From 1b6e745219e368e78a93572c32f28b551b15ddbc Mon Sep 17 00:00:00 2001 From: Stephen Haynes Date: Tue, 8 Sep 2026 16:00:14 -0700 Subject: [PATCH 1/3] add template submit and copy docs --- content/nginx-one-console/changelog.md | 13 +++ .../config-templates/author-templates.md | 3 + .../submit-and-copy-templates.md | 93 +++++++++++++++++++ .../config-templates/submit-templates.md | 5 + .../config-templates/template-detail-view.md | 1 + .../template-submissions-view.md | 3 + 6 files changed, 118 insertions(+) create mode 100644 content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md diff --git a/content/nginx-one-console/changelog.md b/content/nginx-one-console/changelog.md index 34d0a4b31..fc1a5a292 100644 --- a/content/nginx-one-console/changelog.md +++ b/content/nginx-one-console/changelog.md @@ -10,6 +10,19 @@ nollms: true Stay up-to-date with what's new and improved in the F5 NGINX One Console. +## September 15, 2026 + +### Config Templates: Submit and copy templates from the Templates list + +You can now submit templates and copy templates directly from the Templates list in NGINX One Console. Use these row actions to work with templates without building API requests by hand. Both actions require template write permission. + +Key capabilities: + +- **Submit a template**: Select **Submit** on a finalized base template to open the **Submit Template** panel. Fill in parameters, add optional augment templates, choose target objects, and preview the configuration before you save. +- **Copy a template**: Select **Make a Copy** on any template to create a new draft template from its latest version. + +For more information, see [Submit and copy templates from the Templates list]({{< ref "/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md" >}}). + ## August 19, 2026 ### Instances: Custom display names diff --git a/content/nginx-one-console/nginx-configs/config-templates/author-templates.md b/content/nginx-one-console/nginx-configs/config-templates/author-templates.md index 9ef6b609f..bb2df1544 100644 --- a/content/nginx-one-console/nginx-configs/config-templates/author-templates.md +++ b/content/nginx-one-console/nginx-configs/config-templates/author-templates.md @@ -813,10 +813,13 @@ The new template starts at version 1 in `draft` state. All files, the template t This is useful for creating variations of a production template without modifying the original, or for experimenting with changes before promoting a new version. +The same copy action is also available directly from the Templates list as [**Make a Copy**]({{< ref "submit-and-copy-templates.md#copy-a-template" >}}). + ## See also - [Import Templates]({{< ref "import-templates.md" >}}) - [View template details]({{< ref "template-detail-view.md" >}}) - [View template versions]({{< ref "template-versions.md" >}}) - [Submit Templates Guide]({{< ref "submit-templates.md" >}}) +- [Submit and copy templates from the Templates list]({{< ref "submit-and-copy-templates.md" >}}) diff --git a/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md b/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md new file mode 100644 index 000000000..27f0145e7 --- /dev/null +++ b/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md @@ -0,0 +1,93 @@ +--- +f5-content-type: how-to +f5-docs: DOCS-000 +f5-product: NGINX One Console +title: Submit and copy templates from the Templates list +description: "Use the Submit and Make a Copy row actions on the Templates list to submit or copy config templates without API calls." +toc: true +weight: 150 +f5-keywords: "templates list, config templates, NGINX One Console, submit template, Submit Template drawer, make a copy, copy a template, template submission, base template, augment template" +f5-summary: > + Use the Submit and Make a Copy row actions on the Templates list to work with config templates. + These actions offer a guided UI, instead of the Templates API. + Select Submit to open the Submit Template panel. Pick a base template, fill in parameters, add optional augment templates, choose a target, and preview the configuration. + Select Make a Copy to create a new draft template from the latest version of an existing template. +f5-audience: operator +--- + +## Overview + +The Templates list in NGINX One Console has two row actions: **Submit** and **Make a Copy**. These actions give you a guided way to work with config templates, as an alternative to building Templates API requests by hand. + +Select **Submit** on a finalized base template to open the **Submit Template** panel. The panel guides you through filling in parameter values. You can preview the rendered NGINX configuration before you save. + +Select **Make a Copy** on any template to create a new draft template from its latest version. + +## Before you begin + +Before you begin, make sure you have: + +- **NGINX One Console access**: You need template write permission to use the **Submit** and **Make a Copy** row actions. +- **An imported template**: At least one template must exist in **Manage > Config Templates**. See [Import templates]({{< ref "import-templates.md" >}}). +- **A finalized base template**: To use **Submit**, you need at least one base template in the `final` state. + +## Go to the Templates list + +1. In the NGINX One Console, go to **Manage > Config Templates**. + +The **Templates** list opens, showing every imported template with its available row actions. + +## Row actions on the Templates list + +The Templates list includes the following row actions. + +{{}} +| Action | Availability | What it does | +|--------|--------------|--------------| +| **Submit** | Templates with type `base` and state `final`. Requires template write permission. | Opens the **Submit Template** panel to create a template submission. | +| **Make a Copy** | Any template. Requires template write permission. | Creates a new draft template from the latest version of the template. | +{{
