Skip to content

Commit 45d9631

Browse files
pdabelf5pdabelf5
authored
update NGINX Plus to R34 and App Protect to 4.14 & 5.6 (#7597)
* update NGINX Plus to R34 and App Protect to 4.14 & 5.6 * Revert "temporarily disable builds failing for NAP WAF v4 on UBI (#7606)"
1 parent 24bf43c commit 45d9631

File tree

16 files changed

+56
-36
lines changed

16 files changed

+56
-36
lines changed

‎.github/config/config-gcr-retag‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
export TARGET_REGISTRY=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev
22
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips" "-mktpl")
3-
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-mktpl" "-alpine-fips")
3+
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-mktpl" "-alpine-fips")
44
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
55
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
6-
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-mktpl")
6+
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
77
declare -a ADDITIONAL_TAGS=()

‎.github/config/config-plus-gcr-release‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
export TARGET_REGISTRY=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release
22
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips" "-mktpl")
3-
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-alpine-fips" "-mktpl")
3+
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips" "-mktpl")
44
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips" "-ubi8")
55
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
6-
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-mktpl")
6+
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
77
declare -a ADDITIONAL_TAGS=("latest" "${ADDITIONAL_TAG}")
88
export PUBLISH_OSS=false

‎.github/config/config-plus-nginx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
export TARGET_REGISTRY=docker-mgmt.nginx.com
22
export TARGET_NAP_WAF_DOS_IMAGE_PREFIX="nginx-ic-nap-dos/nginx-plus-ingress"
33
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips")
4-
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-alpine-fips")
4+
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
55
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
66
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi")
7-
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("")
7+
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi")
88
export PUBLISH_OSS=false

‎.github/data/matrix-images-nap.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,18 +15,36 @@
1515
"waf,dos"
1616
],
1717
"include": [
18+
{
19+
"image": "ubi-8-plus-nap",
20+
"target": "goreleaser",
21+
"platforms": "linux/amd64",
22+
"nap_modules": "waf"
23+
},
1824
{
1925
"image": "ubi-8-plus-nap-v5",
2026
"target": "goreleaser",
2127
"platforms": "linux/amd64",
2228
"nap_modules": "waf"
2329
},
30+
{
31+
"image": "ubi-9-plus-nap",
32+
"target": "goreleaser",
33+
"platforms": "linux/amd64",
34+
"nap_modules": "waf"
35+
},
2436
{
2537
"image": "ubi-9-plus-nap",
2638
"target": "goreleaser",
2739
"platforms": "linux/amd64",
2840
"nap_modules": "dos"
2941
},
42+
{
43+
"image": "ubi-9-plus-nap",
44+
"target": "goreleaser",
45+
"platforms": "linux/amd64",
46+
"nap_modules": "waf,dos"
47+
},
3048
{
3149
"image": "alpine-plus-nap-fips",
3250
"target": "goreleaser",

‎.github/data/matrix-smoke-nap.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
"images": [
33
{
44
"label": "AP_WAF 1/4",
5-
"image": "debian-plus-nap",
5+
"image": "ubi-8-plus-nap",
66
"type": "plus",
77
"nap_modules": "waf",
88
"marker": "appprotect_waf_policies_allow",
99
"platforms": "linux/amd64"
1010
},
1111
{
1212
"label": "AP_WAF 2/4",
13-
"image": "debian-plus-nap",
13+
"image": "ubi-9-plus-nap",
1414
"type": "plus",
1515
"nap_modules": "waf",
1616
"marker": "'appprotect_waf_policies and not appprotect_waf_policies_allow and not appprotect_waf_policies_vsr'",

‎.github/workflows/regression.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ jobs:
265265
266266
- name: Generate WAF v5 tgz from JSON
267267
run: |
268-
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.5.0 -p /data/wafv5.json -o /data/wafv5.tgz
268+
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.6.0 -p /data/wafv5.json -o /data/wafv5.tgz
269269
if: ${{ contains(matrix.images.image, 'nap-v5')}}
270270

271271
- name: Run Regression Tests

‎.github/workflows/setup-smoke.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ jobs:
149149

150150
- name: Generate WAF v5 tgz from JSON
151151
run: |
152-
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.5.0 -p /data/wafv5.json -o /data/wafv5.tgz
152+
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.6.0 -p /data/wafv5.json -o /data/wafv5.tgz
153153
if: ${{ contains(inputs.image, 'nap-v5')}}
154154

155155
- name: Run Smoke Tests

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
VER = $(shell grep IC_VERSION .github/data/version.txt | cut -d '=' -f 2)
33
GIT_TAG = $(shell git describe --exact-match --tags || echo untagged)
44
VERSION = $(VER)-SNAPSHOT
5-
NGINX_PLUS_VERSION ?= R33
5+
NGINX_PLUS_VERSION ?= R34
66
PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key
77

