Add document for installing NGF on OpenShift through OperatorHub #1332

shaun-nx · 2025-10-20T09:20:47Z

Proposed changes

This change adds a new page to the NGF Install section on how to install the NGF on OpenShift using the RedHat Operator Hub.

This guide also includes Operator specific configurations as well as troubleshooting.

Closes nginx/nginx-gateway-fabric#3911

Checklist

Before sharing this pull request, I completed the following checklist:

I read the Contributing guidelines
My branch adheres to the Git conventions
My content changes adhere to the F5 NGINX Documentation style guide
If my changes involve potentially sensitive information¹, I have assessed the possible impact
I have waited to ensure my changes pass tests, and addressed any discovered issues

Potentially sensitive information includes personally identify information (PII), authentication credentials, and live URLs. Refer to the style guide for guidance about placeholder content. ↩

Update compatability doc with Port for ParentRef

Update gateway addresses compatibility document.

…omment (#1126) Add a small comment on IP families to gateway addresses compatibility document.

Added mention about unsupported fields for RouteRules and Gateways Closes nginx/nginx-gateway-fabric#3784

feat: Update advanced routing guide for regex path

…cs (#1284) * Add details on BuildOS and InferencePoolCount to Product Telemetry docs * Add InferencePoolCount * Move InferencePool resource into "Count of Resources" section

github-actions · 2025-10-20T09:22:54Z

✅ Deploy Preview will be available once build job completes!

Name	Link
😎 Deploy Preview	https://frontdoor-test-docs.nginx.com/previews/docs/1332/

content/ngf/install/openshift.md

shaun-nx · 2025-10-21T16:13:22Z

Changing the base branch to main as we need to wait until we have fully published the Operator to Openshift before making this doc available

content/ngf/install/openshift.md

salonichf5 · 2025-10-21T17:07:06Z

content/ngf/overview/gateway-api-compatibility.md

+Please note that while we make every effort to reflect the support status of experimental fields in our code and documentation, there may be instances where this is not explicitly 
+indicated. Support for such fields is provided on a best-effort basis.{{< /call-out >}}


Suggested change

Please note that while we make every effort to reflect the support status of experimental fields in our code and documentation, there may be instances where this is not explicitly

indicated. Support for such fields is provided on a best-effort basis.{{< /call-out >}}

Please note that while we make every effort to reflect the support status of experimental fields in our code and documentation, there may be instances where this is not explicitly indicated. Support for such fields is provided on a best-effort basis.{{< /call-out >}}

Lets avoid making this update here as it's not part of the new document

salonichf5

mentioned a couple of nits but overall looks good. I think this branch needs a rebase with main

great job 🥳

tataruty · 2025-10-22T11:29:50Z

Changing the base branch to main as we need to wait until we have fully published the Operator to Openshift before making this doc available

Did you change base branch too? or only the aim of merge? I see many commits difference

ADubhlaoich

Broadly speaking, the new page needs to be restructured.

It doesn't adhere to our contemporary page standards:

It's missing the documentation metadata
The requirements section is not named correctly
It uses the NGF three letter acronym: we do not use TLAs in public-facing documentation
It uses bash as a formatting language, when shell has been the norm for months
It doesn't use Hugo for list enumeration

Many of the structural issues could have been avoided by using Hugo archetypes, for which we maintain documentation which is part of the Contributing guidelines as the first item in the PR checklist.

Effectively no commits on this branch adhere to the Git conventions as the second item in the PR checklist, though this does not need to be fixed in retrospect as long as the eventual merge message is correct.

ciarams87 · 2025-10-24T12:23:13Z

content/ngf/install/openshift.md

+1. Navigate to Operators → OperatorHub.
+2. Search for "NGINX Gateway Fabric".
+3. Select the NGF Operator (provider: NGINX, Inc) and click Install.
+4. Choose an update channel (for example, stable 2.x), installation mode (All namespaces or a specific namespace), and approve automatic updates as desired.


We don't currently support specific namespace or automatic updates

ciarams87 · 2025-10-24T12:24:30Z

content/ngf/install/openshift.md

+## Optional: NGINX Plus licensing
+
+If you plan to use NGINX Plus, you will need to:
+- Set `spec.nginx.nginxOneConsole.plus: true`


Suggested change

- Set `spec.nginx.nginxOneConsole.plus: true`

- Set `spec.nginx.plus: true`

ciarams87 · 2025-10-24T12:25:13Z

content/ngf/install/openshift.md

+
+## Create the NginxGatewayFabric CR
+
+Minimal example for OpenShift:


All the pre-populated or empty fields can be omitted - keep the image ones etc as makes sense, but all these fields just correspond to the helm command and don't need to be explicitly set. We display them in the UI for user convenience, but they are not required for a minimal example.

ciarams87 · 2025-10-24T12:29:05Z

content/ngf/install/openshift.md

+
+Wait for the Operator to reconcile. It will provision the NGF controller and data plane deployments, services, and related resources.
+
+## OpenShift-specific exposure options


Is this section required?