}} + +## Submit a template + +Use the **Submit** row action to create a template submission from the Templates list. + +1. Select **Submit** on a base template that's in the `final` state. +2. Fill in the parameter values for the base template. NGINX One Console generates the form from the template's schema. +3. Optional: Add one or more augment templates. Fill in the parameter values for each one. +4. Choose one or more staged configs as the target. You can't target Config Sync Groups or instances directly yet. +5. Preview the rendered NGINX configuration. +6. Select **Save** to create the submission and publish it to your chosen targets. + +## Edit an existing submission + +You can also use the **Submit Template** panel to edit an existing submission. Open the submission from the **Submissions** section on the Template Detail page. For details on how to reach and manage submissions, see [View template submissions]({{< ref "template-submissions-view.md" >}}). + +## Copy a template + +Use the **Make a Copy** row action to copy any template from the Templates list. + +1. Select **Make a Copy** on the template you want to copy. + +NGINX One Console creates a new draft template at version 1. It copies the files, the template type, and the context configuration from the source template. The new template uses the same name and description unless you update them afterward. + +This matches the behavior of [Copy a template]({{< ref "author-templates.md#copy-a-template" >}}), the API operation behind this action. + +## What happens next + +After you submit or copy a template, view the result on the [Template Detail page]({{< ref "template-detail-view.md" >}}). Submissions appear in the [Submissions section]({{< ref "template-submissions-view.md" >}}) of the template you submitted to. + +## API reference + +The Templates list row actions use the following API operations: + +- **Submit**: Uses the [Submit Templates]({{< ref "submit-templates.md" >}}) API to create or update a template submission. +- **Make a Copy**: Uses the [Copy a template]({{< ref "author-templates.md#copy-a-template" >}}) API operation. + +## See also + +- [Submit templates]({{< ref "submit-templates.md" >}}) +- [Author templates]({{< ref "author-templates.md" >}}) +- [View template details]({{< ref "template-detail-view.md" >}}) +- [View template submissions]({{< ref "template-submissions-view.md" >}}) +- [Import templates]({{< ref "import-templates.md" >}}) diff --git a/content/nginx-one-console/nginx-configs/config-templates/submit-templates.md b/content/nginx-one-console/nginx-configs/config-templates/submit-templates.md index 72b25dcd3..11fb4905d 100644 --- a/content/nginx-one-console/nginx-configs/config-templates/submit-templates.md +++ b/content/nginx-one-console/nginx-configs/config-templates/submit-templates.md @@ -10,6 +10,10 @@ weight: 200 This guide explains how to submit templates to render and deploy NGINX configurations, and how to manage existing submissions using the Templates API. +{{< call-out "tip" >}} +You can also submit and copy templates using a guided UI, instead of building API requests by hand. Use the **Submit** and **Make a Copy** row actions on the Templates list. See [Submit and copy templates from the Templates list]({{< ref "submit-and-copy-templates.md" >}}). +{{< /call-out >}} + Before submitting templates, you need to import them into NGINX One Console. - See the [Import Templates Guide]({{< ref "import-templates.md" >}}) for instructions on creating and importing templates. @@ -701,4 +705,5 @@ When composing template submissions, arrange your augments array to match the re - [Template Authoring Guide]({{< ref "author-templates.md" >}}) - [Add Service-Specific Locations]({{< ref "add-multiple-services.md" >}}) +- [Submit and copy templates from the Templates list]({{< ref "submit-and-copy-templates.md" >}}) - [Save rendered config as staged config]({{< ref "save-as-staged-config.md" >}}) diff --git a/content/nginx-one-console/nginx-configs/config-templates/template-detail-view.md b/content/nginx-one-console/nginx-configs/config-templates/template-detail-view.md index b74e8e716..d952f1ea6 100644 --- a/content/nginx-one-console/nginx-configs/config-templates/template-detail-view.md +++ b/content/nginx-one-console/nginx-configs/config-templates/template-detail-view.md @@ -89,3 +89,4 @@ For more information, see: - [Author templates]({{< ref "author-templates.md" >}}) - [Import templates]({{< ref "import-templates.md" >}}) - [Submit templates]({{< ref "submit-templates.md" >}}) +- [Submit and copy templates from the Templates list]({{< ref "submit-and-copy-templates.md" >}}) diff --git a/content/nginx-one-console/nginx-configs/config-templates/template-submissions-view.md b/content/nginx-one-console/nginx-configs/config-templates/template-submissions-view.md index 54d7716fc..173b26903 100644 --- a/content/nginx-one-console/nginx-configs/config-templates/template-submissions-view.md +++ b/content/nginx-one-console/nginx-configs/config-templates/template-submissions-view.md @@ -20,6 +20,8 @@ Use this page to view and manage template submissions in NGINX One Console. The Each row is a submission the [Submit Templates]({{< ref "submit-templates.md" >}}) API created. You can inspect which templates and targets are in each submission and delete submissions you no longer need. +You can also create a new submission directly from the Templates list. Select **Submit** on a finalized base template. See [Submit and copy templates from the Templates list]({{< ref "submit-and-copy-templates.md" >}}). + ## Before you begin Before you begin, make sure you have: @@ -90,4 +92,5 @@ For more information, see: - [View template details]({{< ref "template-detail-view.md" >}}) - [Submit templates]({{< ref "submit-templates.md" >}}) +- [Submit and copy templates from the Templates list]({{< ref "submit-and-copy-templates.md" >}}) - [View template versions]({{< ref "template-versions.md" >}}) From 140e5ce8affaf13c5732fe961bf38a30e7c307c8 Mon Sep 17 00:00:00 2001 From: Jon Torre <78599298+JTorreG@users.noreply.github.com> Date: Wed, 9 Sep 2026 21:00:30 +0100 Subject: [PATCH 2/3] None/add template submit copy docs jtg (#2267) * Fix broken NGF links (#2261) * add N1C doc for WAF policy with gRPC protection (#2238) * add N1C doc for WAF policy with gRPC protection * fix the title format * add changelog entry * Update content/nginx-one-console/waf-integration/policy/grpc-protection-api.md Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * Apply batched suggestions from code review Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * Update content/nginx-one-console/waf-integration/policy/grpc-protection-api.md Co-authored-by: Mike Jang * Update content/nginx-one-console/waf-integration/policy/grpc-protection-api.md Co-authored-by: Mike Jang --------- Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> Co-authored-by: Mike Jang * fix: Correct the ordering of the F5 WAF sections in NGINXaaS (#2266) fix: Correct the ordering of the WAF sections in NGINXaaS Overview Fix the ordering of the sections under