Repository: nginx/kubernetes-ingress

Issue:
Expose a Secure Agent Secret
As a user of NIC,
I would like to have the data plane key for Agent v3 managed by a Kubernetes secret
So that, Dataplane keys are securely stored and managed
And so that, updates to the Dataplane key do not require re-deployment of NIC

Acceptance Criteria
- Allow dataplane key to be set by a secret
- Update documentation

Discussion:

Solution patch:
diff --git a/.github/data/matrix-smoke-oss.json b/.github/data/matrix-smoke-oss.json
index 6c402dc04..c1491e62f 100644
--- a/.github/data/matrix-smoke-oss.json
+++ b/.github/data/matrix-smoke-oss.json
@@ -76,6 +76,13 @@
       "type": "oss",
       "marker": "'ts or otel'",
       "platforms": "linux/arm64, linux/amd64"
+    },
+    {
+      "label": "agent 1/1",
+      "image": "debian",
+      "type": "oss",
+      "marker": "'agentv3'",
+      "platforms": "linux/arm64, linux/amd64"
     }
   ],
   "k8s": []
diff --git a/.github/data/matrix-smoke-plus.json b/.github/data/matrix-smoke-plus.json
index 1323ffdfe..19f7cc167 100644
--- a/.github/data/matrix-smoke-plus.json
+++ b/.github/data/matrix-smoke-plus.json
@@ -84,6 +84,13 @@
       "marker": "policies_rl",
       "platforms": "linux/arm64, linux/amd64"
     },
+    {
+      "label": "agent 1/1",
+      "image": "debian-plus",
+      "type": "plus",
+      "marker": "agentv3",
+      "platforms": "linux/arm64, linux/amd64"
+    },
     {
       "label": "OIDC-UI 1/1",
       "image": "debian-plus",
diff --git a/.github/workflows/build-base-images.yml b/.github/workflows/build-base-images.yml
index 6336f811a..17aedf611 100644
--- a/.github/workflows/build-base-images.yml
+++ b/.github/workflows/build-base-images.yml
@@ -213,8 +213,6 @@ jobs:
         run: |
           [[ "${{ matrix.nap_modules }}" == "waf,dos" ]] && modules="waf-dos" || modules="${{ matrix.nap_modules }}"
           echo "modules=${modules}" >> $GITHUB_OUTPUT
-          [[ "${{ matrix.nap_modules }}" =~ waf ]] && agent="true" || agent="false"
-          echo "agent=${agent}" >> $GITHUB_OUTPUT
         if: ${{ matrix.nap_modules != '' }}
 
       - name: Docker meta
@@ -244,7 +242,6 @@ jobs:
             BUILD_OS=${{ matrix.image }}
             IC_VERSION=${{ needs.checks.outputs.ic_version }}
             NAP_MODULES=${{ matrix.nap_modules }}
-            ${{ contains(matrix.nap_modules,'waf') && format('NGINX_AGENT={0}', steps.nap_modules.outputs.agent) || '' }}
           secrets: |
             "nginx-repo.crt=${{ secrets.NGINX_AP_CRT }}"
             "nginx-repo.key=${{ secrets.NGINX_AP_KEY }}"
diff --git a/.github/workflows/build-plus.yml b/.github/workflows/build-plus.yml
index 07f70dd41..860da9521 100644
--- a/.github/workflows/build-plus.yml
+++ b/.github/workflows/build-plus.yml
@@ -83,8 +83,6 @@ jobs:
           echo "name=${name}" >> $GITHUB_OUTPUT
           [[ "${{ inputs.nap-modules }}" == "waf,dos" ]] && modules="both" || modules="${{ inputs.nap-modules }}"
           echo "modules=${modules}" >> $GITHUB_OUTPUT
-          [[ "${{ inputs.nap-modules }}" =~ waf ]] && agent="true" || agent="false"
-          echo "agent=${agent}" >> $GITHUB_OUTPUT
         if: ${{ inputs.nap-modules != '' }}
 
       - name: Docker meta
@@ -145,7 +143,6 @@ jobs:
             BUILD_OS=${{ inputs.image }}
             IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
             ${{ inputs.nap-modules != '' && format('NAP_MODULES={0}', steps.nap_modules.outputs.name) || '' }}
-            ${{ contains(inputs.nap-modules,'waf') && format('NGINX_AGENT={0}', steps.nap_modules.outputs.agent) || '' }}
           secrets: |
             "nginx-repo.crt=${{ inputs.nap-modules != '' && secrets.NGINX_AP_CRT || secrets.NGINX_CRT }}"
             "nginx-repo.key=${{ inputs.nap-modules != '' && secrets.NGINX_AP_KEY || secrets.NGINX_KEY }}"
@@ -190,9 +187,7 @@ jobs:
             ${{ inputs.authenticated && format('PREBUILT_BASE_IMG={0}', steps.base_name.outputs.image ) }}
             IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
             ${{ inputs.nap-modules != '' && format('NAP_MODULES={0}', steps.nap_modules.outputs.name) || '' }}
-            ${{ contains(inputs.nap-modules,'waf') && format('NGINX_AGENT={0}', steps.nap_modules.outputs.agent) || '' }}
             ${{ (contains(inputs.target, 'aws') && inputs.nap-modules != '') && format('NAP_MODULES_AWS={0}', steps.nap_modules.outputs.modules) || '' }}
-            ${{ contains(inputs.image, 'v5') && 'WAF_VERSION=v5' || '' }}
           secrets: |
             "nginx-repo.crt=${{ inputs.nap-modules != '' && secrets.NGINX_AP_CRT || secrets.NGINX_CRT }}"
             "nginx-repo.key=${{ inputs.nap-modules != '' && secrets.NGINX_AP_KEY || secrets.NGINX_KEY }}"
diff --git a/.github/workflows/setup-smoke.yml b/.github/workflows/setup-smoke.yml
index abbdef99e..416c4cdd5 100644
--- a/.github/workflows/setup-smoke.yml
+++ b/.github/workflows/setup-smoke.yml
@@ -88,8 +88,6 @@ jobs:
         run: |
           [[ "${{ inputs.nap-modules }}" == "waf,dos" ]] && modules="waf-dos" || modules="${{ inputs.nap-modules }}"
           echo "modules=${modules}" >> $GITHUB_OUTPUT
-          [[ "${{ inputs.nap-modules }}" =~ waf ]] && agent="true" || agent="false"
-          echo "agent=${agent}" >> $GITHUB_OUTPUT
         if: ${{ inputs.nap-modules }}
 
       - name: Pull build image
@@ -139,7 +137,6 @@ jobs:
             BUILD_OS=${{ inputs.image }}
             IC_VERSION=CI
             ${{ contains(inputs.image, 'nap') && format('NAP_MODULES={0}', steps.nap_modules.outputs.modules) || '' }}
-            ${{ contains(inputs.nap-modules,'waf') && format('NGINX_AGENT={0}', steps.nap_modules.outputs.agent) || '' }}
             ${{ contains(inputs.marker, 'appprotect') && 'DEBIAN_VERSION=buster-slim' || '' }}
           secrets: |
             ${{ contains(inputs.image, 'nap') && format('"nginx-repo.crt={0}"', secrets.NGINX_AP_CRT) || format('"nginx-repo.crt={0}"', secrets.NGINX_CRT) }}
diff --git a/Makefile b/Makefile
index 72680a4ec..9d19a4f4d 100644
--- a/Makefile
+++ b/Makefile
@@ -14,7 +14,6 @@ PLUS_REPO                     ?= "pkgs.nginx.com" ## The package repo to install
 override DOCKER_BUILD_OPTIONS += --build-arg IC_VERSION=$(VERSION) --build-arg PACKAGE_REPO=$(PLUS_REPO) ## The options for the docker build command. For example, --pull
 ARCH                          ?= amd64 ## The architecture of the image or binary. For example: amd64, arm64, ppc64le, s390x. Not all architectures are supported for all targets
 GOOS                          ?= linux ## The OS of the binary. For example linux, darwin
-NGINX_AGENT                   ?= true
 TELEMETRY_ENDPOINT            ?= oss.edge.df.f5.com:443
 
 # Additional flags added here can be accessed in main.go.
@@ -151,14 +150,12 @@ alpine-image-plus-fips: build ## Create Docker image for Ingress Controller (Alp
 
 .PHONY: alpine-image-nap-plus-fips
 alpine-image-nap-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAF and FIPS)
-	$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips --build-arg NGINX_AGENT=$(NGINX_AGENT)
+	$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips
 
 .PHONY: alpine-image-nap-v5-plus-fips
 alpine-image-nap-v5-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAFv5 and FIPS)
 	$(DOCKER_CMD) $(PLUS_ARGS) \
-	--build-arg BUILD_OS=alpine-plus-nap-v5-fips \
-	--build-arg NGINX_AGENT=$(NGINX_AGENT) \
-	--build-arg WAF_VERSION=v5
+	--build-arg BUILD_OS=alpine-plus-nap-v5-fips
 
 .PHONY: debian-image-plus
 debian-image-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus)
@@ -166,15 +163,11 @@ debian-image-plus: build ## Create Docker image for Ingress Controller (Debian w
 
 .PHONY: debian-image-nap-plus
 debian-image-nap-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAF)
-	$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf --build-arg NGINX_AGENT=$(NGINX_AGENT)
+	$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf
 
 .PHONY: debian-image-nap-v5-plus
 debian-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAFv5)
-	$(DOCKER_CMD) $(PLUS_ARGS) \
-	--build-arg BUILD_OS=debian-plus-nap-v5 \
-	--build-arg NAP_MODULES=waf \
-	--build-arg NGINX_AGENT=$(NGINX_AGENT) \
-	--build-arg WAF_VERSION=v5
+	$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap-v5
 
 .PHONY: debian-image-dos-plus
 debian-image-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect DoS)
@@ -182,7 +175,7 @@ debian-image-dos-plus: build ## Create Docker image for Ingress Controller (Debi
 
 .PHONY: debian-image-nap-dos-plus
 debian-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus, NGINX App Protect WAF and DoS)
-	$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos  --build-arg NGINX_AGENT=$(NGINX_AGENT)
+	$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos
 
 .PHONY: ubi-image
 ubi-image: build ## Create Docker image for Ingress Controller (UBI)
@@ -194,15 +187,21 @@ ubi-image-plus: build ## Create Docker image for Ingress Controller (UBI with NG
 
 .PHONY: ubi-image-nap-plus
 ubi-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
-	$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=waf --build-arg NGINX_AGENT=$(NGINX_AGENT)
+	$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=waf
+
+.PHONY: ubi8-image-nap-plus
+ubi8-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
+	$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-8-plus-nap --build-arg NAP_MODULES=waf
 
 .PHONY: ubi-image-nap-v5-plus
 ubi-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
 	$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
-	--build-arg BUILD_OS=ubi-9-plus-nap-v5 \
-	--build-arg NAP_MODULES=waf \
-	--build-arg NGINX_AGENT=$(NGINX_AGENT) \
-	--build-arg WAF_VERSION=v5
+	--build-arg BUILD_OS=ubi-9-plus-nap-v5
+
+.PHONY: ubi8-image-nap-v5-plus
+ubi8-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
+	$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
+	--build-arg BUILD_OS=ubi-8-plus-nap-v5
 
 .PHONY: ubi-image-dos-plus
 ubi-image-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect DoS)
@@ -210,7 +209,7 @@ ubi-image-dos-plus: build ## Create Docker image for Ingress Controller (UBI wit
 
 .PHONY: ubi-image-nap-dos-plus
 ubi-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus, NGINX App Protect WAF and DoS)
-	$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=waf,dos  --build-arg NGINX_AGENT=$(NGINX_AGENT)
+	$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=waf,dos
 
 .PHONY: all-images ## Create all the Docker images for Ingress Controller
 all-images: alpine-image alpine-image-plus alpine-image-plus-fips alpine-image-nap-plus-fips debian-image debian-image-plus debian-image-nap-plus debian-image-dos-plus debian-image-nap-dos-plus ubi-image ubi-image-plus ubi-image-nap-plus ubi-image-dos-plus ubi-image-nap-dos-plus
diff --git a/build/Dockerfile b/build/Dockerfile
index 29000865a..de1d8c849 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -4,9 +4,7 @@ ARG NGINX_PLUS_VERSION=R34
 ARG DOWNLOAD_TAG=edge
 ARG DEBIAN_FRONTEND=noninteractive
 ARG PREBUILT_BASE_IMG=nginx/nginx-ingress:${DOWNLOAD_TAG}
-ARG NGINX_AGENT=false
 ARG IMAGE_NAME=nginx/nginx-ingress
-ARG WAF_VERSION=v4
 ARG PACKAGE_REPO=pkgs.nginx.com
 
 
@@ -16,31 +14,7 @@ FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:f2ff7ecf287b6f86de03fdebd3
 FROM ghcr.io/nginx/alpine-fips:0.2.4-alpine3.19@sha256:2a7f8451110b588b733e4cb8727a48153057b1debac5c78ef8a539ff63712fa1 AS alpine-fips-3.19
 FROM ghcr.io/nginx/alpine-fips:0.2.4-alpine3.21@sha256:5221dec2e33436f2586c743c7aa3ef4626c0ec54184dc3364d101036d4f4a060 AS alpine-fips-3.21
 FROM redhat/ubi9-minimal:9.6@sha256:f172b3082a3d1bbe789a1057f03883c1113243564f01cd3020e27548b911d3f8 AS ubi-minimal
-FROM golang:1.24-alpine@sha256:ef18ee7117463ac1055f5a370ed18b8750f01589f13ea0b48642f5792b234044 AS golang-builder
-
-
-############################################# Base image for Alpine #############################################
-FROM nginx:1.27.5-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10 AS alpine
-
-RUN printf "%s%s%s\n" "http://nginx.org/packages/mainline/alpine/v" `egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release` "/main" >> /etc/apk/repositories \
-	&& apk add --no-cache libcap libstdc++ nginx-module-otel \
-	&& sed -i -e '/nginx.org/d' /etc/apk/repositories
-
-
-############################################# Base image for Debian #############################################
-FROM nginx:1.27.5@sha256:6784fb0834aa7dbbe12e3d7471e69c290df3e6ba810dc38b34ae33d3c1c05f7d AS debian
-
-RUN apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y \
-	libcap2-bin curl gnupg2 ca-certificates lsb-release debian-archive-keyring \
-	&& curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor > /usr/share/keyrings/nginx-archive-keyring.gpg \
-	&& echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
-	http://nginx.org/packages/mainline/debian `lsb_release -cs` nginx" > /etc/apt/sources.list.d/nginx.list \
-	&& printf "%s" "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" > /etc/apt/preferences.d/99nginx \
-	&& apt-get update \
-	&& apt-get install --no-install-recommends --no-install-suggests -y nginx-module-otel \
-	&& apt-get purge --auto-remove -y gnupg2 lsb-release curl \
-	&& rm -rf /var/lib/apt/lists/* /etc/apt/preferences.d/99nginx /etc/apt/sources.list.d/nginx.list
+FROM golang:1.24-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a AS golang-builder
 
 ############################################# NGINX files #############################################
 FROM scratch AS nginx-files
@@ -106,6 +80,86 @@ RUN --mount=type=bind,from=nginx-files,src=patch-os.sh,target=/usr/local/bin/pat
 USER 101
 