It feels like it would be helpful just for anyone starting out on Openshift. Happy to remove it if we feel it adds to much to the document

ciarams87 · 2025-10-24T12:30:06Z

content/ngf/install/openshift.md

+  - `terminationGracePeriodSeconds`: Default 30 seconds.
+  - `topologySpreadConstraints`, `tolerations`, `nodeSelector`, `affinity`: Pod scheduling controls.
+
+## Pod scheduling and security (OpenShift)


This is a useful section, thanks! SCCs are a headache 😅

ciarams87 · 2025-10-24T12:31:39Z

content/ngf/install/openshift.md

+    ```
+  - For TLS passthrough, use `--passthrough` and target the appropriate service port.
+
+## Operator-specific configuration options (NginxGatewayFabric spec)


I'm not convinced we should maintain a list here - I think the Helm values should be the source of truth, with generic guidelines on how these values are translated into the NginxGatewayFabric CRD fields

Sounds good 👍

content/ngf/install/openshift.md

ciarams87 · 2025-10-24T12:34:33Z

content/ngf/install/openshift.md

+
+- NGF Helm chart defaults (values): See `helm-charts/nginx-gateway-fabric/values.yaml` in the NGF repository.
+
+## Notes


Based on my previous comments, these notes can probably be removed also

shaun-nx · 2025-10-24T15:14:47Z

I made changes to the PR to reflect these points of feedback:

It uses the NGF three letter acronym: we do not use TLAs in public-facing documentation
It uses bash as a formatting language, when shell has been the norm for months

I'm confused by these points

Effectively no commits on this branch adhere to the Git conventions as the second item in the PR checklist

The second items says My branch adheres to the Git conventions. This relates to just the branch, and not the individual commit messages from what I understand. This was never called out as a problem before.

It's missing the documentation metadata

There is a Title and Description in this document. Is there other metadata missing? The most reset set of commits adds nd-content-type, nd-product and nd-docs. Were you referring to these?

The requirements section is not named correctly

This document doesn't have a requirements section at all, so it's not clear what you mean by this. Should we have a requirements section?

It doesn't use Hugo for list enumeration

Again, not sure what this means. The Hugo Content page says **The ordered notation automatically enumerates lists when built by Hugo** but it's still not clear what that relates to.
I did run make docs locally but I'm not sure if that really affected anything regarding this point.

As a point of feedback for the feedback,
If the use shell instead of bash is really important then it feels like that should be enforced by a pre-commit check, especially if it's something that we are willing to block a PR on.

mjang

This is pretty good. I'm guessing that go.mod and go.sum are not part of your proposed change.

content/ngf/install/openshift.md

mjang · 2025-10-24T15:35:31Z

content/ngf/install/openshift.md

+
+## Overview
+
+This guide details how to install F5 NGINX Gateway Fabric on Red Hat OpenShift through OperatorHub and configure it with the `NginxGatewayFabric` custom resource.


General style: shorter sentences are easier to read

Suggested change

This guide details how to install F5 NGINX Gateway Fabric on Red Hat OpenShift through OperatorHub and configure it with the `NginxGatewayFabric` custom resource.

This guide details how to install F5 NGINX Gateway Fabric on Red Hat OpenShift through OperatorHub. You can then configure it with the `NginxGatewayFabric` custom resource.

mjang · 2025-10-24T15:36:50Z

content/ngf/install/openshift.md

+  - F5 NGINX One dataplane API key if you plan to integrate with [F5 NGINX One Console](https://docs.nginx.com/nginx-one/).
+  - F5 NGINX Plus entitlements if you plan to run NGINX Gateway Fabric with F5 NGINX Plus.
+
+NGINX Gateway Fabric provides first-class OpenShift support with Universal Base Image (UBI)-based images. Use the `-ubi` tags shown in the custom resource definition (CRD) examples. Defaults are compatible with OpenShift Security Context Constraints (SCCs) for non-root operation. If your cluster enforces custom SCCs or policies, bind the appropriate SCC to NGINX Gateway Fabric service accounts.


I discourage marketing terms in docs. It hurts credibility with our target audience

Suggested change

NGINX Gateway Fabric provides first-class OpenShift support with Universal Base Image (UBI)-based images. Use the `-ubi` tags shown in the custom resource definition (CRD) examples. Defaults are compatible with OpenShift Security Context Constraints (SCCs) for non-root operation. If your cluster enforces custom SCCs or policies, bind the appropriate SCC to NGINX Gateway Fabric service accounts.

