Skip to content

Commit 46fcf92

Browse files
javorszkyjavorszky
authored
Add tracking.info and copy into plus images (#7400)
* Add tracking.info and copy into plus images Closes #7360 * adds a `dependencies/tracking.info.default` file that is mounted into the docker images that include nginx plus * file contains attribution to nic * dockerfile also has comments explaining the inclusion This is potentially a stopgap solution until we have time to look at startup order. * Move adding the file to nginx-files * Mount info to /tmp, cp into images later * Create the directory /etc/nginx/reporting * Break mkdir into its own line * Tidy up &&s in the RUN command
1 parent b7e6252 commit 46fcf92

File tree

2 files changed

+40
-8
lines changed

2 files changed

+40
-8
lines changed

‎build/Dockerfile‎

Lines changed: 39 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,10 @@ ADD --link --chown=101:0 --chmod=0755 build/scripts/agent.sh agent.sh
8585
ADD --link --chown=101:0 --chmod=0755 build/scripts/ubi-setup.sh ubi-setup.sh
8686
ADD --link --chown=101:0 --chmod=0755 build/scripts/ubi-clean.sh ubi-clean.sh
8787

88+
# Startup is non-deterministic between NGINX Plus reporting usage and licence reporter initialising. This
89+
# is a workaround to attribute the installation to nic even if licence reporter isn't ready yet.
90+
# @See https://github.com/nginx/kubernetes-ingress/issues/7360
91+
ADD --link --chown=101:0 --chmod=0755 build/dependencies/tracking.info.default tracking.info
8892

8993
############################################# Patch Image #############################################
9094
FROM ${IMAGE_NAME} AS patched
@@ -113,10 +117,12 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/apk/cert.pem,mode=0644 \
113117
--mount=type=bind,from=alpine-opentracing-lib,target=/tmp/ot/ \
114118
--mount=type=bind,from=nginx-files,src=nginx_signing.rsa.pub,target=/etc/apk/keys/nginx_signing.rsa.pub \
115119
--mount=type=bind,from=nginx-files,src=user_agent,target=/tmp/user_agent \
120+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
116121
export $(cat /tmp/user_agent) \
117122
&& printf "%s\n" "https://${PACKAGE_REPO}/plus/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
118123
&& apk add --no-cache nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing nginx-plus-module-fips-check libcap libcurl \
119124
&& cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
125+
&& mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
120126
&& ldconfig /usr/local/lib/ \
121127
&& sed -i -e '/nginx.com/d' /etc/apk/repositories
122128

@@ -128,10 +134,12 @@ ARG NGINX_PLUS_VERSION
128134
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
129135

130136
RUN --mount=type=bind,from=alpine-fips-3.20,target=/tmp/fips/ \
137+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
131138
mkdir -p /usr/ssl \
132139
&& cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \
133140
&& cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \
134-
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf
141+
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
142+
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info
135143

136144

137145
############################################# Base image for Alpine with NGINX Plus, App Protect WAF and FIPS #############################################
@@ -151,6 +159,7 @@ RUN --mount=type=bind,from=alpine-fips-3.17,target=/tmp/fips/ \
151159
--mount=type=bind,from=nginx-files,src=nginx_signing.rsa.pub,target=/etc/apk/keys/nginx_signing.rsa.pub \
152160
--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
153161
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
162+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
154163
printf "%s\n" "https://${PACKAGE_REPO}/plus/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
155164
&& printf "%s\n" "https://${PACKAGE_REPO}/app-protect/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
156165
&& printf "%s\n" "https://pkgs.nginx.com/app-protect-security-updates/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
@@ -162,6 +171,8 @@ RUN --mount=type=bind,from=alpine-fips-3.17,target=/tmp/fips/ \
162171
&& cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \
163172
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
164173
&& cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
174+
&& mkdir -p /etc/nginx/reporting/ \
175+
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
165176
&& ldconfig /usr/local/lib/ \
166177
&& apk add --no-cache app-protect app-protect-attack-signatures app-protect-threat-campaigns \
167178
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
@@ -187,6 +198,7 @@ RUN --mount=type=bind,from=alpine-fips-3.17,target=/tmp/fips/ \
187198
--mount=type=bind,from=nginx-files,src=nginx_signing.rsa.pub,target=/etc/apk/keys/nginx_signing.rsa.pub \
188199
--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
189200
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
201+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
190202
printf "%s\n" "https://${PACKAGE_REPO}/plus/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
191203
&& printf "%s\n" "https://${PACKAGE_REPO}/app-protect-x-plus/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
192204
&& printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
@@ -197,6 +209,8 @@ RUN --mount=type=bind,from=alpine-fips-3.17,target=/tmp/fips/ \
197209
&& cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \
198210
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
199211
&& cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
212+
&& mkdir -p /etc/nginx/reporting/ \
213+
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
200214
&& ldconfig /usr/local/lib/ \
201215
&& apk add --no-cache app-protect-module-plus~=33.5.210 \
202216
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
@@ -220,6 +234,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
220234
--mount=type=bind,from=nginx-files,src=app-protect-security-updates.key,target=/tmp/app-protect-security-updates.key \
221235
--mount=type=bind,from=nginx-files,src=90pkgs-nginx,target=/etc/apt/apt.conf.d/90pkgs-nginx \
222236
--mount=type=bind,from=nginx-files,src=debian-plus-12.sources,target=/tmp/nginx-plus.sources \
237+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
223238
apt-get update \
224239
&& apt-get install --no-install-recommends --no-install-suggests -y gpg ca-certificates libcap2-bin libcurl4 \
225240
&& groupadd --system --gid 101 nginx \
@@ -231,6 +246,8 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
231246
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing nginx-plus-module-fips-check \
232247
&& apt-get purge --auto-remove -y gpg \
233248
&& cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
249+
&& mkdir -p /etc/nginx/reporting/ \
250+
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
234251
&& ldconfig \
235252
&& rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx-plus.sources
236253

