Skip to content

Commit cb77334

Browse files
sdutta9sdutta9
authored
Lab1, 2 and 3 changes (#12)
* lab1 added * lab2 added * topic updates * gitignore updated * lab3 updates * Edits to push expired certs * lab3 final edits * lab1 edits based on PR comments * lab2 and 3 edits based on PR comments
1 parent 231f289 commit cb77334

File tree

92 files changed

+3350
-33
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

92 files changed

+3350
-33
lines changed

‎.gitignore

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
# Any private crt and keys #
22
############################
3-
*.crt
4-
*.key
3+
*-day.crt
4+
*-day.key
5+
nginx-repo.*
56
*~
67
\#*
78

‎labs/lab1/media/lab1_none-dataplane-key-delete1.png

75.6 KB
Loading

‎labs/lab1/media/lab1_none-dataplane-key-delete2.png

48.2 KB
Loading

‎labs/lab1/media/lab1_none-dataplane-key-new.png

144 KB
Loading

‎labs/lab1/media/lab1_none-dataplane-key-overview.png

189 KB
Loading

‎labs/lab1/media/lab1_none-dataplane-key-revoke-list.png

83.5 KB
Loading

‎labs/lab1/media/lab1_none-dataplane-key-revoke1.png

164 KB
Loading

‎labs/lab1/media/lab1_none-dataplane-key-revoke2.png

66.7 KB
Loading

‎labs/lab1/media/lab1_none-dataplane-key-save.png

190 KB
Loading

‎labs/lab1/media/lab1_none-empty-overview-dashboard.png

96.2 KB
Loading

‎labs/lab1/media/lab1_none-overview-dashboard.png

325 KB
Loading

‎labs/lab1/media/lab1_none-service.png

208 KB
Loading

‎labs/lab1/media/lab1_none-tile.png

213 KB
Loading

‎labs/lab1/media/lab1_xc-login.png

66 KB
Loading

‎labs/lab1/media/nginx-agent-icon.png

9.35 KB
Loading

‎labs/lab1/media/nginx-one-icon.png

5.73 KB
Loading

‎labs/lab1/readme.md

+132
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# NGINX One Console Introduction & Access
2+
3+
## Introduction
4+
5+
In this lab, you will be logging into NGINX One Console and exploring various components within it. This lab requires that you have access to F5 Distributed Cloud to work with the One Console. As part of this lab, you will explore the NGINX One console product, as a quick Overview of what it is and how to access it.
6+
7+
<br/>
8+
9+
## Learning Objectives
10+
11+
By the end of the lab you will be able to:
12+
13+
- [Understand NGINX One Console product](#nginx-one-console-introduction)
14+
- [Access and navigate NGINX One Console](#access-and-navigate-nginx-one-console)
15+
- [Create and manage data plane keys that would be used to manage NGINX instances](#create-and-manage-data-plane-keys-that-would-be-used-to-manage-nginx-instances)
16+
17+
## Prerequisites
18+
19+
- You must have an F5 Distributed Cloud(XC) Account
20+
- You must have enabled NGINX One service on F5 Distributed Cloud(XC)
21+
- See `Lab0` for instructions on setting up your system for this Workshop
22+
- Familiarity with basic Linux concepts and commands
23+
- Familiarity with basic NGINX concepts and commands
24+
25+
<br/>
26+
27+
### NGINX One Console Introduction
28+
29+
![NGINX One](media/nginx-one-icon.png)
30+
31+
The F5 NGINX One Console is a service which is part of the F5 Distributed Cloud, gives all NGINX users access to a SaaS experience for managing NGINX instances. The console lets you monitor and control your NGINX fleet from one place. You can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more.
32+
33+
The NGINX One Console is valuable because it simplifies the complexities of modern application delivery by integrating multiple functionalities into a single platform. This reduces the need for disparate tools, lowers operational overhead and costs, and ensures robust security for your applications. You will be able to accelerate application delivery and time-to-value like never before with SaaS capabilities.
34+
35+
NGINX One Console offers the following key benefits:
36+
37+
- **Centralized control:** Manage all your NGINX instances from a single console.
38+
- **Enhanced monitoring and risk detection:** Automatically detect critical vulnerabilities (CVEs), verify SSL certificate statuses, and identify security issues in NGINX configurations.
39+
- **Performance optimization:** Track your NGINX versions and receive recommendations for tuning your configurations for better performance.
40+
- **Graphical Metrics Display:** Access a dashboard that shows key metrics for your NGINX instances, including instance availability, version distribution, system health, and utilization trends.
41+
- **Real-time alerts:** Receive alerts about critical issues.
42+
43+
### How it works
44+
45+
![NGINX Agent](media/nginx-agent-icon.png)
46+
47+
The NGINX One Console requires `NGINX Agent`, an open source software module written by NGINX that connects and communicates with NGINX One. This NGINX Agent must be installed and running on every NGINX instance that you wish to manage with NGINX One. You will use the publicly available NGINX with Agent images from Docker Hub for your NGINX OSS containers. In addition, as part of your Docker Compose file, your NGINX Plus containers already have the required `NGINX Agent` installed for you. NGINX Agent can also be installed using regular Linux package managers like `apt` and `yum`. Refer to the References Section for links to the NGINX Agent installation guides.
