Document Opaque secret support in NGINX Ingress Controller

content/nic/configuration/global-configuration/mgmt-configmap-resource.md

@@ -35,13 +35,13 @@ that make sense for your setup:
 
 |ConfigMap Key | Description | Default |
 | ---| ---| ---|
-|*license-token-secret-name* | Configures the secret used in the [license_token](https://nginx.org/en/docs/ngx_mgmt_module.html#license_token) directive. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `nginx.com/license` with the base64 encoded JWT in the `license.jwt` key.  | N/A |
+|*license-token-secret-name* | Configures the secret used in the [license_token](https://nginx.org/en/docs/ngx_mgmt_module.html#license_token) directive. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. Store the base64-encoded JWT in the `license.jwt` key. The secret can be a standard `Opaque` secret or an `nginx.com/license` secret. If the `license.jwt` key is absent, NGINX Ingress Controller rejects the secret. | N/A |
 |*ssl-verify* | Configures the [ssl_verify](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_verify) directive, which enables or disables verification of the usage reporting endpoint certificate. | `true` |
 |*enforce-initial-report* | Configures the [enforce_initial_report](https://nginx.org/en/docs/ngx_mgmt_module.html#enforce_initial_report) directive, which enables or disables the 180-day grace period for sending the initial usage report. | `false` |
 |*usage-report-endpoint* | Configures the endpoint of the [usage_report](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) directive. This is used to configure the endpoint NGINX uses to send usage reports to NIM. | `product.connect.nginx.com` |
 |*usage-report-interval* | Configures the interval of the [usage_report](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) directive. This specifies the frequency that usage reports are sent. This field takes an [NGINX time](https://nginx.org/en/docs/syntax.html). | `1h` |
 |*usage-report-proxy-host* | Configures the host name of the [proxy](https://nginx.org/en/docs/ngx_mgmt_module.html#proxy) directive with optional port. | N/A |
-|*ssl-trusted-certificate-secret-name* | Configures the secret used to create the file(s) referenced the in [ssl_trusted_certifcate](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_trusted_certificate), and [ssl_crl](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_crl) directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `nginx.org/ca`, where the `ca.crt` key contains a base64 encoded trusted cert, and the optional `ca.crl` key can contain a base64 encoded CRL. If the optional `ca.crl` key is supplied, it will configure the NGINX `ssl_crl` directive. | N/A |
+|*ssl-trusted-certificate-secret-name* | Configures the secret used to create the file(s) referenced in the [ssl_trusted_certifcate](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_trusted_certificate), and [ssl_crl](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_crl) directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. Store the base64-encoded trusted certificate in the `ca.crt` key, and an optional base64-encoded CRL in the `ca.crl` key. The secret can be a standard `Opaque` secret or an `nginx.org/ca` secret. If the `ca.crt` key is absent, NGINX Ingress Controller rejects the secret. If the optional `ca.crl` key is supplied, it will configure the NGINX `ssl_crl` directive. | N/A |
 |*ssl-certificate-secret-name* | Configures the secret used to create the `ssl_certificate` and `ssl_certificate_key` directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `kubernetes.io/tls`| N/A |
 |*resolver-addresses* | Configures addresses used in the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive. This field takes a comma separated list of addresses. | N/A |
 |*resolver-ipv6* | Configures whether the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive will look up IPv6 addresses. | `true` |