 
+############################################# Base image for Alpine #############################################
+FROM nginx:1.27.5-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10 AS alpine
+ARG PACKAGE_REPO
+
+RUN --mount=type=bind,from=nginx-files,src=nginx_signing.rsa.pub,target=/etc/apk/keys/nginx_signing.rsa.pub \
+	--mount=type=bind,from=nginx-files,src=user_agent,target=/tmp/user_agent \
+	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
+	apk add --no-cache libcap libstdc++ \
+	&& export $(cat /tmp/user_agent) \
+	&& printf "%s%s%s\n" "http://packages.nginx.org/nginx/mainline/alpine/v" `egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release` "/main" >> /etc/apk/repositories \
+	&& printf "%s%s%s\n" "http://packages.nginx.org/nginx-agent/alpine/v" `egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release` "/main" >> /etc/apk/repositories \
+	&& apk add --no-cache nginx-module-otel "nginx-agent<3.1" \
+	&& ldconfig /usr/local/lib/ \
+	&& agent.sh \
+	&& sed -i -e '/nginx.org/d' /etc/apk/repositories
+
+
+############################################# Base image for Debian #############################################
+FROM nginx:1.27.5@sha256:6784fb0834aa7dbbe12e3d7471e69c290df3e6ba810dc38b34ae33d3c1c05f7d AS debian
+
+RUN --mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \
+	--mount=type=bind,from=nginx-files,src=90pkgs-nginx,target=/etc/apt/apt.conf.d/90pkgs-nginx \
+	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
+	apt-get update \
+	&& apt-get install --no-install-recommends --no-install-suggests -y \
+	gpg libcap2-bin ca-certificates lsb-release debian-archive-keyring \
+	&& gpg --dearmor -o /usr/share/keyrings/nginx-archive-keyring.gpg /tmp/nginx_signing.key \
+	&& echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
+	http://packages.nginx.org/nginx/mainline/debian `lsb_release -cs` nginx" > /etc/apt/sources.list.d/nginx.list \
+    && echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
+    http://packages.nginx.org/nginx-agent/debian `lsb_release -cs` agent" >> /etc/apt/sources.list.d/nginx.list \
+	&& printf "%s" "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" > /etc/apt/preferences.d/99nginx \
+	&& apt-get update \
+	&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=3.0.* nginx-module-otel \
+	&& apt-get purge --auto-remove -y gpg \
+	&& rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-agent.sources /etc/apt/preferences.d/99nginx /etc/apt/sources.list.d/nginx.list \
+	&& agent.sh \
+	&& ldconfig
+
+
+############################################# Base image for UBI #############################################
+FROM ubi-minimal AS ubi
+ARG IC_VERSION
+
+LABEL name="NGINX Ingress Controller" \
+	maintainer="kubernetes@nginx.com" \
+	vendor="NGINX Inc" \
+	version="${IC_VERSION}" \
+	release="1" \
+	summary="The Ingress Controller is an application that runs in a cluster and configures an HTTP load balancer according to Ingress resources." \
+	description="The Ingress Controller is an application that runs in a cluster and configures an HTTP load balancer according to Ingress resources." \
+	io.k8s.description="NGINX Ingress Controller is an application that runs in a cluster and configures an HTTP load balancer according to Ingress resources." \
+	io.openshift.tags="nginx,ingress-controller,ingress,controller,kubernetes,openshift"
+
+COPY --link --chown=101:0 LICENSE /licenses/
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN --mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \
+	--mount=type=bind,from=nginx-files,src=ubi-setup.sh,target=/usr/local/bin/ubi-setup.sh \
+	--mount=type=bind,from=nginx-files,src=ubi-clean.sh,target=/usr/local/bin/ubi-clean.sh \
+	--mount=type=bind,from=ubi9-packages,src=/,target=/ubi-bin/ \
+	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
+	ubi-setup.sh \
+	&& rpm -qa --queryformat "%{NAME}\n" | sort > pkgs-installed \
+	&& microdnf --nodocs --setopt=install_weak_deps=0 install -y diffutils dnf \
+	&& rpm -qa --queryformat "%{NAME}\n" | sort > pkgs-new \
+	&& dnf install -y /ubi-bin/*.rpm \
+	&& dnf -q repoquery --resolve --requires --recursive --whatrequires nginx --queryformat "%{NAME}" > pkgs-nginx \
+	&& dnf --setopt=protected_packages= remove -y $(comm -13 pkgs-installed pkgs-new | comm -13 pkgs-nginx -) \
+	&& rm pkgs-installed pkgs-new pkgs-nginx \
+	&& printf "%s\n" "[nginx]" "name=nginx repo" \
+	"baseurl=https://packages.nginx.org/nginx/mainline/centos/9/\$basearch/" \
+	"gpgcheck=1" "enabled=1" "module_hotfixes=true" > /etc/yum.repos.d/nginx.repo \
+    && printf "%s\n" "[agent]" "name=agent repo" \
+    "baseurl=https://packages.nginx.org/nginx-agent/centos/9/\$basearch/" \
+    "gpgcheck=1" "enabled=1" "module_hotfixes=true" >> /etc/yum.repos.d/nginx.repo \
+	&& microdnf --nodocs install -y nginx nginx-module-njs nginx-module-otel nginx-module-image-filter nginx-module-xslt nginx-agent-3.0.* \
+	&& rm /etc/yum.repos.d/nginx.repo \
+	&& ubi-clean.sh
+
 ############################################# Base image for Alpine with NGINX Plus ##############################################
 FROM alpine:3.21@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c AS alpine-plus
 ARG NGINX_PLUS_VERSION
@@ -117,12 +171,14 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/apk/cert.pem,mode=0644 \
 	--mount=type=secret,id=nginx-repo.key,dst=/etc/apk/cert.key,mode=0644 \
 	--mount=type=bind,from=nginx-files,src=nginx_signing.rsa.pub,target=/etc/apk/keys/nginx_signing.rsa.pub \
 	--mount=type=bind,from=nginx-files,src=user_agent,target=/tmp/user_agent \
+	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
 	--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
 	export $(cat /tmp/user_agent) \
 	&& printf "%s\n" "https://${PACKAGE_REPO}/plus/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
-	&& apk add --no-cache nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check libcap libcurl \
+	&& printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
+	&& apk add --no-cache nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check "nginx-agent<3.1" libcap libcurl \
 	&& mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
-	&& ldconfig /usr/local/lib/ \
+	&& agent.sh \
 	&& sed -i -e '/nginx.com/d' /etc/apk/repositories
 
 
@@ -144,8 +200,6 @@ RUN --mount=type=bind,from=alpine-fips-3.21,target=/tmp/fips/ \
 ############################################# Base image for Alpine with NGINX Plus, App Protect WAF and FIPS #############################################
 FROM alpine:3.19@sha256:e5d0aea7f7d2954678a9a6269ca2d06e06591881161961ea59e974dff3f12377 AS alpine-plus-nap-fips
 ARG NGINX_PLUS_VERSION
-ARG NGINX_AGENT
-ARG NGINX_PLUS_VERSION
 ARG PACKAGE_REPO
 
 ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -163,27 +217,22 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
 	&& printf "%s\n" "https://pkgs.nginx.com/app-protect-security-updates/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
 	&& printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
 	&& apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then apk add --no-cache "nginx-agent<3"; fi \
+	&& apk add --no-cache "nginx-agent<3" \
 	&& mkdir -p /usr/ssl \
 	&& cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \
 	&& cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \
 	&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
 	&& mkdir -p /etc/nginx/reporting/ \
 	&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
-	&& ldconfig /usr/local/lib/ \
 	&& apk add --no-cache app-protect app-protect-attack-signatures app-protect-threat-campaigns \
 	&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
 	&& nap-waf.sh \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then \
-	agent.sh \
-	; fi
+	agent.sh
 
 
 ############################################# Base image for Alpine with NGINX Plus, App Protect WAFv5 and FIPS #############################################
 FROM alpine:3.19@sha256:e5d0aea7f7d2954678a9a6269ca2d06e06591881161961ea59e974dff3f12377 AS alpine-plus-nap-v5-fips
 ARG NGINX_PLUS_VERSION
-ARG NGINX_AGENT
-ARG NGINX_PLUS_VERSION
 ARG PACKAGE_REPO
 
 ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -199,24 +248,21 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
 	&& printf "%s\n" "https://${PACKAGE_REPO}/app-protect-x-plus/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
 	&& printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
 	&& apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then apk add --no-cache "nginx-agent<3"; fi \
+    && apk add --no-cache "nginx-agent<3" \
 	&& mkdir -p /usr/ssl \
 	&& cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \
 	&& cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \
 	&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
 	&& mkdir -p /etc/nginx/reporting/ \
 	&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
-	&& ldconfig /usr/local/lib/ \
 	&& apk add --no-cache app-protect-module-plus~=34.5.342 \
 	&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
 	&& nap-waf.sh \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then \
-	agent.sh \
-	; fi
+	agent.sh
 
 
-############################################# Base image for Debian with NGINX Plus #############################################
-FROM debian:12-slim@sha256:e5865e6858dacc255bead044a7f2d0ad8c362433cfaa5acefb670c1edf54dfef AS debian-plus
+############################################# Base image for Debian with NGINX Plus only #############################################
+FROM debian:12-slim@sha256:e5865e6858dacc255bead044a7f2d0ad8c362433cfaa5acefb670c1edf54dfef AS debian-plus-only
 ARG NGINX_PLUS_VERSION
 
 ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -241,59 +287,64 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
 	&& apt-get purge --auto-remove -y gpg \
 	&& mkdir -p /etc/nginx/reporting/ \
 	&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
-	&& ldconfig \
 	&& rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.sources
 
 
+############################################# Base image for Debian with NGINX Plus #############################################
+FROM debian-plus-only AS debian-plus
+ARG NGINX_PLUS_VERSION
+
+ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
+	--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
+	--mount=type=bind,from=nginx-files,src=90pkgs-nginx,target=/etc/apt/apt.conf.d/90pkgs-nginx \
+	--mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/tmp/nginx-agent.sources \
+	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
+	apt-get update \
+	&& cp /tmp/nginx-agent.sources /etc/apt/sources.list.d/nginx-agent.sources \
+	&& apt-get update \
+	&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=3.0.* \
+	&& agent.sh \
+	&& rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-agent.sources
+
 ############################################# Base image for Debian with NGINX Plus and App Protect WAF/DoS #############################################
-FROM debian-plus AS debian-plus-nap
+FROM debian-plus-only AS debian-plus-nap
 ARG NAP_MODULES
-ARG NGINX_AGENT
 ARG NGINX_PLUS_VERSION
 
 ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
 
 RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
 	--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
-	--mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \
 	--mount=type=bind,from=nginx-files,src=90pkgs-nginx,target=/etc/apt/apt.conf.d/90pkgs-nginx \
 	--mount=type=bind,from=nginx-files,src=nap-waf-12.sources,target=/tmp/app-protect.sources \
 	--mount=type=bind,from=nginx-files,src=nap-dos-12.sources,target=/tmp/app-protect-dos.sources \
-	--mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/etc/apt/sources.list.d/nginx-agent.sources \
+	--mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/tmp/nginx-agent.sources \
 	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
 	--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
 	--mount=type=bind,from=nginx-files,src=nap-dos.sh,target=/usr/local/bin/nap-dos.sh \
-	--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
-	mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	cp /tmp/app-protect.sources /etc/apt/sources.list.d/app-protect.sources; \
-	fi \
-	&& if [ -z "${NAP_MODULES##*dos*}" ]; then \
-	cp /tmp/app-protect-dos.sources /etc/apt/sources.list.d/app-protect-dos.sources; \
-	fi \
+	if [ -z "${NAP_MODULES##*waf*}" ]; then \
+	cp /tmp/app-protect.sources /etc/apt/sources.list.d/app-protect.sources \
+	&& cp /tmp/nginx-agent.sources /etc/apt/sources.list.d/nginx-agent.sources \
 	&& apt-get update \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=2.*; fi \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	apt-get install --no-install-recommends --no-install-suggests -y app-protect app-protect-attack-signatures app-protect-threat-campaigns; \
-	fi \
-	&& if [ -z "${NAP_MODULES##*dos*}" ]; then \
-	apt-get install --no-install-recommends --no-install-suggests -y app-protect-dos; \
-	fi \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	rm -f /etc/apt/sources.list.d/app-protect.sources; \
+	&& apt-get install --no-install-recommends --no-install-suggests -y app-protect app-protect-attack-signatures app-protect-threat-campaigns nginx-agent=2.* \
+	&& rm -f /etc/apt/sources.list.d/app-protect.sources /etc/apt/sources.list.d/nginx-agent.sources \
+	&& nap-waf.sh \
+	&& agent.sh; \
 	fi \
 	&& if [ -z "${NAP_MODULES##*dos*}" ]; then \
-	rm -f /etc/apt/sources.list.d/app-protect-dos.sources; \
+	cp /tmp/app-protect-dos.sources /etc/apt/sources.list.d/app-protect-dos.sources \
+	&& apt-get update \
+	&& apt-get install --no-install-recommends --no-install-suggests -y app-protect-dos \
+	&& rm -f /etc/apt/sources.list.d/app-protect-dos.sources \
+	&& nap-dos.sh; \
 	fi \
-	&& rm -rf /var/lib/apt/lists/* \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then nap-waf.sh; fi \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then agent.sh; fi \
-	&& if [ -z "${NAP_MODULES##*dos*}" ]; then nap-dos.sh; fi
+	&& rm -rf /var/lib/apt/lists/*
 
 ############################################# Base image for Debian with NGINX Plus and App Protect WAFv5 #############################################
-FROM debian-plus AS debian-plus-nap-v5
-ARG NAP_MODULES
-ARG NGINX_AGENT
+FROM debian-plus-only AS debian-plus-nap-v5
 ARG NGINX_PLUS_VERSION
 
 ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -301,57 +352,14 @@ ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
 RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
 	--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
 	--mount=type=bind,from=nginx-files,src=90pkgs-nginx,target=/etc/apt/apt.conf.d/90pkgs-nginx \
-	--mount=type=bind,from=nginx-files,src=nap-waf-v5-12.sources,target=/tmp/app-protect.sources \
+	--mount=type=bind,from=nginx-files,src=nap-waf-v5-12.sources,target=/etc/apt/sources.list.d/app-protect.sources \
 	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
 	--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
 	--mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/etc/apt/sources.list.d/nginx-agent.sources \
-	--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
-	mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	cp /tmp/app-protect.sources /etc/apt/sources.list.d/app-protect.sources; \
-	fi \
-	&& apt-get update \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=2.*; fi \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	apt-get install --no-install-recommends --no-install-suggests -y app-protect-module-plus=34+5.342* nginx-plus-module-appprotect=34+5.342* app-protect-plugin=6.12.0*; \
-	rm -f /etc/apt/sources.list.d/app-protect.sources; \
-	nap-waf.sh; \
-	fi \
-	&& apt-get purge --auto-remove -y gpg \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then \
-	agent.sh; \
-	fi
-
-
-############################################# Base image for UBI #############################################
-FROM ubi-minimal AS ubi
-ARG IC_VERSION
-
-LABEL name="NGINX Ingress Controller" \
-	maintainer="kubernetes@nginx.com" \
-	vendor="NGINX Inc" \
-	version="${IC_VERSION}" \
-	release="1" \
-	summary="The Ingress Controller is an application that runs in a cluster and configures an HTTP load balancer according to Ingress resources." \
-	description="The Ingress Controller is an application that runs in a cluster and configures an HTTP load balancer according to Ingress resources." \
-	io.k8s.description="NGINX Ingress Controller is an application that runs in a cluster and configures an HTTP load balancer according to Ingress resources." \
-	io.openshift.tags="nginx,ingress-controller,ingress,controller,kubernetes,openshift"
-
-COPY --link --chown=101:0 LICENSE /licenses/
-
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-RUN --mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \
-	--mount=type=bind,from=nginx-files,src=ubi-setup.sh,target=/usr/local/bin/ubi-setup.sh \
-	--mount=type=bind,from=nginx-files,src=ubi-clean.sh,target=/usr/local/bin/ubi-clean.sh \
-	--mount=type=bind,from=ubi9-packages,src=/,target=/ubi-bin/ \
-	ubi-setup.sh \
-	&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
-	&& printf "%s\n" "[nginx]" "name=nginx repo" \
-	"baseurl=https://nginx.org/packages/mainline/centos/9/\$basearch/" \
-	"gpgcheck=1" "enabled=1" "module_hotfixes=true" > /etc/yum.repos.d/nginx.repo \
-	&& microdnf --nodocs install -y nginx nginx-module-njs nginx-module-otel nginx-module-image-filter nginx-module-xslt \
-	&& rm /etc/yum.repos.d/nginx.repo \
-	&& ubi-clean.sh
+	apt-get update \
+	&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=2.* app-protect-module-plus=34+5.342* nginx-plus-module-appprotect=34+5.342* app-protect-plugin=6.12.0* \
+	&& nap-waf.sh \
+	&& agent.sh
 
 
 ############################################# Base image for UBI with NGINX Plus #############################################
@@ -367,48 +375,56 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
 	--mount=type=bind,from=nginx-files,src=nginx-plus-9.repo,target=/etc/yum.repos.d/nginx-plus.repo \
 	--mount=type=bind,from=nginx-files,src=ubi-setup.sh,target=/usr/local/bin/ubi-setup.sh \
 	--mount=type=bind,from=nginx-files,src=ubi-clean.sh,target=/usr/local/bin/ubi-clean.sh \
+	--mount=type=bind,from=nginx-files,src=nginx-agent.repo,target=/etc/yum.repos.d/nginx-agent.repo,rw \
+	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
 	--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
 	--mount=type=bind,from=ubi9-packages,src=/,target=/ubi-bin/ \
 	mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
 	&& ubi-setup.sh \
 	&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
-	&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
+	&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-3.0.* \
+	&& agent.sh	\
 	&& ubi-clean.sh
 
