Skip to content

Commit c005b50

Browse files
Chetan-99JTorreGtravisamartin
authored
fix: Added instruction to install NIM 2.19.0 (#747)
* fix: Added instruction to install NIM 2.19.0 * fix: minor fixes * fix: call out about the new helm chart versioning * fix: added openshift details in nim k8s docs * fix: minor changes * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * fix: Update deploy-using-helm.md * fix: Update deploy-using-helm.md * fix: combined call-out of renaming and versioning * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com> * Update content/nim/deploy/kubernetes/deploy-using-helm.md Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com> * fix: minor yaml fixes * fix: minor changes --------- Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> Co-authored-by: Travis Martin <33876974+travisamartin@users.noreply.github.com>
1 parent a90d940 commit c005b50

File tree

1 file changed

+130
-24
lines changed

1 file changed

+130
-24
lines changed

‎content/nim/deploy/kubernetes/deploy-using-helm.md

Lines changed: 130 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ Starting with version 2.20.0, NGINX Instance Manager supports **lightweight mode
1717

1818
- Lightweight mode requires NGINX Agent v2.41.1 or later.
1919

20-
{{< call-out "note" "Chart renamed in NIM 2.20.0" >}}
21-
The Helm chart has been renamed from `nginx-stable/nms-hybrid` to `nginx-stable/nim`.
22-
Make sure to update your chart references if you’re using version 2.20.0 or later.
20+
21+
{{< call-out "note" "Chart renamed with new versioning from NGINX Instance Manager 2.20.0" >}}
22+
Starting with version 2.20.0, the Helm chart was renamed from `nginx-stable/nms-hybrid` to `nginx-stable/nim`. Chart versioning was also reset; `v2.0.0` is the first release under the new name. Be sure to update your chart references if you’re using version `2.20.0` or later.
2323
{{< /call-out >}}
2424