content/nic/install/helm/parameters.md

@@ -29,7 +29,7 @@ The [values.schema.json](https://github.com/nginx/kubernetes-ingress/blob/main/c
 | **controller.kind** | The kind of the NGINX Ingress Controller installation - deployment, daemonset, or statefulset. | deployment |
 | **controller.annotations** | Allows for setting of `annotations` for deployment, daemonset, or statefulset. | {} |
 | **controller.nginxplus** | Deploys NGINX Ingress Controller for NGINX Plus. | false |
-| **controller.mgmt.licenseTokenSecretName** | Configures the secret used in the [license_token](https://nginx.org/en/docs/ngx_mgmt_module.html#license_token) directive. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `nginx.com/license` with the base64 encoded JWT in the `license.jwt` key. | license-token |
+| **controller.mgmt.licenseTokenSecretName** | Configures the secret used in the [license_token](https://nginx.org/en/docs/ngx_mgmt_module.html#license_token) directive. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. Store the base64-encoded JWT in the `license.jwt` key. The secret can be a standard `Opaque` secret or an `nginx.com/license` secret. | license-token |
 | **controller.mgmt.enforceInitialReport** | Configures the [enforce_initial_report](https://nginx.org/en/docs/ngx_mgmt_module.html#enforce_initial_report) directive, which enables or disables the 180-day grace period for sending the initial usage report. | false |
 | **controller.mgmt.usageReport.endpoint** | Configures the endpoint of the [usage_report](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) directive. This is used to configure the endpoint NGINX uses to send usage reports to NGINX Instance Manager . | product.connect.nginx.com |
 | **controller.mgmt.usageReport.interval** | Configures the interval of the [usage_report](https://nginx.org/en/docs/ngx_mgmt_module.html#usage_report) directive. This specifies the frequency that usage reports are sent. Only seconds(s), minutes(m), and hours(h) are allowed and must be between 60s and 24h. | 1h |
@@ -40,7 +40,7 @@ The [values.schema.json](https://github.com/nginx/kubernetes-ingress/blob/main/c
 | **controller.mgmt.resolver.valid** | Configures an [NGINX time](https://nginx.org/en/docs/syntax.html) that the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive will override the TTL value of responses from nameservers with.  | N/A |
 | **controller.mgmt.resolver.addresses** | Configures addresses used in the mgmt block [resolver](https://nginx.org/en/docs/ngx_mgmt_module.html#resolver) directive. This field takes a list of addresses. | N/A |
 | **controller.mgmt.sslCertificateSecretName** | Configures the secret used to create the `ssl_certificate` and `ssl_certificate_key` directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `kubernetes.io/tls` | N/A |
-| **controller.mgmt.sslTrustedCertificateSecretName** | Configures the secret used to create the file(s) referenced the in [ssl_trusted_certifcate](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_trusted_certificate), and [ssl_crl](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_crl) directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. The secret must be of type `nginx.org/ca`, where the `ca.crt` key contains a base64 encoded trusted cert, and the optional `ca.crl` key can contain a base64 encoded CRL. If the optional `ca.crl` key is supplied, it will configure the NGINX `ssl_crl` directive. | N/A |
+| **controller.mgmt.sslTrustedCertificateSecretName** | Configures the secret used to create the file(s) referenced in the [ssl_trusted_certifcate](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_trusted_certificate), and [ssl_crl](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_crl) directives. This key assumes the secret is in the Namespace that NGINX Ingress Controller is deployed in. Store the base64-encoded trusted certificate in the `ca.crt` key, and an optional base64-encoded CRL in the `ca.crl` key. The secret can be a standard `Opaque` secret or an `nginx.org/ca` secret. If the optional `ca.crl` key is supplied, it will configure the NGINX `ssl_crl` directive. | N/A |
 | **controller.mgmt.configMapName** | Allows changing the name of the MGMT config map. The name should not include a namespace| Autogenerated |
 | **controller.nginxReloadTimeout** | The timeout in milliseconds which the NGINX Ingress Controller will wait for a successful NGINX reload after a change or at the initial start. | 60000 |
 | **controller.hostNetwork** | Enables NGINX Ingress Controller pods to use the host's network namespace. | false |

content/nic/install/helm/plus.md

@@ -37,7 +37,7 @@ These commands should be run in the same directory as your **license.jwt** file.
 Create a secret for the NGINX Plus license:
 
 ```shell
-kubectl create secret generic nplus-license --from-file=license.jwt --type=nginx.com/license
+kubectl create secret generic nplus-license --from-file=license.jwt
 ```
 
 Create a secret for the F5 registry:
@@ -98,7 +98,7 @@ JWTs are sensitive information and should be stored securely. Delete them after
 Once you have obtained your license JWT, create a Kubernetes secret using `kubectl create`:
 
 ```shell
-kubectl create secret generic nplus-license --from-file license.jwt
+kubectl create secret generic nplus-license --from-file=license.jwt
 ```
 
 {{< details summary="Example output" >}}

content/nic/install/license-secret.md

@@ -29,12 +29,12 @@ The JWT is required for validating your subscription and reporting telemetry dat
 
 The JWT needs to be configured before deploying NGINX Ingress Controller. 
 
-It must be stored in a Kubernetes Secret of type `nginx.com/license` in the same namespace as your NGINX Ingress Controller pod(s).
+From NGINX Ingress Controller `<VERSION>`, store the JWT in a Kubernetes secret. Put it in the same namespace as your NGINX Ingress Controller pods. NGINX Ingress Controller validates the secret by its `license.jwt` key, so the secret can be a standard `Opaque` secret or an `nginx.com/license` secret. If the `license.jwt` key is absent, NGINX Ingress Controller rejects the secret. Add the key to resolve it.
 
