Skip to content

Commit 43c02bc

Browse files
AlexFenlonAlexFenlon
committed
Merge remote-tracking branch 'origin/main' into chore/allow-easier-nap-agent-updates
# Conflicts: # Makefile # build/Dockerfile
2 parents c646ca9 + 3deb7c4 commit 43c02bc

File tree

2 files changed

+63
-23
lines changed

2 files changed

+63
-23
lines changed

‎Makefile‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,11 @@ GIT_TAG = $(shell git describe --exact-match --tags || echo untagged)
44
VERSION = $(VER)-SNAPSHOT
55
NGINX_OSS_VERSION ?= 1.29
66
NGINX_PLUS_VERSION ?= R35
7-
NGINX_AGENT_VERSION ?= 3.3
7+
NAP_WAF_VERSION ?= 35+5.498
8+
NAP_WAF_COMMON_VERSION ?= 11.533
9+
NAP_WAF_PLUGIN_VERSION ?= 6.20.0
810
NAP_AGENT_VERSION ?= 2
11+
NGINX_AGENT_VERSION ?= 3.3
912
PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key
1013

1114
# Variables that can be overridden
@@ -156,32 +159,37 @@ alpine-image-plus-fips: build ## Create Docker image for Ingress Controller (Alp
156159

157160
.PHONY: alpine-image-nap-plus-fips
158161
alpine-image-nap-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAF and FIPS)
159-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
162+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
160163

161164
.PHONY: alpine-image-nap-v5-plus-fips
162165
alpine-image-nap-v5-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAFv5 and FIPS)
163166
$(DOCKER_CMD) $(PLUS_ARGS) \
164-
--build-arg BUILD_OS=alpine-plus-nap-v5-fips --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
167+
--build-arg BUILD_OS=alpine-plus-nap-v5-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
165168

166169
.PHONY: debian-image-plus
167170
debian-image-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus)
168171
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus --build-arg NGINX_AGENT_VERSION=$(NGINX_AGENT_VERSION)
169172

170173
.PHONY: debian-image-nap-plus
171174
debian-image-nap-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAF)
172-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
175+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf \
176+
--build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) \
177+
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
173178

174179
.PHONY: debian-image-nap-v5-plus
175180
debian-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAFv5)
176-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap-v5 --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
181+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) \
182+
--build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
177183

178184
.PHONY: debian-image-dos-plus
179185
debian-image-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect DoS)
180186
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=dos
181187

182188
.PHONY: debian-image-nap-dos-plus
183189
debian-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus, NGINX App Protect WAF and DoS)
184-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
190+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos \
191+
--build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) \
192+
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
185193

186194
.PHONY: ubi-image
187195
ubi-image: build ## Create Docker image for Ingress Controller (UBI)
@@ -193,29 +201,33 @@ ubi-image-plus: build ## Create Docker image for Ingress Controller (UBI with NG
193201

194202
.PHONY: ubi-image-nap-plus
195203
ubi-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
196-
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=waf --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
204+
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
205+
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
197206

198207
.PHONY: ubi8-image-nap-plus
199208
ubi8-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
200-
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-8-plus-nap --build-arg NAP_MODULES=waf --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
209+
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-8-plus-nap \
210+
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
201211

202212
.PHONY: ubi-image-nap-v5-plus
203213
ubi-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
204214
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
205-
--build-arg BUILD_OS=ubi-9-plus-nap-v5 --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
215+
--build-arg BUILD_OS=ubi-9-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
206216

207217
.PHONY: ubi8-image-nap-v5-plus
208218
ubi8-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
209219
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
210-
--build-arg BUILD_OS=ubi-8-plus-nap-v5 --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
220+
--build-arg BUILD_OS=ubi-8-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
211221

212222
.PHONY: ubi-image-dos-plus
213223
ubi-image-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect DoS)
214-
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=dos
224+
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
225+
--build-arg NAP_MODULES=dos
215226