NGINX Gateway Fabric provides OpenShift support with Universal Base Image (UBI)-based images. Use the `-ubi` tags shown in the custom resource definition (CRD) examples. Defaults are compatible with OpenShift Security Context Constraints (SCCs) for non-root operation. If your cluster enforces custom SCCs or policies, bind the appropriate SCC to NGINX Gateway Fabric service accounts.

@ciarams87 @mkingst what are your thoughts on this one?

mjang · 2025-10-24T15:38:31Z

content/ngf/install/openshift.md

+  -n nginx-gateway-fabric
+```
+
+### Integrate with NGINX One (optional)


I presume you mean the UI, not the product (which includes NIM, N Plus, etc.)

Suggested change

### Integrate with NGINX One (optional)

### Integrate with NGINX One Console (optional)

mjang · 2025-10-24T15:38:57Z

content/ngf/install/openshift.md

+
+### Integrate with NGINX One (optional)
+
+If you want NGINX Gateway Fabric to connect to NGINX One, create a secret for the dataplane key (replace VALUE with your key).


Suggested change

If you want NGINX Gateway Fabric to connect to NGINX One, create a secret for the dataplane key (replace VALUE with your key).

If you want to use NGINX One Console to monitor NGINX Gateway Fabric, create a secret for the dataplane key (replace VALUE with your key).

mjang · 2025-10-24T15:40:05Z

content/ngf/install/openshift.md

+
+### Create the NginxGatewayFabric custom resource
+
+Create a minimal `NginxGatewayFabric` custom resource for OpenShift.


Suggested change

Create a minimal `NginxGatewayFabric` custom resource for OpenShift.

Create a minimal `NginxGatewayFabric` custom resource for OpenShift. Include this code in a file named `nginx-gateway-fabric.yaml`.

mjang · 2025-10-24T15:41:05Z

content/ngf/install/openshift.md

+
+### Validate the installation
+
+Verify that deployments and services are running, and confirm the GatewayClass:


Is there a thing called GatewayClass? If not, I'd rephrase this to the actual directive:

Suggested change

Verify that deployments and services are running, and confirm the GatewayClass:

Verify that deployments and services are running, and confirm the `gatewayclass`:

Yes, GatewayClass is an Object in the Gateway API.
https://gateway-api.sigs.k8s.io/api-types/gatewayclass/

mjang · 2025-10-24T15:42:11Z

content/ngf/install/openshift.md

+
+### Perform a functional check (optional)
+
+9. Create a simple Gateway and HTTPRoute to validate routing:


This implies steps 1-8.
Also, our style guide discourages words like "simple"

Suggested change

9. Create a simple Gateway and HTTPRoute to validate routing:

Create a Gateway and HTTPRoute to validate routing:

Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>

sarthyparty and others added 11 commits September 3, 2025 10:16

Update compability doc (#1054)

de86f56

Update compatability doc with Port for ParentRef

NGF: Update gateway addresses compatibility document (#1109)

ecb9222

Update gateway addresses compatibility document.

NGF: Update gateway addresses compatibility document with IP family c…

29a305d

…omment (#1126) Add a small comment on IP families to gateway addresses compatibility document.

New NGF CLI parameter for Trial period enforcement (#1128)

8d59f42

Merge branch 'main' into ngf-release-2.2

bf2aedf

RouteRules and Gateway unsupported fields update (#1268)

6822326

Added mention about unsupported fields for RouteRules and Gateways Closes nginx/nginx-gateway-fabric#3784

NGF: Update advanced routing guide for Regex PathType (#1286)

4b0aa63

feat: Update advanced routing guide for regex path

Merge branch 'main' into ngf-release-2.2

56d6dce

Add details on BuildOS and InferencePoolCount to Product Telemetry do…

2138ce5

…cs (#1284) * Add details on BuildOS and InferencePoolCount to Product Telemetry docs * Add InferencePoolCount * Move InferencePool resource into "Count of Resources" section

Merge branch 'main' into ngf-release-2.2

d67906e

Add document for installing NGF on Openshift through OperatorHub

a03edd0

shaun-nx requested a review from a team as a code owner October 20, 2025 09:20

github-actions bot added documentation Improvements or additions to documentation product/ngf Issues related to NGINX Gateway Fabric labels Oct 20, 2025

tataruty reviewed Oct 20, 2025

View reviewed changes

content/ngf/install/openshift.md Outdated Show resolved Hide resolved

shaun-nx requested a review from a team October 20, 2025 15:03

shaun-nx changed the base branch from ngf-release-2.2 to main October 21, 2025 16:12

Merge branch 'main' into ngf/openshift-install

61fc33b

salonichf5 reviewed Oct 21, 2025

View reviewed changes

content/ngf/install/openshift.md Outdated Show resolved Hide resolved

salonichf5 reviewed Oct 21, 2025

View reviewed changes