 
 ############################################# Base image for UBI with NGINX Plus and App Protect WAF & DoS #############################################
-FROM ubi-9-plus AS ubi-9-plus-nap
+FROM ubi-minimal AS ubi-9-plus-nap
 ARG NAP_MODULES
-ARG NGINX_AGENT
 ARG BUILD_OS
 
 RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
 	--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
 	--mount=type=secret,id=rhel_license,dst=/tmp/rhel_license,mode=0644 \
 	--mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \
+	--mount=type=bind,from=nginx-files,src=nginx-plus-9.repo,target=/etc/yum.repos.d/nginx-plus.repo \
 	--mount=type=bind,from=nginx-files,src=nginx-agent.repo,target=/etc/yum.repos.d/nginx-agent.repo,rw \
 	--mount=type=bind,from=nginx-files,src=app-protect-security-updates.key,target=/tmp/app-protect-security-updates.key \
 	--mount=type=bind,from=nginx-files,src=app-protect-9.repo,target=/tmp/app-protect-9.repo \
 	--mount=type=bind,from=nginx-files,src=app-protect-dos-9.repo,target=/tmp/app-protect-dos-9.repo \
+	--mount=type=bind,from=nginx-files,src=ubi-setup.sh,target=/usr/local/bin/ubi-setup.sh \
 	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
 	--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
 	--mount=type=bind,from=nginx-files,src=nap-dos.sh,target=/usr/local/bin/nap-dos.sh \
 	--mount=type=bind,from=nginx-files,src=ubi-clean.sh,target=/usr/local/bin/ubi-clean.sh \
+    --mount=type=bind,from=ubi9-packages,src=/,target=/ubi-bin/ \
 	--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
 	mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
+	&& ubi-setup.sh \
+    && rpm -Uvh /ubi-bin/c-ares-*.rpm \
+	&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check nginx-plus-module-otel nginx-agent-2.* \
 	&& source /tmp/rhel_license \
-	&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
 	&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then microdnf --nodocs install -y nginx-agent-2.*; fi \
-	&& subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} --name ${BUILD_OS}-${NAP_MODULES}-$(uname -m)  || true \
+	&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
+	&& subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} --name ${BUILD_OS}-$(uname -m) || true \
 	&& subscription-manager attach \
-	&& rpm --import /tmp/app-protect-security-updates.key \
 	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	cp /tmp/app-protect-9.repo /etc/yum.repos.d/app-protect-9.repo \
+	rpm --import /tmp/app-protect-security-updates.key \
+	&& cp /tmp/app-protect-9.repo /etc/yum.repos.d/app-protect-9.repo \
 	&& microdnf --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms --nodocs install -y \
 	app-protect app-protect-attack-signatures app-protect-threat-campaigns \
 	&& rm -f /etc/yum.repos.d/app-protect-9.repo \
-	&& nap-waf.sh; \
+	&& nap-waf.sh \
+	&& agent.sh; \
 	fi \
 	&& if [ -z "${NAP_MODULES##*dos*}" ]; then \
 	cp /tmp/app-protect-dos-9.repo /etc/yum.repos.d/app-protect-dos-9.repo \
@@ -417,44 +433,40 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
 	&& nap-dos.sh; \
 	fi \
 	&& subscription-manager unregister \
-	&& ubi-clean.sh \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then agent.sh; fi
+	&& ubi-clean.sh
 
 
 ############################################# Base image for UBI with NGINX Plus and App Protect WAFv5 #############################################
-FROM ubi-9-plus AS ubi-9-plus-nap-v5
-ARG NAP_MODULES
-ARG NGINX_AGENT
+FROM ubi-minimal AS ubi-9-plus-nap-v5
 
 RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
 	--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
 	--mount=type=secret,id=rhel_license,dst=/tmp/rhel_license,mode=0644 \
 	--mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \
+	--mount=type=bind,from=nginx-files,src=nginx-plus-9.repo,target=/etc/yum.repos.d/nginx-plus.repo \
 	--mount=type=bind,from=nginx-files,src=nginx-agent.repo,target=/etc/yum.repos.d/nginx-agent.repo,rw \
-	--mount=type=bind,from=nginx-files,src=app-protect-v5-9.repo,target=/tmp/app-protect-9.repo \
+	--mount=type=bind,from=nginx-files,src=app-protect-v5-9.repo,target=/etc/yum.repos.d/app-protect-9.repo \
+	--mount=type=bind,from=nginx-files,src=ubi-setup.sh,target=/usr/local/bin/ubi-setup.sh \
 	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
 	--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
 	--mount=type=bind,from=nginx-files,src=ubi-clean.sh,target=/usr/local/bin/ubi-clean.sh \
+	--mount=type=bind,from=ubi9-packages,src=/,target=/ubi-bin/ \
 	--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
 	mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
+	&& ubi-setup.sh \
+	&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check \
 	&& source /tmp/rhel_license \
 	&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
+	&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
 	&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then microdnf --nodocs install -y nginx-agent-2.*; fi \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	cp /tmp/app-protect-9.repo /etc/yum.repos.d/app-protect-9.repo \
-	&& microdnf --nodocs install -y app-protect-module-plus-34+5.342* \
+	&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-2.* app-protect-module-plus-34+5.342* \
 	&& nap-waf.sh \
-	&& rm -f /etc/yum.repos.d/app-protect-9.repo; \
-	fi \
 	&& ubi-clean.sh \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then agent.sh; fi
+	&& agent.sh
 
 
 ############################################# Base image for UBI8 with NGINX Plus and App Protect WAF #############################################
 FROM redhat/ubi8@sha256:0c1757c4526cfd7fdfedc54fadf4940e7f453201de65c0fefd454f3dde117273 AS ubi-8-plus-nap
-ARG NAP_MODULES
-ARG NGINX_AGENT
 ARG NGINX_PLUS_VERSION
 ARG BUILD_OS
 
@@ -467,46 +479,34 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
 	--mount=type=bind,from=nginx-files,src=nginx-plus-8.repo,target=/etc/yum.repos.d/nginx-plus.repo,rw \
 	--mount=type=bind,from=nginx-files,src=nginx-agent.repo,target=/etc/yum.repos.d/nginx-agent.repo,rw \
 	--mount=type=bind,from=nginx-files,src=app-protect-security-updates.key,target=/tmp/app-protect-security-updates.key \
-	--mount=type=bind,from=nginx-files,src=app-protect-8.repo,target=/tmp/app-protect-8.repo \
+	--mount=type=bind,from=nginx-files,src=app-protect-8.repo,target=/etc/yum.repos.d/app-protect-8.repo \
 	--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
 	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
 	--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
 	--mount=type=bind,from=ubi8-packages,src=/,target=/ubi-bin/ \
 	mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
 	&& source /tmp/rhel_license \
-	&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	cp /tmp/app-protect-8.repo /etc/yum.repos.d/app-protect-8.repo; \
-	fi \
 	&& groupadd --system --gid 101 nginx \
 	&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
 	&& rpm --import /tmp/nginx_signing.key \
-	&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then dnf --nodocs install -y nginx-agent-2.*; fi \
+	&& rpm --import /tmp/app-protect-security-updates.key \
+	&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
+	&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-2.* \
 	&& sed -i 's/\(def in_container():\)/\1\n    return False/g' /usr/lib64/python*/*-packages/rhsm/config.py \
 	&& subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} --name ${BUILD_OS}-$(uname -m) || true \
 	&& subscription-manager attach \
 	&& dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \
 	&& dnf --nodocs install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
-	&& rpm --import /tmp/app-protect-security-updates.key \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	dnf --nodocs install -y app-protect app-protect-attack-signatures app-protect-threat-campaigns; \
-	fi \
+	&& dnf --nodocs install -y app-protect app-protect-attack-signatures app-protect-threat-campaigns \
 	&& subscription-manager unregister \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	rm -f /etc/yum.repos.d/app-protect-8.repo \
-	&& nap-waf.sh; \
-	fi \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then agent.sh; fi \
+	&& nap-waf.sh \
+	&& agent.sh \
 	&& dnf clean all
 
 
 ############################################# Base image for UBI8 with NGINX Plus and App Protect WAFv5  #############################################
 FROM redhat/ubi8@sha256:0c1757c4526cfd7fdfedc54fadf4940e7f453201de65c0fefd454f3dde117273 AS ubi-8-plus-nap-v5
-ARG NAP_MODULES
-ARG NGINX_AGENT
 ARG NGINX_PLUS_VERSION
-ARG BUILD_OS
 
 ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
 
@@ -516,38 +516,22 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
 	--mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \
 	--mount=type=bind,from=nginx-files,src=nginx-plus-8.repo,target=/etc/yum.repos.d/nginx-plus.repo,rw \
 	--mount=type=bind,from=nginx-files,src=nginx-agent.repo,target=/etc/yum.repos.d/nginx-agent.repo,rw \
-	--mount=type=bind,from=nginx-files,src=app-protect-v5-8.repo,target=/tmp/app-protect-8.repo \
+	--mount=type=bind,from=nginx-files,src=app-protect-v5-8.repo,target=/etc/yum.repos.d/app-protect-8.repo \
 	--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
 	--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
 	--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
 	--mount=type=bind,from=ubi8-packages,src=/,target=/ubi-bin/ \
-	mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
-	&& source /tmp/rhel_license \
-	&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	cp /tmp/app-protect-8.repo /etc/yum.repos.d/app-protect-8.repo; \
-	fi \
-	## the code below is duplicated from the ubi-plus image because NAP DOS doesn't support UBI 9 and minimal versions
+	source /tmp/rhel_license \
+	&& mkdir -p /etc/nginx/reporting/ \
+	&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
 	&& groupadd --system --gid 101 nginx \
 	&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
 	&& rpm --import /tmp/nginx_signing.key \
-	&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then dnf --nodocs install -y nginx-agent-2.*; fi \
-	## end of duplicated code
-	&& sed -i 's/\(def in_container():\)/\1\n    return False/g' /usr/lib64/python*/*-packages/rhsm/config.py \
-	&& subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} --name ${BUILD_OS}-$(uname -m) || true \
-	&& subscription-manager attach \
-	&& dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \
-	&& dnf --nodocs install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	dnf --nodocs install -y app-protect-module-plus-34+5.342*; \
-	fi \
-	&& subscription-manager unregister \
-	&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
-	rm -f /etc/yum.repos.d/app-protect-8.repo \
-	&& nap-waf.sh; \
-	fi \
-	&& if [ "${NGINX_AGENT}" = "true" ]; then agent.sh; fi \
+	&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
+	&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-2.* \
+	&& dnf --nodocs install -y app-protect-module-plus-34+5.342* \
+	&& nap-waf.sh \
+	&& agent.sh \
 	&& dnf clean all
 
 
@@ -620,13 +604,19 @@ COPY --link --from=builder --chown=101:0 /nginx-ingress /
 
 ############################################# Create image with nginx-ingress built locally #############################################
 FROM common AS local
+ARG BUILD_OS
+ENV BUILD_OS=${BUILD_OS}
 
 LABEL org.nginx.kic.image.build.version="local"
 
 COPY --link --chown=101:0 nginx-ingress /
 # root is required for `setcap` invocation
 USER 0
-RUN setcap 'cap_net_bind_service=+ep' /nginx-ingress && setcap -v 'cap_net_bind_service=+ep' /nginx-ingress
+RUN --mount=type=bind,target=/tmp [ -z "${BUILD_OS##*plus*}" ] && PLUS=-plus; cp -a /tmp/internal/configs/version1/nginx$PLUS.ingress.tmpl /tmp/internal/configs/version1/nginx$PLUS.tmpl \
+	/tmp/internal/configs/version2/nginx$PLUS.virtualserver.tmpl /tmp/internal/configs/version2/nginx$PLUS.transportserver.tmpl / \
+	&& chown -R 101:0 /*.tmpl \
+	&& chmod -R g=u /*.tmpl \
+	&& setcap 'cap_net_bind_service=+ep' /nginx-ingress && setcap -v 'cap_net_bind_service=+ep' /nginx-ingress
 # 101 is nginx, defined above
 USER 101
 
diff --git a/build/scripts/agent.sh b/build/scripts/agent.sh
index 0cb6a07ff..7aa08d06e 100755
--- a/build/scripts/agent.sh
+++ b/build/scripts/agent.sh
@@ -2,13 +2,17 @@
 
 set -e
 
+chown -R 101:0 /etc/nginx-agent
+if [ -f "/opt/app_protect/RELEASE" ]; then
+    # shellcheck disable=SC2002
+    if cat "/opt/app_protect/RELEASE" | cut -d '.' -f 1 | grep -q 4; then
+        NAP_VERSION=$(cat /opt/app_protect/VERSION)
+        echo "Adding NAP $NAP_VERSION directories"
 
-if [ -z "${WAF_VERSION##*v4*}" ]; then
-    NAP_VERSION=$(cat /opt/app_protect/VERSION)
+        mkdir -p /etc/ssl/nms /opt/nms-nap-compiler
+        chown -R 101:0 /etc/ssl/nms /opt/nms-nap-compiler
+        chmod -R g=u /etc/ssl/nms /opt/nms-nap-compiler
 
-    mkdir -p /etc/ssl/nms /opt/nms-nap-compiler
-    chown -R 101:0 /etc/ssl/nms /opt/nms-nap-compiler
-    chmod -R g=u /etc/ssl/nms /opt/nms-nap-compiler
-
-	ln -s /opt/app_protect "/opt/nms-nap-compiler/app_protect-${NAP_VERSION}"
+        ln -s /opt/app_protect "/opt/nms-nap-compiler/app_protect-${NAP_VERSION}"
+    fi
 fi
diff --git a/charts/nginx-ingress/templates/_helpers.tpl b/charts/nginx-ingress/templates/_helpers.tpl
index d3dc46808..c1700c9fa 100644
--- a/charts/nginx-ingress/templates/_helpers.tpl
+++ b/charts/nginx-ingress/templates/_helpers.tpl
@@ -326,8 +326,10 @@ Build the args for the service binary.
 - -weight-changes-dynamic-reload={{ .Values.controller.enableWeightChangesDynamicReload}}
 {{- if .Values.nginxAgent.enable }}
 - -agent=true
+{{- if eq .Values.nginxAgent.dataplaneKeySecretName "" }}
 - -agent-instance-group={{ default (include "nginx-ingress.controller.fullname" .) .Values.nginxAgent.instanceGroup }}
 {{- end }}
+{{- end }}
 {{- end -}}
 
 {{/*
@@ -369,8 +371,14 @@ List of volumes for controller.
 - name: agent-conf
   configMap:
     name: {{ include "nginx-ingress.agentConfigName" . }}
+{{- if ne .Values.nginxAgent.dataplaneKeySecretName "" }}
+- name: dataplane-key
+  secret:
+    secretName: {{ .Values.nginxAgent.dataplaneKeySecretName }}
+{{- else }}
 - name: agent-dynamic
   emptyDir: {}
+{{- end }}
 {{- if and .Values.nginxAgent.instanceManager.tls (or (ne (.Values.nginxAgent.instanceManager.tls.secret | default "") "") (ne (.Values.nginxAgent.instanceManager.tls.caSecret | default "") "")) }}
 - name: nginx-agent-tls
   projected:
@@ -429,8 +437,13 @@ volumeMounts:
 - name: agent-conf
   mountPath: /etc/nginx-agent/nginx-agent.conf
   subPath: nginx-agent.conf
+{{- if ne .Values.nginxAgent.dataplaneKeySecretName "" }}
+- name: dataplane-key
+  mountPath: /etc/nginx-agent/secrets
+{{- else }}
 - name: agent-dynamic
   mountPath: /var/lib/nginx-agent
+{{- end }}
 {{- if and .Values.nginxAgent.instanceManager.tls (or (ne (.Values.nginxAgent.instanceManager.tls.secret | default "") "") (ne (.Values.nginxAgent.instanceManager.tls.caSecret | default "") "")) }}
 - name: nginx-agent-tls
   mountPath: /etc/ssl/nms
@@ -474,6 +487,34 @@ volumeMounts:
 {{- end -}}
 