216227
.PHONY: ubi-image-nap-dos-plus
217228
ubi-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus, NGINX App Protect WAF and DoS)
218-
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=waf,dos --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
229+
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
230+
--build-arg NAP_MODULES=waf,dos --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
219231

220232
.PHONY: all-images ## Create all the Docker images for Ingress Controller
221233
all-images: alpine-image alpine-image-plus alpine-image-plus-fips alpine-image-nap-plus-fips debian-image debian-image-plus debian-image-nap-plus debian-image-dos-plus debian-image-nap-dos-plus ubi-image ubi-image-plus ubi-image-nap-plus ubi-image-dos-plus ubi-image-nap-dos-plus

‎build/Dockerfile‎

Lines changed: 39 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
ARG BUILD_OS=debian
33
ARG NGINX_OSS_VERSION=1.29
44
ARG NGINX_PLUS_VERSION=R35
5+
ARG NAP_WAF_VERSION=35+5.498
6+
ARG NAP_WAF_COMMON_VERSION=11.533
7+
ARG NAP_WAF_PLUGIN_VERSION=6.20.0
58
ARG NGINX_AGENT_VERSION=3.3
69
ARG NAP_AGENT_VERSION=2
710
ARG DOWNLOAD_TAG=edge
@@ -12,8 +15,8 @@ ARG PACKAGE_REPO=pkgs.nginx.com
1215

1316

1417
############################################# Base images containing libs for FIPS #############################################
15-
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi8@sha256:1253fe92cb86359f8b3433e4fdb1a07eef5a6e04d27c050edf00e98ffd283742 AS ubi8-packages
16-
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:625782628d499ae83b9781968db1cfb91bed128ac07116c938957d9a25db82a9 AS ubi9-packages
18+
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi8@sha256:8d0c9d6ec488e7f393d4563fa6ac82b572873fe691eb7e6e9c86366373f4273d AS ubi8-packages
19+
FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:073c40696d255cbc11aff52473f975e99c8253e0982da7f42d9f70b567b31eb2 AS ubi9-packages
1720
FROM ghcr.io/nginx/alpine-fips:0.4.0-alpine3.19@sha256:0b400b81b5f403d69535a54839296ae35ced374eb1bb04db5b4282f380fef09a AS alpine-fips-3.19
1821
FROM ghcr.io/nginx/alpine-fips:0.4.0-alpine3.22@sha256:61ed75f252bde7da1e6db33d2709456e87478280dfae3d11084f94c361e9f329 AS alpine-fips-3.22
1922
FROM redhat/ubi9-minimal:9.6@sha256:7c5495d5fad59aaee12abc3cbbd2b283818ee1e814b00dbc7f25bf2d14fa4f0c AS ubi-minimal
@@ -208,6 +211,7 @@ RUN --mount=type=bind,from=alpine-fips-3.22,target=/tmp/fips/ \
208211
############################################# Base image for Alpine with NGINX Plus, App Protect WAF and FIPS #############################################
209212
FROM alpine:3.19@sha256:3be987e6cde1d07e873c012bf6cfe941e6e85d16ca5fc5b8bedc675451d2de67 AS alpine-plus-nap-fips
210213
ARG NGINX_PLUS_VERSION
214+
ARG NAP_WAF_VERSION
211215
ARG PACKAGE_REPO
212216
ARG NAP_AGENT_VERSION
213217

@@ -233,7 +237,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
233237
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
234238
&& mkdir -p /etc/nginx/reporting/ \
235239
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
236-
&& apk add --no-cache app-protect app-protect-attack-signatures app-protect-threat-campaigns \
240+
&& apk add --no-cache app-protect~=${NAP_WAF_VERSION/+/.} app-protect-attack-signatures app-protect-threat-campaigns \
237241
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
238242
&& nap-waf.sh \
239243
agent.sh
@@ -243,6 +247,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
243247
FROM alpine:3.19@sha256:3be987e6cde1d07e873c012bf6cfe941e6e85d16ca5fc5b8bedc675451d2de67 AS alpine-plus-nap-v5-fips
244248
ARG NGINX_PLUS_VERSION
245249
ARG PACKAGE_REPO
250+
ARG NAP_WAF_VERSION
246251
ARG NAP_AGENT_VERSION
247252

