Skip to content

Commit 2e34418

Browse files
AlexFenlonAlexFenlon
authored
Merge branch 'main' into chore/allow-easier-nap-agent-updates
Signed-off-by: AlexFenlon <[email protected]>
2 parents 4b1b962 + 577c2ef commit 2e34418

File tree

17 files changed

+169
-63
lines changed

17 files changed

+169
-63
lines changed

‎.github/actions/smoke-tests/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ runs:
5252
- name: Deploy Kubernetes
5353
id: k8s
5454
run: |
55-
make -f tests/Makefile create-kind-cluster K8S_CLUSTER_NAME=${{ github.run_id }} K8S_CLUSTER_VERSION=${{ inputs.k8s-version }} K8S_TIMEOUT=${{ inputs.k8s-timeout }}
55+
make -f tests/Makefile create-kind-cluster K8S_CLUSTER_NAME=${{ github.run_id }} K8S_CLUSTER_VERSION=v${{ inputs.k8s-version }} K8S_TIMEOUT=${{ inputs.k8s-timeout }}
5656
make -f tests/Makefile image-load REGISTRY="" PREFIX=${{ inputs.image-name }} TAG=${{ inputs.tag }} K8S_CLUSTER_NAME=${{ github.run_id }}
5757
label="${{ inputs.label }}"
5858
nospaces="${label// /_}"

‎.github/scripts/binary-json.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
3+
set -eo pipefail
4+
5+
path=${1:-dist/}
6+
project=${2:-kubernetes-ingress}
7+
binary_name=${3:-nginx-ingress}
8+
9+
if [ -z "$path" ] || [ -z "$project" ]; then
10+
echo "Usage: $0 <path> <project>"
11+
exit 1
12+
fi
13+
14+
15+
json='[]'
16+
for bin in $(find "$path" -type f -name "$binary_name"); do
17+
dir=$(basename "$(dirname $bin)")
18+
if [[ "$dir" =~ ${project}_([a-zA-Z0-9]+)_([a-zA-Z0-9]+) ]]; then
19+
os="${BASH_REMATCH[1]}"
20+
arch="${BASH_REMATCH[2]}"
21+
digest=$(sha256sum "$bin" | cut -d' ' -f1)
22+
json=$(echo "$json" | jq -c --arg path "$bin" --arg os "$os" --arg arch "$arch" --arg digest "$digest" '. += [{"path": $path, "os": $os, "arch": $arch, "digest": $digest}]')
23+
fi
24+
done
25+
echo "$json"

‎.github/scripts/requirements.txt‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
#
55
# pip-compile --generate-hashes --output-file=requirements.txt requirements.in
66
#
7-
certifi==2025.6.15 \
8-
--hash=sha256:2e0c7ce7cb5d8f8634ca55d2ba7e6ec2689a2fd6537d8dec1296a477a4910057 \
9-
--hash=sha256:d747aa5a8b9bbbb1bb8c22bb13e22bd1f18e9796defa16bab421f7f7a317323b
7+
certifi==2025.8.3 \
8+
--hash=sha256:e564105f78ded564e3ae7c923924435e1daa7463faeab5bb932bc53ffae63407 \
9+
--hash=sha256:f6c12493cfb1b06ba2ff328595af9350c65d6644968e5d3a2ffd78699af217a5
1010
# via requests
1111
cffi==1.17.1 \
1212
--hash=sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8 \
@@ -304,9 +304,9 @@ markupsafe==3.0.2 \
304304
--hash=sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430 \
305305
--hash=sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50
306306
# via jinja2
307-
pycparser==2.22 \
308-
--hash=sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6 \
309-
--hash=sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc
307+
pycparser==2.23 \
308+
--hash=sha256:78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2 \
309+
--hash=sha256:e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934
310310
# via cffi
311311
pygithub==2.6.1 \
312312
--hash=sha256:6f2fa6d076ccae475f9fc392cc6cdbd54db985d4f69b8833a28397de75ed6ca3 \

‎.github/workflows/build-artifacts.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@ jobs:
5858
permissions:
5959
contents: read
6060
id-token: write
61+
outputs:
62+
json: ${{ steps.nic_binaries.outputs.json }}
6163
steps:
6264
- name: Checkout Repository
6365
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -100,13 +102,94 @@ jobs:
100102
GORELEASER_CURRENT_TAG: "v${{ inputs.ic-version }}"
101103
if: ${{ inputs.force }}
102104

105+
- name: Extract NGINX Ingress Controller binary info
106+
id: nic_binaries
107+
run: |
108+
echo "json=$(.github/scripts/binary-json.sh ${{ github.workspace }}/dist ${{ github.event.repository.name }} "nginx-ingress")" >> $GITHUB_OUTPUT
109+
if: ${{ inputs.force }}
110+
103111
- name: Store Artifacts in Cache
104112
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
105113
with:
106114
path: ${{ github.workspace }}/dist
107115
key: nginx-ingress-${{ inputs.go-md5 }}
108116
if: ${{ inputs.force }}
109117