 {{- define "nginx-ingress.agentConfiguration" -}}
+{{- if ne .Values.nginxAgent.dataplaneKeySecretName "" }}
+log:
+  # set log level (error, info, debug; default "info")
+  level: {{ .Values.nginxAgent.logLevel }}
+  # set log path. if empty, don't log to file.
+  path: ""
+
+allowed_directories:
+  - /etc/nginx
+  - /usr/lib/nginx/modules
+
+features:
+  - certificates
+  - connection
+  - metrics
+  - file-watcher
+
+## command server settings
+command:
+  server:
+    host: {{ .Values.nginxAgent.endpointHost }}
+    port: {{ .Values.nginxAgent.endpointPort }}
+  auth:
+    tokenpath: "/etc/nginx-agent/secrets/dataplane.key"
+  tls:
+    skip_verify: {{ .Values.nginxAgent.tlsSkipVerify | default false }}
+
+{{- else }}
 log:
   level: {{ .Values.nginxAgent.logLevel }}
   path: ""
@@ -513,4 +554,5 @@ nap_monitoring:
   syslog_ip: {{ .Values.nginxAgent.syslog.host }}
   syslog_port: {{ .Values.nginxAgent.syslog.port }}
 
-{{ end -}}
+{{- end }}
+{{ end }}
diff --git a/charts/nginx-ingress/values.schema.json b/charts/nginx-ingress/values.schema.json
index 27b6cc99b..bbb6658e0 100644
--- a/charts/nginx-ingress/values.schema.json
+++ b/charts/nginx-ingress/values.schema.json
@@ -2323,6 +2323,35 @@
             "error"
           ]
         },
+        "dataplaneKeySecretName": {
+          "type": "string",
+          "default": "",
+          "title": "The Dataplane key is required to authenticate NGINX Agent with NGINX One Console",
+          "examples": [
+            "dataplane-key"
+          ]
+        },
+        "endpointHost": {
+          "type": "string",
+          "default": "product.connect.nginx.com",
+          "title": "FQDN or IP for connecting to NGINX One SaaS Console",
+          "examples": [
+            "product.connect.nginx.com"
+          ]
+        },
+        "endpointPort": {
+          "type": "integer",
+          "title": "Port for connecting to NGINX One SaaS Console",
+          "default": 443,
+          "examples": [
+            443
+          ]
+        },
+        "tlsSkipVerify": {
+          "type": "boolean",
+          "default": "false",
+          "title": "skip certificate verification"
+        },
         "instanceManager": {
           "type": "object",
           "default": {},
diff --git a/charts/nginx-ingress/values.yaml b/charts/nginx-ingress/values.yaml
index 17a4903f0..5557e20b8 100644
--- a/charts/nginx-ingress/values.yaml
+++ b/charts/nginx-ingress/values.yaml
@@ -665,7 +665,14 @@ nginxServiceMesh:
 nginxAgent:
   ## Enables NGINX Agent.
   enable: false
-  logLevel: "error"
+  logLevel: "info"
+
+  # Agent V3 configuration
+  # Dataplane key is required to authenticate NGINX Agent with NGINX One Console
+  dataplaneKeySecretName: ""
+  endpointHost: "product.connect.nginx.com"
+  endpointPort: 443
+  tlsSkipVerify: false
 
   # Agent V2 configuration
   ## If nginxAgent.instanceGroup is not set the value of nginx-ingress.controller.fullname will be used
diff --git a/cmd/nginx-ingress/flags.go b/cmd/nginx-ingress/flags.go
index 3471c7b85..2cac9c724 100644
--- a/cmd/nginx-ingress/flags.go
+++ b/cmd/nginx-ingress/flags.go
@@ -427,10 +427,6 @@ func mustValidateFlags(ctx context.Context) {
 		nl.Fatal(l, "ingresslink and external-service cannot both be set")
 	}
 
-	if *agent && !*appProtect {
-		nl.Fatal(l, "NGINX Agent is used to enable the Security Monitoring dashboard and requires NGINX App Protect to be enabled")
-	}
-
 	if *nginxPlus && *mgmtConfigMap == "" {
 		nl.Fatal(l, "NGINX Plus requires a mgmt ConfigMap to be set")
 	}
diff --git a/internal/configs/version2/__snapshots__/templates_test.snap b/internal/configs/version2/__snapshots__/templates_test.snap
index df3f49401..b95a6e946 100644
--- a/internal/configs/version2/__snapshots__/templates_test.snap
+++ b/internal/configs/version2/__snapshots__/templates_test.snap
@@ -2483,437 +2483,6 @@ server {
 
 ---
 
-[TestExecuteVirtualServerTemplate_WithCustomOIDCRedirectLocation - 1]
-
-upstream test-upstream {
-    zone test-upstream 256k;
-    random;
-    server 10.0.0.20:8001 max_fails=4 fail_timeout=10s slow_start=10s max_conns=31;
-    keepalive 32;
-    queue 10 timeout=60s;
-    sticky cookie test expires=25s path=/tea;
-    ntlm;
-}
-
-upstream coffee-v1 {
-    zone coffee-v1 256k;
-    server 10.0.0.31:8001 max_fails=8 fail_timeout=15s max_conns=2;
-}
-
-upstream coffee-v2 {
-    zone coffee-v2 256k;
-    server 10.0.0.32:8001 max_fails=12 fail_timeout=20s max_conns=4;
-}
-
-split_clients $request_id $split_0 {
-    50% @loc0;
-    50% @loc1;
-}
-map $match_0_0 $match {
-    ~^1 @match_loc_0;
-    default @match_loc_default;
-}
-map $http_x_version $match_0_0 {
-    v2 1;
-    default 0;
-}
-# HTTP snippet
-limit_req_zone $url zone=pol_rl_test_test_test:10m rate=10r/s;
-
-server {
-    listen 80 proxy_protocol;
-    listen [::]:80 proxy_protocol;
-
-
-    server_name example.com;
-    status_zone example.com;
-    set $resource_type "virtualserver";
-    set $resource_name "";
-    set $resource_namespace "";
-    include oidc/oidc.conf;
-
-    set $oidc_pkce_enable 0;
-    set $oidc_client_auth_method "client_secret_post";
-    set $oidc_logout_redirect "https://example.com/logout";
-    set $oidc_hmac_key "";
-    set $zone_sync_leeway 0;
-
-    set $oidc_authz_endpoint "https://idp.example.com/auth";
-    set $oidc_authz_extra_args "";
-    set $oidc_token_endpoint "https://idp.example.com/token";
-    set $oidc_end_session_endpoint "https://idp.example.com/logout";
-    set $oidc_jwt_keyfile "https://idp.example.com/jwks";
-    set $oidc_scopes "openid+profile+email";
-    set $oidc_client "test-client";
-    set $oidc_client_secret "test-secret";
-    set $redir_location "/custom-location";
-    # Custom OIDC redirect location based on policy redirectURI
-    location = /custom-location {
-        status_zone "OIDC code exchange";
-        js_content oidc.codeExchange;
-        error_page 500 502 504 @oidc_error;
-    }
-    listen 443 ssl proxy_protocol;
-    listen [::]:443 ssl proxy_protocol;
-
-    http2 on;
-    ssl_certificate cafe-secret.pem;
-    ssl_certificate_key cafe-secret.pem;
-    ssl_client_certificate ingress-mtls-secret;
-    ssl_verify_client on;
-    ssl_verify_depth 2;
-    if ($scheme = 'http') {
-        return 301 https://$host$request_uri;
-    }
-
-    server_tokens "off";
-    set_real_ip_from 0.0.0.0/0;
-    real_ip_header X-Real-IP;
-    real_ip_recursive on;
-    allow 127.0.0.1;
-    deny all;
-    deny 127.0.0.1;
-    allow all;
-    limit_req_log_level error;
-    limit_req_status 503;
-    limit_req zone=pol_rl_test_test_test burst=5 delay=10;
-    auth_jwt "My Api";
-    auth_jwt_key_file jwk-secret;
-    app_protect_enable on;
-    app_protect_policy_file /etc/nginx/waf/nac-policies/default-dataguard-alarm;
-    app_protect_security_log_enable on;
-    app_protect_security_log /etc/nginx/waf/nac-logconfs/default-logconf;
-    
-    # server snippet
-    location /split {
-        rewrite ^ @split_0 last;
-    }
-    location /coffee {
-        rewrite ^ @match last;
-    }
-    location @hc-coffee {
-        
-        proxy_connect_timeout ;
-        proxy_read_timeout ;
-        proxy_send_timeout ;
-        proxy_pass http://coffee-v2;
-        health_check uri=/  port=50 interval=5s jitter=0s fails=1 passes=1 mandatory  persistent  keepalive_time=60s;
-
-   }
-    location @hc-tea {
-        
-        grpc_connect_timeout ;
-        grpc_read_timeout ;
-        grpc_send_timeout ;
-        grpc_pass grpc://tea-v3;
-        health_check port=50 interval=5s jitter=0s fails=1 passes=1 type=grpc grpc_status=12 grpc_service=tea-servicev2;
-
-   }
-    location @vs_cafe_cafe_vsr_tea_tea_tea__tea_error_page_0 {
-        
-        default_type "application/json";
-        
-        
-        # status code is ignored here, using 0
-        return 0 "Hello World";
-    }
-    
-    location @vs_cafe_cafe_vsr_tea_tea_tea__tea_error_page_1 {
-        
-        
-        add_header Set-Cookie "cookie1=test" always;
-        
-        add_header Set-Cookie "cookie2=test; Secure" always;
-        
-        # status code is ignored here, using 0
-        return 0 "Hello World";
-    }
-    
-
-    
-    location @return_0 {
-        default_type "text/html";
-        
-        # status code is ignored here, using 0
-        return 0 "Hello!";
-    }
-    
-
-    
-    location / {
-        set $service "";
-        status_zone "";
-        internal;
-        # location snippet
-        allow 127.0.0.1;
-        deny all;
-        deny 127.0.0.1;
-        allow all;
-        limit_req zone=loc_pol_rl_test_test_test;
-
-        
-        proxy_ssl_certificate egress-mtls-secret.pem;
-        proxy_ssl_certificate_key egress-mtls-secret.pem;
-            
-        proxy_ssl_trusted_certificate trusted-cert.pem;
-        proxy_ssl_verify on;
-        proxy_ssl_verify_depth 1;
-        proxy_ssl_protocols TLSv1.3;
-        proxy_ssl_ciphers DEFAULT;
-        proxy_ssl_session_reuse on;
-        proxy_ssl_server_name on;
-        proxy_ssl_name ;
-        set $default_connection_header close;
-        rewrite $request_uri $request_uri;
-        rewrite $request_uri $request_uri;
-        proxy_connect_timeout 30s;
-        proxy_read_timeout 31s;
-        proxy_send_timeout 32s;
-        client_max_body_size 1m;
-        proxy_max_temp_file_size 1024m;
-
-        proxy_buffering on;
-        proxy_buffers 8 4k;
-        proxy_buffer_size 4k;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $vs_connection_header;
-        proxy_pass_request_headers off;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Port $server_port;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_hide_header Header;
-        proxy_pass_header Host;
-        proxy_ignore_headers Cache;
-        add_header Header-Name "Header Value" always;
-        proxy_pass http://test-upstream$request_uri;
-        proxy_next_upstream error timeout;
-        proxy_next_upstream_timeout 5s;
-        proxy_next_upstream_tries 0;
-    }
-    location @loc0 {
-        set $service "";
-        status_zone "";
-
-        
-        error_page 400 500 =200 "@error_page_1";
-        error_page 500  "@error_page_2";
-        proxy_intercept_errors on;
-        set $default_connection_header close;
-        proxy_connect_timeout 30s;
-        proxy_read_timeout 31s;
-        proxy_send_timeout 32s;
-        client_max_body_size 1m;
-
-        proxy_buffering off;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $vs_connection_header;
-        proxy_pass_request_headers off;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Port $server_port;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://coffee-v1;
-        proxy_next_upstream error timeout;
-        proxy_next_upstream_timeout 5s;
-        proxy_next_upstream_tries 0;
-    }
-    location @loc1 {
-        set $service "";
-        status_zone "";
-
-        
-        set $default_connection_header close;
-        proxy_connect_timeout 30s;
-        proxy_read_timeout 31s;
-        proxy_send_timeout 32s;
-        client_max_body_size 1m;
-
-        proxy_buffering off;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $vs_connection_header;
-        proxy_pass_request_headers off;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Port $server_port;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://coffee-v2;
-        proxy_next_upstream error timeout;
-        proxy_next_upstream_timeout 5s;
-        proxy_next_upstream_tries 0;
-    }
-    location @loc2 {
-        set $service "";
-        status_zone "";
-
-        
-        error_page 400 = @grpc_internal;
-        error_page 401 = @grpc_unauthenticated;
-        error_page 403 = @grpc_permission_denied;
-        error_page 404 = @grpc_unimplemented;
-        error_page 429 = @grpc_unavailable;
-        error_page 502 = @grpc_unavailable;
-        error_page 503 = @grpc_unavailable;
-        error_page 504 = @grpc_unavailable;
-        error_page 405 = @grpc_internal;
-        error_page 408 = @grpc_deadline_exceeded;
-        error_page 413 = @grpc_resource_exhausted;
-        error_page 414 = @grpc_resource_exhausted;
-        error_page 415 = @grpc_internal;
-        error_page 426 = @grpc_internal;
-        error_page 495 = @grpc_unauthenticated;
-        error_page 496 = @grpc_unauthenticated;
-        error_page 497 = @grpc_internal;
-        error_page 500 = @grpc_internal;
-        error_page 501 = @grpc_internal;
-        set $default_connection_header close;
-        grpc_connect_timeout 30s;
-        grpc_read_timeout 31s;
-        grpc_send_timeout 32s;
-        client_max_body_size 1m;
-
-        proxy_buffering off;
-        grpc_set_header X-Real-IP $remote_addr;
-        grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        grpc_set_header X-Forwarded-Host $host;
-        grpc_set_header X-Forwarded-Port $server_port;
-        grpc_set_header X-Forwarded-Proto $scheme;
-        grpc_pass grpc://coffee-v3;
-        grpc_next_upstream ;
-        grpc_next_upstream_timeout ;
-        grpc_next_upstream_tries 0;
-    }
-    location @match_loc_0 {
-        set $service "";
-        status_zone "";
-
-        
-        set $default_connection_header close;
-        proxy_connect_timeout 30s;
-        proxy_read_timeout 31s;
-        proxy_send_timeout 32s;
-        client_max_body_size 1m;
-
-        proxy_buffering off;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $vs_connection_header;
-        proxy_pass_request_headers off;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Port $server_port;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://coffee-v2;
-        proxy_next_upstream error timeout;
-        proxy_next_upstream_timeout 5s;
-        proxy_next_upstream_tries 0;
-    }
-    location @match_loc_default {
-        set $service "";
-        status_zone "";
-
-        
-        set $default_connection_header close;
-        proxy_connect_timeout 30s;
-        proxy_read_timeout 31s;
-        proxy_send_timeout 32s;
-        client_max_body_size 1m;
-
-        proxy_buffering off;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $vs_connection_header;
-        proxy_pass_request_headers off;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Port $server_port;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://coffee-v1;
-        proxy_next_upstream error timeout;
-        proxy_next_upstream_timeout 5s;
-        proxy_next_upstream_tries 0;
-    }
-    location /return {
-        set $service "";
-        status_zone "";
-
-        
-        error_page 418 =200 "@return_0";
-        proxy_intercept_errors on;
-        proxy_pass http://unix:/var/lib/nginx/nginx-418-server.sock;
-        set $default_connection_header close;
-    }
-        
-    location @grpc_deadline_exceeded {
-        default_type application/grpc;
-        add_header content-type application/grpc;
-        add_header grpc-status 4;
-        add_header grpc-message 'deadline exceeded';
-        return 204;
-    }
-
-    location @grpc_permission_denied {
-        default_type application/grpc;
-        add_header content-type application/grpc;
-        add_header grpc-status 7;
-        add_header grpc-message 'permission denied';
-        return 204;
-    }
-
-    location @grpc_resource_exhausted {
-        default_type application/grpc;
-        add_header content-type application/grpc;
-        add_header grpc-status 8;
-        add_header grpc-message 'resource exhausted';
-        return 204;
-    }
-
-    location @grpc_unimplemented {
-        default_type application/grpc;
-        add_header content-type application/grpc;
-        add_header grpc-status 12;
-        add_header grpc-message unimplemented;
-        return 204;
-    }
-
-    location @grpc_internal {
-        default_type application/grpc;
-        add_header content-type application/grpc;
-        add_header grpc-status 13;
-        add_header grpc-message 'internal error';
-        return 204;
-    }
-
-    location @grpc_unavailable {
-        default_type application/grpc;
-        add_header content-type application/grpc;
-        add_header grpc-status 14;
-        add_header grpc-message unavailable;
-        return 204;
-    }
-
-    location @grpc_unauthenticated {
-        default_type application/grpc;
-        add_header content-type application/grpc;
-        add_header grpc-status 16;
-        add_header grpc-message unauthenticated;
-        return 204;
-    }
-
-        
-    
-}
-
----
-
 [TestTLSPassthroughHosts - 1]
 # mapping between TLS Passthrough hosts and unix sockets
 
diff --git a/internal/nginx/manager.go b/internal/nginx/manager.go
index 01467fccd..48f62148f 100644
--- a/internal/nginx/manager.go
+++ b/internal/nginx/manager.go
@@ -610,7 +610,7 @@ func (lm *LocalManager) AppProtectDosAgentStart(apdaDone chan error, debug bool,
 	}()
 }
 