248253
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -265,14 +270,14 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
265270
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
266271
&& mkdir -p /etc/nginx/reporting/ \
267272
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
268-
&& apk add --no-cache app-protect-module-plus~=35.5.498 \
273+
&& apk add --no-cache app-protect-module-plus~=${NAP_WAF_VERSION/+/.} \
269274
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
270275
&& nap-waf.sh \
271276
agent.sh
272277

273278

274279
############################################# Base image for Debian with NGINX Plus only #############################################
275-
FROM debian:12-slim@sha256:df52e55e3361a81ac1bead266f3373ee55d29aa50cf0975d440c2be3483d8ed3 AS debian-plus-only
280+
FROM debian:12-slim@sha256:7e490910eea2861b9664577a96b54ce68ea3e02ce7f51d89cb0103a6f9c386e0 AS debian-plus-only
276281
ARG NGINX_PLUS_VERSION
277282

278283
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -324,6 +329,9 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
324329
FROM debian-plus-only AS debian-plus-nap
325330
ARG NAP_MODULES
326331
ARG NGINX_PLUS_VERSION
332+
ARG NAP_WAF_VERSION
333+
ARG NAP_WAF_COMMON_VERSION
334+
ARG NAP_WAF_PLUGIN_VERSION
327335
ARG NAP_AGENT_VERSION
328336

329337
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -341,7 +349,15 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
341349
cp /tmp/app-protect.sources /etc/apt/sources.list.d/app-protect.sources \
342350
&& cp /tmp/nginx-agent.sources /etc/apt/sources.list.d/nginx-agent.sources \
343351
&& apt-get update \
344-
&& apt-get install --no-install-recommends --no-install-suggests -y app-protect app-protect-attack-signatures app-protect-threat-campaigns nginx-agent=${NAP_AGENT_VERSION}* \
352+
&& apt-get install --no-install-recommends --no-install-suggests -y app-protect=${NAP_WAF_VERSION}* \
353+
nginx-plus-module-appprotect=${NAP_WAF_VERSION}* \
354+
app-protect-engine=${NAP_WAF_COMMON_VERSION}* \
355+
app-protect-common=${NAP_WAF_COMMON_VERSION}* \
356+
app-protect-compiler=${NAP_WAF_COMMON_VERSION}* \
357+
app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
358+
app-protect-attack-signatures \
359+
app-protect-threat-campaigns \
360+
nginx-agent=${NAP_AGENT_VERSION}* \
345361
&& rm -f /etc/apt/sources.list.d/app-protect.sources /etc/apt/sources.list.d/nginx-agent.sources \
346362
&& nap-waf.sh \
347363
&& agent.sh; \
@@ -358,6 +374,8 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
358374
############################################# Base image for Debian with NGINX Plus and App Protect WAFv5 #############################################
359375
FROM debian-plus-only AS debian-plus-nap-v5
360376
ARG NGINX_PLUS_VERSION
377+
ARG NAP_WAF_VERSION
378+
ARG NAP_WAF_PLUGIN_VERSION
361379
ARG NAP_AGENT_VERSION
362380

363381
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -370,7 +388,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
370388
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
371389
--mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/etc/apt/sources.list.d/nginx-agent.sources \
372390
apt-get update \
373-
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=${NAP_AGENT_VERSION}* app-protect-module-plus=35+5.498* nginx-plus-module-appprotect=35+5.498* app-protect-plugin=6.20.0* \
391+
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=${NAP_AGENT_VERSION}* app-protect-module-plus=${NAP_WAF_VERSION}* nginx-plus-module-appprotect=${NAP_WAF_VERSION}* app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
374392
&& nap-waf.sh \
375393
&& agent.sh
376394

