Skip to content

Commit cfc5635

Browse files
pdabelf5pdabelf5
authored
update WAF to latest version (#7283)
1 parent 0b8380c commit cfc5635

File tree

9 files changed

+24
-24
lines changed

9 files changed

+24
-24
lines changed

‎.github/workflows/regression.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ jobs:
265265
266266
- name: Generate WAF v5 tgz from JSON
267267
run: |
268-
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.4.0 -p /data/wafv5.json -o /data/wafv5.tgz
268+
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.5.0 -p /data/wafv5.json -o /data/wafv5.tgz
269269
if: ${{ contains(matrix.images.image, 'nap-v5')}}
270270

271271
- name: Run Regression Tests

‎.github/workflows/setup-smoke.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ jobs:
149149

150150
- name: Generate WAF v5 tgz from JSON
151151
run: |
152-
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.4.0 -p /data/wafv5.json -o /data/wafv5.tgz
152+
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.5.0 -p /data/wafv5.json -o /data/wafv5.tgz
153153
if: ${{ contains(inputs.image, 'nap-v5')}}
154154

155155
- name: Run Smoke Tests

‎build/Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ RUN --mount=type=bind,from=alpine-fips-3.17,target=/tmp/fips/ \
212212
&& mkdir -p /etc/nginx/reporting/ \
213213
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
214214
&& ldconfig /usr/local/lib/ \
215-
&& apk add --no-cache app-protect-module-plus~=33.5.210 \
215+
&& apk add --no-cache app-protect-module-plus~=33.5.264 \
216216
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
217217
&& nap-waf.sh \
218218
&& if [ "${NGINX_AGENT}" = "true" ]; then \
@@ -321,7 +321,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
321321
&& apt-get update \
322322
&& if [ "${NGINX_AGENT}" = "true" ]; then apt-get install --no-install-recommends --no-install-suggests -y nginx-agent; fi \
323323
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
324-
apt-get install --no-install-recommends --no-install-suggests -y app-protect-module-plus=33+5.210* nginx-plus-module-appprotect=33+5.210*; \
324+
apt-get install --no-install-recommends --no-install-suggests -y app-protect-module-plus=33+5.264* nginx-plus-module-appprotect=33+5.264*; \
325325
rm -f /etc/apt/sources.list.d/app-protect.sources; \
326326
nap-waf.sh; \
327327
fi \
@@ -457,7 +457,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
457457
&& if [ "${NGINX_AGENT}" = "true" ]; then microdnf --nodocs install -y nginx-agent; fi \
458458
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
459459
cp /tmp/app-protect-9.repo /etc/yum.repos.d/app-protect-9.repo \
460-
&& microdnf --nodocs install -y app-protect-module-plus-33+5.210* \
460+
&& microdnf --nodocs install -y app-protect-module-plus-33+5.264* \
461461
&& nap-waf.sh \
462462
&& rm -f /etc/yum.repos.d/app-protect-9.repo; \
463463
fi \
@@ -548,7 +548,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
548548
&& dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \
549549
&& dnf --nodocs install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
550550
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
551-
dnf --nodocs install -y app-protect-module-plus-33+5.210*; \
551+
dnf --nodocs install -y app-protect-module-plus-33+5.264*; \
552552
fi \
553553
&& subscription-manager unregister \
554554
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \

‎charts/nginx-ingress/values.schema.json‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -327,10 +327,10 @@
327327
},
328328
"tag": {
329329
"type": "string",
330-
"default": "5.4.0",
330+
"default": "5.5.0",
331331
"title": "The tag of the App Protect WAF v5 Enforcer image",
332332
"examples": [
333-
"5.4.0"
333+
"5.5.0"
334334
]
335335
},
336336
"digest": {
@@ -367,7 +367,7 @@
367367
"examples": [
368368
{
369369
"repository": "private-registry.nginx.com/nap/waf-enforcer",
370-
"tag": "5.4.0",
370+
"tag": "5.5.0",
371371
"pullPolicy": "IfNotPresent"
372372
}
373373
]
@@ -401,10 +401,10 @@
401401
},
402402
"tag": {
403403
"type": "string",
404-
"default": "5.4.0",
404+
"default": "5.5.0",
405405
"title": "The tag of the App Protect WAF v5 Config Manager image",
406406
"examples": [
407-
"5.4.0"
407+
"5.5.0"
408408
]
409409
},
410410
"digest": {
@@ -441,7 +441,7 @@
441441
"examples": [
442442
{
443443
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
444-
"tag": "5.4.0",
444+
"tag": "5.5.0",
445445
"pullPolicy": "IfNotPresent"
446446
}
447447
]
@@ -1837,15 +1837,15 @@
18371837
"port": 50000,
18381838
"image": {
18391839
"repository": "private-registry.nginx.com/nap/waf-enforcer",
1840-
"tag": "5.4.0",
1840+
"tag": "5.5.0",
18411841
"pullPolicy": "IfNotPresent"
18421842
},
18431843
"securityContext": {}
18441844
},
18451845
"configManager": {
18461846
"image": {
18471847
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
1848-
"tag": "5.4.0",
1848+
"tag": "5.5.0",
18491849
"pullPolicy": "IfNotPresent"
18501850
},
18511851
"securityContext": {
@@ -2451,15 +2451,15 @@
24512451
"port": 50000,
24522452
"image": {
24532453
"repository": "private-registry.nginx.com/nap/waf-enforcer",
2454-
"tag": "5.4.0",
2454+
"tag": "5.5.0",
24552455
"pullPolicy": "IfNotPresent"
24562456
},
24572457
"securityContext": {}
24582458
},
24592459
"configManager": {
24602460
"image": {
24612461
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
2462-
"tag": "5.4.0",
2462+
"tag": "5.5.0",
24632463
"pullPolicy": "IfNotPresent"
24642464
},
24652465
"securityContext": {

