f5devcentral / f5-agility-labs-nginx

Everything NGINX for F5 Agility

F5 Agility Lab Template

Introduction

This repo contains a template that should be used when creating lab documentation for F5's Agility Labs.

Setup

1. Download or git clone the f5-agility-lab-template
2. Download and install Docker CE (https://docs.docker.com/engine/installation/)
3. Build the sample docs ./containthedocs-build.sh. The first time you build a container (~1G in size) will be downloaded from Docker Hub.
4. Open the docs/_build/html/index.html file on you system in a web browser

Configuration & Use

To use this template:

1. Copy contents of this repo to a new directory cp -Rf . /path/to/your/docs
2. cd /path/to/your/docs
3. Edit docs/conf.py
4. Modify the following lines:
   • classname = "Your Class Name"
   • github_repo = "https://github.com/f5devcentral/your-class-repo"
5. Build docs ./containthedocs-build.sh (see Build Scripts below)
6. Open the docs/_build/html/index.html file on you system in a web browser
7. Edit the *.rst files as needed for your class
8. Rebuild docs as needed using ./containthedocs-build.sh

Converting from Microsoft Word

To convert a .docx file from Microsoft Work to reStructuredText:

1. Copy your .docx file into the f5-agility-lab-template directory
2. Run ./containthedocs-convert.sh <filename.docx>
3. Your converted file will be named filename.rst
4. Images in your document will be extracted and placed in the media directory

.. WARNING:: While the document has been converted to rST format you will still need to refactor the rST to use the structure implemented in this template.

.. _scripts:

Build Scripts

The repo includes build scripts for common operations:

• containthedocs-bash.sh: Run to container with a BASH prompt
• containthedocs-build.sh: Build HTML docs using make -C docs html to docs/_build/html
• containthedocs-clean.sh: Clean the build directory using make -C docs clean
• containthedocs-cleanbuild.sh: Clean the build directory and build HTML docs using make -C docs clean html
• containthedocs-convert.sh: Convert a Word .docx file to rST

f5-agility-labs-nginx's Issues

docs: I think there is no "Publish to Proxy"

For the Docs, the part Expose the API proxy¶

There is no "Publish to Proxy" in this version, should change to click on "Add Proxy" instead (I think )

UDF: win10 postman has no collections

And I can't find the collection in the win10 disk or in this gitub.

Thanks!!!!

cannot add nginx1 instance on Module 2 - Deploy the API Gateway instance

follow the step 5 on Module 2 - Deploy the API Gateway instance, and add nginx1 instance with curl or wget, it will show error info <curl: (7) Failed connect to 10.1.20.4:443; Connection timed out>.

How to solve:
there is no subnet - 20 on NGINX-1 - API GW, create eth1 interface with following config
[centos@e0df010e-8f28-4e80-9a90-3cbf714cbe9b ~]$ sudo vi /etc/sysconfig/network-scripts/ifcfg-eth1
# Created by cloud-init on instance boot automatically, do not edit.
#
BOOTPROTO=dhcp
DEVICE=eth1
HWADDR=52:54:00:6c:5e:f6
ONBOOT=yes
TYPE=Ethernet
USERCTL=no

after doing this, restart this instance named NGINX-1 - API GW.

docs: class 10 mod 4 step 7

Because it is easy for the student to accidently to this in the CORS dropdown instead of where they really need to do it in the OPTIONS dropdown, I suggest change "And add the header apikey into the allow list. Scroll down till the end, and then in the field enter apikey and click Add Header" to "In the OPTIONS field, add the header apikey into the allow list. Scroll down till the end, and then in the field enter apikey and click Add Header"

Wrong DNS resolver in NAP

https://clouddocs.f5.com/training/community/nginx/html/class5/module3/lab5/lab5.html#create-an-owasp-top-10-policy-for-nap

Resolver (BIND docker) is 10.1.1.8. In the nginx config file, in the lab guide, it is 10.1.1.9.

Change Centos VM name in lab GRPC

https://clouddocs.f5.com/training/community/nginx/html/class5/module6/lab4/lab4.html

Controller installation missing after UDF's spin up.

NGINX controller installation seems to be missing after every reboot.