@@ -405,8 +423,12 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
405423
FROM ubi-minimal AS ubi-9-plus-nap
406424
ARG NAP_MODULES
407425
ARG BUILD_OS
426+
ARG NGINX_PLUS_VERSION
427+
ARG NAP_WAF_VERSION
408428
ARG NAP_AGENT_VERSION
409429

430+
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
431+
410432
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
411433
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
412434
--mount=type=secret,id=rhel_license,dst=/tmp/rhel_license,mode=0644 \
@@ -436,7 +458,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
436458
rpm --import /tmp/app-protect-security-updates.key \
437459
&& cp /tmp/app-protect-9.repo /etc/yum.repos.d/app-protect-9.repo \
438460
&& microdnf --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms --nodocs install -y \
439-
app-protect app-protect-attack-signatures app-protect-threat-campaigns \
461+
app-protect-${NAP_WAF_VERSION}* app-protect-attack-signatures app-protect-threat-campaigns \
440462
&& rm -f /etc/yum.repos.d/app-protect-9.repo \
441463
&& nap-waf.sh \
442464
&& agent.sh; \
@@ -453,8 +475,12 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
453475

454476
############################################# Base image for UBI with NGINX Plus and App Protect WAFv5 #############################################
455477
FROM ubi-minimal AS ubi-9-plus-nap-v5
478+
ARG NGINX_PLUS_VERSION
479+
ARG NAP_WAF_VERSION
456480
ARG NAP_AGENT_VERSION
457481

482+
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
483+
458484
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
459485
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
460486
--mount=type=secret,id=rhel_license,dst=/tmp/rhel_license,mode=0644 \
@@ -475,7 +501,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
475501
&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
476502
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
477503
&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
478-
&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-${NAP_AGENT_VERSION}* app-protect-module-plus-35+5.498* \
504+
&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-${NAP_AGENT_VERSION}* app-protect-module-plus-${NAP_WAF_VERSION}* \
479505
&& nap-waf.sh \
480506
&& ubi-clean.sh \
481507
&& agent.sh
@@ -484,6 +510,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
484510
############################################# Base image for UBI8 with NGINX Plus and App Protect WAF #############################################
485511
FROM redhat/ubi8@sha256:534c2c0efa4150ede18e3f9d7480d3b9ec2a52e62bc91cd54e08ee7336819619 AS ubi-8-plus-nap
486512
ARG NGINX_PLUS_VERSION
513+
ARG NAP_WAF_VERSION
487514
ARG BUILD_OS
488515
ARG NAP_AGENT_VERSION
489516

@@ -514,7 +541,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
514541
&& subscription-manager attach \
515542
&& dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \
516543
&& dnf --nodocs install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
517-
&& dnf --nodocs install -y app-protect app-protect-attack-signatures app-protect-threat-campaigns \
544+
&& dnf --nodocs install -y app-protect-${NAP_WAF_VERSION}* app-protect-attack-signatures app-protect-threat-campaigns \
518545
&& subscription-manager unregister \
519546
&& nap-waf.sh \
520547
&& agent.sh \
@@ -524,6 +551,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
524551
############################################# Base image for UBI8 with NGINX Plus and App Protect WAFv5 #############################################
525552
FROM redhat/ubi8@sha256:534c2c0efa4150ede18e3f9d7480d3b9ec2a52e62bc91cd54e08ee7336819619 AS ubi-8-plus-nap-v5
526553
ARG NGINX_PLUS_VERSION
554+
ARG NAP_WAF_VERSION
527555
ARG NAP_AGENT_VERSION
528556

529557
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -547,7 +575,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
547575
&& rpm --import /tmp/nginx_signing.key \
548576
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
549577
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NAP_AGENT_VERSION}* \
550-
&& dnf --nodocs install -y app-protect-module-plus-35+5.498* \
578+
&& dnf --nodocs install -y app-protect-module-plus-${NAP_WAF_VERSION}* \
551579
&& nap-waf.sh \
552580
&& agent.sh \
553581
&& dnf clean all

0 commit comments

Comments
 (0)