F5 WAF for NGINX for the NGINXaaS product. They should be in the order Enable-Configure-Disable. * Update outdated links to Gateway API docs (#2265) fix: Update outdated links to Gateway API docs Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * NGINXAAS-2627 Add content for username-password auth for NGINXaaS (#2262) The changes include: - updating the main user management page to reference the new username-password login method - adding a new user login page for details of signing up with an email and password, resetting password, password standards - user login page includes instructions for configuring Entra tenants for MS social login Co-authored-by: Jon Torre <78599298+JTorreG@users.noreply.github.com> * feat: style suggestions for submit-and-copy-templates --------- Co-authored-by: Mike Jang Co-authored-by: Sylvia Wang <139922338+sylwang@users.noreply.github.com> Co-authored-by: Erik Darzins Co-authored-by: Nutsa Bidzishvili Co-authored-by: Alex Russell <91080557+arussellf5@users.noreply.github.com> --- .style-guide | 2 +- .../BIG-IP/multicluster.md | 4 +- .../BIG-IP/quickstart.md | 4 +- content/ngf/monitoring/tracing.md | 4 +- .../traffic-management/advanced-routing.md | 4 +- .../ngf/traffic-management/basic-routing.md | 2 +- .../redirects-and-rewrites.md | 2 +- .../request-response-headers.md | 2 +- content/ngf/traffic-management/snippets.md | 2 +- content/nginx-one-console/changelog.md | 6 + .../submit-and-copy-templates.md | 54 ++--- .../policy/grpc-protection-api.md | 196 ++++++++++++++++++ .../overview/app-protect/configure-waf.md | 2 +- .../overview/app-protect/disable-waf.md | 2 +- .../overview/manage-users-organizations.md | 7 +- content/nginxaas/overview/user-login.md | 76 +++++++ 16 files changed, 320 insertions(+), 49 deletions(-) create mode 100644 content/nginx-one-console/waf-integration/policy/grpc-protection-api.md create mode 100644 content/nginxaas/overview/user-login.md diff --git a/.style-guide b/.style-guide index 98aa29d39..e6f7bf8ca 160000 --- a/.style-guide +++ b/.style-guide @@ -1 +1 @@ -Subproject commit 98aa29d39009a02582b9c6d6214acac1a7ee624c +Subproject commit e6f7bf8ca4716fdd15d6583d6087bbd8c19dca73 diff --git a/content/ngf/external-loadbalancers/BIG-IP/multicluster.md b/content/ngf/external-loadbalancers/BIG-IP/multicluster.md index 1a597c086..71046ebc9 100644 --- a/content/ngf/external-loadbalancers/BIG-IP/multicluster.md +++ b/content/ngf/external-loadbalancers/BIG-IP/multicluster.md @@ -18,7 +18,7 @@ In this guide, you configure an `ExternalLoadBalancer` resource that puts BIG-IP The intended use case is a single hostname and certificate served by backends in more than one cluster, such as an active-active deployment or a migration between clusters. Clients see one address, and traffic moves between clusters without a DNS change. -See [How configuration reaches BIG-IP]({{< ref "/ngf/external-loadbalancers/gateway-link/quickstart.md#how-configuration-reaches-big-ip" >}}). +See [How configuration reaches BIG-IP]({{< ref "/ngf/external-loadbalancers/BIG-IP/quickstart.md#how-configuration-reaches-big-ip" >}}). ## Before you begin @@ -762,4 +762,4 @@ curl -sku "$BIGIP_USERNAME:$BIGIP_PASSWORD" "https://$BIGIP_ADDRESS/mgmt/tm/ltm/ - [BIG-IP Virtual Edition on Amazon Web Services](https://clouddocs.f5.com/cloud/public/v1/aws_index.html) - [BIG-IP Virtual Edition on Microsoft Azure](https://clouddocs.f5.com/cloud/public/v1/azure_index.html) - [BIG-IP Virtual Edition on Google Cloud Platform](https://clouddocs.f5.com/cloud/public/v1/google_index.html) -- [F5 Container Ingress Services multi-cluster guide](https://clouddocs.f5.com/containers/latest/userguide/multicluster/): multi-cluster deployment topologies. \ No newline at end of file +- [F5 Container Ingress Services multi-cluster guide](https://clouddocs.f5.com/containers/latest/userguide/multicluster/): multi-cluster deployment topologies. diff --git a/content/ngf/external-loadbalancers/BIG-IP/quickstart.md b/content/ngf/external-loadbalancers/BIG-IP/quickstart.md index 23ace7994..9b9332347 100644 --- a/content/ngf/external-loadbalancers/BIG-IP/quickstart.md +++ b/content/ngf/external-loadbalancers/BIG-IP/quickstart.md @@ -548,11 +548,11 @@ curl -sku "$BIGIP_USERNAME:$BIGIP_PASSWORD" "https://$BIGIP_ADDRESS/mgmt/tm/ltm/ ## References -- [Distribute traffic across clusters with F5 BIG-IP]({{< ref "/ngf/external-loadbalancers/gateway-link/multicluster.md" >}}): terminate TLS at BIG-IP and spread traffic across two clusters, with health monitors and iRules. +- [Distribute traffic across clusters with F5 BIG-IP]({{< ref "/ngf/external-loadbalancers/BIG-IP/multicluster.md" >}}): terminate TLS at BIG-IP and spread traffic across two clusters, with health monitors and iRules. - [F5 IngressLink documentation](https://clouddocs.f5.com/containers/latest/userguide/ingresslink/): the F5 Container Ingress Services resource that NGINX Gateway Fabric generates. - [F5 Application Services 3 Extension reference](https://clouddocs.f5.com/products/extensions/f5-appsvcs-extension/latest/refguide/schema-reference.html): the declaration format F5 Container Ingress Services posts to BIG-IP. - [NGINX Gateway Fabric](https://github.com/nginx/nginx-gateway-fabric): the NGINX Gateway Fabric source, including the `ExternalLoadBalancer` custom resource definitions. - [F5 Container Ingress Services](https://github.com/F5Networks/k8s-bigip-ctlr): the F5 Container Ingress Services source and custom resource definitions. - [F5 IPAM Controller](https://github.com/F5Networks/f5-ipam-controller): allocates virtual server addresses. - [F5 Container Ingress Services configuration parameters](https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html): the full list of deployment options. -- [PROXY protocol specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt): the header format the iRule generates. \ No newline at end of file +- [PROXY protocol specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt): the header format the iRule generates. diff --git a/content/ngf/monitoring/tracing.md b/content/ngf/monitoring/tracing.md index ebcf449d3..eb6a8737a 100644 --- a/content/ngf/monitoring/tracing.md +++ b/content/ngf/monitoring/tracing.md @@ -64,7 +64,7 @@ Visit [http://127.0.0.1:16686](http://127.0.0.1:16686) to view the dashboard. To enable tracing, you must configure two resources: -- `NginxProxy`: This resource contains global settings relating to the NGINX data plane. It is created and managed by the [cluster