48+
49+
### Access and navigate NGINX One console
50+
51+
1. Login into the F5 Distributed Cloud console using your account credentials. The login page can be found at: https://console.ves.volterra.io/login/start
52+
53+
![XC Login](media/lab1_xc-login.png)
54+
55+
1. Once logged in, the "home" screen shows you various tiles which represent F5 Distributed Cloud console features. In this lab, we'll focus on the `NGINX One` console tile as highlighted in the below screenshot.
56+
57+
![XC HomeScreen](media/lab1_none-tile.png)
58+
59+
1. Click on the `NGINX One` tile from the home screen. The NGINX One "welcome" screen will appear. Make sure the NGINX One Console status shows `green - Enabled` as highlighted in below screenshot. Click on `Visit Service`. If it is not enabled, you must request access from your F5 Distributed Cloud admin.
60+
61+
![N One Visit Service](media/lab1_none-service.png)
62+
63+
1. By default, this will bring you to the NGINX One Console `Overview Dashboard` page. As no NGINX Instances are being managed by NGINX One you are seeing the blank dashboard as shown in below screenshot.
64+
65+
![Empty Dashboard](media/lab1_none-empty-overview-dashboard.png)
66+
67+
Once you add different NGINX Instance in the next section, this Dashboard would get populated by useful insights as depicted in below sample dashboard screenshot.
68+
69+
![Sample Overview Dashboard](media/lab1_none-overview-dashboard.png)
70+
71+
<br/>
72+
73+
### Create and manage data plane keys that would be used to manage NGINX instances
74+
75+
1. Within the NGINX One Console, click on `Manage > Data Plane Keys`. This would show all the Data Plane keys that you currently have.
76+
77+
![Dataplane key](media/lab1_none-dataplane-key-overview.png)
78+
79+
1. Click on `Add Data Plane Key` to create a new Dataplane key. This should open an `Add Data Plane Key` window. Provide a name of your choice for the new key. By default, the expiration date is set for a year. You can modify the expiration data as per your preference or keep the defaults for this workshop. Click on `Generate` to create your new key.
80+
81+
![New Dataplane key](media/lab1_none-dataplane-key-new.png)
82+
83+
Once the key is generated, copy the value of this key to the clipboard using the `Copy` icon on the right side. **NOTE:** This Dataplane Key is only shown here and NGINX One doesn't save this value. Save this value locally as you would be using it to register new NGINX Instances. You can Register as many NGINX Instances as you like with the same Dataplane Key. If you lose the value of the key then you need to generate a new one again.
84+
85+
![New Dataplane key save](media/lab1_none-dataplane-key-save.png)
86+
87+
1. Once you have saved the key locally for future use, click the `Close` button to finish the Data plane key creation process.
88+
89+
<br/>
90+
91+
### (Optional Exercise): Revoke a data plane key
92+
93+
1. To revoke the data plane key, search the key that you would like to revoke within the Data Plane Keys Page and then click on the key. This should open a new overlay window on the right side as shown in below screenshot. Click on `Revoke` button. In the next confirmation window, again click on `Revoke` button to disable the data plane key.
94+
95+
![Revoke Dataplane Key](media/lab1_none-dataplane-key-revoke1.png)
96+
![Confirm Revoke](media/lab1_none-dataplane-key-revoke2.png)
97+
98+
### (Optional Exercise): Delete a data plane key
99+
100+
1. Active keys cannot be directly deleted. The key must first be revoked and then can be deleted.
101+
102+
1. You can delete a revoked data plane key by opening the Data Plane Keys Page and then navigating to the `Revoked Keys` tab. This view should list all the revoked keys.
103+
104+
![Revoke key list](media/lab1_none-dataplane-key-revoke-list.png)
105+
106+
To delete a particular revoked key, select the key and then click on `Delete Selected` button. In the next confirmation window, again click on `Delete` button to delete the data plane key.
107+
108+
![Delete key](media/lab1_none-dataplane-key-delete1.png)
109+
![Delete key confirmation](media/lab1_none-dataplane-key-delete2.png)
110+
111+
<br/>
112+
113+
This ends lab1.
114+
115+
<br/>
116+
117+
## References:
118+
119+
- [NGINX One Console](https://docs.nginx.com/nginx-one/)
120+
- [NGINX Agent](https://docs.nginx.com/nginx-agent/overview/)
121+
122+
<br/>
123+
124+
### Authors
125+
126+
- Chris Akker - Solutions Architect - Community and Alliances @ F5, Inc.
127+
- Shouvik Dutta - Solutions Architect - Community and Alliances @ F5, Inc.
128+
- Adam Currier - Solutions Architect - Community and Alliances @ F5, Inc.
129+
130+
-------------
131+
132+
Navigate to ([Lab2](../lab2/readme.md) | [LabGuide](../readme.md))