Cant install agent on N+ for APIGW or DevPortal

failed when trying to connect to pkgs.nginx.com.

root@ubuntu:/# curl -k https://10.1.1.6/install/nginx-agent > install.sh && sudo sh install.sh -g devportal-cluster && sudo systemctl start nginx-agent
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 44481 0 44481 0 0 3619k 0 --:--:-- --:--:-- --:--:-- 3619k
Overriding instance_group value from command line: devportal-cluster ...
Sudo permissions detected
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

---

Warning: An insecure connection will be used during this nginx-agent installation

---

ubuntu-20

Adding public key https://10.1.1.6/packages-repository/nginx-signing.key...
Finished adding public key.
Adding NGINX Agent apt repository...
Creating apt config: /etc/apt/apt.conf.d/80agent
Adding nginx-agent.list to /etc/apt/sources.list.d
Adding packages URL to /etc/apt/sources.list.d/nginx-agent.list
Updating permissions for /etc/apt/sources.list.d/nginx-agent.list to 644
Public key to repository added.
Hit:1 https://10.1.1.6/packages-repository/deb/ubuntu focal InRelease
Get:2 http://security.ubuntu.com/ubuntu focal-security InRelease [114 kB]
Hit:3 http://archive.ubuntu.com/ubuntu focal InRelease
Get:4 http://archive.ubuntu.com/ubuntu focal-updates InRelease [114 kB]
Err:5 https://pkgs.nginx.com/app-protect-security-updates/ubuntu focal InRelease
400 Bad Request [IP: 3.126.134.177 443]
Get:6 http://security.ubuntu.com/ubuntu focal-security/main amd64 Packages [2338 kB]
Get:7 http://archive.ubuntu.com/ubuntu focal-backports InRelease [108 kB]
Get:8 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages [2734 kB]
Err:9 https://pkgs.nginx.com/app-protect/ubuntu focal InRelease
400 Bad Request [IP: 3.126.134.177 443]
Err:10 https://pkgs.nginx.com/plus/ubuntu focal InRelease
400 Bad Request [IP: 3.126.134.177 443]
Get:11 http://archive.ubuntu.com/ubuntu focal-updates/main Translation-en [453 kB]
Get:12 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 c-n-f Metadata [16.9 kB]
Get:13 http://archive.ubuntu.com/ubuntu focal-updates/restricted amd64 Packages [2143 kB]
Get:14 http://security.ubuntu.com/ubuntu focal-security/main Translation-en [370 kB]
Get:15 http://security.ubuntu.com/ubuntu focal-security/main amd64 c-n-f Metadata [13.0 kB]
Get:16 http://security.ubuntu.com/ubuntu focal-security/restricted amd64 Packages [2031 kB]
Get:17 http://archive.ubuntu.com/ubuntu focal-updates/restricted Translation-en [300 kB]
Get:18 http://archive.ubuntu.com/ubuntu focal-updates/restricted amd64 c-n-f Metadata [576 B]
Get:19 http://archive.ubuntu.com/ubuntu focal-updates/universe amd64 Packages [1091 kB]
Get:20 http://archive.ubuntu.com/ubuntu focal-updates/universe Translation-en [260 kB]
Get:21 http://security.ubuntu.com/ubuntu focal-security/restricted Translation-en [285 kB]
Get:22 http://security.ubuntu.com/ubuntu focal-security/restricted amd64 c-n-f Metadata [576 B]
Get:23 http://security.ubuntu.com/ubuntu focal-security/universe amd64 Packages [864 kB]
Get:24 http://security.ubuntu.com/ubuntu focal-security/universe Translation-en [180 kB]
Get:25 http://security.ubuntu.com/ubuntu focal-security/universe amd64 c-n-f Metadata [18.8 kB]
Get:26 http://security.ubuntu.com/ubuntu focal-security/multiverse amd64 Packages [23.6 kB]
Get:27 http://archive.ubuntu.com/ubuntu focal-updates/universe amd64 c-n-f Metadata [25.3 kB]
Err:28 https://pkgs.nginx.com/nms/ubuntu focal InRelease
400 Bad Request [IP: 3.126.134.177 443]
Get:29 http://security.ubuntu.com/ubuntu focal-security/multiverse Translation-en [5504 B]
Get:30 http://archive.ubuntu.com/ubuntu focal-updates/multiverse amd64 Packages [25.8 kB]
Get:31 http://archive.ubuntu.com/ubuntu focal-updates/multiverse Translation-en [7484 B]
Get:32 http://archive.ubuntu.com/ubuntu focal-updates/multiverse amd64 c-n-f Metadata [620 B]
Get:33 http://security.ubuntu.com/ubuntu focal-security/multiverse amd64 c-n-f Metadata [548 B]
Err:34 https://pkgs.nginx.com/adm/ubuntu focal InRelease
400 Bad Request [IP: 3.126.134.177 443]
Reading package lists... Done
N: See apt-secure(8) manpage for repository creation and user configuration details.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
E: The repository 'https://pkgs.nginx.com/app-protect-security-updates/ubuntu focal InRelease' is no longer signed.
E: Failed to fetch https://pkgs.nginx.com/app-protect-security-updates/ubuntu/dists/focal/InRelease 400 Bad Request [IP: 3.126.134.177 443]
N: See apt-secure(8) manpage for repository creation and user configuration details.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
E: The repository 'https://pkgs.nginx.com/app-protect/ubuntu focal InRelease' is no longer signed.
E: Failed to fetch https://pkgs.nginx.com/app-protect/ubuntu/dists/focal/InRelease 400 Bad Request [IP: 3.126.134.177 443]
N: See apt-secure(8) manpage for repository creation and user configuration details.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
E: The repository 'https://pkgs.nginx.com/plus/ubuntu focal InRelease' is no longer signed.
E: Failed to fetch https://pkgs.nginx.com/plus/ubuntu/dists/focal/InRelease 400 Bad Request [IP: 3.126.134.177 443]
E: Failed to fetch https://pkgs.nginx.com/nms/ubuntu/dists/focal/InRelease 400 Bad Request [IP: 3.126.134.177 443]
E: The repository 'https://pkgs.nginx.com/nms/ubuntu focal InRelease' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Failed to fetch https://pkgs.nginx.com/adm/ubuntu/dists/focal/InRelease 400 Bad Request [IP: 3.126.134.177 443]
E: The repository 'https://pkgs.nginx.com/adm/ubuntu focal InRelease' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