-// AgentStart starts the AppProtect plugin and sets AppProtect log level.
+// AgentStart starts the NGINX Agent and sets the log level.
 func (lm *LocalManager) AgentStart(agentDone chan error, instanceGroup string) {
 	ctx := nl.ContextWithLogger(context.Background(), lm.logger)
 	nl.Debugf(lm.logger, "Starting Agent")
diff --git a/pyproject.toml b/pyproject.toml
index cfd6f488b..63f3570c6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,6 +24,7 @@ addopts = "--tb=native -ra --disable-warnings -x -l -v --strict-markers"
 log_cli = true
 markers = [
     "agentv2",
+    "agentv3",
     "annotations",
     "appprotect",
     "appprotect_integration",



Test patch:
diff --git a/charts/tests/__snapshots__/helmunit_test.snap b/charts/tests/__snapshots__/helmunit_test.snap
index 78d45f7e8..709d4065c 100755
--- a/charts/tests/__snapshots__/helmunit_test.snap
+++ b/charts/tests/__snapshots__/helmunit_test.snap
@@ -982,8 +982,9 @@ metadata:
     app.kubernetes.io/managed-by: Helm
 data:
   nginx-agent.conf: |-
+    
     log:
-      level: error
+      level: info
       path: ""
     server:
       host: nim.example.com
@@ -1319,7 +1320,7 @@ spec:
       labels:
         app.kubernetes.io/name: nginx-ingress
         app.kubernetes.io/instance: app-protect-waf-agentv2
-        agent-configuration-revision-hash: "ae1dac42"
+        agent-configuration-revision-hash: "58428611"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9113"
@@ -2032,8 +2033,9 @@ metadata:
     app.kubernetes.io/managed-by: Helm
 data:
   nginx-agent.conf: |-
+    
     log:
-      level: error
+      level: info
       path: ""
     server:
       host: nim.example.com
@@ -2369,7 +2371,7 @@ spec:
       labels:
         app.kubernetes.io/name: nginx-ingress
         app.kubernetes.io/instance: app-protect-wafv5-agentv2
-        agent-configuration-revision-hash: "55da744f"
+        agent-configuration-revision-hash: "a8989f3a"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9113"
@@ -5224,18 +5226,18 @@ metadata:
     app.kubernetes.io/managed-by: Helm
 ---
 
-[TestHelmNICTemplate/plus - 1]
+[TestHelmNICTemplate/ossAgentV3 - 1]
 /-/-/-/
 # Source: nginx-ingress/templates/controller-serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: plus-nginx-ingress
+  name: oss-agent-nginx-ingress
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -5243,43 +5245,68 @@ metadata:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-nginx-ingress
+  name: oss-agent-nginx-ingress
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
   {}
 /-/-/-/
 # Source: nginx-ingress/templates/controller-configmap.yaml
-/-/-/-/
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-nginx-ingress-mgmt
+  name: oss-agent-nginx-ingress-agent-config
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
-  license-token-secret-name: license-token
+  nginx-agent.conf: |-
+    
+    log:
+      # set log level (error, info, debug; default "info")
+      level: info
+      # set log path. if empty, don't log to file.
+      path: ""
+    
+    allowed_directories:
+      - /etc/nginx
+      - /usr/lib/nginx/modules
+    
+    features:
+      - certificates
+      - connection
+      - metrics
+      - file-watcher
+    
+    ## command server settings
+    command:
+      server:
+        host: product.connect.nginx.com
+        port: 443
+      auth:
+        tokenpath: "/etc/nginx-agent/secrets/dataplane.key"
+      tls:
+        skip_verify: false
 /-/-/-/
 # Source: nginx-ingress/templates/controller-leader-election-configmap.yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-nginx-ingress-leader-election
+  name: oss-agent-nginx-ingress-leader-election
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -5287,11 +5314,11 @@ metadata:
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-nginx-ingress
+  name: oss-agent-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 rules:
@@ -5401,31 +5428,31 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-nginx-ingress
+  name: oss-agent-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 subjects:
 - kind: ServiceAccount
-  name: plus-nginx-ingress
+  name: oss-agent-nginx-ingress
   namespace: default
 roleRef:
   kind: ClusterRole
-  name: plus-nginx-ingress
+  name: oss-agent-nginx-ingress
   apiGroup: rbac.authorization.k8s.io
 /-/-/-/
 # Source: nginx-ingress/templates/controller-role.yaml
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-nginx-ingress
+  name: oss-agent-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
   namespace: default
@@ -5466,7 +5493,7 @@ rules:
   resources:
   - leases
   resourceNames:
-  - plus-nginx-ingress-leader-election
+  - oss-agent-nginx-ingress-leader-election
   verbs:
   - get
   - update
@@ -5481,33 +5508,33 @@ rules:
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-nginx-ingress
+  name: oss-agent-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
   namespace: default
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: plus-nginx-ingress
+  name: oss-agent-nginx-ingress
 subjects:
 - kind: ServiceAccount
-  name: plus-nginx-ingress
+  name: oss-agent-nginx-ingress
   namespace: default
 /-/-/-/
 # Source: nginx-ingress/templates/controller-service.yaml
 apiVersion: v1
 kind: Service
 metadata:
-  name: plus-nginx-ingress-controller
+  name: oss-agent-nginx-ingress-controller
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -5526,18 +5553,18 @@ spec:
     nodePort: 
   selector:
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
 /-/-/-/
 # Source: nginx-ingress/templates/controller-deployment.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: plus-nginx-ingress-controller
+  name: oss-agent-nginx-ingress-controller
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -5545,19 +5572,27 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: nginx-ingress
-      app.kubernetes.io/instance: plus
+      app.kubernetes.io/instance: oss-agent
   template:
     metadata:
       labels:
         app.kubernetes.io/name: nginx-ingress
-        app.kubernetes.io/instance: plus
+        app.kubernetes.io/instance: oss-agent
+        agent-configuration-revision-hash: "eb3f867e"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9113"
         prometheus.io/scheme: "http"
     spec:      
-      volumes: []
-      serviceAccountName: plus-nginx-ingress
+      volumes:
+      
+      - name: agent-conf
+        configMap:
+          name: oss-agent-nginx-ingress-agent-config
+      - name: dataplane-key
+        secret:
+          secretName: dataplane-key
+      serviceAccountName: oss-agent-nginx-ingress
       automountServiceAccountToken: true
       securityContext:
         seccompProfile:
@@ -5600,7 +5635,13 @@ spec:
             - ALL
             add:
             - NET_BIND_SERVICE        
-        volumeMounts: []
+        volumeMounts:
+        
+        - name: agent-conf
+          mountPath: /etc/nginx-agent/nginx-agent.conf
+          subPath: nginx-agent.conf
+        - name: dataplane-key
+          mountPath: /etc/nginx-agent/secrets
         env:
         - name: POD_NAMESPACE
           valueFrom:
@@ -5612,12 +5653,11 @@ spec:
               fieldPath: metadata.name
         args:
           
-          - -nginx-plus=true
+          - -nginx-plus=false
           - -nginx-reload-timeout=60000
           - -enable-app-protect=false
           - -enable-app-protect-dos=false
-          - -nginx-configmaps=$(POD_NAMESPACE)/plus-nginx-ingress
-          - -mgmt-configmap=$(POD_NAMESPACE)/plus-nginx-ingress-mgmt
+          - -nginx-configmaps=$(POD_NAMESPACE)/oss-agent-nginx-ingress
           - -ingress-class=nginx
           - -health-status=false
           - -health-status-uri=/nginx-health
@@ -5628,9 +5668,9 @@ spec:
           - -nginx-status-port=8080
           - -nginx-status-allow-cidrs=127.0.0.1
           - -report-ingress-status
-          - -external-service=plus-nginx-ingress-controller
+          - -external-service=oss-agent-nginx-ingress-controller
           - -enable-leader-election=true
-          - -leader-election-lock-name=plus-nginx-ingress-leader-election
+          - -leader-election-lock-name=oss-agent-nginx-ingress-leader-election
           - -enable-prometheus-metrics=true
           - -prometheus-metrics-listen-port=9113
           - -prometheus-tls-secret=
@@ -5652,6 +5692,7 @@ spec:
           - -ssl-dynamic-reload=true
           - -enable-telemetry-reporting=true
           - -weight-changes-dynamic-reload=false
+          - -agent=true
 /-/-/-/
 # Source: nginx-ingress/templates/controller-ingress-class.yaml
 apiVersion: networking.k8s.io/v1
@@ -5661,7 +5702,7 @@ metadata:
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -5671,28 +5712,28 @@ spec:
 apiVersion: coordination.k8s.io/v1
 kind: Lease
 metadata:
-  name: plus-nginx-ingress-leader-election
+  name: oss-agent-nginx-ingress-leader-election
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus
+    app.kubernetes.io/instance: oss-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 ---
 
-[TestHelmNICTemplate/plus-debug - 1]
+[TestHelmNICTemplate/plus - 1]
 /-/-/-/
 # Source: nginx-ingress/templates/controller-serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: plus-debug-nginx-ingress
+  name: plus-nginx-ingress
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -5700,12 +5741,12 @@ metadata:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-debug-nginx-ingress
+  name: plus-nginx-ingress
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
@@ -5716,12 +5757,12 @@ data:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-debug-nginx-ingress-mgmt
+  name: plus-nginx-ingress-mgmt
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
@@ -5731,12 +5772,12 @@ data:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-debug-nginx-ingress-leader-election
+  name: plus-nginx-ingress-leader-election
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -5744,11 +5785,11 @@ metadata:
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-debug-nginx-ingress
+  name: plus-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 rules:
@@ -5858,31 +5899,31 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-debug-nginx-ingress
+  name: plus-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 subjects:
 - kind: ServiceAccount
-  name: plus-debug-nginx-ingress
+  name: plus-nginx-ingress
   namespace: default
 roleRef:
   kind: ClusterRole
-  name: plus-debug-nginx-ingress
+  name: plus-nginx-ingress
   apiGroup: rbac.authorization.k8s.io
 /-/-/-/
 # Source: nginx-ingress/templates/controller-role.yaml
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-debug-nginx-ingress
+  name: plus-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
   namespace: default
@@ -5923,7 +5964,7 @@ rules:
   resources:
   - leases
   resourceNames:
-  - plus-debug-nginx-ingress-leader-election
+  - plus-nginx-ingress-leader-election
   verbs:
   - get
   - update
@@ -5938,33 +5979,33 @@ rules:
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-debug-nginx-ingress
+  name: plus-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
   namespace: default
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: plus-debug-nginx-ingress
+  name: plus-nginx-ingress
 subjects:
 - kind: ServiceAccount
-  name: plus-debug-nginx-ingress
+  name: plus-nginx-ingress
   namespace: default
 /-/-/-/
 # Source: nginx-ingress/templates/controller-service.yaml
 apiVersion: v1
 kind: Service
 metadata:
-  name: plus-debug-nginx-ingress-controller
+  name: plus-nginx-ingress-controller
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -5983,18 +6024,18 @@ spec:
     nodePort: 
   selector:
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
 /-/-/-/
 # Source: nginx-ingress/templates/controller-deployment.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: plus-debug-nginx-ingress-controller
+  name: plus-nginx-ingress-controller
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -6002,19 +6043,19 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: nginx-ingress
-      app.kubernetes.io/instance: plus-debug
+      app.kubernetes.io/instance: plus
   template:
     metadata:
       labels:
         app.kubernetes.io/name: nginx-ingress
-        app.kubernetes.io/instance: plus-debug
+        app.kubernetes.io/instance: plus
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9113"
         prometheus.io/scheme: "http"
     spec:      
       volumes: []
-      serviceAccountName: plus-debug-nginx-ingress
+      serviceAccountName: plus-nginx-ingress
       automountServiceAccountToken: true
       securityContext:
         seccompProfile:
@@ -6069,22 +6110,12 @@ spec:
               fieldPath: metadata.name
         args:
           
-          - --listen=:2345
-          - --headless=true
-          - --log=true
-          - --log-output=debugger,debuglineerr,gdbwire,lldbout,rpc,dap,fncall,minidump,stack
-          - --accept-multiclient
-          - --api-version=2
-          - exec
-          - ./nginx-ingress
-          - --continue
-          - --
           - -nginx-plus=true
           - -nginx-reload-timeout=60000
           - -enable-app-protect=false
           - -enable-app-protect-dos=false
-          - -nginx-configmaps=$(POD_NAMESPACE)/plus-debug-nginx-ingress
-          - -mgmt-configmap=$(POD_NAMESPACE)/plus-debug-nginx-ingress-mgmt
+          - -nginx-configmaps=$(POD_NAMESPACE)/plus-nginx-ingress
+          - -mgmt-configmap=$(POD_NAMESPACE)/plus-nginx-ingress-mgmt
           - -ingress-class=nginx
           - -health-status=false
           - -health-status-uri=/nginx-health
@@ -6095,9 +6126,9 @@ spec:
           - -nginx-status-port=8080
           - -nginx-status-allow-cidrs=127.0.0.1
           - -report-ingress-status
-          - -external-service=plus-debug-nginx-ingress-controller
+          - -external-service=plus-nginx-ingress-controller
           - -enable-leader-election=true
-          - -leader-election-lock-name=plus-debug-nginx-ingress-leader-election
+          - -leader-election-lock-name=plus-nginx-ingress-leader-election
           - -enable-prometheus-metrics=true
           - -prometheus-metrics-listen-port=9113
           - -prometheus-tls-secret=
@@ -6128,7 +6159,7 @@ metadata:
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -6138,28 +6169,28 @@ spec:
 apiVersion: coordination.k8s.io/v1
 kind: Lease
 metadata:
-  name: plus-debug-nginx-ingress-leader-election
+  name: plus-nginx-ingress-leader-election
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/instance: plus
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 ---
 