88
# Variables that can be overridden

‎build/Dockerfile‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# syntax=docker/dockerfile:1.6
22
ARG BUILD_OS=debian
3-
ARG NGINX_PLUS_VERSION=R33
3+
ARG NGINX_PLUS_VERSION=R34
44
ARG DOWNLOAD_TAG=edge
55
ARG DEBIAN_FRONTEND=noninteractive
66
ARG PREBUILT_BASE_IMG=nginx/nginx-ingress:${DOWNLOAD_TAG}
@@ -206,7 +206,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
206206
&& mkdir -p /etc/nginx/reporting/ \
207207
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
208208
&& ldconfig /usr/local/lib/ \
209-
&& apk add --no-cache app-protect-module-plus~=33.5.264 \
209+
&& apk add --no-cache app-protect-module-plus~=34.5.342 \
210210
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
211211
&& nap-waf.sh \
212212
&& if [ "${NGINX_AGENT}" = "true" ]; then \
@@ -312,7 +312,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
312312
&& apt-get update \
313313
&& if [ "${NGINX_AGENT}" = "true" ]; then apt-get install --no-install-recommends --no-install-suggests -y nginx-agent; fi \
314314
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
315-
apt-get install --no-install-recommends --no-install-suggests -y app-protect-module-plus=33+5.264* nginx-plus-module-appprotect=33+5.264* app-protect-plugin=6.9.0*; \
315+
apt-get install --no-install-recommends --no-install-suggests -y app-protect-module-plus=34+5.342* nginx-plus-module-appprotect=34+5.342* app-protect-plugin=6.12.0*; \
316316
rm -f /etc/apt/sources.list.d/app-protect.sources; \
317317
nap-waf.sh; \
318318
fi \
@@ -448,7 +448,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
448448
&& if [ "${NGINX_AGENT}" = "true" ]; then microdnf --nodocs install -y nginx-agent; fi \
449449
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
450450
cp /tmp/app-protect-9.repo /etc/yum.repos.d/app-protect-9.repo \
451-
&& microdnf --nodocs install -y app-protect-module-plus-33+5.264* \
451+
&& microdnf --nodocs install -y app-protect-module-plus-34+5.342* \
452452
&& nap-waf.sh \
453453
&& rm -f /etc/yum.repos.d/app-protect-9.repo; \
454454
fi \
@@ -539,7 +539,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
539539
&& dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \
540540
&& dnf --nodocs install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
541541
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
542-
dnf --nodocs install -y app-protect-module-plus-33+5.264*; \
542+
dnf --nodocs install -y app-protect-module-plus-34+5.342*; \
543543
fi \
544544
&& subscription-manager unregister \
545545
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \

‎charts/nginx-ingress/values.schema.json‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -327,10 +327,10 @@
327327
},
328328
"tag": {
329329
"type": "string",
330-
"default": "5.5.0",
330+
"default": "5.6.0",
331331
"title": "The tag of the App Protect WAF v5 Enforcer image",
332332
"examples": [
333-
"5.5.0"
333+
"5.6.0"
334334
]
335335
},
336336
"digest": {
@@ -367,7 +367,7 @@
367367
"examples": [
368368
{
369369
"repository": "private-registry.nginx.com/nap/waf-enforcer",
370-
"tag": "5.5.0",
370+
"tag": "5.6.0",
371371
"pullPolicy": "IfNotPresent"
372372
}
373373
]
@@ -401,10 +401,10 @@
401401
},
402402
"tag": {
403403
"type": "string",
404-
"default": "5.5.0",
404+
"default": "5.6.0",
405405
"title": "The tag of the App Protect WAF v5 Config Manager image",
406406
"examples": [
407-
"5.5.0"
407+
"5.6.0"
408408
]
409409
},
410410
"digest": {
@@ -441,7 +441,7 @@
441441
"examples": [
442442
{
443443
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
444-
"tag": "5.5.0",
444+
"tag": "5.6.0",
445445
"pullPolicy": "IfNotPresent"
446446
}
447447
]
@@ -1837,15 +1837,15 @@
18371837
"port": 50000,
18381838
"image": {
18391839
"repository": "private-registry.nginx.com/nap/waf-enforcer",
1840-
"tag": "5.5.0",
1840+
"tag": "5.6.0",
18411841
"pullPolicy": "IfNotPresent"
18421842
},
18431843
"securityContext": {}
18441844
},
18451845
"configManager": {
18461846
"image": {
18471847
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
1848-
"tag": "5.5.0",
1848+
"tag": "5.6.0",
18491849
"pullPolicy": "IfNotPresent"
18501850
},
18511851
"securityContext": {
@@ -2451,15 +2451,15 @@
24512451
"port": 50000,
24522452
"image": {
24532453
"repository": "private-registry.nginx.com/nap/waf-enforcer",
2454-
"tag": "5.5.0",
2454+
"tag": "5.6.0",
24552455
"pullPolicy": "IfNotPresent"
24562456
},
24572457
"securityContext": {}
24582458
},
24592459
"configManager": {
24602460
"image": {
24612461
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
2462-
"tag": "5.5.0",
2462+
"tag": "5.6.0",
24632463
"pullPolicy": "IfNotPresent"
24642464
},
24652465
"securityContext": {

0 commit comments

Comments
 (0)