operator](https://gateway-api.sigs.k8s.io/concepts/roles-and-personas/), and is referenced in the `parametersRef` field of the GatewayClass. By default, an `NginxProxy` resource is created in the same namespace where NGINX Gateway Fabric is installed, attached to the GatewayClass. You can set configuration options in the `nginx` Helm value section, and the resource will be created and attached using the set values. +- `NginxProxy`: This resource contains global settings relating to the NGINX data plane. It is created and managed by the [cluster operator](https://gateway-api.sigs.k8s.io/docs/concepts/roles-and-personas/), and is referenced in the `parametersRef` field of the GatewayClass. By default, an `NginxProxy` resource is created in the same namespace where NGINX Gateway Fabric is installed, attached to the GatewayClass. You can set configuration options in the `nginx` Helm value section, and the resource will be created and attached using the set values. When installed using the Helm chart, the NginxProxy resource is named `-proxy-config` and is created in the release Namespace. @@ -72,7 +72,7 @@ When installed using the Helm chart, the NginxProxy resource is named `}} You can also override the tracing configuration for a particular Gateway by manually creating and attaching specific `NginxProxy` resources to target the different Gateways. This guide covers the global tracing configuration only. {{< /call-out >}} -- `ObservabilityPolicy`: This resource is a [Direct PolicyAttachment](https://gateway-api.sigs.k8s.io/reference/policy-attachment/) that targets HTTPRoutes or GRPCRoutes. It is created by the [application developer](https://gateway-api.sigs.k8s.io/concepts/roles-and-personas/) and enables tracing for a specific route or routes. It requires the `NginxProxy` resource to exist in order to complete the tracing configuration. +- `ObservabilityPolicy`: This resource is a [Direct PolicyAttachment](https://gateway-api.sigs.k8s.io/reference/policy-attachment/) that targets HTTPRoutes or GRPCRoutes. It is created by the [application developer](https://gateway-api.sigs.k8s.io/docs/concepts/roles-and-personas/) and enables tracing for a specific route or routes. It requires the `NginxProxy` resource to exist in order to complete the tracing configuration. For all the possible configuration options for these resources, see the [API reference]({{< ref "/ngf/reference/api.md" >}}). diff --git a/content/ngf/traffic-management/advanced-routing.md b/content/ngf/traffic-management/advanced-routing.md index b180e3c80..e537fb0b8 100644 --- a/content/ngf/traffic-management/advanced-routing.md +++ b/content/ngf/traffic-management/advanced-routing.md @@ -71,7 +71,7 @@ kubectl apply -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v{ ### Deploy the Gateway API Resources for the Coffee applications -The [gateway](https://gateway-api.sigs.k8s.io/api-types/gateway/) resource is typically deployed by the [cluster operator](https://gateway-api.sigs.k8s.io/concepts/roles-and-personas/#roles-and-personas_1). To deploy the gateway: +The [gateway](https://gateway-api.sigs.k8s.io/api-types/gateway/) resource is typically deployed by the [cluster operator](https://gateway-api.sigs.k8s.io/docs/concepts/roles-and-personas/#roles-and-personas_1). To deploy the gateway: ```yaml kubectl apply -f - <}} -The [HTTPRoute](https://gateway-api.sigs.k8s.io/api-types/httproute/) is typically deployed by the [application developer](https://gateway-api.sigs.k8s.io/concepts/roles-and-personas/#roles-and-personas_1). To deploy the `coffee` HTTPRoute: +The [HTTPRoute](https://gateway-api.sigs.k8s.io/api-types/httproute/) is typically deployed by the [application developer](https://gateway-api.sigs.k8s.io/docs/concepts/roles-and-personas/#roles-and-personas_1). To deploy the `coffee` HTTPRoute: ```yaml kubectl apply -f - <}}In the diagrams above, all resources that are the responsibility of the cluster operator are shown in blue. The orange resources are the responsibility of the application developers. -See the [roles and personas](https://gateway-api.sigs.k8s.io/concepts/roles-and-personas/#roles-and-personas_1) Gateway API document for more information on these roles.{{< /call-out >}} +See the [roles and personas](https://gateway-api.sigs.k8s.io/docs/concepts/roles-and-personas/#roles-and-personas_1) Gateway API document for more information on these roles.{{< /call-out >}} --- diff --git a/content/ngf/traffic-management/redirects-and-rewrites.md b/content/ngf/traffic-management/redirects-and-rewrites.md index 4992f91ef..81b90ec2c 100644 --- a/content/ngf/traffic-management/redirects-and-rewrites.md +++ b/content/ngf/traffic-management/redirects-and-rewrites.md @@ -27,7 +27,7 @@ We will configure a common gateway for the `URLRewrite` and `RequestRedirect` fi ### Deploy the Gateway resource for the applications -The [Gateway](https://gateway-api.sigs.k8s.io/api-types/gateway/) resource is typically deployed by the [Cluster Operator](https://gateway-api.sigs.k8s.io/concepts/roles-and-personas/#roles-and-personas_1). This Gateway defines a single listener on port 80. Since no hostname is specified, this listener matches on all hostnames. To deploy the Gateway: +The [Gateway](https://gateway-api.sigs.k8s.io/api-types/gateway/) resource is typically deployed by the [Cluster Operator](https://gateway-api.sigs.k8s.io/docs/concepts/roles-and-personas/#roles-and-personas_1). This Gateway defines a single listener on port 80. Since no hostname is specified, this listener matches on all hostnames. To deploy the Gateway: ```yaml kubectl apply -f - <}}). +## September 8, 2026 + +### F5 WAF for NGINX: gRPC protection through the API + +You can now configure [gRPC protection]({{< ref "/waf/policies/grpc-protection.md" >}}) for F5 WAF for NGINX policies through the NGINX One Console API. Upload the `.proto` IDL files referenced by a policy's `grpc-profiles` configuration alongside the policy, either as inline base64-encoded content or as a `.tar.gz` archive. For more information, see [Add gRPC protection to a policy]({{< ref "/nginx-one-console/waf-integration/policy/grpc-protection-api.md" >}}). + ## August 19, 2026 ### Instances: Custom display names diff --git a/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md b/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md index 27f0145e7..1b6275c0b 100644 --- a/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md +++ b/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md @@ -6,18 +6,18 @@ title: Submit and