Connect NGINX Gateway Fabric to NGINX Instance Manager

Overview

Connect NGINX Gateway Fabric to NGINX Instance Manager to export F5 WAF security events to the Security Dashboard.

This connection supports security event export only. F5 WAF policy fetching uses a separate credential flow. See Configure policy sources.

Before you begin

Before you begin, verify that you have:

Administrator access to a Kubernetes cluster
Helm and kubectl installed locally
An NGINX Plus subscription

Download your NGINX Plus JWT

Log in to MyF5.
Go to My Products & Plans > Subscriptions to see your active subscriptions.
Find your NGINX products or services subscription and select the Subscription ID for details.
Download the JSON Web Token (JWT) from the subscription page.

The Connectivity Stack for Kubernetes JWT does not work with NGINX Plus reporting. Use a regular NGINX Plus instance JWT.

Create the NGINX Plus Secret

Place the JWT in a file called license.jwt. Create a Kubernetes Secret using the contents of the JWT file.

kubectl create secret generic nplus-license --from-file license.jwt -n nginx-gateway

You can now delete the license.jwt file.

If you need to update the JWT at any time, update the license.jwt field in the Secret using kubectl edit and apply the changes.

This Secret is required to run NGINX Plus, with or without F5 WAF for NGINX. It also authenticates the connection from NGINX Gateway Fabric to NGINX Instance Manager.

Install Gateway API resources

The Gateway API resources from the standard channel must be installed before deploying NGINX Gateway Fabric. If they are already installed in your cluster, please ensure they are the correct version as supported by the NGINX Gateway Fabric - see the Technical Specifications.

To install the Gateway API resources, run the following:

kubectl kustomize "https://github.com/nginx/nginx-gateway-fabric/config/crd/gateway-api/standard?ref=v2.7.0" | kubectl apply -f -

If you plan to use the edge version of NGINX Gateway Fabric, you can replace the version in ref with main, for example ref=main.

Alternatively, you can install the Gateway API resources from the experimental channel. Installing Gateway API resources from the experimental channel includes everything in the standard release channel plus additional experimental resources and fields. NGINX Gateway Fabric currently supports a subset of the additional features provided by the experimental channel. To install from the experimental channel, run the following:

kubectl kustomize "https://github.com/nginx/nginx-gateway-fabric/config/crd/gateway-api/experimental?ref=v2.7.0" | kubectl apply -f -

To learn more about what Gateway API resources NGINX Gateway Fabric currently supports, visit our Gateway API Compatibility document.

Install NGINX Gateway Fabric

This integration requires NGINX Plus with F5 WAF for NGINX. Install NGINX Gateway Fabric using the following Helm command:

shellhelm install ngf oci://ghcr.io/nginx/charts/nginx-gateway-fabric \
  --set nginx.image.repository=private-registry.nginx.com/nginx-gateway-fabric/nginx-plus \
  --set nginx.plus=true \
  --set nginx.config.waf.enable=true \
  --set nginx.imagePullSecret=nginx-plus-registry-secret \
  --set nginx.usage.secretName=nplus-license \
  --set nginx.nginxInstanceManager.endpointHost=<NIM_HOSTNAME> \
  -n nginx-gateway

Replace <NIM_HOSTNAME> with your NGINX Instance Manager hostname.