-[TestHelmNICTemplate/plus-mgmt - 1]
+[TestHelmNICTemplate/plus-debug - 1]
 /-/-/-/
 # Source: nginx-ingress/templates/controller-serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: plus-mgmt-nginx-ingress
+  name: plus-debug-nginx-ingress
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -6167,12 +6198,12 @@ metadata:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-nginx-ingress
+  name: plus-debug-nginx-ingress
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
@@ -6183,37 +6214,27 @@ data:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-nginx-ingress-mgmt
+  name: plus-debug-nginx-ingress-mgmt
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
-  license-token-secret-name: license
-  ssl-verify: "false"
-  enforce-initial-report: "true"
-  usage-report-endpoint: "11.22.33.44"
-  usage-report-interval: "7h"
-  usage-report-proxy-host: "44.55.66.77:88"
-  ssl-trusted-certificate-secret-name: "ssl-trusted"
-  ssl-certificate-secret-name: "ssl-cert"
-  resolver-addresses: "example.com"
-  resolver-ipv6: "false"
-  resolver-valid: "15s"
+  license-token-secret-name: license-token
 /-/-/-/
 # Source: nginx-ingress/templates/controller-leader-election-configmap.yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-nginx-ingress-leader-election
+  name: plus-debug-nginx-ingress-leader-election
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -6221,11 +6242,11 @@ metadata:
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-nginx-ingress
+  name: plus-debug-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 rules:
@@ -6335,31 +6356,31 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-nginx-ingress
+  name: plus-debug-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 subjects:
 - kind: ServiceAccount
-  name: plus-mgmt-nginx-ingress
+  name: plus-debug-nginx-ingress
   namespace: default
 roleRef:
   kind: ClusterRole
-  name: plus-mgmt-nginx-ingress
+  name: plus-debug-nginx-ingress
   apiGroup: rbac.authorization.k8s.io
 /-/-/-/
 # Source: nginx-ingress/templates/controller-role.yaml
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-nginx-ingress
+  name: plus-debug-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
   namespace: default
@@ -6400,7 +6421,7 @@ rules:
   resources:
   - leases
   resourceNames:
-  - plus-mgmt-nginx-ingress-leader-election
+  - plus-debug-nginx-ingress-leader-election
   verbs:
   - get
   - update
@@ -6415,33 +6436,33 @@ rules:
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-nginx-ingress
+  name: plus-debug-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
   namespace: default
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: plus-mgmt-nginx-ingress
+  name: plus-debug-nginx-ingress
 subjects:
 - kind: ServiceAccount
-  name: plus-mgmt-nginx-ingress
+  name: plus-debug-nginx-ingress
   namespace: default
 /-/-/-/
 # Source: nginx-ingress/templates/controller-service.yaml
 apiVersion: v1
 kind: Service
 metadata:
-  name: plus-mgmt-nginx-ingress-controller
+  name: plus-debug-nginx-ingress-controller
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -6460,18 +6481,18 @@ spec:
     nodePort: 
   selector:
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
 /-/-/-/
 # Source: nginx-ingress/templates/controller-deployment.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: plus-mgmt-nginx-ingress-controller
+  name: plus-debug-nginx-ingress-controller
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-debug
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -6479,19 +6500,19 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: nginx-ingress
-      app.kubernetes.io/instance: plus-mgmt
+      app.kubernetes.io/instance: plus-debug
   template:
     metadata:
       labels:
         app.kubernetes.io/name: nginx-ingress
-        app.kubernetes.io/instance: plus-mgmt
+        app.kubernetes.io/instance: plus-debug
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9113"
         prometheus.io/scheme: "http"
     spec:      
       volumes: []
-      serviceAccountName: plus-mgmt-nginx-ingress
+      serviceAccountName: plus-debug-nginx-ingress
       automountServiceAccountToken: true
       securityContext:
         seccompProfile:
@@ -6544,24 +6565,1417 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
-        - name: PROXY_USER
-          valueFrom:
-            secretKeyRef:
-              name: proxy-credentials
-              key: username
-        - name: PROXY_PASS
+        args:
+          
+          - --listen=:2345
+          - --headless=true
+          - --log=true
+          - --log-output=debugger,debuglineerr,gdbwire,lldbout,rpc,dap,fncall,minidump,stack
+          - --accept-multiclient
+          - --api-version=2
+          - exec
+          - ./nginx-ingress
+          - --continue
+          - --
+          - -nginx-plus=true
+          - -nginx-reload-timeout=60000
+          - -enable-app-protect=false
+          - -enable-app-protect-dos=false
+          - -nginx-configmaps=$(POD_NAMESPACE)/plus-debug-nginx-ingress
+          - -mgmt-configmap=$(POD_NAMESPACE)/plus-debug-nginx-ingress-mgmt
+          - -ingress-class=nginx
+          - -health-status=false
+          - -health-status-uri=/nginx-health
+          - -nginx-debug=false
+          - -log-level=info
+          - -log-format=glog
+          - -nginx-status=true
+          - -nginx-status-port=8080
+          - -nginx-status-allow-cidrs=127.0.0.1
+          - -report-ingress-status
+          - -external-service=plus-debug-nginx-ingress-controller
+          - -enable-leader-election=true
+          - -leader-election-lock-name=plus-debug-nginx-ingress-leader-election
+          - -enable-prometheus-metrics=true
+          - -prometheus-metrics-listen-port=9113
+          - -prometheus-tls-secret=
+          - -enable-service-insight=false
+          - -service-insight-listen-port=9114
+          - -service-insight-tls-secret=
+          - -enable-custom-resources=true
+          - -enable-snippets=false
+          - -disable-ipv6=false
+          - -enable-tls-passthrough=false
+          - -enable-cert-manager=false
+          - -enable-oidc=false
+          - -enable-external-dns=false
+          - -default-http-listener-port=80
+          - -default-https-listener-port=443
+          - -ready-status=true
+          - -ready-status-port=8081
+          - -enable-latency-metrics=false
+          - -ssl-dynamic-reload=true
+          - -enable-telemetry-reporting=true
+          - -weight-changes-dynamic-reload=false
+/-/-/-/
+# Source: nginx-ingress/templates/controller-ingress-class.yaml
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  name: nginx
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  controller: nginx.org/ingress-controller
+/-/-/-/
+# Source: nginx-ingress/templates/controller-lease.yaml
+apiVersion: coordination.k8s.io/v1
+kind: Lease
+metadata:
+  name: plus-debug-nginx-ingress-leader-election
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-debug
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+---
+
+[TestHelmNICTemplate/plus-mgmt - 1]
+/-/-/-/
+# Source: nginx-ingress/templates/controller-serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: plus-mgmt-nginx-ingress
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+/-/-/-/
+# Source: nginx-ingress/templates/controller-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-mgmt-nginx-ingress
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+data:
+  {}
+/-/-/-/
+# Source: nginx-ingress/templates/controller-configmap.yaml
+/-/-/-/
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-mgmt-nginx-ingress-mgmt
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+data:
+  license-token-secret-name: license
+  ssl-verify: "false"
+  enforce-initial-report: "true"
+  usage-report-endpoint: "11.22.33.44"
+  usage-report-interval: "7h"
+  usage-report-proxy-host: "44.55.66.77:88"
+  ssl-trusted-certificate-secret-name: "ssl-trusted"
+  ssl-certificate-secret-name: "ssl-cert"
+  resolver-addresses: "example.com"
+  resolver-ipv6: "false"
+  resolver-valid: "15s"
+/-/-/-/
+# Source: nginx-ingress/templates/controller-leader-election-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-mgmt-nginx-ingress-leader-election
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+/-/-/-/
+# Source: nginx-ingress/templates/clusterrole.yaml
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - namespaces
+  - pods
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - list
+- apiGroups:
+  - "apps"
+  resources:
+  - replicasets
+  - daemonsets
+  verbs:
+  - get
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingressclasses
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses/status
+  verbs:
+  - update
+- apiGroups:
+  - k8s.nginx.org
+  resources:
+  - virtualservers
+  - virtualserverroutes
+  - globalconfigurations
+  - transportservers
+  - policies
+  verbs:
+  - list
+  - watch
+  - get
+- apiGroups:
+  - k8s.nginx.org
+  resources:
+  - virtualservers/status
+  - virtualserverroutes/status
+  - policies/status
+  - transportservers/status
+  verbs:
+  - update
+/-/-/-/
+# Source: nginx-ingress/templates/clusterrolebinding.yaml
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+subjects:
+- kind: ServiceAccount
+  name: plus-mgmt-nginx-ingress
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: plus-mgmt-nginx-ingress
+  apiGroup: rbac.authorization.k8s.io
+/-/-/-/
+# Source: nginx-ingress/templates/controller-role.yaml
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+  namespace: default
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+    - ""
+  resources:
+    - namespaces
+  verbs:
+    - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - list
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  resourceNames:
+  - plus-mgmt-nginx-ingress-leader-election
+  verbs:
+  - get
+  - update
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+/-/-/-/
+# Source: nginx-ingress/templates/controller-rolebinding.yaml
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: plus-mgmt-nginx-ingress
+subjects:
+- kind: ServiceAccount
+  name: plus-mgmt-nginx-ingress
+  namespace: default
+/-/-/-/
+# Source: nginx-ingress/templates/controller-service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: plus-mgmt-nginx-ingress-controller
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  externalTrafficPolicy: Local
+  type: LoadBalancer
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+    name: http
+    nodePort: 
+  - port: 443
+    targetPort: 443
+    protocol: TCP
+    name: https
+    nodePort: 
+  selector:
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+/-/-/-/
+# Source: nginx-ingress/templates/controller-deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plus-mgmt-nginx-ingress-controller
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nginx-ingress
+      app.kubernetes.io/instance: plus-mgmt
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nginx-ingress
+        app.kubernetes.io/instance: plus-mgmt
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9113"
+        prometheus.io/scheme: "http"
+    spec:      
+      volumes: []
+      serviceAccountName: plus-mgmt-nginx-ingress
+      automountServiceAccountToken: true
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      terminationGracePeriodSeconds: 30
+      hostNetwork: false
+      dnsPolicy: ClusterFirst
+      containers:
+      - image: nginx/nginx-ingress:5.1.0
+        name: nginx-ingress
+        imagePullPolicy: "IfNotPresent"
+        ports:
+        - name: http
+          containerPort: 80
+          protocol: TCP
+        - name: https
+          containerPort: 443
+          protocol: TCP
+        - name: prometheus
+          containerPort: 9113
+        - name: readiness-port
+          containerPort: 8081
+        readinessProbe:
+          httpGet:
+            path: /nginx-ready
+            port: readiness-port
+          periodSeconds: 1
+          initialDelaySeconds: 0
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: false
+          runAsUser: 101 #nginx
+          runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
+            add:
+            - NET_BIND_SERVICE        
+        volumeMounts: []
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: PROXY_USER
+          valueFrom:
+            secretKeyRef:
+              name: proxy-credentials
+              key: username
+        - name: PROXY_PASS
+          valueFrom:
+            secretKeyRef:
+              name: proxy-credentials
+              key: password
+        args:
+          
+          - -nginx-plus=true
+          - -nginx-reload-timeout=60000
+          - -enable-app-protect=false
+          - -enable-app-protect-dos=false
+          - -nginx-configmaps=$(POD_NAMESPACE)/plus-mgmt-nginx-ingress
+          - -mgmt-configmap=$(POD_NAMESPACE)/plus-mgmt-nginx-ingress-mgmt
+          - -ingress-class=nginx
+          - -health-status=false
+          - -health-status-uri=/nginx-health
+          - -nginx-debug=false
+          - -log-level=info
+          - -log-format=glog
+          - -nginx-status=true
+          - -nginx-status-port=8080
+          - -nginx-status-allow-cidrs=127.0.0.1
+          - -report-ingress-status
+          - -external-service=plus-mgmt-nginx-ingress-controller
+          - -enable-leader-election=true
+          - -leader-election-lock-name=plus-mgmt-nginx-ingress-leader-election
+          - -enable-prometheus-metrics=true
+          - -prometheus-metrics-listen-port=9113
+          - -prometheus-tls-secret=
+          - -enable-service-insight=false
+          - -service-insight-listen-port=9114
+          - -service-insight-tls-secret=
+          - -enable-custom-resources=true
+          - -enable-snippets=false
+          - -disable-ipv6=false
+          - -enable-tls-passthrough=false
+          - -enable-cert-manager=false
+          - -enable-oidc=false
+          - -enable-external-dns=false
+          - -default-http-listener-port=80
+          - -default-https-listener-port=443
+          - -ready-status=true
+          - -ready-status-port=8081
+          - -enable-latency-metrics=false
+          - -ssl-dynamic-reload=true
+          - -enable-telemetry-reporting=true
+          - -weight-changes-dynamic-reload=false
+/-/-/-/
+# Source: nginx-ingress/templates/controller-ingress-class.yaml
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  name: nginx
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  controller: nginx.org/ingress-controller
+/-/-/-/
+# Source: nginx-ingress/templates/controller-lease.yaml
+apiVersion: coordination.k8s.io/v1
+kind: Lease
+metadata:
+  name: plus-mgmt-nginx-ingress-leader-election
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+---
+
+[TestHelmNICTemplate/plus-mgmt-custom-endpoint - 1]
+/-/-/-/
+# Source: nginx-ingress/templates/controller-serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+/-/-/-/
+# Source: nginx-ingress/templates/controller-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+data:
+  {}
+/-/-/-/
+# Source: nginx-ingress/templates/controller-configmap.yaml
+/-/-/-/
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress-mgmt
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+data:
+  license-token-secret-name: license-token
+  usage-report-endpoint: "11.22.33.44"
+/-/-/-/
+# Source: nginx-ingress/templates/controller-leader-election-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress-leader-election
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+/-/-/-/
+# Source: nginx-ingress/templates/clusterrole.yaml
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - namespaces
+  - pods
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - list
+- apiGroups:
+  - "apps"
+  resources:
+  - replicasets
+  - daemonsets
+  verbs:
+  - get
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingressclasses
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses/status
+  verbs:
+  - update
+- apiGroups:
+  - k8s.nginx.org
+  resources:
+  - virtualservers
+  - virtualserverroutes
+  - globalconfigurations
+  - transportservers
+  - policies
+  verbs:
+  - list
+  - watch
+  - get
+- apiGroups:
+  - k8s.nginx.org
+  resources:
+  - virtualservers/status
+  - virtualserverroutes/status
+  - policies/status
+  - transportservers/status
+  verbs:
+  - update
+/-/-/-/
+# Source: nginx-ingress/templates/clusterrolebinding.yaml
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+subjects:
+- kind: ServiceAccount
+  name: plus-mgmt-custom-endpoint-nginx-ingress
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: plus-mgmt-custom-endpoint-nginx-ingress
+  apiGroup: rbac.authorization.k8s.io
+/-/-/-/
+# Source: nginx-ingress/templates/controller-role.yaml
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+  namespace: default
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+    - ""
+  resources:
+    - namespaces
+  verbs:
+    - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - list
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  resourceNames:
+  - plus-mgmt-custom-endpoint-nginx-ingress-leader-election
+  verbs:
+  - get
+  - update
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+/-/-/-/
+# Source: nginx-ingress/templates/controller-rolebinding.yaml
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: plus-mgmt-custom-endpoint-nginx-ingress
+subjects:
+- kind: ServiceAccount
+  name: plus-mgmt-custom-endpoint-nginx-ingress
+  namespace: default
+/-/-/-/
+# Source: nginx-ingress/templates/controller-service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress-controller
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  externalTrafficPolicy: Local
+  type: LoadBalancer
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+    name: http
+    nodePort: 
+  - port: 443
+    targetPort: 443
+    protocol: TCP
+    name: https
+    nodePort: 
+  selector:
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+/-/-/-/
+# Source: nginx-ingress/templates/controller-deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress-controller
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nginx-ingress
+      app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nginx-ingress
+        app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9113"
+        prometheus.io/scheme: "http"
+    spec:      
+      volumes: []
+      serviceAccountName: plus-mgmt-custom-endpoint-nginx-ingress
+      automountServiceAccountToken: true
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      terminationGracePeriodSeconds: 30
+      hostNetwork: false
+      dnsPolicy: ClusterFirst
+      containers:
+      - image: nginx/nginx-ingress:5.1.0
+        name: nginx-ingress
+        imagePullPolicy: "IfNotPresent"
+        ports:
+        - name: http
+          containerPort: 80
+          protocol: TCP
+        - name: https
+          containerPort: 443
+          protocol: TCP
+        - name: prometheus
+          containerPort: 9113
+        - name: readiness-port
+          containerPort: 8081
+        readinessProbe:
+          httpGet:
+            path: /nginx-ready
+            port: readiness-port
+          periodSeconds: 1
+          initialDelaySeconds: 0
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: false
+          runAsUser: 101 #nginx
+          runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
+            add:
+            - NET_BIND_SERVICE        
+        volumeMounts: []
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        args:
+          
+          - -nginx-plus=true
+          - -nginx-reload-timeout=60000
+          - -enable-app-protect=false
+          - -enable-app-protect-dos=false
+          - -nginx-configmaps=$(POD_NAMESPACE)/plus-mgmt-custom-endpoint-nginx-ingress
+          - -mgmt-configmap=$(POD_NAMESPACE)/plus-mgmt-custom-endpoint-nginx-ingress-mgmt
+          - -ingress-class=nginx
+          - -health-status=false
+          - -health-status-uri=/nginx-health
+          - -nginx-debug=false
+          - -log-level=info
+          - -log-format=glog
+          - -nginx-status=true
+          - -nginx-status-port=8080
+          - -nginx-status-allow-cidrs=127.0.0.1
+          - -report-ingress-status
+          - -external-service=plus-mgmt-custom-endpoint-nginx-ingress-controller
+          - -enable-leader-election=true
+          - -leader-election-lock-name=plus-mgmt-custom-endpoint-nginx-ingress-leader-election
+          - -enable-prometheus-metrics=true
+          - -prometheus-metrics-listen-port=9113
+          - -prometheus-tls-secret=
+          - -enable-service-insight=false
+          - -service-insight-listen-port=9114
+          - -service-insight-tls-secret=
+          - -enable-custom-resources=true
+          - -enable-snippets=false
+          - -disable-ipv6=false
+          - -enable-tls-passthrough=false
+          - -enable-cert-manager=false
+          - -enable-oidc=false
+          - -enable-external-dns=false
+          - -default-http-listener-port=80
+          - -default-https-listener-port=443
+          - -ready-status=true
+          - -ready-status-port=8081
+          - -enable-latency-metrics=false
+          - -ssl-dynamic-reload=true
+          - -enable-telemetry-reporting=true
+          - -weight-changes-dynamic-reload=false
+/-/-/-/
+# Source: nginx-ingress/templates/controller-ingress-class.yaml
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  name: nginx
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  controller: nginx.org/ingress-controller
+/-/-/-/
+# Source: nginx-ingress/templates/controller-lease.yaml
+apiVersion: coordination.k8s.io/v1
+kind: Lease
+metadata:
+  name: plus-mgmt-custom-endpoint-nginx-ingress-leader-election
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+---
+
+[TestHelmNICTemplate/plus-mgmt-proxy-host - 1]
+/-/-/-/
+# Source: nginx-ingress/templates/controller-serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: plus-mgmt-proxy-host-nginx-ingress
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+/-/-/-/
+# Source: nginx-ingress/templates/controller-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-mgmt-proxy-host-nginx-ingress
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+data:
+  {}
+/-/-/-/
+# Source: nginx-ingress/templates/controller-configmap.yaml
+/-/-/-/
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-mgmt-proxy-host-nginx-ingress-mgmt
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+data:
+  license-token-secret-name: license-token
+  usage-report-proxy-host: "44.55.66.77:88"
+/-/-/-/
+# Source: nginx-ingress/templates/controller-leader-election-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-mgmt-proxy-host-nginx-ingress-leader-election
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+/-/-/-/
+# Source: nginx-ingress/templates/clusterrole.yaml
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-proxy-host-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - namespaces
+  - pods
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - list
+- apiGroups:
+  - "apps"
+  resources:
+  - replicasets
+  - daemonsets
+  verbs:
+  - get
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingressclasses
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses/status
+  verbs:
+  - update
+- apiGroups:
+  - k8s.nginx.org
+  resources:
+  - virtualservers
+  - virtualserverroutes
+  - globalconfigurations
+  - transportservers
+  - policies
+  verbs:
+  - list
+  - watch
+  - get
+- apiGroups:
+  - k8s.nginx.org
+  resources:
+  - virtualservers/status
+  - virtualserverroutes/status
+  - policies/status
+  - transportservers/status
+  verbs:
+  - update
+/-/-/-/
+# Source: nginx-ingress/templates/clusterrolebinding.yaml
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-proxy-host-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+subjects:
+- kind: ServiceAccount
+  name: plus-mgmt-proxy-host-nginx-ingress
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: plus-mgmt-proxy-host-nginx-ingress
+  apiGroup: rbac.authorization.k8s.io
+/-/-/-/
+# Source: nginx-ingress/templates/controller-role.yaml
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-proxy-host-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+  namespace: default
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+    - ""
+  resources:
+    - namespaces
+  verbs:
+    - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - list
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  resourceNames:
+  - plus-mgmt-proxy-host-nginx-ingress-leader-election
+  verbs:
+  - get
+  - update
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+/-/-/-/
+# Source: nginx-ingress/templates/controller-rolebinding.yaml
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: plus-mgmt-proxy-host-nginx-ingress
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: plus-mgmt-proxy-host-nginx-ingress
+subjects:
+- kind: ServiceAccount
+  name: plus-mgmt-proxy-host-nginx-ingress
+  namespace: default
+/-/-/-/
+# Source: nginx-ingress/templates/controller-service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: plus-mgmt-proxy-host-nginx-ingress-controller
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  externalTrafficPolicy: Local
+  type: LoadBalancer
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+    name: http
+    nodePort: 
+  - port: 443
+    targetPort: 443
+    protocol: TCP
+    name: https
+    nodePort: 
+  selector:
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+/-/-/-/
+# Source: nginx-ingress/templates/controller-deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plus-mgmt-proxy-host-nginx-ingress-controller
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nginx-ingress
+      app.kubernetes.io/instance: plus-mgmt-proxy-host
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nginx-ingress
+        app.kubernetes.io/instance: plus-mgmt-proxy-host
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9113"
+        prometheus.io/scheme: "http"
+    spec:      
+      volumes: []
+      serviceAccountName: plus-mgmt-proxy-host-nginx-ingress
+      automountServiceAccountToken: true
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      terminationGracePeriodSeconds: 30
+      hostNetwork: false
+      dnsPolicy: ClusterFirst
+      containers:
+      - image: nginx/nginx-ingress:5.1.0
+        name: nginx-ingress
+        imagePullPolicy: "IfNotPresent"
+        ports:
+        - name: http
+          containerPort: 80
+          protocol: TCP
+        - name: https
+          containerPort: 443
+          protocol: TCP
+        - name: prometheus
+          containerPort: 9113
+        - name: readiness-port
+          containerPort: 8081
+        readinessProbe:
+          httpGet:
+            path: /nginx-ready
+            port: readiness-port
+          periodSeconds: 1
+          initialDelaySeconds: 0
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: false
+          runAsUser: 101 #nginx
+          runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
+            add:
+            - NET_BIND_SERVICE        
+        volumeMounts: []
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: POD_NAME
           valueFrom:
-            secretKeyRef:
-              name: proxy-credentials
-              key: password
+            fieldRef:
+              fieldPath: metadata.name
         args:
           