copy templates from the Templates list description: "Use the Submit and Make a Copy row actions on the Templates list to submit or copy config templates without API calls." toc: true weight: 150 -f5-keywords: "templates list, config templates, NGINX One Console, submit template, Submit Template drawer, make a copy, copy a template, template submission, base template, augment template" +f5-keywords: "templates list, config templates, NGINX One Console, submit template, Submit Template panel, make a copy, copy a template, template submission, base template, augment template" f5-summary: > Use the Submit and Make a Copy row actions on the Templates list to work with config templates. These actions offer a guided UI, instead of the Templates API. - Select Submit to open the Submit Template panel. Pick a base template, fill in parameters, add optional augment templates, choose a target, and preview the configuration. + Select Submit to open the Submit Template panel. Select a base template, enter parameter values, add optional augment templates, select a target, and preview the configuration. Select Make a Copy to create a new draft template from the latest version of an existing template. f5-audience: operator --- ## Overview -The Templates list in NGINX One Console has two row actions: **Submit** and **Make a Copy**. These actions give you a guided way to work with config templates, as an alternative to building Templates API requests by hand. +The Templates list in NGINX One Console has two row actions: **Submit** and **Make a Copy**. Use these actions to work with config templates instead of building Templates API requests by hand. Select **Submit** on a finalized base template to open the **Submit Template** panel. The panel guides you through filling in parameter values. You can preview the rendered NGINX configuration before you save. @@ -27,55 +27,43 @@ Select **Make a Copy** on any template to create a new draft template from its l Before you begin, make sure you have: -- **NGINX One Console access**: You need template write permission to use the **Submit** and **Make a Copy** row actions. -- **An imported template**: At least one template must exist in **Manage > Config Templates**. See [Import templates]({{< ref "import-templates.md" >}}). -- **A finalized base template**: To use **Submit**, you need at least one base template in the `final` state. +- NGINX One Console access: You need template write permission to use the **Submit** and **Make a Copy** row actions. +- An imported template: At least one template must exist in **Manage** > **Config Templates**. If you don't have any templates yet, import one first. See [Import templates]({{< ref "import-templates.md" >}}) for instructions. +- A finalized base template: To use **Submit**, you need at least one base template in the `final` state. -## Go to the Templates list - -1. In the NGINX One Console, go to **Manage > Config Templates**. - -The **Templates** list opens, showing every imported template with its available row actions. - -## Row actions on the Templates list - -The Templates list includes the following row actions. +## Submit a template -{{}} -| Action | Availability | What it does | -|--------|--------------|--------------| -| **Submit** | Templates with type `base` and state `final`. Requires template write permission. | Opens the **Submit Template** panel to create a template submission. | -| **Make a Copy** | Any template. Requires template write permission. | Creates a new draft template from the latest version of the template. | -{{
}} +The **Submit** option is available for templates of type `base` that are in the `final` state. -## Submit a template +1. Go to **Manage** > **Config Templates**. The **Templates** list opens and shows every imported template with its available row actions. +1. Select **Submit** on a base template that's in the `final` state to create a template submission from the Templates list. +1. Fill in the parameter values for the base template. NGINX One Console generates the form from the template's schema. +1. (Optional) Add one or more augment templates. -Use the **Submit** row action to create a template submission from the Templates list. + - Fill in the parameter values for each augment template. -1. Select **Submit** on a base template that's in the `final` state. -2. Fill in the parameter values for the base template. NGINX One Console generates the form from the template's schema. -3. Optional: Add one or more augment templates. Fill in the parameter values for each one. -4. Choose one or more staged configs as the target. You can't target Config Sync Groups or instances directly yet. -5. Preview the rendered NGINX configuration. -6. Select **Save** to create the submission and publish it to your chosen targets. +1. Select one or more staged configs as the target. You can't target Config Sync Groups or instances directly yet. +1. Preview the rendered NGINX configuration. +1. Select **Save** to create the submission and publish it to your chosen targets. ## Edit an existing submission -You can also use the **Submit Template** panel to edit an existing submission. Open the submission from the **Submissions** section on the Template Detail page. For details on how to reach and manage submissions, see [View template submissions]({{< ref "template-submissions-view.md" >}}). +You can also use the **Submit Template** panel to edit an existing submission. Open the submission from the **Submissions** section on the Template Detail page. ## Copy a template -Use the **Make a Copy** row action to copy any template from the Templates list. +The **Make a Copy** option is available for any template, regardless of its type or state. It creates a new draft template from the latest version of the selected template. +1. Go to **Manage** > **Config Templates**. The **Templates** list opens and shows every imported template with its available row actions. 