2525

@@ -149,40 +149,34 @@ imagePullSecrets:
149149
apigw:
150150
image:
151151
repository: private-registry.nginx.com/nms/apigw
152-
tag: 2.20.0
153-
152+
tag: <version>
154153
core:
155154
image:
156155
repository: private-registry.nginx.com/nms/core
157-
tag: 2.20.0
158-
156+
tag: <version>
159157
dpm:
160158
image:
161159
repository: private-registry.nginx.com/nms/dpm
162-
tag: 2.20.0
163-
160+
tag: <version>
164161
ingestion:
165162
image:
166163
repository: private-registry.nginx.com/nms/ingestion
167-
tag: 2.20.0
168-
164+
tag: <version>
169165
integrations:
170166
image:
171167
repository: private-registry.nginx.com/nms/integrations
172-
tag: 2.20.0
173-
168+
tag: <version>
174169
secmon:
175170
image:
176171
repository: private-registry.nginx.com/nms/secmon
177-
tag: 2.20.0
178-
172+
tag: <version>
179173
utility:
180174
image:
181175
repository: private-registry.nginx.com/nms/utility
182-
tag: 2.20.0
176+
tag: <version>
183177
```
184178

185-
These values are required when pulling images from the NGINX private registry. The chart does not auto-resolve image tags. Update the tag: fields to match the NGINX Instance Manager version you want to install.
179+
These values are required when pulling images from the NGINX private registry. The chart doesn't auto-resolve image tags. Set each `tag:` value to match the NGINX Instance Manager version you want to install. Refer to the Helm chart table for version details.
186180
187181
Use the file with the `-f values.yaml` flag when installing the chart.
188182
@@ -236,6 +230,11 @@ helm status nim -n nim
236230
237231
You should see `STATUS: deployed` in the output.
238232
233+
234+
To find the right NGINX Instance Manager chart version, see the following table:
235+
236+
{{< include "nim/kubernetes/nms-chart-supported-module-versions.md" >}}
237+
239238
---
240239
241240
## Access the web interface
@@ -346,6 +345,112 @@ networkPolicies:
346345
347346
---
348347
348+
## Helm deployment for NGINX Instance Manager 2.19
349+
350+
### Create a Helm deployment values.yaml file
351+
352+
The `values.yaml` file customizes the Helm chart installation without changing the chart itself. You can use it to set image repositories, environment variables, resource requests, and other options.
353+
354+
1. Create a `values.yaml` file like this example:
355+
356+
- In the `imagePullSecrets` section, add your private Docker registry credentials.
357+
- Set the `tag:` field to the version of NGINX Instance Manager you want to install. You can find supported versions in the Helm chart table.
358+
359+
For details on creating a secret, see the Kubernetes [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) guide.
360+
361+
```yaml
362+
imagePullSecrets:
363+
- name: regcred
364+
365+
apigw:
366+
image:
367+
repository: private-registry.nginx.com/nms/apigw
368+
tag: <version>
369+
core:
370+
image:
371+
repository: private-registry.nginx.com/nms/core
372+
tag: <version>
373+
dpm:
374+
image:
375+
repository: private-registry.nginx.com/nms/dpm
376+
tag: <version>
377+
ingestion:
378+
image:
379+
repository: private-registry.nginx.com/nms/ingestion
380+
tag: <version>
381+
integrations:
382+
image:
383+
repository: private-registry.nginx.com/nms/integrations
384+
tag: <version>
385+
secmon:
386+
image:
387+
repository: private-registry.nginx.com/nms/secmon
388+
tag: <version>
389+
utility:
390+
image:
391+
repository: private-registry.nginx.com/nms/utility
392+
tag: <version>
393+
```
394+
395+
396+
2. Save and close the `values.yaml` file.
397+
398+
---
399+
400+
### Install the chart
401+
402+
Run the `helm install` command to deploy NGINX Instance Manager:
403+
404+
1. Replace `<path-to-your-values.yaml>` with the path to your `values.yaml` file.
405+
2. Replace `<your-password>` with a secure password (containing a mix of uppercase, lowercase letters, numbers, and special characters).
406+
407+
{{< important >}} Remember to save the password for future use. Only the encrypted password is stored, and there's no way to recover or reset it if lost. {{< /important >}}
408+
409+
410+
```shell
411+
helm install -n nms-hybrid \
412+
--set adminPasswordHash=$(openssl passwd -6 '<your-password>') \
413+
nms nginx-stable/nms-hybrid \
414+
--create-namespace \
415+
-f <path-to-your-values.yaml> \
416+
--version <chart-version> \
417+
--wait
418+
```
419+
420+
---
421+
422+
### Upgrade NGINX Instance Manager
423+
424+
To upgrade:
425+
426+
1. [Update the Helm repository list](#add-repository).
427+
2. [Adjust your `values.yaml` file](#create-a-helm-deployment-values.yaml-file) if needed.
428+
3. To upgrade the NGINX Instance Manager deployment, run the following command. This command updates the `nms` deployment with a new version from the `nginx-stable/nms-hybrid` repository. It also hashes the provided password and uses the `values.yaml` file at the path you specify.
429+
4. Replace `<chart-version>` with the desired chart version of NGINX Instance Manager 2.19.x referring the Helm chart table.
430+
431+
```shell
432+
helm upgrade -n nms \
433+
--set nms-hybrid.adminPasswordHash=$(openssl passwd -6 '<your-password>') \
434+
nms nginx-stable/nms-hybrid \
435+
-f <path-to-your-values.yaml> \
436+
--version <chart-version> \
437+
--wait
438+
```
439+
440+
- Replace `<path-to-your-values.yaml>` with the path to the `values.yaml` file you created]({{< ref "/nim/deploy/kubernetes/deploy-using-helm.md#configure-chart" >}}).
441+
- Replace `<your-password>` with a secure password that includes uppercase and lowercase letters, numbers, and special characters.
442+
443+
{{<call-out "important" "Save the password!" "" >}} Save this password for future use. Only the encrypted password is stored in Kubernetes, and you can’t recover or reset it later. {{</call-out>}}
444+
445+
{{< call-out "note" "Upgrading from 2.18.0 or earlier to 2.19.x" >}}
446+
If you're upgrading from version 2.18.0 or earlier to 2.19.x, note the following changes:
447+
448+
- If you used the legacy `nms` chart or release name, update the chart reference and adjust the release name if needed.
449+
- The structure of the `values.yaml` file has changed in this release.
450+
{{< /call-out >}}
451+
452+
---
453+
349454
## Helm Deployment for NGINX Instance Manager 2.18 or lower
350455
351456
### Create a Helm deployment values.yaml file
@@ -414,10 +519,6 @@ nms nginx-stable/nms \
414519
--wait
415520
```
416521

417-
To help you choose the right NGINX Instance Manager chart version, see the table in:
418-
419-
{{< include "nim/kubernetes/nms-chart-supported-module-versions.md" >}}
420-
421522
---
422523

423524
### Upgrade NGINX Instance Manager
@@ -462,9 +563,14 @@ openshift:
462563

463564
This ensures pods can run with the user IDs required by NGINX Instance Manager services.
464565

465-
{{< call-out "note" "Note" >}}
466-
If you see permission errors during deployment, your user account might not have access to manage SCCs. Contact a cluster administrator to request access.
467-
{{< /call-out >}}
566+
567+
When `openshift.enabled: true` is set in the `values.yaml` file, the NGINX Instance Manager deployment automatically creates a custom [Security Context Constraints (SCC)](https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/authentication_and_authorization/managing-pod-security-policies) object and links it to the Service Account used by all pods.
568+
569+
By default, OpenShift enforces strict security policies that require containers to run as **non-root** users. The deployment needs specific user IDs (UIDs) for certain services—**1000** for `nms`, and **101** for `nginx` and `clickhouse`. Since the default SCCs don’t allow these UIDs, the deployment creates a custom SCC. This SCC sets the `runAsUser` field to allow the necessary UIDs while still complying with OpenShift’s security standards.
570+
571+
This deployment has been tested with OpenShift v4.13.0 Server.
572+
573+
If you see permission errors during deployment, your account might not have access to manage SCCs. Ask a cluster administrator for access.
468574

469575
To verify that the SCC was created after installing the Helm chart, run:
470576

0 commit comments

Comments
 (0)