 Create the Secret with the following command:
 
 ```shell
-kubectl create secret generic license-token --from-file=license.jwt=<path-to-your-jwt> --type=nginx.com/license -n <your-namespace>
+kubectl create secret generic license-token --from-file=license.jwt=<path-to-your-jwt> -n <your-namespace>
 ```
 
 Once created, you can download the `.jwt` file.
@@ -54,7 +54,6 @@ kubectl create secret generic license-token \
 --save-config \
 --dry-run=client \
 --from-file=license.jwt=<new-jwt-file-path> \
---type=nginx.com/license \
 -o yaml | \
 kubectl apply -f -
 ```
@@ -123,13 +122,12 @@ To use Client Auth with NGINX Instance Manager, first create a Secret of type `k
 kubectl create secret tls ssl-certificate --cert=<path-to-your-client.pem> --key=<path-to-your-client.key> -n <Your Namespace>
 ```
 
-To provide a SSL trusted certificate, and an optional Certificate Revocation List, create a Secret of type `nginx.org/ca` in the Namespace that the NIC Pod(s) are in.
+To provide an SSL trusted certificate and an optional certificate revocation list, create a secret. Put it in the same namespace as the NGINX Ingress Controller pods. The secret can be a standard `Opaque` secret or an `nginx.org/ca` secret:
 
 ```shell
 kubectl create secret generic ssl-trusted-certificate \
    --from-file=ca.crt=<path-to-your-ca.crt> \
-   --from-file=ca.crl=<path-to-your-ca.crl> \ # optional
-   --type=nginx.org/ca
+   --from-file=ca.crl=<path-to-your-ca.crl> # optional
 ```
 
 Providing an optional CRL (certificate revocation list) will configure the [`ssl_crl`](https://nginx.org/en/docs/ngx_mgmt_module.html#ssl_crl) directive.

content/nic/install/plm-installation.md

@@ -125,8 +125,7 @@ kubectl create secret docker-registry regcred \
 
 kubectl create secret generic license-token \
   --namespace nginx-ingress \
-  --from-file=license.jwt=nginx-repo.jwt \
-  --type=nginx.com/license
+  --from-file=license.jwt=nginx-repo.jwt
 ```
 
 Add the NGINX Helm repository:

content/nic/install/waf-helm.md

@@ -152,10 +152,11 @@ kubectl create secret \
 
 kubectl create secret \
     generic license-token \
-    --from-file=license.jwt=./nginx-repo.jwt \
-    --type=nginx.com/license
+    --from-file=license.jwt=./nginx-repo.jwt
 ```
 
+This creates a standard `Opaque` secret. An `nginx.com/license` secret also works.
+
 Install the required CRDs for NGINX Ingress Controller:
 
 ```shell

content/nic/integrations/app-protect-waf-v5/bundle-sources.md

@@ -43,13 +43,12 @@ Complete end-to-end NGINX Ingress Controller with F5 WAF for NGINX bundle source
 
 ### Create a credentials Secret
 
-Create a Secret of type `nginx.com/waf-bundle` in the same namespace as the Policy. The Secret must contain a `token` key with your NGINX One Console API token:
+Create a secret in the same namespace as the Policy to hold your NGINX One Console API token. From NGINX Ingress Controller `<VERSION>`, the secret can be a standard `Opaque` secret or an `nginx.com/waf-bundle` secret. If the `token` key is absent, NGINX Ingress Controller rejects the secret. Store the token under the key `token`:
 
 To create an API token, see [Authentication]({{< ref "/nginx-one-console/api/authentication.md" >}}).
 
 ```shell
 kubectl create secret generic n1c-credentials \
-  --type=nginx.com/waf-bundle \
   --from-literal=token=<YOUR_API_TOKEN>
 ```
 
@@ -114,7 +113,7 @@ For complete HTTPS setup manifests, see the [bundle server files](https://github
    kubectl describe policy waf-policy
    ```
 
-   Look for a `Normal` event confirming the bundle was fetched. If you see a `Warning` event, check the message for the cause — common issues include an incorrect `policyName`, an invalid token, or a policy that has not been published yet.
+   Look for a `Normal` event confirming the bundle was fetched. If you see a `Warning` event, check the message for the cause — common issues include an incorrect `policyName`, an invalid token, or a policy that has not been published yet. NGINX Ingress Controller also rejects a secret that is missing the required `token` key.
 
 1. Send a legitimate request to confirm traffic flows normally:
 
@@ -199,7 +198,7 @@ kubectl exec -it <SYSLOG_POD> -- cat /var/log/messages
 
 ### Create a credentials Secret
 
-Create a Secret of type `nginx.com/waf-bundle` in the same namespace as the Policy. Use a `token` key for bearer auth, or `username` and `password` keys for basic auth:
+Create a secret in the same namespace as the Policy. The secret can be a standard `Opaque` secret or an `nginx.com/waf-bundle` secret. If neither the `token` key nor the `username` and `password` keys are present, NGINX Ingress Controller rejects the secret. For bearer auth, store the token under the key `token`. For basic auth, store the credentials under the keys `username` and `password`:
 
 If you use bearer auth, get an access token using your configured authentication flow. For supported methods, see [API Overview]({{< ref "/nim/fundamentals/api-overview.md#authentication" >}}).
 
@@ -209,7 +208,6 @@ If you use bearer auth, get an access token using your configured authentication
 