118+
generate-assertion-doc:
119+
if: ${{ github.event_name != 'pull_request' }}
120+
name: Assertion Doc ${{ matrix.nic.arch }}
121+
needs: [binaries]
122+
runs-on: ${{ inputs.runner }}
123+
permissions:
124+
contents: read
125+
id-token: write # for compliance-rules action to sign assertion doc
126+
strategy:
127+
fail-fast: false
128+
matrix:
129+
nic: ${{ fromJSON( needs.binaries.outputs.json ) }}
130+
steps:
131+
- name: Checkout Repository
132+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
133+
with:
134+
ref: ${{ inputs.branch }}
135+
136+
- name: Setup Golang Environment
137+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
138+
with:
139+
go-version-file: go.mod
140+
141+
- name: Setup netrc
142+
run: |
143+
cat <<EOF > $HOME/.netrc
144+
machine azr.artifactory.f5net.com
145+
login ${{ secrets.ARTIFACTORY_USER }}
146+
password ${{ secrets.ARTIFACTORY_TOKEN }}
147+
EOF
148+
chmod 600 $HOME/.netrc
149+
150+
- name: Fetch Cached Artifacts
151+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
152+
with:
153+
path: ${{ github.workspace }}/dist
154+
key: nginx-ingress-${{ inputs.go-md5 }}
155+
fail-on-cache-miss: true
156+
157+
- name: List packages in Go binary
158+
id: godeps
159+
env:
160+
GOPATH: ${{ inputs.go-path }}
161+
GOPROXY: ${{ inputs.go-proxy }}
162+
run: |
163+
go version -m ${{ matrix.nic.path }} > go_version_out_${{ github.run_id }}_${{ github.run_number }}.txt
164+
echo "go_version_out=$(find -type f -name "go_version_out*.txt" | head -n 1)" >> $GITHUB_OUTPUT
165+
echo "artifact_digest=$(openssl dgst -sha256 -r ${{ matrix.nic.path }} | cut -d ' ' -f 1)" >> $GITHUB_OUTPUT
166+
cat $GITHUB_OUTPUT
167+
168+
- name: Generate Assertion Document
169+
id: assertiondoc
170+
uses: nginxinc/compliance-rules/.github/actions/assertion@83e452166aaf0ad8f07caf91a4f1f903b3dea1e6 # v0.3.0
171+
with:
172+
artifact-name: "${{ github.event.repository.name }}_${{ github.sha }}_${{ github.run_number }}_${{ matrix.nic.os }}_${{ matrix.nic.arch }}"
173+
artifact-digest: ${{ steps.godeps.outputs.artifact_digest }}
174+
build-type: "github.com"
175+
builder-id: "github"
176+
builder-version: v0.1.0
177+
started-on: ${{ github.event.head_commit.timestamp || github.event.created_at }}
178+
finished-on: ${{ github.event.head_commit.timestamp || github.event.created_at }}
179+
invocation-id: ${{ github.run_id }}.${{ github.run_number }}.${{ github.run_attempt }}
180+
artifactory-user: ${{ secrets.ARTIFACTORY_USER }}
181+
artifactory-api-token: ${{ secrets.ARTIFACTORY_TOKEN }}
182+
artifactory-url: ${{ secrets.ARTIFACTORY_URL }}
183+
artifactory-repo: 'f5-nginx-go-local-approved-dependency'
184+
assertion-doc-file: assertion_${{ github.event.repository.name }}_${{ github.sha }}_${{ github.run_id }}_${{ github.run_number }}_${{ matrix.nic.os }}_${{ matrix.nic.arch }}.json
185+
build-content-path: ${{ steps.godeps.outputs.go_version_out }}
186+
187+
- name: Sign and Store Assertion Document
188+
id: sign
189+
uses: nginxinc/compliance-rules/.github/actions/sign@83e452166aaf0ad8f07caf91a4f1f903b3dea1e6 # v0.3.0
190+
with:
191+
assertion-doc: ${{ steps.assertiondoc.outputs.assertion-document-path }}
192+
110193
build-docker:
111194
name: Build Docker OSS
112195
needs: [binaries]

‎.github/workflows/regression.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -275,7 +275,7 @@ jobs:
275275
276276
- name: Generate WAF v5 tgz from JSON
277277
run: |
278-
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.8.0 -p /data/wafv5.json -o /data/wafv5.tgz
278+
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.9.0 -p /data/wafv5.json -o /data/wafv5.tgz
279279
if: ${{ contains(matrix.images.image, 'nap-v5')}}
280280

281281
- name: Run Regression Tests

‎.github/workflows/scorecards.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
persist-credentials: false
3535

