Skip to content

Commit 4d7cb73

Browse files
AlexFenlonAlexFenlon
authored
Allow easier updates to Agent versions on NAP images (#8303)
1 parent 11e9f7a commit 4d7cb73

File tree

2 files changed

+30
-20
lines changed

2 files changed

+30
-20
lines changed

‎Makefile‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ NGINX_PLUS_VERSION ?= R35
88
NAP_WAF_VERSION ?= 35+5.527
99
NAP_WAF_COMMON_VERSION ?= 11.559
1010
NAP_WAF_PLUGIN_VERSION ?= 6.23.0
11+
NAP_AGENT_VERSION ?= 2
1112
NGINX_AGENT_VERSION ?= 3.3
1213
PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key
1314

@@ -159,12 +160,12 @@ alpine-image-plus-fips: build ## Create Docker image for Ingress Controller (Alp
159160

160161
.PHONY: alpine-image-nap-plus-fips
161162
alpine-image-nap-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAF and FIPS)
162-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
163+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
163164

164165
.PHONY: alpine-image-nap-v5-plus-fips
165166
alpine-image-nap-v5-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAFv5 and FIPS)
166167
$(DOCKER_CMD) $(PLUS_ARGS) \
167-
--build-arg BUILD_OS=alpine-plus-nap-v5-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
168+
--build-arg BUILD_OS=alpine-plus-nap-v5-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
168169

169170
.PHONY: debian-image-plus
170171
debian-image-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus)
@@ -174,12 +175,12 @@ debian-image-plus: build ## Create Docker image for Ingress Controller (Debian w
174175
debian-image-nap-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAF)
175176
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf \
176177
--build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) \
177-
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION)
178+
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
178179

179180
.PHONY: debian-image-nap-v5-plus
180181
debian-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAFv5)
181182
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) \
182-
--build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION)
183+
--build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
183184

184185
.PHONY: debian-image-dos-plus
185186
debian-image-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect DoS)
@@ -189,7 +190,7 @@ debian-image-dos-plus: build ## Create Docker image for Ingress Controller (Debi
189190
debian-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus, NGINX App Protect WAF and DoS)
190191
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos \
191192
--build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) \
192-
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION)
193+
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
193194

194195
.PHONY: ubi-image
195196
ubi-image: build ## Create Docker image for Ingress Controller (UBI)
@@ -202,22 +203,22 @@ ubi-image-plus: build ## Create Docker image for Ingress Controller (UBI with NG
202203
.PHONY: ubi-image-nap-plus
203204
ubi-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
204205
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
205-
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
206+
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
206207

207208
.PHONY: ubi8-image-nap-plus
208209
ubi8-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
209210
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-8-plus-nap \
210-
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
211+
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
211212

212213
.PHONY: ubi-image-nap-v5-plus
213214
ubi-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
214215
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
215-
--build-arg BUILD_OS=ubi-9-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
216+
--build-arg BUILD_OS=ubi-9-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
216217

217218
.PHONY: ubi8-image-nap-v5-plus
218219
ubi8-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
219220
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
220-
--build-arg BUILD_OS=ubi-8-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
221+
--build-arg BUILD_OS=ubi-8-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
221222

222223
.PHONY: ubi-image-dos-plus
223224
ubi-image-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect DoS)
@@ -227,7 +228,7 @@ ubi-image-dos-plus: build ## Create Docker image for Ingress Controller (UBI wit
227228
.PHONY: ubi-image-nap-dos-plus
228229
ubi-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus, NGINX App Protect WAF and DoS)
229230
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
230-
--build-arg NAP_MODULES=waf,dos --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
231+
--build-arg NAP_MODULES=waf,dos --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)
231232

232233
.PHONY: all-images ## Create all the Docker images for Ingress Controller
233234
all-images: alpine-image alpine-image-plus alpine-image-plus-fips alpine-image-nap-plus-fips debian-image debian-image-plus debian-image-nap-plus debian-image-dos-plus debian-image-nap-dos-plus ubi-image ubi-image-plus ubi-image-nap-plus ubi-image-dos-plus ubi-image-nap-dos-plus

‎build/Dockerfile‎

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ ARG NAP_WAF_VERSION=35+5.527
77
ARG NAP_WAF_COMMON_VERSION=11.559
88
ARG NAP_WAF_PLUGIN_VERSION=6.23.0
99
ARG NGINX_AGENT_VERSION=3.3
10+
ARG NAP_AGENT_VERSION=2
1011
ARG DOWNLOAD_TAG=edge
1112
ARG DEBIAN_FRONTEND=noninteractive
1213
ARG PREBUILT_BASE_IMG=nginx/nginx-ingress:${DOWNLOAD_TAG}
@@ -216,6 +217,7 @@ FROM alpine:3.19@sha256:6baf43584bcb78f2e5847d1de515f23499913ac9f12bdf834811a314
216217
ARG NGINX_PLUS_VERSION
217218
ARG NAP_WAF_VERSION
218219
ARG PACKAGE_REPO
220+
ARG NAP_AGENT_VERSION
219221

220222
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
221223

@@ -232,7 +234,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
232234
&& printf "%s\n" "https://pkgs.nginx.com/app-protect-security-updates/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
233235
&& printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
234236
&& apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
235-
&& apk add --no-cache nginx-agent~2 \
237+
&& apk add --no-cache nginx-agent~${NAP_AGENT_VERSION} \
236238
&& mkdir -p /usr/ssl \
237239
&& cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \
238240
&& cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \
@@ -248,8 +250,9 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
248250
############################################# Base image for Alpine with NGINX Plus, App Protect WAFv5 and FIPS #############################################
249251
FROM alpine:3.19@sha256:6baf43584bcb78f2e5847d1de515f23499913ac9f12bdf834811a3145eb11ca1 AS alpine-plus-nap-v5-fips
250252
ARG NGINX_PLUS_VERSION
251-
ARG NAP_WAF_VERSION
252253
ARG PACKAGE_REPO
254+
ARG NAP_WAF_VERSION
255+
ARG NAP_AGENT_VERSION
253256

