Important: NGINX Plus R33 requires NGINX Instance Manager 2.18 or later
To ensure uninterrupted traffic processing, upgrade to NGINX Instance Manager 2.18 or later if your NGINX data plane instances are running NGINX Plus R33. This upgrade is necessary to support usage reporting.

NGINX Plus R33 instances must send usage data to the F5 licensing endpoint or NGINX Instance Manager. If they don’t, they will stop processing user traffic.

For more information about usage reporting and enforcement, see About solution licenses.

Configurable Helm settings

Legacy 'nms' references
Some commands, file paths, and configuration references still use nms due to the ongoing transition from NGINX Management Suite (NMS) to NGINX Instance Manager (NIM). These will be updated in future releases.

This reference guide lists the configurable Helm chart parameters and default settings for NGINX Instance Manager.

NGINX Instance Manager Helm chart settings

The following table lists the configurable parameters and default values for NGINX Instance Manager when installing from a Helm chart.

To modify a configuration for an existing release, run the helm upgrade command and use -f <my-values-file>, where <my-values-file> is the path to a values file with your desired configuration.

Parameter	Description	Default
`nms-hybrid.adminPasswordHash`	The hashed value of the password for the admin user. To generate the hash using `openssl`, run a command like: `openssl passwd -1 "YourPassword123#"`	N/A
`nms-hybrid.nmsClickhouse.enabled`	Enable this if external ClickHouse is not used.	`true`
`nms-hybrid.nmsClickhouse.fullnameOverride`	Modify the name of ClickHouse resources.	`clickhouse`
`nms-hybrid.nmsClickhouse.image.repository`	Repository name and path for the public ClickHouse image.	`clickhouse/clickhouse-server`
`nms-hybrid.nmsClickhouse.image.tag`	Tag used for pulling images from the registry.	`21.3.20.1-alpine`
`nms-hybrid.nmsClickhouse.image.pullPolicy`	Image pull policy.	`IfNotPresent`
`nms-hybrid.nmsClickhouse.user`	Username to connect to the ClickHouse server.	N/A
`nms-hybrid.nmsClickhouse.password`	Password for the ClickHouse server.	N/A
`nms-hybrid.nmsClickhouse.service.name`	ClickHouse service name.	`clickhouse`
`nms-hybrid.nmsClickhouse.service.rpcPort`	ClickHouse service port.	`9000`
`nms-hybrid.nmsClickhouse.resources.requests.cpu`	Minimum required CPU to run the ClickHouse server.	`500m`
`nms-hybrid.nmsClickhouse.resources.requests.memory`	Minimum required memory to run the ClickHouse server.	`1Gi`
`nms-hybrid.nmsClickhouse.persistence.enabled`	Use PVCs to persist ClickHouse data.	`true`
`nms-hybrid.nmsClickhouse.persistence.existingClaim`	Name of an existing Persistent Volume Claim (PVC) to use for ClickHouse persistence.	N/A
`nms-hybrid.nmsClickhouse.persistence.storageClass`	Storage class to use for creating a ClickHouse PVC.
`nms-hybrid.nmsClickhouse.persistence.volumeName`	Name to use for a ClickHouse PVC volume.
`nms-hybrid.nmsClickhouse.persistence.accessMode`	PVC access mode for ClickHouse.	`ReadWriteOnce`
`nms-hybrid.nmsClickhouse.persistence.size`	PVC size for ClickHouse.	`1G`
`nms-hybrid.nmsClickhouse.tolerations`	List of Kubernetes tolerations, if any.	See Kubernetes taints and tolerations
`nms-hybrid.externalClickhouse.address`	Address of the external ClickHouse service.
`nms-hybrid.externalClickhouse.user`	User of the external ClickHouse service.
`nms-hybrid.externalClickhouse.password`	Password of the external ClickHouse service.
`nms-hybrid.serviceAccount.annotations`	Set custom annotations for the service account used by NGINX Instance Manager.	`{}`
`nms-hybrid.apigw.name`	Name used for API Gateway resources.	`apigw`
`nms-hybrid.apigw.tlsSecret`	By default, this Helm chart creates its own Certificate Authority (CA) to self-sign HTTPS server cert key pairs. These are not managed by NGINX Instance Manager. You can bring your own NGINX API Gateway certificates for hosting the HTTPS server by setting `tlsSecret` to an existing Kubernetes secret name in the targeted namespace. The secret should include `tls.crt`, `tls.key`, and `ca.pem` in the data object. Using a self-provisioned “tlsSecret” is recommended for production. Refer to the “Use your own certificates” section in Frequently used Helm configurations for an example.