2 typos - Class 10 Mod 7 Step 13

https://clouddocs.f5.com/training/community/nginx/html/class10/module7/lab3/lab3.html

The word "valid" is misspelled twice.

1. But in this use case, the API GW does not check against Keycloak is the JWT token is valide.
2. OAuthv2 Introspect adds a capability for the API GW to check against the Oauth AS (Keycloak) if the JWT is valide

And that 2nd sentence needs a period "." at the end.

Thanks

The environment is now created and you can see the commands to execute to link NGINX instances to your NMS.

Add a note: "Note: Because these objects are pre-created, there is now no way to see these commands after the fact."

JWT step does not seem to work

In ACM lab, In Postman, after getting the token and selecting to use that token, when sending request results in a 401. the policy is configured to send a 403, so even the wrong response code

docs: class 10 mod 3 step 4

This sentence should probably be removed: "As you can notice, Infra team and API team have their own and separated workspace" because there is not a infra team and api team workspace

there is no grpcurl tool

There is no grpcurl tool in step 17 of class 5.

add a step to export and download the openapi/swagger spec

In https://github.com/f5devcentral/f5-agility-labs-nginx/blob/develop/docs/class10/module3/lab1/lab1.rst need to add a step to export and download the openapi/swagger spec so that it can be dragg'd and dropp'd

there is no ssl_certificate and key

step 17, class 5 -
there is no ssl_certificate and ssl_certificate_key in the folder of /etc/nginx/ssl/

Devportal bookmark URL incomplete

In 'Step 6 - Check the doc pushed by API Team' ( https://clouddocs.f5.com/training/community/nginx/html/class10/module4/lab1/lab1.html ), Click on Developers bookmark. The Developers bookmark itself points to http://dev.sentence.com, which is the default nginx page. The link should be http://dev.sentence.com/devportal .

postman imports

Unable to see collections in postman for api calls. Also bookmarks in Edge browser is missing. But nevertheless this is a great lab.

topology diagram might need more details - like a dataplane LB and the dev portal server

First, I believe there may already be plans for the following, but just wanted to track it here: It is not clear to first look at the UDF blueprint components, and the lab steps like creating the api-cluster and dev-cluster and relate them to the topology diagram. For example, and I am not sure about this, but it seems like the mobile user, should they not first be going to a (nginx+) load balancer data plane instance, and api.sentence.com should resolve to the load balancer ip? Also on the topology diagram, because the dev portal is not shown, this seems confusing. As an aside, I actually cannot find a good diagram of this on nginx docs site, the diagram on the ACM page is also confusing because it is a logical diagram shown only some of the logic, and there does not seem to be a topology diagram.