3636
- name: "Run analysis"
37-
uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
37+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
3838
with:
3939
results_file: results.sarif
4040
results_format: sarif

‎.github/workflows/setup-smoke.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ jobs:
152152

153153
- name: Generate WAF v5 tgz from JSON
154154
run: |
155-
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.8.0 -p /data/wafv5.json -o /data/wafv5.tgz
155+
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.9.0 -p /data/wafv5.json -o /data/wafv5.tgz
156156
if: ${{ contains(inputs.image, 'nap-v5')}}
157157

158158
- name: Run Smoke Tests

‎Makefile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ GIT_TAG = $(shell git describe --exact-match --tags || echo untagged)
44
VERSION = $(VER)-SNAPSHOT
55
NGINX_OSS_VERSION ?= 1.29
66
NGINX_PLUS_VERSION ?= R35
7-
NAP_WAF_VERSION ?= 35+5.498
8-
NAP_WAF_COMMON_VERSION ?= 11.533
9-
NAP_WAF_PLUGIN_VERSION ?= 6.20.0
7+
NAP_WAF_VERSION ?= 35+5.527
8+
NAP_WAF_COMMON_VERSION ?= 11.559
9+
NAP_WAF_PLUGIN_VERSION ?= 6.23.0
1010
NAP_AGENT_VERSION ?= 2
1111
NGINX_AGENT_VERSION ?= 3.3
1212
PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key

‎build/Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
ARG BUILD_OS=debian
33
ARG NGINX_OSS_VERSION=1.29
44
ARG NGINX_PLUS_VERSION=R35
5-
ARG NAP_WAF_VERSION=35+5.498
6-
ARG NAP_WAF_COMMON_VERSION=11.533
7-
ARG NAP_WAF_PLUGIN_VERSION=6.20.0
5+
ARG NAP_WAF_VERSION=35+5.527
6+
ARG NAP_WAF_COMMON_VERSION=11.559
7+
ARG NAP_WAF_PLUGIN_VERSION=6.23.0
88
ARG NGINX_AGENT_VERSION=3.3
99
ARG NAP_AGENT_VERSION=2
1010
ARG DOWNLOAD_TAG=edge

‎charts/nginx-ingress/values.schema.json‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -350,10 +350,10 @@
350350
},
351351
"tag": {
352352
"type": "string",
353-
"default": "5.8.0",
353+
"default": "5.9.0",
354354
"title": "The tag of the App Protect WAF v5 Enforcer image",
355355
"examples": [
356-
"5.8.0"
356+
"5.9.0"
357357
]
358358
},
359359
"digest": {
@@ -389,7 +389,7 @@
389389
"examples": [
390390
{
391391
"repository": "private-registry.nginx.com/nap/waf-enforcer",
392-
"tag": "5.8.0",
392+
"tag": "5.9.0",
393393
"pullPolicy": "IfNotPresent"
394394
}
395395
]
@@ -422,10 +422,10 @@
422422
},
423423
"tag": {
424424
"type": "string",
425-
"default": "5.8.0",
425+
"default": "5.9.0",
426426
"title": "The tag of the App Protect WAF v5 Config Manager image",
427427
"examples": [
428-
"5.8.0"
428+
"5.9.0"
429429
]
430430
},
431431
"digest": {
@@ -461,7 +461,7 @@
461461
"examples": [
462462
{
463463
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
464-
"tag": "5.8.0",
464+
"tag": "5.9.0",
465465
"pullPolicy": "IfNotPresent"
466466
}
467467
]
@@ -2020,15 +2020,15 @@
20202020
"port": 50000,
20212021
"image": {
20222022
"repository": "private-registry.nginx.com/nap/waf-enforcer",
2023-
"tag": "5.8.0",
2023+
"tag": "5.9.0",
20242024
"pullPolicy": "IfNotPresent"
20252025
},
20262026
"securityContext": {}
20272027
},
20282028
"configManager": {
20292029
"image": {
20302030
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
2031-
"tag": "5.8.0",
2031+
"tag": "5.9.0",
20322032
"pullPolicy": "IfNotPresent"
20332033
},
20342034
"securityContext": {
@@ -2660,15 +2660,15 @@
26602660
"port": 50000,
26612661
"image": {
26622662
"repository": "private-registry.nginx.com/nap/waf-enforcer",
2663-
"tag": "5.8.0",
2663+
"tag": "5.9.0",
26642664
"pullPolicy": "IfNotPresent"
26652665
},
26662666
"securityContext": {}
26672667
},
26682668
"configManager": {
26692669
"image": {
26702670
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
2671-
"tag": "5.8.0",
2671+
"tag": "5.9.0",
26722672
"pullPolicy": "IfNotPresent"
26732673
},
26742674
"securityContext": {

0 commit comments

Comments
 (0)