Skip to content

Commit f99be74

Browse files
authored
fix: update NIM deploy helm doc (#317)
1 parent ee7fbde commit f99be74

File tree

1 file changed

+13
-12
lines changed

1 file changed

+13
-12
lines changed

Diff for: content/nim/deploy/kubernetes/deploy-using-helm.md

+13-12
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ type:
1313

1414
This guide explains how to deploy F5 NGINX Instance Manager on a Kubernetes or OpenShift cluster using Helm. You’ll learn how to download and use Docker images and customize your deployment.
1515

16-
{{< note >}} Starting in NGINX Instance Manager 2.19, you can deploy NGINX Instance Manager on an OpenShift cluster using Helm. {{< /note >}}
16+
{{< note >}} Starting in NGINX Instance Manager 2.19, you can deploy NGINX Instance Manager on an OpenShift cluster using Helm. {{< /note >}}
1717

1818
### About Helm
1919

@@ -81,9 +81,9 @@ Create a Docker registry secret on the cluster, using the JWT token as the usern
8181
-n nms
8282
```
8383

84-
{{< warning >}}
84+
{{< warning >}}
8585

86-
You might see a warning about `--password` being insecure.
86+
You might see a warning about `--password` being insecure.
8787

8888
This can be ignored (since no password is used), but if others have access to this system, delete the JWT token and clear your shell history after deployment.
8989

@@ -174,7 +174,7 @@ The `values.yaml` file customizes the Helm chart installation without modifying
174174

175175
---
176176

177-
## Enabling OpenShift
177+
## Enabling OpenShift
178178

179179
If deploying on OpenShift, include this setting in the `values.yaml` file:
180180

@@ -187,9 +187,9 @@ openshift:
187187

188188
### How OpenShift handles security constraints
189189

190-
When `openshift.enabled: true` is set in the `values.yaml` file, the NGINX Instance Manager deployment automatically creates a **custom [Security Context Constraints](https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/authentication_and_authorization/managing-pod-security-policies) (SCCs)** and links it to the Service Account used by all pods.
190+
When `openshift.enabled: true` is set in the `values.yaml` file, the NGINX Instance Manager deployment automatically creates a **custom [Security Context Constraints](https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/authentication_and_authorization/managing-pod-security-policies) (SCCs)** and links it to the Service Account used by all pods.
191191

192-
By default, OpenShift enforces strict security policies that require containers to run as **non-root** users. The NGINX Instance Manager deployment needs specific user IDs (UIDs) for certain services, such as **1000** for `nms` and **101** for `nginx` and `clickhouse`. Since the default SCCs do not allow these UIDs, a **custom SCC** is created. This ensures that the deployment can run with the necessary permissions while maintaining OpenShift’s security standards. The custom SCC allows these UIDs by setting the `runAsUser` field, which controls which users can run containers.
192+
By default, OpenShift enforces strict security policies that require containers to run as **non-root** users. The NGINX Instance Manager deployment needs specific user IDs (UIDs) for certain services, such as **1000** for `nms` and **101** for `nginx` and `clickhouse`. Since the default SCCs do not allow these UIDs, a **custom SCC** is created. This ensures that the deployment can run with the necessary permissions while maintaining OpenShift’s security standards. The custom SCC allows these UIDs by setting the `runAsUser` field, which controls which users can run containers.
193193

194194
{{< note >}} If you’re encountering errors with the custom SCC, you may not have permissions to access the Security Context Constraints resource. Please contact a Cluster Administrator to request access, either through a cluster role binding or by adjusting your user role. {{< /note >}}
195195

@@ -271,7 +271,7 @@ To upgrade:
271271

272272
- Replace `<path-to-your-values.yaml>` with the path to the `values.yaml` file you created]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}).
273273
- Replace `YourPassword123#` with a secure password that includes uppercase and lowercase letters, numbers, and special characters.
274-
274+
275275
{{<call-out "important" "Save the password!" "" >}} Save this password for future use. Only the encrypted password is stored in Kubernetes, and you can’t recover or reset it later. {{</call-out>}}
276276
- (Optional) Replace <nms-chart-version> with the desired version number. If you don’t specify a version, the latest version will be installed.
277277

@@ -324,9 +324,10 @@ By default, the following network policies will be created in the release namesp
324324
To disable network policies, update the `values.yaml` file:
325325

326326
```yaml
327-
networkPolicies:
328-
# Set this to true to enable network policies for NGINX Instance Manager.
329-
enabled: false
327+
nms-hybrid:
328+
networkPolicies:
329+
# Set this to true to enable network policies for NGINX Instance Manager.
330+
enabled: false
330331
```
331332

332333
---
@@ -371,7 +372,7 @@ The `values.yaml` file customizes the Helm chart installation without modifying
371372
utility:
372373
image:
373374
repository: private-registry.nginx.com/nms/utility
374-
tag: <version>
375+
tag: <version>
375376
```
376377

377378
2. Save and close the `values.yaml` file.
@@ -425,7 +426,7 @@ To upgrade:
425426

426427
- Replace `<path-to-your-values.yaml>` with the path to the `values.yaml` file you created]({{< relref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}).
427428
- Replace `YourPassword123#` with a secure password that includes uppercase and lowercase letters, numbers, and special characters.
428-
429+
429430
{{<call-out "important" "Save the password!" "" >}} Save this password for future use. Only the encrypted password is stored in Kubernetes, and you can’t recover or reset it later. {{</call-out>}}
430431

431432
---

0 commit comments

Comments
 (0)