Management ConfigMap resource

When using F5 NGINX Ingress Controller with NGINX Plus, it is required to pass a command line argument to NGINX Ingress Controller, --mgmt-configmap=<namespace/name> which specifies the ConfigMap to use. The minimal required ConfigMap must have a license-token-secret-name key. Helm users will not need to create this map or pass the argument, it will be created with a Helm install.

  1. Create a ConfigMap file with the name nginx-config-mgmt.yaml and set the values that make sense for your setup:

    yaml
    apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config-mgmt
  namespace: nginx-ingress
data:
  license-token-secret-name: "license-token"

  2. Create a new (or update the existing) ConfigMap resource:

    kubectl apply -f nginx-config-mgmt.yaml

    The NGINX Management block configuration will be updated.

Management ConfigMap keys

ConfigMap Key Description Default
license-token-secret-name Configures the secret used in the license_token directive. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. Use a standard Opaque secret, and store the base64-encoded JWT in the license.jwt key. If the license.jwt key is absent, NGINX Ingress Controller rejects the secret. N/A
ssl-verify Configures the ssl_verify directive, which enables or disables verification of the usage reporting endpoint certificate. true
enforce-initial-report Configures the enforce_initial_report directive, which enables or disables the 180-day grace period for sending the initial usage report. false
usage-report-endpoint Configures the endpoint of the usage_report directive. This is used to configure the endpoint NGINX uses to send usage reports to NIM. product.connect.nginx.com
usage-report-interval Configures the interval of the usage_report directive. This specifies the frequency that usage reports are sent. This field takes an NGINX time. 1h
usage-report-proxy-host Configures the host name of the proxy directive with optional port. N/A
ssl-trusted-certificate-secret-name Configures the secret used to create the file(s) referenced in the ssl_trusted_certifcate, and ssl_crl directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. Use a standard Opaque secret. Store the base64-encoded trusted certificate in the ca.crt key, and an optional base64-encoded CRL in the ca.crl key. If the ca.crt key is absent, NGINX Ingress Controller rejects the secret. If the optional ca.crl key is supplied, it will configure the NGINX ssl_crl directive. N/A
ssl-certificate-secret-name Configures the secret used to create the ssl_certificate and ssl_certificate_key directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type kubernetes.io/tls N/A
resolver-addresses Configures addresses used in the mgmt block resolver directive. This field takes a comma separated list of addresses. N/A
resolver-ipv6 Configures whether the mgmt block resolver directive will look up IPv6 addresses. true
resolver-valid Configures an NGINX time that the mgmt block resolver directive will override the TTL value of responses from nameservers with. N/A
View source
View as Markdown
Edit this page
Create a new issue