`nms-hybrid.apigw.image.repository`	Repository name and path for the `apigw` image.	`apigw`
`nms-hybrid.apigw.image.tag`	Tag used for pulling images from the registry.	`latest`
`nms-hybrid.apigw.image.pullPolicy`	Image pull policy.	`IfNotPresent`
`nms-hybrid.apigw.container.port.https`	Container HTTPS port.	`443`
`nms-hybrid.apigw.service.name`	Service name.	`apigw`
`nms-hybrid.apigw.service.type`	Service type (options: `ClusterIp`, `LoadBalancer`, `NodePort`).	`ClusterIp`
`nms-hybrid.apigw.service.httpsPort`	Service HTTPS port.	`443`
`nms-hybrid.apigw.resources.requests.cpu`	Minimum required CPU to run `apigw`.	`250m`
`nms-hybrid.apigw.resources.requests.memory`	Minimum required memory to run `apigw`.	`256Mi`
`nms-hybrid.apigw.tolerations`	List of Kubernetes tolerations, if any.	See Kubernetes taints and tolerations
`nms-hybrid.core.name`	Name used for core resources.	`core`
`nms-hybrid.core.image.repository`	Repository name and path for the `core` image.	`core`
`nms-hybrid.core.image.tag`	Tag used for pulling images from the registry.	`latest`
`nms-hybrid.core.image.pullPolicy`	Image pull policy.	`IfNotPresent`
`nms-hybrid.core.container.port.http`	Container HTTP port.	`8033`
`nms-hybrid.core.container.port.db`	Container database port.	`7891`
`nms-hybrid.core.container.port.grpc`	Container gRPC port.	`8038`
`nms-hybrid.core.service.httpPort`	Service HTTP port.	`8033`
`nms-hybrid.core.service.grpcPort`	Service gRPC port.	`8038`
`nms-hybrid.core.resources.requests.cpu`	Minimum required CPU to run `core`.	`500m`
`nms-hybrid.core.resources.requests.memory`	Minimum required memory to run `core`.	`512Mi`
`nms-hybrid.core.persistence.enabled`	Enable persistence for `core` service.	`true`
`nms-hybrid.core.persistence.claims`	An array of persistent volume claims for Dqlite and secrets. Can be modified to use an existing PVC.	See Dqlite and Secrets
`nms-hybrid.core.persistence.storageClass`	Storage class to use for creating a `core` PVC.
`nms-hybrid.core.persistence.volumeName`	Name to use for a `core` PVC volume.
`nms-hybrid.core.tolerations`	List of Kubernetes tolerations, if any.	See Kubernetes taints and tolerations
`nms-hybrid.dpm.name`	Name used for `dpm`.	`dpm`
`nms-hybrid.dpm.image.repository`	Repository name and path for the `dpm` image.	`dpm`
`nms-hybrid.dpm.image.tag`	Tag used for pulling images from the registry.	`latest`
`nms-hybrid.dpm.image.pullPolicy`	Image pull policy.	`IfNotPresent`
`nms-hybrid.dpm.container.port.http`	Container HTTP port.	`8034`
`nms-hybrid.dpm.container.port.nats`	Container NATS port.	`9100`
`nms-hybrid.dpm.container.port.db`	Container database port.	`7890`
`nms-hybrid.dpm.container.port.grpc`	Container gRPC port.	`8036`

NGINX Instance Manager dqlite storage configuration

  - name: dqlite
    existingClaim:
    size: 500Mi
    accessMode: ReadWriteOnce

NGINX Instance Manager secrets storage configuration

  - name: secrets
    existingClaim:
    size: 128Mi
    accessMode: ReadWriteOnce

NGINX Instance Manager NATS storage configuration

  - name: nats-streaming
    existingClaim:
    size: 1Gi
    accessMode: ReadWriteOnce

Kubernetes taints and tolerations

The following example snippet shows a toleration for an NGINX Instance Manager API Gateway deployment. In this example, Kubernetes will tolerate the “NoExecute” effect for 60 seconds before evicting the pod from the tainted node.

tolerations:
  - key: "node.kubernetes.io/unreachable"
    operator: "Exists"
    effect: "NoExecute"
    tolerationSeconds: 60
  - key: "node.kubernetes.io/network-unavailable"
    operator: "Exists"
    effect: "NoExecute"
    tolerationSeconds: 60

For more information, refer to the official Kubernetes Taints and Tolerations documentation.