diff --git a/content/nic/configuration/global-configuration/command-line-arguments.md b/content/nic/configuration/global-configuration/command-line-arguments.md index 86c0d8233..240434bc1 100644 --- a/content/nic/configuration/global-configuration/command-line-arguments.md +++ b/content/nic/configuration/global-configuration/command-line-arguments.md @@ -479,6 +479,42 @@ Enables App Protect IP Intelligence. Defaults to `false`. *Only applies to WAF s Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect](#cmdoption-enable-app-protect). + + +### -plm-storage-url + +SeaweedFS S3 endpoint for NGINX Ingress Controller to fetch policy and logconf bundle from. Leave empty to disable PLM support. + + + +### -plm-storage-credentials-secret + +Secret containing the SeaweedFS admin secret under seaweedfs_admin_secret. + +Format: `/` + + + +### -plm-storage-ca-secret + +Optional Secret containing ca.crt for SeaweedFS TLS verification. + +Format: `/` + + + +### -plm-storage-client-ssl-secret + +Optional Secret containing tls.crt and tls.key for SeaweedFS mTLS. + +Format: `/` + + + +### -plm-storage-insecure-skip-verify + +Disables SeaweedFS TLS verification. For development and testing only. + ### -ready-status diff --git a/content/nic/configuration/policy-resource.md b/content/nic/configuration/policy-resource.md index e22437010..9c8de25e5 100644 --- a/content/nic/configuration/policy-resource.md +++ b/content/nic/configuration/policy-resource.md @@ -1294,7 +1294,7 @@ waf: |Field | Description | Type | Required | | ---| ---| ---| --- | |``enable`` | Enables F5 WAF for NGINX. | ``bool`` | Yes | -|``apPolicy`` | The [F5 WAF for NGINX policy]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-policies" >}}) of the WAF. Accepts an optional namespace. Mutually exclusive with ``apBundle``. | ``string`` | No | +|``apPolicy`` | The [F5 WAF for NGINX policy]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-policies" >}}) of the WAF. References an APPolicy CR by `[/]`. When the Ingress Controller is started with `-plm-storage-url`, the referenced APPolicy must have been compiled by PLM (status.bundle.state == ready). Mutually exclusive with `apBundle`. | `string` | No | |``apBundle`` | The [F5 WAF for NGINX policy bundle]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-bundles" >}}). Mutually exclusive with ``apPolicy`` and ``apBundleSource``. | ``string`` | No | |``apBundleSource`` | [Remote source]({{< ref "/nic/integrations/app-protect-waf-v5/bundle-sources.md" >}}) for fetching the WAF policy bundle. Mutually exclusive with ``apBundle`` and ``apPolicy``. | [waf.apBundleSource](#wafapbundlesource) | No | |``securityLog.enable`` | **Deprecated:** Enables security log. | ``bool`` | No | @@ -1312,7 +1312,7 @@ waf: |Field | Description | Type | Required | | ---| ---| ---| --- | |``enable`` | Enables security log. | ``bool`` | No | -|``apLogConf`` | The [App Protect WAF log conf]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. Accepts an optional namespace. Only works with ``apPolicy``. | ``string`` | No | +|``apLogConf`` | The [App Protect WAF log conf]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. `apLogConf` references an APPolicy CR by "[/]". When the Ingress Controller is started with `-plm-storage-url`, the referenced APLogConf must have been compiled by PLM (status.bundle.state == ready). Only works with `apPolicy`. | ``string`` | No | |``apLogBundle`` | The [App Protect WAF log bundle]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-bundles" >}}) resource. Only works with ``apBundle``. Mutually exclusive with ``apLogBundleSource``. | ``string`` | No | |``apLogBundleSource`` | [Remote source]({{< ref "/nic/integrations/app-protect-waf-v5/bundle-sources.md" >}}) for fetching the log profile bundle. Mutually exclusive with ``apLogBundle``. | [waf.apBundleSource](#wafapbundlesource) | No | |``logDest`` | The log destination for the security log. Only accepted variables are ``syslog:server=; localhost; :``, ``stderr``, ````. | ``string`` | No | diff --git a/content/nic/install/helm/parameters.md b/content/nic/install/helm/parameters.md index 8d4967710..f45f5a58b 100644 --- a/content/nic/install/helm/parameters.md +++ b/content/nic/install/helm/parameters.md @@ -140,6 +140,11 @@ The [values.schema.json](https://github.com/nginx/kubernetes-ingress/blob/main/c | **controller.pod.extraLabels** | The additional extra labels of the NGINX Ingress Controller pod. | {} | | **controller.appprotect.enable** | Enables the F5 WAF for NGINX module in the NGINX Ingress Controller. | false | | **controller.appprotect.v5** | Enables F5 WAF for NGINX v5. | false | +| **controller.appprotect.plmStorage.url** | SeaweedFS S3 endpoint for NGINX Ingress Controller to fetch policy and logconf bundle from. Leave empty to disable PLM support. Requires `controller.appprotect.v5` to be `true` | "" | +| **controller.appprotect.plmStorage.credentialsSecret** | Secret containing the SeaweedFS admin secret under seaweedfs_admin_secret, `namespace/name` format. | "" | +| **controller.appprotect.plmStorage.caSecret** | Optional Secret containing the SeaweedFS admin secret under seaweedfs_admin_secret, `namespace/name format`. | "" | +| **controller.appprotect.plmStorage.clientSSLSecret** | Optional Secret containing tls.crt and tls.key for SeaweedFS mTLS, `namespace/name` format. | "" | +| **controller.appprotect.plmStorage.insecureSkipVerify** | Disables SeaweedFS TLS verification. For development and testing only. | false | | **controller.appprotect.volumes** | Volumes for F5 WAF for NGINX v5. | [{"name": "app-protect-bd-config", "emptyDir": {}},{"name": "app-protect-config", "emptyDir": {}},{"name": "app-protect-bundles", "emptyDir": {}}] | | **controller.appprotect.enforcer.host** | Host that the F5 WAF for NGINX v5 Enforcer runs on. | "127.0.0.1" | | **controller.appprotect.enforcer.port** | Port that the F5 WAF for NGINX v5 Enforcer runs on. | 50000 |