‎labs/lab2/docker-compose.yml

+164
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
# NGINX Plus / OSS with NGINX Agent
2+
# NGINX webservers with ingress-demo pages
3+
# NGINX One Console Instance Registration
4+
# NGINX Basics, Dec 2024
5+
# Chris Akker, Shouvik Dutta, Adam Currier
6+
#
7+
services:
8+
basics-plus1: # Alpine NGINX Plus Web / Load Balancer
9+
environment:
10+
NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com"
11+
NGINX_AGENT_SERVER_GRPCPORT: "443"
12+
NGINX_AGENT_TLS_ENABLE: "true"
13+
NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron basics- One Console
14+
# NGINX_AGENT_INSTANCE_GROUP: basics-workshop-plus
15+
hostname: basics-plus1
16+
container_name: basics-plus1
17+
image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r32-alpine-3.20-20240613 # CVE - From Nginx Private Registry
18+
volumes: # Sync these folders to container
19+
- ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf
20+
- ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d
21+
- ./nginx-plus/etc/nginx/includes:/etc/nginx/includes
22+
- ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html
23+
ports:
24+
- 80:80 # Open for HTTP
25+
- 443:443 # Open for HTTPS
26+
- 9000:9000 # Open for stub status page
27+
- 9113:9113 # Open for Prometheus Scraper page
28+
restart: always
29+
#
30+
basics-plus2: # Alpine NGINX Plus Web / Load Balancer
31+
environment:
32+
NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com"
33+
NGINX_AGENT_SERVER_GRPCPORT: "443"
34+
NGINX_AGENT_TLS_ENABLE: "true"
35+
NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console
36+
# NGINX_AGENT_INSTANCE_GROUP: basics-workshop-plus
37+
hostname: basics-plus2
38+
container_name: basics-plus2
39+
image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-alpine-3.19-20240522 # CVE - From Nginx Private Registry
40+
volumes: # Sync these folders to container
41+
- ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf
42+
- ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d
43+
- ./nginx-plus/etc/nginx/includes:/etc/nginx/includes
44+
- ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html
45+
ports:
46+
- "80" # Open for HTTP
47+
- "443" # Open for HTTPS
48+
- "9000" # Open for API / Dashboard page
49+
- "9113" # Open for Prometheus Scraper page
50+
restart: always
51+
#
52+
basics-plus3: # RHEL UBI NGINX Plus Web / Load Balancer
53+
environment:
54+
NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com"
55+
NGINX_AGENT_SERVER_GRPCPORT: "443"
56+
NGINX_AGENT_TLS_ENABLE: "true"
57+
NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console
58+
# NGINX_AGENT_INSTANCE_GROUP: basics-workshop-plus
59+
hostname: basics-plus3
60+
container_name: basics-plus3
61+
image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-ubi-9-20240522 # From Nginx Private Registry
62+
volumes: # Sync these folders to container
63+
- ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf
64+
- ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d
65+
- ./nginx-plus/etc/nginx/includes:/etc/nginx/includes
66+
- ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html
67+
ports:
68+
- "80" # Open for HTTP
69+
- "443" # Open for HTTPS
70+
- "9000" # Open for API / Dashboard page
71+
- "9113" # Open for Prometheus Scraper page
72+
restart: always
73+
#
74+
basics-oss1: # Debian NGINX OSS Web / Load Balancer
75+
environment:
76+
NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com"
77+
NGINX_AGENT_SERVER_GRPCPORT: "443"
78+
NGINX_AGENT_TLS_ENABLE: "true"
79+
NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console
80+
hostname: basics-oss1
81+
container_name: basics-oss1
82+
image: docker-registry.nginx.com/nginx/agent:mainline # From Docker Public Registry
83+
volumes: # Sync these folders to container
84+
- ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf
85+
- ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d
86+
- ./nginx-oss/etc/nginx/includes:/etc/nginx/includes
87+
- ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx
88+
- ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html
89+
ports:
90+
- "80" # Open for HTTP
91+
- "443" # Open for HTTPS
92+
- "9000" # Open for stub status page
93+
- "9113" # Open for Prometheus Scraper page
94+
restart: always
95+
#
96+
basics-oss2: # Alpine NGINX OSS Web / Load Balancer
97+
environment:
98+
NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com"
99+
NGINX_AGENT_SERVER_GRPCPORT: "443"
100+
NGINX_AGENT_TLS_ENABLE: "true"
101+
NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console
102+
hostname: basics-oss2
103+
container_name: basics-oss2
104+
image: docker-registry.nginx.com/nginx/agent:alpine # From Docker Public Registry
105+
volumes: # Sync these folders to container
106+
- ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf
107+
- ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d
108+
- ./nginx-oss/etc/nginx/includes:/etc/nginx/includes
109+
- ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx
110+
- ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html
111+
ports:
112+
- "80" # Open for HTTP
113+
- "443" # Open for HTTPS
114+
- "9000" # Open for stub status page
115+
- "9113" # Open for Prometheus Scraper page
116+
restart: always
117+
#
118+
basics-oss3: # Older Alpine NGINX OSS Web / Load Balancer
119+
environment:
120+
NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com"
121+
NGINX_AGENT_SERVER_GRPCPORT: "443"
122+
NGINX_AGENT_TLS_ENABLE: "true"
123+
NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console
124+
hostname: basics-oss3
125+
container_name: basics-oss3
126+
image: docker-registry.nginx.com/nginx/agent:1.26-alpine # From Docker Public Registry
127+
volumes: # Sync these folders to container
128+
- ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf
129+
- ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d
130+
- ./nginx-oss/etc/nginx/includes:/etc/nginx/includes
131+
- ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx
132+
- ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html
133+
ports:
134+
- "80" # Open for HTTP
135+
- "443" # Open for HTTPS
136+
- "9000" # Open for stub status page
137+
- "9113" # Open for Prometheus Scraper page
138+
restart: always
139+
#
140+
web1:
141+
hostname: web1
142+
container_name: web1
143+
platform: linux/amd64
144+
image: nginxinc/ingress-demo # Image from Docker Hub
145+
ports:
146+
- "80" # Open for HTTP
147+
- "443" # Open for HTTPS
148+
web2:
149+
hostname: web2
150+
container_name: web2
151+
platform: linux/amd64
152+
image: nginxinc/ingress-demo
153+
ports:
154+
- "80"
155+
- "433"
156+
web3:
157+
hostname: web3
158+
container_name: web3
159+
platform: linux/amd64
160+
image: nginxinc/ingress-demo
161+
ports:
162+
- "80"
163+
- "443"
164+