           - -nginx-plus=true
           - -nginx-reload-timeout=60000
           - -enable-app-protect=false
           - -enable-app-protect-dos=false
-          - -nginx-configmaps=$(POD_NAMESPACE)/plus-mgmt-nginx-ingress
-          - -mgmt-configmap=$(POD_NAMESPACE)/plus-mgmt-nginx-ingress-mgmt
+          - -nginx-configmaps=$(POD_NAMESPACE)/plus-mgmt-proxy-host-nginx-ingress
+          - -mgmt-configmap=$(POD_NAMESPACE)/plus-mgmt-proxy-host-nginx-ingress-mgmt
           - -ingress-class=nginx
           - -health-status=false
           - -health-status-uri=/nginx-health
@@ -6572,9 +7986,9 @@ spec:
           - -nginx-status-port=8080
           - -nginx-status-allow-cidrs=127.0.0.1
           - -report-ingress-status
-          - -external-service=plus-mgmt-nginx-ingress-controller
+          - -external-service=plus-mgmt-proxy-host-nginx-ingress-controller
           - -enable-leader-election=true
-          - -leader-election-lock-name=plus-mgmt-nginx-ingress-leader-election
+          - -leader-election-lock-name=plus-mgmt-proxy-host-nginx-ingress-leader-election
           - -enable-prometheus-metrics=true
           - -prometheus-metrics-listen-port=9113
           - -prometheus-tls-secret=
@@ -6605,7 +8019,7 @@ metadata:
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -6615,28 +8029,28 @@ spec:
 apiVersion: coordination.k8s.io/v1
 kind: Lease
 metadata:
-  name: plus-mgmt-nginx-ingress-leader-election
+  name: plus-mgmt-proxy-host-nginx-ingress-leader-election
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt
+    app.kubernetes.io/instance: plus-mgmt-proxy-host
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 ---
 
-[TestHelmNICTemplate/plus-mgmt-custom-endpoint - 1]
+[TestHelmNICTemplate/plus-mgmt-proxy-host-auth - 1]
 /-/-/-/
 # Source: nginx-ingress/templates/controller-serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress
+  name: plus-mgmt-proxy-host-auth-nginx-ingress
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -6644,12 +8058,12 @@ metadata:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress
+  name: plus-mgmt-proxy-host-auth-nginx-ingress
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
@@ -6660,28 +8074,28 @@ data:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress-mgmt
+  name: plus-mgmt-proxy-host-auth-nginx-ingress-mgmt
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
   license-token-secret-name: license-token
-  usage-report-endpoint: "11.22.33.44"
+  usage-report-proxy-host: "44.55.66.77:88"
 /-/-/-/
 # Source: nginx-ingress/templates/controller-leader-election-configmap.yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress-leader-election
+  name: plus-mgmt-proxy-host-auth-nginx-ingress-leader-election
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -6689,11 +8103,11 @@ metadata:
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress
+  name: plus-mgmt-proxy-host-auth-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 rules:
@@ -6803,31 +8217,31 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress
+  name: plus-mgmt-proxy-host-auth-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 subjects:
 - kind: ServiceAccount
-  name: plus-mgmt-custom-endpoint-nginx-ingress
+  name: plus-mgmt-proxy-host-auth-nginx-ingress
   namespace: default
 roleRef:
   kind: ClusterRole
-  name: plus-mgmt-custom-endpoint-nginx-ingress
+  name: plus-mgmt-proxy-host-auth-nginx-ingress
   apiGroup: rbac.authorization.k8s.io
 /-/-/-/
 # Source: nginx-ingress/templates/controller-role.yaml
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress
+  name: plus-mgmt-proxy-host-auth-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
   namespace: default
@@ -6868,7 +8282,7 @@ rules:
   resources:
   - leases
   resourceNames:
-  - plus-mgmt-custom-endpoint-nginx-ingress-leader-election
+  - plus-mgmt-proxy-host-auth-nginx-ingress-leader-election
   verbs:
   - get
   - update
@@ -6883,33 +8297,33 @@ rules:
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress
+  name: plus-mgmt-proxy-host-auth-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
   namespace: default
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: plus-mgmt-custom-endpoint-nginx-ingress
+  name: plus-mgmt-proxy-host-auth-nginx-ingress
 subjects:
 - kind: ServiceAccount
-  name: plus-mgmt-custom-endpoint-nginx-ingress
+  name: plus-mgmt-proxy-host-auth-nginx-ingress
   namespace: default
 /-/-/-/
 # Source: nginx-ingress/templates/controller-service.yaml
 apiVersion: v1
 kind: Service
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress-controller
+  name: plus-mgmt-proxy-host-auth-nginx-ingress-controller
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -6928,18 +8342,18 @@ spec:
     nodePort: 
   selector:
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
 /-/-/-/
 # Source: nginx-ingress/templates/controller-deployment.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress-controller
+  name: plus-mgmt-proxy-host-auth-nginx-ingress-controller
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -6947,19 +8361,19 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: nginx-ingress
-      app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+      app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
   template:
     metadata:
       labels:
         app.kubernetes.io/name: nginx-ingress
-        app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+        app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9113"
         prometheus.io/scheme: "http"
     spec:      
       volumes: []
-      serviceAccountName: plus-mgmt-custom-endpoint-nginx-ingress
+      serviceAccountName: plus-mgmt-proxy-host-auth-nginx-ingress
       automountServiceAccountToken: true
       securityContext:
         seccompProfile:
@@ -7012,14 +8426,24 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
+        - name: PROXY_USER
+          valueFrom:
+            secretKeyRef:
+              name: custom-credentials
+              key: username
+        - name: PROXY_PASS
+          valueFrom:
+            secretKeyRef:
+              name: custom-credentials
+              key: password
         args:
           
           - -nginx-plus=true
           - -nginx-reload-timeout=60000
           - -enable-app-protect=false
           - -enable-app-protect-dos=false
-          - -nginx-configmaps=$(POD_NAMESPACE)/plus-mgmt-custom-endpoint-nginx-ingress
-          - -mgmt-configmap=$(POD_NAMESPACE)/plus-mgmt-custom-endpoint-nginx-ingress-mgmt
+          - -nginx-configmaps=$(POD_NAMESPACE)/plus-mgmt-proxy-host-auth-nginx-ingress
+          - -mgmt-configmap=$(POD_NAMESPACE)/plus-mgmt-proxy-host-auth-nginx-ingress-mgmt
           - -ingress-class=nginx
           - -health-status=false
           - -health-status-uri=/nginx-health
@@ -7030,9 +8454,9 @@ spec:
           - -nginx-status-port=8080
           - -nginx-status-allow-cidrs=127.0.0.1
           - -report-ingress-status
-          - -external-service=plus-mgmt-custom-endpoint-nginx-ingress-controller
+          - -external-service=plus-mgmt-proxy-host-auth-nginx-ingress-controller
           - -enable-leader-election=true
-          - -leader-election-lock-name=plus-mgmt-custom-endpoint-nginx-ingress-leader-election
+          - -leader-election-lock-name=plus-mgmt-proxy-host-auth-nginx-ingress-leader-election
           - -enable-prometheus-metrics=true
           - -prometheus-metrics-listen-port=9113
           - -prometheus-tls-secret=
@@ -7063,7 +8487,7 @@ metadata:
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -7073,28 +8497,28 @@ spec:
 apiVersion: coordination.k8s.io/v1
 kind: Lease
 metadata:
-  name: plus-mgmt-custom-endpoint-nginx-ingress-leader-election
+  name: plus-mgmt-proxy-host-auth-nginx-ingress-leader-election
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-custom-endpoint
+    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 ---
 