254257
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
255258

@@ -264,7 +267,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
264267
&& printf "%s\n" "https://${PACKAGE_REPO}/app-protect-x-plus/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
265268
&& printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
266269
&& apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
267-
&& apk add --no-cache nginx-agent~2 \
270+
&& apk add --no-cache nginx-agent~${NAP_AGENT_VERSION} \
268271
&& mkdir -p /usr/ssl \
269272
&& cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \
270273
&& cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \
@@ -333,6 +336,7 @@ ARG NGINX_PLUS_VERSION
333336
ARG NAP_WAF_VERSION
334337
ARG NAP_WAF_COMMON_VERSION
335338
ARG NAP_WAF_PLUGIN_VERSION
339+
ARG NAP_AGENT_VERSION
336340

337341
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
338342

@@ -357,7 +361,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
357361
app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
358362
app-protect-attack-signatures \
359363
app-protect-threat-campaigns \
360-
nginx-agent=2.* \
364+
nginx-agent=${NAP_AGENT_VERSION}.* \
361365
&& rm -f /etc/apt/sources.list.d/app-protect.sources /etc/apt/sources.list.d/nginx-agent.sources \
362366
&& nap-waf.sh \
363367
&& agent.sh; \
@@ -376,6 +380,7 @@ FROM debian-plus-only AS debian-plus-nap-v5
376380
ARG NGINX_PLUS_VERSION
377381
ARG NAP_WAF_VERSION
378382
ARG NAP_WAF_PLUGIN_VERSION
383+
ARG NAP_AGENT_VERSION
379384

380385
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
381386

@@ -387,7 +392,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
387392
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
388393
--mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/etc/apt/sources.list.d/nginx-agent.sources \
389394
apt-get update \
390-
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=2.* app-protect-module-plus=${NAP_WAF_VERSION}* nginx-plus-module-appprotect=${NAP_WAF_VERSION}* app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
395+
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=${NAP_AGENT_VERSION}.* app-protect-module-plus=${NAP_WAF_VERSION}* nginx-plus-module-appprotect=${NAP_WAF_VERSION}* app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
391396
&& nap-waf.sh \
392397
&& agent.sh
393398

@@ -413,7 +418,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
413418
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
414419
&& ubi-setup.sh \
415420
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
416-
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NGINX_AGENT_VERSION}* \
421+
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NGINX_AGENT_VERSION}.* \
417422
&& agent.sh \
418423
&& ubi-clean.sh
419424

@@ -424,6 +429,7 @@ ARG NAP_MODULES
424429
ARG BUILD_OS
425430
ARG NGINX_PLUS_VERSION
426431
ARG NAP_WAF_VERSION
432+
ARG NAP_AGENT_VERSION
427433

428434
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
429435

@@ -446,7 +452,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
446452
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
447453
&& ubi-setup.sh \
448454
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
449-
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check nginx-plus-module-otel nginx-agent-2.* \
455+
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check nginx-plus-module-otel nginx-agent-${NAP_AGENT_VERSION}.* \
450456
&& source /tmp/rhel_license \
451457
&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
452458
&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
@@ -475,6 +481,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
475481
FROM ubi-minimal AS ubi-9-plus-nap-v5
476482
ARG NGINX_PLUS_VERSION
477483
ARG NAP_WAF_VERSION
484+
ARG NAP_AGENT_VERSION
478485

479486
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
480487

@@ -498,7 +505,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
498505
&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
499506
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
500507
&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
501-
&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-2.* app-protect-module-plus-${NAP_WAF_VERSION}* \
508+
&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-${NAP_AGENT_VERSION}.* app-protect-module-plus-${NAP_WAF_VERSION}* \
502509
&& nap-waf.sh \
503510
&& ubi-clean.sh \
504511
&& agent.sh
@@ -509,6 +516,7 @@ FROM redhat/ubi8@sha256:2f698e145dd30ac9f611b8984b910640bc210fae476dc36aa9ba200f
509516
ARG NGINX_PLUS_VERSION
510517
ARG NAP_WAF_VERSION
511518
ARG BUILD_OS
519+
ARG NAP_AGENT_VERSION
512520

513521
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
514522

@@ -531,7 +539,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
531539
&& rpm --import /tmp/nginx_signing.key \
532540
&& rpm --import /tmp/app-protect-security-updates.key \
533541
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
534-
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-2.* \
542+
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NAP_AGENT_VERSION}.* \
535543
&& sed -i 's/\(def in_container():\)/\1\n return False/g' /usr/lib64/python*/*-packages/rhsm/config.py \
536544
&& subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} --name ${BUILD_OS}-$(uname -m) || true \
537545
&& subscription-manager attach \
@@ -548,6 +556,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
548556
FROM redhat/ubi8@sha256:2f698e145dd30ac9f611b8984b910640bc210fae476dc36aa9ba200fad2a30ed AS ubi-8-plus-nap-v5
549557
ARG NGINX_PLUS_VERSION
550558
ARG NAP_WAF_VERSION
559+
ARG NAP_AGENT_VERSION
551560

552561
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
553562

@@ -569,7 +578,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
569578
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
570579
&& rpm --import /tmp/nginx_signing.key \
571580
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
572-
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-2.* \
581+
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NAP_AGENT_VERSION}.* \
573582
&& dnf --nodocs install -y app-protect-module-plus-${NAP_WAF_VERSION}* \
574583
&& nap-waf.sh \
575584
&& agent.sh \

0 commit comments

Comments
 (0)