‎labs/lab2/generate_certs.sh

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
echo "Generate 1-day cert."
2+
openssl req -x509 -nodes -days 1 -newkey rsa:2048 -keyout nginx-oss/etc/ssl/nginx/1-day.key -out nginx-oss/etc/ssl/nginx/1-day.crt -subj "/CN=NginxPlusBasics"
3+
echo "Generate 30-day cert."
4+
openssl req -x509 -nodes -days 30 -newkey rsa:2048 -keyout nginx-oss/etc/ssl/nginx/30-day.key -out nginx-oss/etc/ssl/nginx/30-day.crt -subj "/CN=NginxPlusBasics"

‎labs/lab2/media/docker-icon.png

15.2 KB
Loading

‎labs/lab2/media/lab2_docker-pulling.png

39.3 KB
Loading

‎labs/lab2/media/lab2_none-instances.png

68.9 KB
Loading

‎labs/lab2/media/nginx-icon.png

5.55 KB
Loading

‎labs/lab2/media/nginx-plus-icon.png

6.35 KB
Loading

‎labs/lab2/nginx-oss/etc/nginx/conf.d/cafe.example.com.conf

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# cafe.example.com HTTP
2+
server {
3+
# Listening on port 80 on all IP addresses on this machine
4+
listen 80;
5+
6+
server_name cafe.example.com;
7+
8+
# status_zone cafe-VirtualServer;
9+
10+
# Server specific logging
11+
access_log /var/log/nginx/cafe.example.com.log main_ext;
12+
error_log /var/log/nginx/cafe.example.com_error.log info;
13+
14+
location / {
15+
16+
proxy_buffering off;
17+
18+
# Including best-practice headers are bonus points
19+
include includes/proxy_headers.conf;
20+
include includes/keepalive.conf;
21+
22+
# status_zone /;
23+
24+
proxy_pass http://nginx_cafe;
25+
}
26+
27+
}

‎labs/lab2/nginx-oss/etc/nginx/conf.d/stub_status.conf

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# ngx_http_stub_status_module (Available in NGINX OSS)
2+
# provides Basic Status information http://nginx.org/en/docs/http/ngx_http_stub_status_module.html
3+
4+
server {
5+
listen 9000 ssl; # Listener for Stub Status
6+
7+
ssl_certificate /etc/ssl/nginx/30-day.crt;
8+
ssl_certificate_key /etc/ssl/nginx/30-day.key;
9+
10+
location /basic_status {
11+
stub_status;
12+
}
13+
14+
# Redirect requests for "/" to "/basic_status"
15+
location / {
16+
return 301 /basic_status;
17+
}
18+
19+
}

0 commit comments

Comments
 (0)