-[TestHelmNICTemplate/plus-mgmt-proxy-host - 1]
+[TestHelmNICTemplate/plusAgentV3 - 1]
 /-/-/-/
 # Source: nginx-ingress/templates/controller-serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress
+  name: plus-agent-nginx-ingress
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -7102,44 +8526,83 @@ metadata:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress
+  name: plus-agent-nginx-ingress
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
   {}
 /-/-/-/
 # Source: nginx-ingress/templates/controller-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-agent-nginx-ingress-agent-config
+  namespace: default
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-agent
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+data:
+  nginx-agent.conf: |-
+    
+    log:
+      # set log level (error, info, debug; default "info")
+      level: info
+      # set log path. if empty, don't log to file.
+      path: ""
+    
+    allowed_directories:
+      - /etc/nginx
+      - /usr/lib/nginx/modules
+    
+    features:
+      - certificates
+      - connection
+      - metrics
+      - file-watcher
+    
+    ## command server settings
+    command:
+      server:
+        host: product.connect.nginx.com
+        port: 443
+      auth:
+        tokenpath: "/etc/nginx-agent/secrets/dataplane.key"
+      tls:
+        skip_verify: false
 /-/-/-/
+# Source: nginx-ingress/templates/controller-configmap.yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress-mgmt
+  name: plus-agent-nginx-ingress-mgmt
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
   license-token-secret-name: license-token
-  usage-report-proxy-host: "44.55.66.77:88"
 /-/-/-/
 # Source: nginx-ingress/templates/controller-leader-election-configmap.yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress-leader-election
+  name: plus-agent-nginx-ingress-leader-election
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -7147,11 +8610,11 @@ metadata:
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress
+  name: plus-agent-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 rules:
@@ -7261,31 +8724,31 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress
+  name: plus-agent-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 subjects:
 - kind: ServiceAccount
-  name: plus-mgmt-proxy-host-nginx-ingress
+  name: plus-agent-nginx-ingress
   namespace: default
 roleRef:
   kind: ClusterRole
-  name: plus-mgmt-proxy-host-nginx-ingress
+  name: plus-agent-nginx-ingress
   apiGroup: rbac.authorization.k8s.io
 /-/-/-/
 # Source: nginx-ingress/templates/controller-role.yaml
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress
+  name: plus-agent-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
   namespace: default
@@ -7326,7 +8789,7 @@ rules:
   resources:
   - leases
   resourceNames:
-  - plus-mgmt-proxy-host-nginx-ingress-leader-election
+  - plus-agent-nginx-ingress-leader-election
   verbs:
   - get
   - update
@@ -7341,33 +8804,33 @@ rules:
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress
+  name: plus-agent-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
   namespace: default
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: plus-mgmt-proxy-host-nginx-ingress
+  name: plus-agent-nginx-ingress
 subjects:
 - kind: ServiceAccount
-  name: plus-mgmt-proxy-host-nginx-ingress
+  name: plus-agent-nginx-ingress
   namespace: default
 /-/-/-/
 # Source: nginx-ingress/templates/controller-service.yaml
 apiVersion: v1
 kind: Service
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress-controller
+  name: plus-agent-nginx-ingress-controller
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -7386,18 +8849,18 @@ spec:
     nodePort: 
   selector:
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
 /-/-/-/
 # Source: nginx-ingress/templates/controller-deployment.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress-controller
+  name: plus-agent-nginx-ingress-controller
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -7405,19 +8868,27 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: nginx-ingress
-      app.kubernetes.io/instance: plus-mgmt-proxy-host
+      app.kubernetes.io/instance: plus-agent
   template:
     metadata:
       labels:
         app.kubernetes.io/name: nginx-ingress
-        app.kubernetes.io/instance: plus-mgmt-proxy-host
+        app.kubernetes.io/instance: plus-agent
+        agent-configuration-revision-hash: "eb3f867e"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9113"
         prometheus.io/scheme: "http"
     spec:      
-      volumes: []
-      serviceAccountName: plus-mgmt-proxy-host-nginx-ingress
+      volumes:
+      
+      - name: agent-conf
+        configMap:
+          name: plus-agent-nginx-ingress-agent-config
+      - name: dataplane-key
+        secret:
+          secretName: dataplane-key
+      serviceAccountName: plus-agent-nginx-ingress
       automountServiceAccountToken: true
       securityContext:
         seccompProfile:
@@ -7460,7 +8931,13 @@ spec:
             - ALL
             add:
             - NET_BIND_SERVICE        
-        volumeMounts: []
+        volumeMounts:
+        
+        - name: agent-conf
+          mountPath: /etc/nginx-agent/nginx-agent.conf
+          subPath: nginx-agent.conf
+        - name: dataplane-key
+          mountPath: /etc/nginx-agent/secrets
         env:
         - name: POD_NAMESPACE
           valueFrom:
@@ -7476,8 +8953,8 @@ spec:
           - -nginx-reload-timeout=60000
           - -enable-app-protect=false
           - -enable-app-protect-dos=false
-          - -nginx-configmaps=$(POD_NAMESPACE)/plus-mgmt-proxy-host-nginx-ingress
-          - -mgmt-configmap=$(POD_NAMESPACE)/plus-mgmt-proxy-host-nginx-ingress-mgmt
+          - -nginx-configmaps=$(POD_NAMESPACE)/plus-agent-nginx-ingress
+          - -mgmt-configmap=$(POD_NAMESPACE)/plus-agent-nginx-ingress-mgmt
           - -ingress-class=nginx
           - -health-status=false
           - -health-status-uri=/nginx-health
@@ -7488,9 +8965,9 @@ spec:
           - -nginx-status-port=8080
           - -nginx-status-allow-cidrs=127.0.0.1
           - -report-ingress-status
-          - -external-service=plus-mgmt-proxy-host-nginx-ingress-controller
+          - -external-service=plus-agent-nginx-ingress-controller
           - -enable-leader-election=true
-          - -leader-election-lock-name=plus-mgmt-proxy-host-nginx-ingress-leader-election
+          - -leader-election-lock-name=plus-agent-nginx-ingress-leader-election
           - -enable-prometheus-metrics=true
           - -prometheus-metrics-listen-port=9113
           - -prometheus-tls-secret=
@@ -7512,6 +8989,7 @@ spec:
           - -ssl-dynamic-reload=true
           - -enable-telemetry-reporting=true
           - -weight-changes-dynamic-reload=false
+          - -agent=true
 /-/-/-/
 # Source: nginx-ingress/templates/controller-ingress-class.yaml
 apiVersion: networking.k8s.io/v1
@@ -7521,7 +8999,7 @@ metadata:
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -7531,28 +9009,28 @@ spec:
 apiVersion: coordination.k8s.io/v1
 kind: Lease
 metadata:
-  name: plus-mgmt-proxy-host-nginx-ingress-leader-election
+  name: plus-agent-nginx-ingress-leader-election
   namespace: default
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host
+    app.kubernetes.io/instance: plus-agent
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 ---
 
-[TestHelmNICTemplate/plus-mgmt-proxy-host-auth - 1]
+[TestHelmNICTemplate/plusAgentV3All - 1]
 /-/-/-/
 # Source: nginx-ingress/templates/controller-serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress
-  namespace: default
+  name: plus-agent-all-nginx-ingress
+  namespace: custom
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -7560,44 +9038,83 @@ metadata:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress
-  namespace: default
+  name: plus-agent-all-nginx-ingress
+  namespace: custom
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
   {}
 /-/-/-/
 # Source: nginx-ingress/templates/controller-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plus-agent-all-nginx-ingress-agent-config
+  namespace: custom
+  labels:
+    helm.sh/chart: nginx-ingress-2.2.0
+    app.kubernetes.io/name: nginx-ingress
+    app.kubernetes.io/instance: plus-agent-all
+    app.kubernetes.io/version: "5.1.0"
+    app.kubernetes.io/managed-by: Helm
+data:
+  nginx-agent.conf: |-
+    
+    log:
+      # set log level (error, info, debug; default "info")
+      level: debug
+      # set log path. if empty, don't log to file.
+      path: ""
+    
+    allowed_directories:
+      - /etc/nginx
+      - /usr/lib/nginx/modules
+    
+    features:
+      - certificates
+      - connection
+      - metrics
+      - file-watcher
+    
+    ## command server settings
+    command:
+      server:
+        host: my-host.example.com
+        port: 8443
+      auth:
+        tokenpath: "/etc/nginx-agent/secrets/dataplane.key"
+      tls:
+        skip_verify: true
 /-/-/-/
+# Source: nginx-ingress/templates/controller-configmap.yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress-mgmt
-  namespace: default
+  name: plus-agent-all-nginx-ingress-mgmt
+  namespace: custom
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 data:
   license-token-secret-name: license-token
-  usage-report-proxy-host: "44.55.66.77:88"
 /-/-/-/
 # Source: nginx-ingress/templates/controller-leader-election-configmap.yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress-leader-election
-  namespace: default
+  name: plus-agent-all-nginx-ingress-leader-election
+  namespace: custom
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 /-/-/-/
@@ -7605,11 +9122,11 @@ metadata:
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress
+  name: plus-agent-all-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 rules:
@@ -7719,34 +9236,34 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress
+  name: plus-agent-all-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 subjects:
 - kind: ServiceAccount
-  name: plus-mgmt-proxy-host-auth-nginx-ingress
-  namespace: default
+  name: plus-agent-all-nginx-ingress
+  namespace: custom
 roleRef:
   kind: ClusterRole
-  name: plus-mgmt-proxy-host-auth-nginx-ingress
+  name: plus-agent-all-nginx-ingress
   apiGroup: rbac.authorization.k8s.io
 /-/-/-/
 # Source: nginx-ingress/templates/controller-role.yaml
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress
+  name: plus-agent-all-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
-  namespace: default
+  namespace: custom
 rules:
 - apiGroups:
   - ""
@@ -7784,7 +9301,7 @@ rules:
   resources:
   - leases
   resourceNames:
-  - plus-mgmt-proxy-host-auth-nginx-ingress-leader-election
+  - plus-agent-all-nginx-ingress-leader-election
   verbs:
   - get
   - update
@@ -7799,33 +9316,33 @@ rules:
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress
+  name: plus-agent-all-nginx-ingress
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
-  namespace: default
+  namespace: custom
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: plus-mgmt-proxy-host-auth-nginx-ingress
+  name: plus-agent-all-nginx-ingress
 subjects:
 - kind: ServiceAccount
-  name: plus-mgmt-proxy-host-auth-nginx-ingress
-  namespace: default
+  name: plus-agent-all-nginx-ingress
+  namespace: custom
 /-/-/-/
 # Source: nginx-ingress/templates/controller-service.yaml
 apiVersion: v1
 kind: Service
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress-controller
-  namespace: default
+  name: plus-agent-all-nginx-ingress-controller
+  namespace: custom
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -7844,18 +9361,18 @@ spec:
     nodePort: 
   selector:
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
 /-/-/-/
 # Source: nginx-ingress/templates/controller-deployment.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress-controller
-  namespace: default
+  name: plus-agent-all-nginx-ingress-controller
+  namespace: custom
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -7863,19 +9380,27 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: nginx-ingress
-      app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+      app.kubernetes.io/instance: plus-agent-all
   template:
     metadata:
       labels:
         app.kubernetes.io/name: nginx-ingress
-        app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+        app.kubernetes.io/instance: plus-agent-all
+        agent-configuration-revision-hash: "8c900020"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9113"
         prometheus.io/scheme: "http"
     spec:      
-      volumes: []
-      serviceAccountName: plus-mgmt-proxy-host-auth-nginx-ingress
+      volumes:
+      
+      - name: agent-conf
+        configMap:
+          name: plus-agent-all-nginx-ingress-agent-config
+      - name: dataplane-key
+        secret:
+          secretName: dataplane-key
+      serviceAccountName: plus-agent-all-nginx-ingress
       automountServiceAccountToken: true
       securityContext:
         seccompProfile:
@@ -7918,7 +9443,13 @@ spec:
             - ALL
             add:
             - NET_BIND_SERVICE        
-        volumeMounts: []
+        volumeMounts:
+        
+        - name: agent-conf
+          mountPath: /etc/nginx-agent/nginx-agent.conf
+          subPath: nginx-agent.conf
+        - name: dataplane-key
+          mountPath: /etc/nginx-agent/secrets
         env:
         - name: POD_NAMESPACE
           valueFrom:
@@ -7928,24 +9459,14 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
-        - name: PROXY_USER
-          valueFrom:
-            secretKeyRef:
-              name: custom-credentials
-              key: username
-        - name: PROXY_PASS
-          valueFrom:
-            secretKeyRef:
-              name: custom-credentials
-              key: password
         args:
           
           - -nginx-plus=true
           - -nginx-reload-timeout=60000
           - -enable-app-protect=false
           - -enable-app-protect-dos=false
-          - -nginx-configmaps=$(POD_NAMESPACE)/plus-mgmt-proxy-host-auth-nginx-ingress
-          - -mgmt-configmap=$(POD_NAMESPACE)/plus-mgmt-proxy-host-auth-nginx-ingress-mgmt
+          - -nginx-configmaps=$(POD_NAMESPACE)/plus-agent-all-nginx-ingress
+          - -mgmt-configmap=$(POD_NAMESPACE)/plus-agent-all-nginx-ingress-mgmt
           - -ingress-class=nginx
           - -health-status=false
           - -health-status-uri=/nginx-health
@@ -7956,9 +9477,9 @@ spec:
           - -nginx-status-port=8080
           - -nginx-status-allow-cidrs=127.0.0.1
           - -report-ingress-status
-          - -external-service=plus-mgmt-proxy-host-auth-nginx-ingress-controller
+          - -external-service=plus-agent-all-nginx-ingress-controller
           - -enable-leader-election=true
-          - -leader-election-lock-name=plus-mgmt-proxy-host-auth-nginx-ingress-leader-election
+          - -leader-election-lock-name=plus-agent-all-nginx-ingress-leader-election
           - -enable-prometheus-metrics=true
           - -prometheus-metrics-listen-port=9113
           - -prometheus-tls-secret=
@@ -7980,6 +9501,7 @@ spec:
           - -ssl-dynamic-reload=true
           - -enable-telemetry-reporting=true
           - -weight-changes-dynamic-reload=false
+          - -agent=true
 /-/-/-/
 # Source: nginx-ingress/templates/controller-ingress-class.yaml
 apiVersion: networking.k8s.io/v1
@@ -7989,7 +9511,7 @@ metadata:
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 spec:
@@ -7999,12 +9521,12 @@ spec:
 apiVersion: coordination.k8s.io/v1
 kind: Lease
 metadata:
-  name: plus-mgmt-proxy-host-auth-nginx-ingress-leader-election
-  namespace: default
+  name: plus-agent-all-nginx-ingress-leader-election
+  namespace: custom
   labels:
     helm.sh/chart: nginx-ingress-2.2.0
     app.kubernetes.io/name: nginx-ingress
-    app.kubernetes.io/instance: plus-mgmt-proxy-host-auth
+    app.kubernetes.io/instance: plus-agent-all
     app.kubernetes.io/version: "5.1.0"
     app.kubernetes.io/managed-by: Helm
 ---
diff --git a/charts/tests/helmunit_test.go b/charts/tests/helmunit_test.go
index 4585aace9..208c7a6fe 100644
--- a/charts/tests/helmunit_test.go
+++ b/charts/tests/helmunit_test.go
@@ -105,6 +105,21 @@ func TestHelmNICTemplate(t *testing.T) {
 			releaseName: "appprotect-dos",
 			namespace:   "appprotect-dos",
 		},
+		"ossAgentV3": {
+			valuesFile:  "testdata/oss-agentv3.yaml",
+			releaseName: "oss-agent",
+			namespace:   "default",
+		},
+		"plusAgentV3": {
+			valuesFile:  "testdata/plus-agentv3.yaml",
+			releaseName: "plus-agent",
+			namespace:   "default",
+		},
+		"plusAgentV3All": {
+			valuesFile:  "testdata/plus-agentv3-all.yaml",
+			releaseName: "plus-agent-all",
+			namespace:   "custom",
+		},
 		"appProtectWAFV5AgentV2": {
 			valuesFile:  "testdata/app-protect-wafv5-agentv2.yaml",
 			releaseName: "app-protect-wafv5-agentv2",
diff --git a/charts/tests/testdata/oss-agentv3.yaml b/charts/tests/testdata/oss-agentv3.yaml
new file mode 100644
index 000000000..f6023004d
--- /dev/null
+++ b/charts/tests/testdata/oss-agentv3.yaml
@@ -0,0 +1,3 @@
+nginxAgent:
+  enable: true
+  dataplaneKeySecretName: "dataplane-key" # secret ref
diff --git a/charts/tests/testdata/plus-agentv3-all.yaml b/charts/tests/testdata/plus-agentv3-all.yaml
new file mode 100644
index 000000000..1e289dca2
--- /dev/null
+++ b/charts/tests/testdata/plus-agentv3-all.yaml
@@ -0,0 +1,9 @@
+controller:
+  nginxplus: true
+nginxAgent:
+  enable: true
+  dataplaneKeySecretName: "dataplane-key" # secret ref
+  tlsSkipVerify: true
+  logLevel: debug
+  endpointHost: my-host.example.com
+  endpointPort: 8443
diff --git a/charts/tests/testdata/plus-agentv3.yaml b/charts/tests/testdata/plus-agentv3.yaml
new file mode 100644
index 000000000..65c646f8e
--- /dev/null
+++ b/charts/tests/testdata/plus-agentv3.yaml
@@ -0,0 +1,5 @@
+controller:
+  nginxplus: true
+nginxAgent:
+  enable: true
+  dataplaneKeySecretName: "dataplane-key" # secret ref
diff --git a/tests/suite/test_agent.py b/tests/suite/test_agent.py
new file mode 100644
index 000000000..30e2658a5
--- /dev/null
+++ b/tests/suite/test_agent.py
@@ -0,0 +1,47 @@
+import pytest
+from kubernetes.stream import stream
+from suite.utils.resources_utils import get_first_pod_name, wait_before_test
+
+
+@pytest.mark.agentv3
+@pytest.mark.parametrize(
+    "ingress_controller",
+    [
+        {
+            "extra_args": [
+                f"-agent=true",
+            ]
+        }
+    ],
+    indirect=["ingress_controller"],
+)
+class TestAgentV3:
+    def test_agent(self, kube_apis, ingress_controller_prerequisites, ingress_controller):
+        pod_name = get_first_pod_name(kube_apis.v1, "nginx-ingress")
+        log = kube_apis.v1.read_namespaced_pod_log(pod_name, ingress_controller_prerequisites.namespace)
+
+        command = ["/usr/bin/nginx-agent", "-v"]
+        retries = 0
+        while retries <= 3:
+            wait_before_test()
+            try:
+                resp = stream(
+                    kube_apis.v1.connect_get_namespaced_pod_exec,
+                    pod_name,
+                    ingress_controller_prerequisites.namespace,
+                    command=command,
+                    stderr=True,
+                    stdin=False,
+                    stdout=True,
+                    tty=False,
+                )
+                break
+            except Exception as e:
+                print(f"Error: {e}")
+                retries += 1
+                if retries == 3:
+                    raise e
+        result_conf = str(resp)
+
+        assert f"Failed to get nginx-agent version: fork/exec /usr/bin/nginx-agent" not in log
+        assert "nginx-agent version v3" in result_conf
diff --git a/tests/suite/test_agent_app_protect.py b/tests/suite/test_app_protect_agent.py
similarity index 100%
rename from tests/suite/test_agent_app_protect.py
rename to tests/suite/test_app_protect_agent.py