-
Notifications
You must be signed in to change notification settings - Fork 123
Update N1C getting started guide with instructions on how to enable metrics collection for a NGINX Plus API with SSL enabled #1496
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
…etrics collection for a NGINX Plus API with SSL enabled
✅ Deploy Preview will be available once build job completes!
|
| ssl_certificate_key /etc/nginx/certs/nginx-selfsigned.key; | ||
| location /api/ { | ||
| # To restrict write methods (POST, PATCH, DELETE), uncomment: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Think we can take out the commented section for http basic auth. Keep the example clear for ssl only.
| NGINX Agent configuration needs to be update with the following to enable the NGINX Agent to be able to call the NGINX Plus API. | ||
| ``` | ||
| data_plane_config: | ||
| nginx: | ||
| api_tls: | ||
| ca: "/etc/nginx/certs/nginx-selfsigned.crt" | ||
| ``` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
| NGINX Agent configuration needs to be update with the following to enable the NGINX Agent to be able to call the NGINX Plus API. | |
| ``` | |
| data_plane_config: | |
| nginx: | |
| api_tls: | |
| ca: "/etc/nginx/certs/nginx-selfsigned.crt" | |
| ``` | |
| #### Configure NGINX Agent to call the NGINX Plus API | |
| To enable the Agent to call the NGINX Plus API, follow the steps below: | |
| 1. `sudo vim /etc/nginx-agent/nginx-agent.conf` | |
| 2. Open the file for editing | |
| 3. Add the following configuration: | |
data_plane_config:
nginx:
api_tls:
ca: "/etc/nginx/certs/nginx-selfsigned.crt"
4. Save and Restart
`sudo systemctl restart nginx-agent`
5. Run the following `sudo journalctl -u nginx-agent | grep "NGINX Plus API"`
The following output should be shown: `NGINX Plus API found, NGINX Plus receiver enabled to scrape metrics`
mjang
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've made some basic suggestions. IMO, this also should be approved by @shaynesf5 , whose been working on observability for N1 Console.
| ``` | ||
|
|
||
| {{<call-out type="important" title="Important">}} | ||
| Make sure that the `server` and `location` blocks are in the same single configuration file, and not split across multiple files using `include` directives. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
| Make sure that the `server` and `location` blocks are in the same single configuration file, and not split across multiple files using `include` directives. | |
| Make sure that the `server` and `location` blocks are in the same configuration file, and not split across multiple files using `include` directives. |
| ``` | ||
|
|
||
| {{<call-out type="important" title="Important">}} | ||
| Make sure that the `server` and `location` blocks are in the same single configuration file, and not split across multiple files using `include` directives. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
| Make sure that the `server` and `location` blocks are in the same single configuration file, and not split across multiple files using `include` directives. | |
| Make sure that the `server` and `location` blocks are in the same configuration file, and not split across multiple files using `include` directives. |
| ``` | ||
|
|
||
| {{<call-out type="important" title="Important">}} | ||
| Make sure that the `server` and `location` blocks are in the same single configuration file, and not split across multiple files using `include` directives. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
| Make sure that the `server` and `location` blocks are in the same single configuration file, and not split across multiple files using `include` directives. | |
| Make sure that the `server` and `location` blocks are in the same configuration file, and not split across multiple files using `include` directives. |
| ca: "/etc/nginx/certs/nginx-selfsigned.crt" | ||
| ``` | ||
|
|
||
| Here is an example of how to generate self-signed certificates |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Formatting
| Here is an example of how to generate self-signed certificates | |
| Here is an example of how to generate self-signed certificates | |
|
|
||
| Here is an example of how to generate self-signed certificates | ||
| ``` | ||
| openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/certs/nginx-selfsigned.key -out /etc/nginx/certs/nginx-selfsigned.crt -subj "/CN=localhost" -addext "subjectAltName=IP:127.0.0.1" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Formatting
| openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/certs/nginx-selfsigned.key -out /etc/nginx/certs/nginx-selfsigned.crt -subj "/CN=localhost" -addext "subjectAltName=IP:127.0.0.1" | |
| openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/certs/nginx-selfsigned.key -out /etc/nginx/certs/nginx-selfsigned.crt -subj "/CN=localhost" -addext "subjectAltName=IP:127.0.0.1" | |
Proposed changes
Checklist
Before sharing this pull request, I completed the following checklist:
Footnotes
Potentially sensitive information includes personally identify information (PII), authentication credentials, and live URLs. Refer to the style guide for guidance about placeholder content. ↩