You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/nim/deploy/kubernetes/deploy-using-helm.md
+13-12
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ type:
13
13
14
14
This guide explains how to deploy F5 NGINX Instance Manager on a Kubernetes or OpenShift cluster using Helm. You’ll learn how to download and use Docker images and customize your deployment.
15
15
16
-
{{< note >}} Starting in NGINX Instance Manager 2.19, you can deploy NGINX Instance Manager on an OpenShift cluster using Helm. {{< /note >}}
16
+
{{< note >}} Starting in NGINX Instance Manager 2.19, you can deploy NGINX Instance Manager on an OpenShift cluster using Helm. {{< /note >}}
17
17
18
18
### About Helm
19
19
@@ -81,9 +81,9 @@ Create a Docker registry secret on the cluster, using the JWT token as the usern
81
81
-n nms
82
82
```
83
83
84
-
{{< warning >}}
84
+
{{< warning >}}
85
85
86
-
You might see a warning about `--password` being insecure.
86
+
You might see a warning about `--password` being insecure.
87
87
88
88
This can be ignored (since no password is used), but if others have access to this system, delete the JWT token and clear your shell history after deployment.
89
89
@@ -174,7 +174,7 @@ The `values.yaml` file customizes the Helm chart installation without modifying
174
174
175
175
---
176
176
177
-
## Enabling OpenShift
177
+
## Enabling OpenShift
178
178
179
179
If deploying on OpenShift, include this setting in the `values.yaml` file:
180
180
@@ -187,9 +187,9 @@ openshift:
187
187
188
188
### How OpenShift handles security constraints
189
189
190
-
When `openshift.enabled: true` is set in the `values.yaml` file, the NGINX Instance Manager deployment automatically creates a **custom [Security Context Constraints](https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/authentication_and_authorization/managing-pod-security-policies) (SCCs)** and links it to the Service Account used by all pods.
190
+
When `openshift.enabled: true` is set in the `values.yaml` file, the NGINX Instance Manager deployment automatically creates a **custom [Security Context Constraints](https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/authentication_and_authorization/managing-pod-security-policies) (SCCs)** and links it to the Service Account used by all pods.
191
191
192
-
By default, OpenShift enforces strict security policies that require containers to run as **non-root** users. The NGINX Instance Manager deployment needs specific user IDs (UIDs) for certain services, such as **1000** for `nms` and **101** for `nginx` and `clickhouse`. Since the default SCCs do not allow these UIDs, a **custom SCC** is created. This ensures that the deployment can run with the necessary permissions while maintaining OpenShift’s security standards. The custom SCC allows these UIDs by setting the `runAsUser` field, which controls which users can run containers.
192
+
By default, OpenShift enforces strict security policies that require containers to run as **non-root** users. The NGINX Instance Manager deployment needs specific user IDs (UIDs) for certain services, such as **1000** for `nms` and **101** for `nginx` and `clickhouse`. Since the default SCCs do not allow these UIDs, a **custom SCC** is created. This ensures that the deployment can run with the necessary permissions while maintaining OpenShift’s security standards. The custom SCC allows these UIDs by setting the `runAsUser` field, which controls which users can run containers.
193
193
194
194
{{< note >}} If you’re encountering errors with the custom SCC, you may not have permissions to access the Security Context Constraints resource. Please contact a Cluster Administrator to request access, either through a cluster role binding or by adjusting your user role. {{< /note >}}
195
195
@@ -271,7 +271,7 @@ To upgrade:
271
271
272
272
- Replace `<path-to-your-values.yaml>` with the path to the `values.yaml` file you created]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}).
273
273
- Replace `YourPassword123#` with a secure password that includes uppercase and lowercase letters, numbers, and special characters.
274
-
274
+
275
275
{{<call-out "important" "Save the password!" "" >}} Save this password for future use. Only the encrypted password is stored in Kubernetes, and you can’t recover or reset it later. {{</call-out>}}
276
276
- (Optional) Replace <nms-chart-version> with the desired version number. If you don’t specify a version, the latest version will be installed.
277
277
@@ -324,9 +324,10 @@ By default, the following network policies will be created in the release namesp
324
324
To disable network policies, update the `values.yaml` file:
325
325
326
326
```yaml
327
-
networkPolicies:
328
-
# Set this to true to enable network policies for NGINX Instance Manager.
329
-
enabled: false
327
+
nms-hybrid:
328
+
networkPolicies:
329
+
# Set this to true to enable network policies for NGINX Instance Manager.
330
+
enabled: false
330
331
```
331
332
332
333
---
@@ -371,7 +372,7 @@ The `values.yaml` file customizes the Helm chart installation without modifying
- Replace `<path-to-your-values.yaml>` with the path to the `values.yaml` file you created]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}).
427
428
- Replace `YourPassword123#` with a secure password that includes uppercase and lowercase letters, numbers, and special characters.
428
-
429
+
429
430
{{<call-out "important" "Save the password!" "" >}} Save this password for future use. Only the encrypted password is stored in Kubernetes, and you can’t recover or reset it later. {{</call-out>}}
0 commit comments