content/ngf/install/openshift.md Outdated Show resolved Hide resolved

salonichf5 reviewed Oct 21, 2025

View reviewed changes

Merge branch 'main' into ngf/openshift-install

f075835

ADubhlaoich requested changes Oct 22, 2025

View reviewed changes

ADubhlaoich and others added 3 commits October 22, 2025 14:18

Merge branch 'main' into ngf/openshift-install

3b76707

Merge branch 'main' into ngf/openshift-install

b700813

Merge branch 'main' into ngf/openshift-install

b49beab

ciarams87 requested changes Oct 24, 2025

View reviewed changes

shaun-nx added 6 commits October 24, 2025 14:51

Update docs to be in line with style guidelins

020f81c

Code review updates

892135f

Update document to follow "How-to-guide" format

f0e129c

Replace bash with shell

6cd31ce

Fix pre-commit errors

e5642d8

Fix pre-commit errors

0c077c7

shaun-nx requested review from ADubhlaoich, ciarams87, salonichf5 and tataruty October 24, 2025 15:15

mjang reviewed Oct 24, 2025

View reviewed changes

shaun-nx and others added 3 commits October 24, 2025 16:49

Update content/ngf/install/openshift.md

df1dd08

Co-authored-by: Mike Jang <3287976+mjang@users.noreply.github.com>

Style updates

206474c

Revert changes to go.mod and go.sum

481f9b4

		Please note that while we make every effort to reflect the support status of experimental fields in our code and documentation, there may be instances where this is not explicitly
		indicated. Support for such fields is provided on a best-effort basis.{{< /call-out >}}

	- Set `spec.nginx.nginxOneConsole.plus: true`
	- Set `spec.nginx.plus: true`


		## Create the NginxGatewayFabric CR

		Minimal example for OpenShift:


		Wait for the Operator to reconcile. It will provision the NGF controller and data plane deployments, services, and related resources.

		## OpenShift-specific exposure options


		- NGF Helm chart defaults (values): See `helm-charts/nginx-gateway-fabric/values.yaml` in the NGF repository.

		## Notes


		## Overview

		This guide details how to install F5 NGINX Gateway Fabric on Red Hat OpenShift through OperatorHub and configure it with the `NginxGatewayFabric` custom resource.

	NGINX Gateway Fabric provides first-class OpenShift support with Universal Base Image (UBI)-based images. Use the `-ubi` tags shown in the custom resource definition (CRD) examples. Defaults are compatible with OpenShift Security Context Constraints (SCCs) for non-root operation. If your cluster enforces custom SCCs or policies, bind the appropriate SCC to NGINX Gateway Fabric service accounts.
	NGINX Gateway Fabric provides OpenShift support with Universal Base Image (UBI)-based images. Use the `-ubi` tags shown in the custom resource definition (CRD) examples. Defaults are compatible with OpenShift Security Context Constraints (SCCs) for non-root operation. If your cluster enforces custom SCCs or policies, bind the appropriate SCC to NGINX Gateway Fabric service accounts.

	### Integrate with NGINX One (optional)
	### Integrate with NGINX One Console (optional)


		### Integrate with NGINX One (optional)

		If you want NGINX Gateway Fabric to connect to NGINX One, create a secret for the dataplane key (replace VALUE with your key).

	If you want NGINX Gateway Fabric to connect to NGINX One, create a secret for the dataplane key (replace VALUE with your key).
	If you want to use NGINX One Console to monitor NGINX Gateway Fabric, create a secret for the dataplane key (replace VALUE with your key).


		### Create the NginxGatewayFabric custom resource

		Create a minimal `NginxGatewayFabric` custom resource for OpenShift.


		### Validate the installation

		Verify that deployments and services are running, and confirm the GatewayClass:


		### Perform a functional check (optional)

		9. Create a simple Gateway and HTTPRoute to validate routing:

	9. Create a simple Gateway and HTTPRoute to validate routing:
	Create a Gateway and HTTPRoute to validate routing:

Add document for installing NGF on OpenShift through OperatorHub #1332

Are you sure you want to change the base?

Add document for installing NGF on OpenShift through OperatorHub #1332

Uh oh!

Conversation

shaun-nx commented Oct 20, 2025

Proposed changes

Checklist

Footnotes

Uh oh!

github-actions bot commented Oct 20, 2025

✅ Deploy Preview will be available once build job completes!

Uh oh!

Uh oh!

shaun-nx commented Oct 21, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

salonichf5 left a comment

Choose a reason for hiding this comment

Uh oh!

tataruty commented Oct 22, 2025

Uh oh!

ADubhlaoich left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shaun-nx commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mjang left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

shaun-nx commented Oct 24, 2025 •

edited

Loading