 ```shell
 kubectl create secret generic nim-credentials \
-  --type=nginx.com/waf-bundle \
   --from-literal=token=<YOUR_TOKEN>
 ```
 
@@ -219,7 +217,6 @@ kubectl create secret generic nim-credentials \
 
 ```shell
 kubectl create secret generic nim-credentials \
-  --type=nginx.com/waf-bundle \
   --from-literal=username=<YOUR_USERNAME> \
   --from-literal=password=<YOUR_PASSWORD>
 ```
@@ -286,7 +283,7 @@ For complete end-to-end manifests, see the [waf-management-plane examples](https
    kubectl describe policy waf-policy
    ```
 
-   Look for a `Normal` event confirming the bundle was fetched. If you see a `Warning` event, check the message for the cause — common issues include an incorrect `policyName`, authentication failure, or a bundle that has not been compiled yet.
+   Look for a `Normal` event confirming the bundle was fetched. If you see a `Warning` event, check the message for the cause — common issues include an incorrect `policyName`, authentication failure, or a bundle that has not been compiled yet. NGINX Ingress Controller also rejects a secret with neither the `token` key nor the `username` and `password` keys.
 
 1. Send a legitimate request to confirm traffic flows normally:
 
@@ -405,11 +402,10 @@ After compiling your policy with the [F5 WAF compiler]({{< ref "/waf/configure/c
 
 Skip this step if your HTTPS server uses a publicly trusted certificate.
 
-- **Custom CA certificate** — If your server uses a self-signed or internal CA, create a Secret of type `nginx.org/ca` with a `ca.crt` key, and reference it in `trustedCertSecret`:
+- **Custom CA certificate** — If your server uses a self-signed or internal CA, create a secret with a `ca.crt` key. If the `ca.crt` key is absent, NGINX Ingress Controller rejects the secret. Reference it in `trustedCertSecret`. The secret can be a standard `Opaque` secret or an `nginx.org/ca` secret:
 
   ```shell
   kubectl create secret generic bundle-ca-cert \
-    --type=nginx.org/ca \
     --from-file=ca.crt=</path/to/ca.crt>
   ```
 

content/nic/overview/design.md

@@ -86,7 +86,7 @@ The previous diagram depicts NGINX Ingress Controller using NGINX. NGINX Ingress
 
 - To configure NGINX Plus, NGINX Ingress Controller uses [configuration reloads](#reloading-nginx) and the [NGINX Plus API](http://nginx.org/en/docs/http/ngx_http_api_module.html#api). This allows NGINX Ingress Controller to dynamically change the upstream servers.
 - Instead of the stub status metrics, the extended metrics available from the NGINX Plus API are used.
-- In addition to TLS certs and keys, NGINX Ingress Controller writes JWKs from the secrets of the type `nginx.org/jwk`, and NGINX workers read them.
+- In addition to TLS certs and keys, NGINX Ingress Controller writes JWKs from secrets that contain a `jwk` key, and NGINX workers read them.
 
 ## The NGINX Ingress Controller process
 
@@ -241,7 +241,7 @@ Ultimately, NGINX Ingress Controller ensures the NGINX config on the filesystem
 
 ##### LocalSecretStore
 
-[_LocalSecretStore_](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/secrets/store.go#L32) (of the _SecretStore_ interface) holds the valid Secret resources and keeps the corresponding files on the filesystem in sync with them. Secrets are used to hold TLS certificates and keys (type `kubernetes.io/tls`), CAs (`nginx.org/ca`), JWKs (`nginx.org/jwk`), and client secrets for an OIDC provider (`nginx.org/oidc`).
+[_LocalSecretStore_](https://github.com/nginx/kubernetes-ingress/blob/v1.11.0/internal/k8s/secrets/store.go#L32) (of the _SecretStore_ interface) holds the valid Secret resources and keeps the corresponding files on the filesystem in sync with them. Secrets are used to hold TLS certificates and keys (`tls.crt` and `tls.key`), CAs (`ca.crt`), JWKs (`jwk`), and client secrets for an OIDC provider (`client-secret`).
 
 When _Controller_ processes a change to a configuration resource like Ingress, it creates an extended version of a resource that includes the dependencies (Such as Secrets) necessary to generate the NGINX configuration. _LocalSecretStore_ allows _Controller_ to reference the filesystem for a secret using the secret key (namespace/name).