1. Select **Make a Copy** on the template you want to copy. -NGINX One Console creates a new draft template at version 1. It copies the files, the template type, and the context configuration from the source template. The new template uses the same name and description unless you update them afterward. +NGINX One Console creates a new draft template at version 1. It copies the files, template type, and context configuration from the source template. The new template uses the same name and description. You can update them afterward. This matches the behavior of [Copy a template]({{< ref "author-templates.md#copy-a-template" >}}), the API operation behind this action. ## What happens next -After you submit or copy a template, view the result on the [Template Detail page]({{< ref "template-detail-view.md" >}}). Submissions appear in the [Submissions section]({{< ref "template-submissions-view.md" >}}) of the template you submitted to. +After you submit or copy a template, view the result on the [Template Detail page]({{< ref "template-detail-view.md" >}}). Submissions appear in the Submissions section for the submitted template. ## API reference diff --git a/content/nginx-one-console/waf-integration/policy/grpc-protection-api.md b/content/nginx-one-console/waf-integration/policy/grpc-protection-api.md new file mode 100644 index 000000000..2acee15f5 --- /dev/null +++ b/content/nginx-one-console/waf-integration/policy/grpc-protection-api.md @@ -0,0 +1,196 @@ +--- +title: "Add gRPC protection to a policy" +description: "Upload .proto files through the API so a WAF policy's grpc-profiles entry can validate gRPC messages." +weight: 450 +toc: true +f5-content-type: how-to +f5-product: NGINX One Console +f5-keywords: "gRPC, protobuf, proto files, WAF policy, file references" +f5-summary: > + This page explains how to upload the .proto files a grpc-profiles entry references, using the NGINX One Console API. + You need this because policy JSON only references IDL files by URI, and the actual file content must be uploaded separately. + gRPC protection is currently supported through the API only. +f5-audience: developer +--- + +F5 WAF for NGINX can protect gRPC APIs by validating messages against their Interface Definition Language (IDL) files (`.proto`). This is configured through the `grpc-profiles` property of a WAF policy. + +{{< call-out class="important" >}} +This page covers only how to upload the `.proto` files a `grpc-profiles` entry references through the NGINX One Console API. For a full description of the gRPC protection feature itself (content profiles, defense attributes, URL association, streaming, violations, and logging), see [gRPC protection]({{< ref "/waf/policies/grpc-protection.md" >}}) and the `grpc-profiles` section of the [Policy parameter reference]({{< ref "/waf/policies/parameter-reference.md" >}}). + +**gRPC protection is currently supported through the API only.** There is no NGINX One Console UI for configuring `grpc-profiles` or uploading IDL files yet. +{{< /call-out >}} + +{{< call-out class="important" >}} +**Experimental API.** The file reference fields and request bodies described on this page (`file_references`, `file_references_archive`, and related schemas) are under active development. They may change in a future release. +{{< /call-out >}} + +## Why file references are needed + +A `grpc-profiles` entry's `idlFiles` point at the service's `.proto` file(s) using a `file://` URI, for example: + +```json +"idlFiles": [ + { + "idlFile": { "$ref": "file:///grpc_files/album.proto" }, + "isPrimary": true + } +] +``` + +The policy JSON only contains a *reference* to the file. It doesn't contain the file itself. To make the reference resolvable, you must separately upload the actual `.proto` file content in the same API request that creates or updates the policy. + +{{< call-out class="note" >}} +**You must explicitly provide the file contents yourself.** NGINX One Console does not fetch, generate, or infer IDL files on your behalf — you own the `.proto` file(s) for your gRPC service, and you are responsible for uploading their exact content every time you create or update a policy version that references them. If a policy version's `file://` reference has no matching uploaded file, the policy will fail to compile. +{{< /call-out >}} + +You can upload file references in either of two ways: + +- **Inline as base64 JSON**: good for a small number of files, or when you're already sending the policy as JSON. +- **As a `.tar.gz` archive**: good for bundling many files (for example, a primary `.proto` plus its imports) without base64 overhead. Available only when *creating* a policy. + +## Upload files as inline JSON (`file_references`) + +Send the policy as `application/json` to `POST /app-protect/policies` (create) or `PUT /app-protect/policies/{nap_policy_object_id}` (update a policy, creating a new version), with a `file_references` array alongside the base64-encoded `policy`: + +```json +{ + "policy": "", + "file_references": [ + { + "type": "proto", + "file_path": "/grpc_files/album.proto", + "content": "" + } + ] +} +``` + +Each entry in `file_references` requires: + +| Field | Description | +|-------|--------------| +| `type` | Currently only `proto` is supported. | +| `file_path` | The absolute path matching the `file://` URI referenced in the policy JSON. Must start with `/`. | +| `content` | The base64-encoded file content. | + +{{< call-out class="important" >}} +On update (`PUT`), `file_references` **replaces the full set of files** for the new policy version. If you omit `file_references` on an update, the new version is created with **no** file references at all, even if a previous version had files uploaded. Always re-include every file reference the policy still needs when updating. +{{< /call-out >}} + +## Upload files as a .tar.gz archive (file_references_archive) + +When creating a policy (`POST /app-protect/policies` only, not supported on update), you can instead send `multipart/form-data` with a `policy` field and a `file_references_archive` field containing a gzip-compressed tarball of the referenced files: + +```bash +curl -X POST https://api.nginx-one.console.nginx.com/app-protect/policies \ + -H "Authorization: Bearer " \ + -F "policy=" \ + -F "file_references_archive=@refs.tar.gz;type=application/gzip" +``` + +The archive's internal directory structure determines the absolute path each file resolves to. Build the archive from the **parent** of the referenced directory so the paths line up with your policy's `file://` URIs: + +``` +grpc_files/ +├── album.proto +└── common/ + └── messages.proto +``` + +```bash +# Correct: paths resolve to /grpc_files/album.proto, /grpc_files/common/messages.proto +tar czf refs.tar.gz grpc_files/ + +# Incorrect: paths resolve to /album.proto (missing parent directory) +cd grpc_files && tar czf refs.tar.gz *.proto +``` + +If your policy references `"$ref": "file:///grpc_files/album.proto"`, the archive must contain `grpc_files/album.proto` at that relative path. Only regular files are extracted. Symlinks, hardlinks, and directory-only entries are ignored. + +## Path rules and limits + +`file_path` (JSON method) and archive entry paths (multipart method) must: + +- Be absolute (start with `/`) and contain no `..