nic: plm cli options

content/nic/configuration/global-configuration/command-line-arguments.md

@@ -479,6 +479,42 @@ Enables App Protect IP Intelligence. Defaults to `false`. *Only applies to WAF s
 
 Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect](#cmdoption-enable-app-protect).
 
+<a name="cmdoption-plm-storage-url"></a>
+
+### -plm-storage-url
+
+SeaweedFS S3 endpoint for NGINX Ingress Controller to fetch policy and logconf bundle from. Leave empty to disable PLM support.
+
+<a name="cmdoption-plm-storage-credentials-secret"></a>
+
+### -plm-storage-credentials-secret
+
+Secret containing the SeaweedFS admin secret under seaweedfs_admin_secret.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-plm-storage-ca-secret"></a>
+
+### -plm-storage-ca-secret
+
+Optional Secret containing ca.crt for SeaweedFS TLS verification.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-plm-storage-client-ssl-secret"></a>
+
+### -plm-storage-client-ssl-secret
+
+Optional Secret containing tls.crt and tls.key for SeaweedFS mTLS.
+
+Format: `<namespace>/<name>`
+
+<a name="cmdoption-plm-storage-insecure-skip-verify"></a>
+
+### -plm-storage-insecure-skip-verify
+
+Disables SeaweedFS TLS verification. For development and testing only.
+
 <a name="cmdoption-ready-status"></a>
 
 ### -ready-status

content/nic/configuration/policy-resource.md

@@ -1294,7 +1294,7 @@ waf:
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
 |``enable`` | Enables F5 WAF for NGINX. | ``bool`` | Yes |
-|``apPolicy`` | The [F5 WAF for NGINX policy]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-policies" >}}) of the WAF. Accepts an optional namespace. Mutually exclusive with ``apBundle``. | ``string`` | No |
+|``apPolicy`` | The [F5 WAF for NGINX policy]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-policies" >}}) of the WAF. References an APPolicy CR by `[<namespace>/]<name>`. When the Ingress Controller is started with `-plm-storage-url`, the referenced APPolicy must have been compiled by PLM (status.bundle.state == ready). Mutually exclusive with `apBundle`. | `string` | No |
 |``apBundle`` | The [F5 WAF for NGINX policy bundle]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-bundles" >}}). Mutually exclusive with ``apPolicy`` and ``apBundleSource``. | ``string`` | No |
 |``apBundleSource`` | [Remote source]({{< ref "/nic/integrations/app-protect-waf-v5/bundle-sources.md" >}}) for fetching the WAF policy bundle. Mutually exclusive with ``apBundle`` and ``apPolicy``. | [waf.apBundleSource](#wafapbundlesource) | No |
 |``securityLog.enable`` | **Deprecated:** Enables security log. | ``bool`` | No |
@@ -1312,7 +1312,7 @@ waf:
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
 |``enable`` | Enables security log. | ``bool`` | No |
-|``apLogConf`` | The [App Protect WAF log conf]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. Accepts an optional namespace. Only works with ``apPolicy``. | ``string`` | No |
+|``apLogConf`` | The [App Protect WAF log conf]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. `apLogConf` references an APPolicy CR by "[<namespace>/]<name>". When the Ingress Controller is started with `-plm-storage-url`, the referenced APLogConf must have been compiled by PLM (status.bundle.state == ready). Only works with `apPolicy`. | ``string`` | No |
 |``apLogBundle`` | The [App Protect WAF log bundle]({{< ref "/nic/integrations/app-protect-waf/configuration.md#waf-bundles" >}}) resource. Only works with ``apBundle``. Mutually exclusive with ``apLogBundleSource``. | ``string`` | No |
 |``apLogBundleSource`` | [Remote source]({{< ref "/nic/integrations/app-protect-waf-v5/bundle-sources.md" >}}) for fetching the log profile bundle. Mutually exclusive with ``apLogBundle``. | [waf.apBundleSource](#wafapbundlesource) | No |
 |``logDest`` | The log destination for the security log. Only accepted variables are ``syslog:server=<ip-address>; localhost; <fqdn>:<port>``, ``stderr``, ``<absolute path to file>``. | ``string`` | No |

content/nic/install/helm/parameters.md

@@ -140,6 +140,11 @@ The [values.schema.json](https://github.com/nginx/kubernetes-ingress/blob/main/c
 | **controller.pod.extraLabels** | The additional extra labels of the NGINX Ingress Controller pod. | {} |
 | **controller.appprotect.enable** | Enables the F5 WAF for NGINX module in the NGINX Ingress Controller. | false |
 | **controller.appprotect.v5** | Enables F5 WAF for NGINX v5. | false |
+| **controller.appprotect.plmStorage.url** | SeaweedFS S3 endpoint for NGINX Ingress Controller to fetch policy and logconf bundle from. Leave empty to disable PLM support. Requires `controller.appprotect.v5` to be `true` | "" |
+| **controller.appprotect.plmStorage.credentialsSecret** | Secret containing the SeaweedFS admin secret under seaweedfs_admin_secret, `namespace/name` format. | "" |
+| **controller.appprotect.plmStorage.caSecret** | Optional Secret containing the SeaweedFS admin secret under seaweedfs_admin_secret, `namespace/name format`. | "" |
+| **controller.appprotect.plmStorage.clientSSLSecret** | Optional Secret containing tls.crt and tls.key for SeaweedFS mTLS, `namespace/name` format. | "" |
+| **controller.appprotect.plmStorage.insecureSkipVerify** | Disables SeaweedFS TLS verification. For development and testing only. | false |
 | **controller.appprotect.volumes** | Volumes for F5 WAF for NGINX v5. | [{"name": "app-protect-bd-config", "emptyDir": {}},{"name": "app-protect-config", "emptyDir": {}},{"name": "app-protect-bundles", "emptyDir": {}}] |
 | **controller.appprotect.enforcer.host** | Host that the F5 WAF for NGINX v5 Enforcer runs on. | "127.0.0.1" |
 | **controller.appprotect.enforcer.port** | Port that the F5 WAF for NGINX v5 Enforcer runs on. | 50000 |