Document how to deploy NGINX Plus in a Kubernetes pod and connect it to NGINX One

[travisamartin]

Description

Customers are asking for clear, official documentation on how to deploy NGINX Plus in a Kubernetes (K8s) pod and connect that instance to NGINX One.

This request came from a customer engagement with Infosys (India-based) and reflects a broader need among customers and internal solution architects. While many users can figure out the technical steps, there is a strong desire for validated, official guidance that follows best practices and reduces guesswork.

There is currently no end-to-end guide that shows:

1. How to deploy a container that includes both NGINX Plus and the NGINX Agent in a Kubernetes pod
2. How to configure the pod for secure image pulling from the private registry
3. How to connect the instance to NGINX One Console

Related documentation

• Deploy NGINX Plus with NAP using Helm: Covers Helm-based deployment patterns but is focused on WAF use cases.
• Connect NGINX Plus container images to NGINX One: Explains container-to-NGINX One connection, but not in a Kubernetes context.

Goals / What needs to be documented

1. How to deploy a container with both NGINX Plus and the NGINX Agent in a Kubernetes pod (using either Helm or YAML)
2. How to authenticate and pull the image from the private NGINX registry using a JWT secret
3. How to connect the NGINX Plus instance to NGINX One using required environment variables and credentials
4. Guidance on including the NGINX Plus instance in a Config Sync Group, if relevant
5. Validation steps to ensure the instance appears in NGINX One and is reporting metrics

Code example (from @mkingst)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-plus-agent-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - image: private-registry.nginx.com/nginx-plus/agent:<version>
        name: agent
        env:
        - name: NGINX_AGENT_SERVER_GRPCPORT
          value: "443"
        - name: NGINX_AGENT_SERVER_HOST
          value: "agent-connect.nginx.com"
        - name: NGINX_AGENT_SERVER_TOKEN
          value: "YOUR_NGINX_ONE_DATA_PLANE_KEY_HERE"
        - name: NGINX_AGENT_TLS_ENABLE
          value: "true"
      imagePullSecrets:
        - name: nginx-jwt

Acceptance criteria

• A new guide is published in the NGINX One documentation set (exact location TBD)
• Guide explains how to deploy a container image that includes both NGINX Plus and the NGINX Agent in a Kubernetes pod
• Includes YAML or Helm-based examples for deployment and configuration
• Covers how to pull the combined image from the private registry using a JWT secret
• Provides guidance for optionally adding the NGINX Plus instance to a Config Sync Group
• Reviewed by Docs, Product, and Engineering for technical accuracy and completeness
• Indexed for discoverability under common terms like “Kubernetes deployment,” “NGINX Plus in K8s,” and “connect to NGINX One”

References

• Customer: Infosys (India-based)
• Related docs:
  • https://docs.nginx.com/nginx-app-protect-waf/v5/admin-guide/deploy-with-helm/
  • https://docs.nginx.com/nginx-one/how-to/containers/connect-nginx-plus-container-images-to-nginx-one/

[jasonclopper]

Reflecting on this one a bit, beyond giving them the basics of how to accomplish, it might be good to explain why they would want to use config sync groups as a part of this to more easily manage k8s based instances.