` traversal segments. +- Target a directory outside the standard system paths (`/etc`, `/tmp`, `/usr`, `/var`, `/opt`, `/root`, and similar). Use a novel top-level directory such as `/grpc_files` for your referenced files. + +| Limit | Inline JSON (`file_references`) | Archive (`file_references_archive`) | +|-------|----------------------------------|--------------------------------------| +| Max size per file | 2 MB | 2 MB (uncompressed) | +| Max total size | 5 MB | 10 MB (uncompressed) / 5 MB (compressed archive) | +| Max number of files | 50 | 100 | + +## Retrieving file reference information + +`GET` requests for a policy version return **metadata only** for each file reference: `type`, `file_path`, `size`, and a base64-encoded SHA-256 `hash`. They don't return the file's content. + +```json +"file_references": [ + { + "type": "proto", + "file_path": "/grpc_files/album.proto", + "size": 4096, + "hash": "oxiWKPqR/soi4MQCgVnW8KHt8Jk68AqCeQcQ1sed4Dk=" + } +] +``` + +There is currently no endpoint to download the original file content back from NGINX One Console. Keep a copy of your `.proto` files on your side. + +## Full example + +The following creates an F5 WAF policy with a `grpc-profiles` entry that references `album.proto`, uploading the file inline as base64 JSON. This mirrors the [example]({{< ref "/waf/policies/grpc-protection.md#content-profiles" >}}) from the gRPC protection feature documentation. + +```bash +curl -X POST https://api.nginx-one.console.nginx.com/app-protect/policies \ + -H "Authorization: Bearer " \ + -H "Content-Type: application/json" \ + -d '{ + "policy": "", + "file_references": [ + { + "type": "proto", + "file_path": "/grpc_files/album.proto", + "content": "" + } + ] + }' +``` + +Decoded `policy` contents: + +```json +{ + "policy": { + "name": "my-grpc-service-policy", + "grpc-profiles": [ + { + "name": "photo_service_profile", + "associateUrls": true, + "defenseAttributes": { + "maximumDataLength": 100000, + "allowUnknownFields": false + }, + "attackSignaturesCheck": true, + "idlFiles": [ + { + "idlFile": { "$ref": "file:///grpc_files/album.proto" }, + "isPrimary": true + } + ] + } + ], + "urls": [ + { "name": "*", "type": "wildcard", "method": "*", "$action": "delete" } + ] + } +} +``` + +## See also + +- [Set security policies through the API]({{< ref "/nginx-one-console/waf-integration/policy/security-policy-api.md" >}}) +- [API reference guide]({{< ref "/nginx-one-console/api/api-reference-guide.md" >}}) +- [gRPC protection]({{< ref "/waf/policies/grpc-protection.md" >}}): full feature description +- [Policy parameter reference]({{< ref "/waf/policies/parameter-reference.md" >}}): `grpc-profiles` field reference diff --git a/content/nginxaas/overview/app-protect/configure-waf.md b/content/nginxaas/overview/app-protect/configure-waf.md index 034901c55..52d0ee83a 100644 --- a/content/nginxaas/overview/app-protect/configure-waf.md +++ b/content/nginxaas/overview/app-protect/configure-waf.md @@ -1,7 +1,7 @@ --- title: Configure F5 WAF for NGINX description: "Configure F5 WAF for NGINX security features by editing the NGINX configuration file." -weight: 100 +weight: 110 toc: true f5-docs: DOCS-000 url: /nginxaas/overview/app-protect/configure-waf/ diff --git a/content/nginxaas/overview/app-protect/disable-waf.md b/content/nginxaas/overview/app-protect/disable-waf.md index 11095539e..09ec4b0e8 100644 --- a/content/nginxaas/overview/app-protect/disable-waf.md +++ b/content/nginxaas/overview/app-protect/disable-waf.md @@ -1,7 +1,7 @@ --- title: Disable F5 WAF for NGINX description: "Disable F5 WAF for NGINX on an NGINXaaS deployment using the NGINXaaS Console." -weight: 100 +weight: 120 toc: true f5-docs: DOCS-000 url: /nginxaas/overview/app-protect/disable-waf/ diff --git a/content/nginxaas/overview/manage-users-organizations.md b/content/nginxaas/overview/manage-users-organizations.md index 8361e047c..e4252e6a2 100644 --- a/content/nginxaas/overview/manage-users-organizations.md +++ b/content/nginxaas/overview/manage-users-organizations.md @@ -20,7 +20,12 @@ Before you start, ensure you understand the following concepts: - Note that once a user has gained access to an NGINXaaS Organization through a particular login method, they must continue to use that login method to gain access to that NGINXaaS Organization. If the same human user authenticates through two different login methods, the resulting user identities are distinct from the perspective of NGINXaaS. - **Authentication settings**: Authentication settings are specific to the enabled login method. - - **Login Methods**: NGINXaaS authenticates users through Microsoft social login or Google social login. The NGINXaaS Organization can be configured to allow either or both of these login methods. By default, both login methods are enabled. + - **Login Methods**: NGINXaaS authenticates users through the following login methods: + - Microsoft social login + - Google social login + - Email and password + + You can configure the NGINXaaS Organization to allow any or all of these methods. By default, all listed methods are enabled. See [user login]({{< ref "/nginxaas/overview/user-login.md" >}}) for further details. - **Google Authorized Domains**: If Google social login is enabled, authorized users can configure the list of domains with which users must be associated. - This can be used to restrict access to Google identities within your Google Cloud Organization or Google Workspace, or other known, trusted Workspaces. For example, your Google Cloud Organization may have users created under the `example.com` domain. By setting the Authorized Domains in your NGINXaaS Organization to only allow `example.com`, users attempting to log in with the same email associated with `alternative.net` Google Workspace would not be authenticated. - By default, an NGINXaaS Organization has an empty authorized domains list, which accepts matching users from any Google Workspace. diff --git a/content/nginxaas/overview/user-login.md b/content/nginxaas/overview/user-login.md new file mode 100644 index 000000000..b534ed289 --- /dev/null +++ b/content/nginxaas/overview/user-login.md @@ -0,0 +1,76 @@ +--- +title: User login +weight: 350 +toc: true +f5-docs: DOCS-000 +url: /nginxaas/overview/user-login/ +f5-product: F5 