Skip to content

Commit

Permalink
Document increased reload time for APUserSig
Browse files Browse the repository at this point in the history
Co-authored-by: Jodie Putrino <j.putrino@f5.com>
  • Loading branch information
pleshakov and jputrino authored Jan 14, 2021
1 parent 1196174 commit 1ba5b5c
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 1 deletion.
4 changes: 3 additions & 1 deletion docs-web/app-protect/configuration.md
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,8 @@ You can define App Protect [User Defined Signatures](https://docs.nginx.com/ngin

> **Note**: The field `revisionDatetime` is not currently supported.

> **Note**: `APUserSig` resources increase the reload time of NGINX Plus compared with `APPolicy` and `APLogConf` resources. Refer to [NGINX Fails to Start or Reload](/nginx-ingress-controller/app-protect/troubleshooting/#nginx-fails-to-start-or-reload) for more information.

To add the [User Defined Signatures](https://docs.nginx.com/nginx-app-protect/configuration/#user-defined-signature-definitions) to an Ingress resource:

1. Create an `APUserSig` Custom resource manifest.
Expand Down Expand Up @@ -186,4 +188,4 @@ spec:
- name: Unix/Linux
softwareVersion: 15.1.0
tag: Fruits
```
```
2 changes: 2 additions & 0 deletions docs-web/app-protect/troubleshooting.md
Original file line number Diff line number Diff line change
Expand Up @@ -130,4 +130,6 @@ This timeout should be more than enough to verify configurations. However, when

You can increase this timeout by setting the `nginx-reload-timeout` [cli-argument](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments/#cmdoption-nginx-reload-timeout).

When using the User Defined Signature feature, an update to an `APUserSig` requires more reload time from NGINX Plus compared with the other AppProtect resources. As a consequence, we recommend increasing the `nginx-reload-timeout` to 30 seconds if you're planning to use this feature.

If you are using external references in your Nginx App Protect policies, verify if the servers hosting the referenced resources are available and that their response time is as short as possible (see the Check the Availability of APPolicy External References section). If the references are not available during the Ingress Controller startup, the pod will fail to start. In case the resources are not available during a reload, the reload will fail, and NGINX Plus will use the previous correct configuration.

0 comments on commit 1ba5b5c

Please sign in to comment.