@@ -254,7 +271,9 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
254271
--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
255272
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
256273
--mount=type=bind,from=nginx-files,src=nap-dos.sh,target=/usr/local/bin/nap-dos.sh \
257-
if [ -z "${NAP_MODULES##*waf*}" ]; then \
274+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
275+
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
276+
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
258277
cp /tmp/app-protect.sources /etc/apt/sources.list.d/app-protect.sources; \
259278
fi \
260279
&& if [ -z "${NAP_MODULES##*dos*}" ]; then \
@@ -294,7 +313,9 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
294313
--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
295314
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
296315
--mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/etc/apt/sources.list.d/nginx-agent.sources \
297-
if [ -z "${NAP_MODULES##*waf*}" ]; then \
316+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
317+
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
318+
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
298319
cp /tmp/app-protect.sources /etc/apt/sources.list.d/app-protect.sources; \
299320
fi \
300321
&& apt-get update \
@@ -363,7 +384,9 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
363384
--mount=type=bind,from=nginx-files,src=nginx-plus-9.repo,target=/etc/yum.repos.d/nginx-plus.repo \
364385
--mount=type=bind,from=nginx-files,src=ubi-setup.sh,target=/usr/local/bin/ubi-setup.sh \
365386
--mount=type=bind,from=nginx-files,src=ubi-clean.sh,target=/usr/local/bin/ubi-clean.sh \
366-
ubi-setup.sh \
387+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
388+
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
389+
&& ubi-setup.sh \
367390
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check \
368391
&& ubi-clean.sh
369392

@@ -385,7 +408,9 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
385408
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
386409
--mount=type=bind,from=nginx-files,src=nap-dos.sh,target=/usr/local/bin/nap-dos.sh \
387410
--mount=type=bind,from=nginx-files,src=ubi-clean.sh,target=/usr/local/bin/ubi-clean.sh \
388-
source /tmp/rhel_license \
411+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
412+
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
413+
&& source /tmp/rhel_license \
389414
&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
390415
&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
391416
&& if [ "${NGINX_AGENT}" = "true" ]; then microdnf --nodocs install -y nginx-agent; fi \
@@ -424,7 +449,9 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
424449
--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
425450
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
426451
--mount=type=bind,from=nginx-files,src=ubi-clean.sh,target=/usr/local/bin/ubi-clean.sh \
427-
source /tmp/rhel_license \
452+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
453+
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
454+
&& source /tmp/rhel_license \
428455
&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
429456
&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
430457
&& if [ "${NGINX_AGENT}" = "true" ]; then microdnf --nodocs install -y nginx-agent; fi \
@@ -456,7 +483,9 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
456483
--mount=type=bind,from=nginx-files,src=app-protect-8.repo,target=/tmp/app-protect-8.repo \
457484
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
458485
--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
459-
source /tmp/rhel_license \
486+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
487+
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
488+
&& source /tmp/rhel_license \
460489
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
461490
cp /tmp/app-protect-8.repo /etc/yum.repos.d/app-protect-8.repo; \
462491
fi \
@@ -500,7 +529,9 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
500529
--mount=type=bind,from=nginx-files,src=app-protect-v5-8.repo,target=/tmp/app-protect-8.repo \
501530
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
502531
--mount=type=bind,from=nginx-files,src=agent.sh,target=/usr/local/bin/agent.sh \
503-
source /tmp/rhel_license \
532+
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
533+
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
534+
&& source /tmp/rhel_license \
504535
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
505536
cp /tmp/app-protect-8.repo /etc/yum.repos.d/app-protect-8.repo; \
506537
fi \

‎build/dependencies/tracking.info.default‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"integration": "nic"}

0 commit comments

Comments
 (0)