NGINXaaS +f5-content-type: how-to +f5-keywords: "login,authentication" +f5-summary: > + Use this guide to sign up to NGINXaaS using an email address and password. The guide includes instructions on how to reset a password and how to grant admin consent for users of an Entra tenant to use the F5 Social Login Entra app. +f5-audience: operator +--- + +## Overview + +NGINXaaS authenticates users through three login methods: + +- Microsoft social login +- Google social login +- Email and password + +If a user signs in through Microsoft social or Google social, they interact with [Google authentication](https://docs.cloud.google.com/architecture/identity/overview-google-authentication) or the [Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/v2-overview) to establish their identity. Alternatively, the user can register a email address and password directly with our service. + +## Sign up with email and password + +If a user wishes to register with an email address and password, they must follow these steps: + +1. Select **Sign In** on the main console page. +1. On the login page, select **Sign up** in the email address input form. +1. Enter a valid email address and select **Continue**. +1. Check your email account for a six-digit verification code. +1. Enter the verification code in the browser. +1. Choose a password and select **Continue**. +1. Authenticate with our service using the email and password you have chosen. + +## Password reset + +If you want to reset your password, follow these steps: + +1. Select **Sign In** on the main console page. +1. On the login page, enter email address and select **Continue**. +1. On the password entry page, select **Reset password**. +1. On the next page, confirm the email address and select **Continue**. +1. Check your email account for a six-digit verification code. +1. Enter the verification code in the browser. +1. Enter a new password and then select **Reset password**. +1. Use the new password to authenticate with our service. + +## Password standards + +A valid password must contain: + +- At least 14 characters +- No more than 2 identical characters in a row +- At least one special character (!@#$%^&*) +- At least one lower case character (a-z), one upper case character (A-Z) and one number (0-9) + +## Entra configuration for Microsoft social login + +Depending on the configuration of an Entra tenant, administrators may need to follow these steps before users can log in with F5's Entra app and the Microsoft identity platform. + +1. Sign in to the service on the main console page +1. Select **Continue with Microsoft** +1. After signing in with Microsoft, on the **Permissions requested** prompt for the **F5 - Inc Social Login** Entra app, select **Accept** +1. At this point, you can abort the login to NGINXaaS if you wish +1. Go to the Azure portal and go to **Entra** -> **Enterprise Applications** +1. Select the **F5 Inc - Social Login** Entra app +1. Under **Permissions**, select **Grant admin consent** +1. Users of your Entra tenant should now be able to use Microsoft social login to authenticate with NGINXaaS + +See [Entra guidance on granting admin consent](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal) for further details. + +- The app ID (client ID) of the **F5 Inc - Social Login** Entra app is `4aef7a9d-810c-4746-8a6a-6c5d43e4e5f2`. +- The tenant ID is `dd3dfd2f-6a3b-40d1-9be0-bf8327d81c50`. +- The app requires the following Microsoft Graph API permissions: `email`, `openid`, `profile` and `User.Read`. \ No newline at end of file From a521c9bedee20fe681e8fd806cc52e6eff4d52fa Mon Sep 17 00:00:00 2001 From: Stephen Haynes Date: Wed, 9 Sep 2026 13:13:00 -0700 Subject: [PATCH 3/3] Simplify and correct submit and copy template instructions --- .../submit-and-copy-templates.md | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md b/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md index 1b6275c0b..8b19fbe73 100644 --- a/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md +++ b/content/nginx-one-console/nginx-configs/config-templates/submit-and-copy-templates.md @@ -35,20 +35,15 @@ Before you begin, make sure you have: The **Submit** option is available for templates of type `base` that are in the `final` state. -1. Go to **Manage** > **Config Templates**. The **Templates** list opens and shows every imported template with its available row actions. +1. Go to **Manage** > **Config Templates**. The **Templates** list opens and shows every imported template with its available row actions, as well as F5-provided templates. 1. Select **Submit** on a base template that's in the `final` state to create a template submission from the Templates list. -1. Fill in the parameter values for the base template. NGINX One Console generates the form from the template's schema. -1. (Optional) Add one or more augment templates. - - - Fill in the parameter values for each augment template. - -1. Select one or more staged configs as the target. You can't target Config Sync Groups or instances directly yet. +1. Fill in the parameter values for the base template. 1. Preview the rendered NGINX configuration. 1. Select **Save** to create the submission and publish it to your chosen targets. ## Edit an existing submission -You can also use the **Submit Template** panel to edit an existing submission. Open the submission from the **Submissions** section on the Template Detail page. +You can also use the **Edit Template Submission** panel to edit an existing submission. Open the submission from the **Submissions** section on the Template Detail page. ## Copy a template @@ -56,10 +51,9 @@ The **Make a Copy** option is available for any template, regardless of its type 1. Go to **Manage** > **Config Templates**. The **Templates** list opens and shows every imported template with its available row actions. 1. Select **Make a Copy** on the template you want to copy. +1. Fill in the name and description for the new template copy. -NGINX One Console creates a new draft template at version 1. It copies the files, template type, and context configuration from the source template. The new template uses the same name and description. You can update them afterward. - -This matches the behavior of [Copy a template]({{< ref "author-templates.md#copy-a-template" >}}), the API operation behind this action. +NGINX One Console creates a new draft template at version 1. It copies the files, template type, and context configuration from the source template. ## What happens next