will not work with the F5 Docker registry.** You can also get the image using alternative methods:
10+
11+
* Please see [here](/nginx-ingress-controller/installation/using-the-jwt-token-docker-secret) for details on how to use the JWT token to use the image directly in your Kubernetes cluster.
12+
* Please see [here](/nginx-ingress-controller/installation/building-ingress-controller-image) for information on how to build an Ingress Controller image using the source code from this repository and your NGINX Plus subscription certificate and key.
13+
* For NGINX Ingress Controller based on NGINX OSS, we provide the image through DockerHub.
1014

1115
## Prerequisites
1216

1317
Before you can pull the image, make sure that the following software is installed on your machine:
1418
* [Docker](https://www.docker.com/products/docker) v18.09+
15-
* For NGINX Plus, you must have the NGINX Plus Ingress Controller license -- the certificate (`nginx-repo.crt`) and the key (`nginx-repo.key`).
19+
* For NGINX Ingress Controller, you must have the NGINX Ingress Controller subscription -- download the NGINX Plus Ingress Controller (per instance) certificate (`nginx-repo.crt`) and the key (`nginx-repo.key`) from [MyF5](https://myf5.com).
1620

1721
## Pulling the Image using Docker and Pushing It to the Private Registry
1822

19-
1. First, configure the Docker environment to use certificate-based client-server authentication with the F5 Container registry - `docker-registry.nginx.com`.
20-
To do so in a Linux based environment, create a `docker-registry.nginx.com` directory under `/etc/docker/certs.d` and create a certificate `client.cert` (using `nginx-repo.crt` - please note that the certificate MUST have the `.cert` suffix, not `.crt`) and a key `client.key` (using `nginx-repo.key`). See [this document](https://docs.docker.com/engine/security/certificates/) for more details.
23+
1. First, configure the Docker environment to use certificate-based client-server authentication with the F5 Container registry - `private-registry.nginx.com`.
24+
To do so in a Linux based environment, create a `private-registry.nginx.com` directory under `/etc/docker/certs.d` and create a certificate `client.cert` (using `nginx-repo.crt` - please note that the certificate MUST have the `.cert` suffix, not `.crt`) and a key `client.key` (using `nginx-repo.key`). See [this document](https://docs.docker.com/engine/security/certificates/) for more details.
2125

2226
```
23-
# mkdir /etc/docker/certs.d/docker-registry.nginx.com
24-
# cp nginx-repo.crt /etc/docker/certs.d/docker-registry.nginx.com/client.cert
25-
# cp nginx-repo.key /etc/docker/certs.d/docker-registry.nginx.com/client.key
27+
# mkdir /etc/docker/certs.d/private-registry.nginx.com
28+
# cp nginx-repo.crt /etc/docker/certs.d/private-registry.nginx.com/client.cert
29+
# cp nginx-repo.key /etc/docker/certs.d/private-registry.nginx.com/client.key
2630
```
2731

2832
> **Note**: The preceding example is operating-system specific and is for illustrative purposes only. You should consult your operating system documentation for creating an os-provided bundled certificate chain. For example, to configure this for Docker Desktop for Mac or Docker Desktop for Windows, see [this document](https://docs.docker.com/docker-for-mac/#add-client-certificates) or [this document](https://docs.docker.com/docker-for-windows/#how-do-i-add-client-certificates) for more details.
2933
30-
2. Use docker to pull the required image from `docker-registry.nginx.com`.
31-
For NGINX Plus Ingress Controller, pull from `docker-registry.nginx.com/nginx-ic/nginx-plus-ingress`:
34+
2. Use docker to pull the required image from `private-registry.nginx.com`. Choose the image from the available images listed [here](nginx-ingress-controller/technical-specifications/#images-with-nginx-plus).
35+
For NGINX Plus Ingress Controller, pull from `private-registry.nginx.com/nginx-ic/nginx-plus-ingress`, e.g.:
3236
```
33-
$ docker pull docker-registry.nginx.com/nginx-ic/nginx-plus-ingress:1.12.0
37+
$ docker pull private-registry.nginx.com/nginx-ic/nginx-plus-ingress:1.12.0
3438
```
3539

36-
`1.12.0` will pull down the Debian based image. Other available image tags are `1.12.0-alpine` for the Alpine based image, `1.12.0-ot` for the Debian based image with OpenTracing, and `1.12.0-ubi` for the UBI based image.
37-
38-
For NGINX Plus Ingress Controller with App Protect, pull from `docker-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress`:
40+
For NGINX Plus Ingress Controller with App Protect, pull from `private-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress`, e.g.:
3941
```
40-
$ docker pull docker-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress:1.12.0
42+
$ docker pull private-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress:1.12.0
4143
```
4244

43-
`1.12.0` will pull down the Debian based image. The other available image tag is `1.12.0-ubi` for the UBI based image.
44-
45-
To list the available image tags for the repositories, you can use the Docker registry API, e.g.:
45+
To list the available image tags for the repositories, you can also use the Docker registry API, e.g.:
4646
```
47-
$ curl https://docker-registry.nginx.com/v2/nginx-ic/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq
47+
$ curl https://private-registry.nginx.com/v2/nginx-ic/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq
4848
{
4949
"name": "nginx-ic/nginx-plus-ingress",
5050
"tags": [
@@ -55,7 +55,7 @@ Before you can pull the image, make sure that the following software is installe
5555
]
5656
}
5757
58-
$ curl https://docker-registry.nginx.com/v2/nginx-ic-nap/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq
58+
$ curl https://private-registry.nginx.com/v2/nginx-ic-nap/nginx-plus-ingress/tags/list --key <path-to-client.key> --cert <path-to-client.cert> | jq
5959
{
6060
"name": "nginx-ic-nap/nginx-plus-ingress",
6161
"tags": [
@@ -68,12 +68,12 @@ Before you can pull the image, make sure that the following software is installe
6868
3. Tag and push the image to your private registry.
6969
Make sure to run the `docker login` command first to log in to the registry.
7070
```
71-
$ docker tag docker-registry.nginx.com/nginx-ic/nginx-plus-ingress:1.12.0 <my-docker-registry>/nginx-ic/nginx-plus-ingress:1.12.0
71+
$ docker tag private-registry.nginx.com/nginx-ic/nginx-plus-ingress:1.12.0 <my-docker-registry>/nginx-ic/nginx-plus-ingress:1.12.0
7272
$ docker push <my-docker-registry>/nginx-ic/nginx-plus-ingress:1.12.0
7373
```
7474

7575
or for NGINX App Protect enabled image
7676
```
77-
$ docker tag docker-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress:1.12.0 <my-docker-registry>/nginx-ic-nap/nginx-plus-ingress:1.12.0
77+
$ docker tag private-registry.nginx.com/nginx-ic-nap/nginx-plus-ingress:1.12.0 <my-docker-registry>/nginx-ic-nap/nginx-plus-ingress:1.12.0
7878
$ docker push <my-docker-registry>/nginx-ic-nap/nginx-plus-ingress:1.12.0
7979
```

‎docs/content/installation/running-multiple-ingress-controllers.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Running Multiple Ingress Controllers
33

44
description:
5-
weight: 2000
5+
weight: 2100
66
doctypes: [""]
77
aliases:
88
- /multiple-ingress-controllers/

0 commit comments

Comments
 (0)
0