‎charts/nginx-ingress/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ controller:
8282
repository: private-registry.nginx.com/nap/waf-enforcer
8383

8484
## The tag of the App Protect WAF v5 Enforcer image.
85-
tag: "5.4.0"
85+
tag: "5.5.0"
8686
## The digest of the App Protect WAF v5 Enforcer image.
8787
## If digest is specified it has precedence over tag and will be used instead
8888
# digest: "sha256:CHANGEME"
@@ -98,7 +98,7 @@ controller:
9898
repository: private-registry.nginx.com/nap/waf-config-mgr
9999

100100
## The tag of the App Protect WAF v5 Configuration Manager image.
101-
tag: "5.4.0"
101+
tag: "5.5.0"
102102
## The digest of the App Protect WAF v5 Configuration Manager image.
103103
## If digest is specified it has precedence over tag and will be used instead
104104
# digest: "sha256:CHANGEME"

‎charts/tests/__snapshots__/helmunit_test.snap‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1395,7 +1395,7 @@ spec:
13951395
- -weight-changes-dynamic-reload=false
13961396

13971397
- name: waf-enforcer
1398-
image: my.private.reg/nap/waf-enforcer:5.4.0
1398+
image: my.private.reg/nap/waf-enforcer:5.5.0
13991399
imagePullPolicy: "IfNotPresent"
14001400
env:
14011401
- name: ENFORCER_PORT
@@ -1406,7 +1406,7 @@ spec:
14061406
- name: app-protect-bd-config
14071407
mountPath: /opt/app_protect/bd_config
14081408
- name: waf-config-mgr
1409-
image: my.private.reg/nap/waf-config-mgr:5.4.0
1409+
image: my.private.reg/nap/waf-config-mgr:5.5.0
14101410
imagePullPolicy: "IfNotPresent"
14111411
securityContext:
14121412

‎site/content/installation/installing-nic/installation-with-helm.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -423,12 +423,12 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
423423
| **controller.appprotect.enforcer.host** | Host that the App Protect WAF v5 Enforcer runs on. | "127.0.0.1" |
424424
| **controller.appprotect.enforcer.port** | Port that the App Protect WAF v5 Enforcer runs on. | 50000 |
425425
| **controller.appprotect.enforcer.image.repository** | The image repository of the App Protect WAF v5 Enforcer. | private-registry.nginx.com/nap/waf-enforcer |
426-
| **controller.appprotect.enforcer.image.tag** | The tag of the App Protect WAF v5 Enforcer. | "5.4.0" |
426+
| **controller.appprotect.enforcer.image.tag** | The tag of the App Protect WAF v5 Enforcer. | "5.5.0" |
427427
| **controller.appprotect.enforcer.image.digest** | The digest of the App Protect WAF v5 Enforcer. Takes precedence over tag if set. | "" |
428428
| **controller.appprotect.enforcer.image.pullPolicy** | The pull policy for the App Protect WAF v5 Enforcer image. | IfNotPresent |
429429
| **controller.appprotect.enforcer.securityContext** | The security context for App Protect WAF v5 Enforcer container. | {} |
430430
| **controller.appprotect.configManager.image.repository** | The image repository of the App Protect WAF v5 Configuration Manager. | private-registry.nginx.com/nap/waf-config-mgr |
431-
| **controller.appprotect.configManager.image.tag** | The tag of the App Protect WAF v5 Configuration Manager. | "5.4.0" |
431+
| **controller.appprotect.configManager.image.tag** | The tag of the App Protect WAF v5 Configuration Manager. | "5.5.0" |
432432
| **controller.appprotect.configManager.image.digest** | The digest of the App Protect WAF v5 Configuration Manager. Takes precedence over tag if set. | "" |
433433
| **controller.appprotect.configManager.image.pullPolicy** | The pull policy for the App Protect WAF v5 Configuration Manager image. | IfNotPresent |
434434
| **controller.appprotect.configManager.securityContext** | The security context for App Protect WAF v5 Configuration Manager container. | {"allowPrivilegeEscalation":false,"runAsUser":101,"runAsNonRoot":true,"capabilities":{"drop":["all"]}} |

‎site/content/installation/integrations/app-protect-waf-v5/installation.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -507,7 +507,7 @@ If you prefer not to build your own NGINX Ingress Controller image, you can use
507507
{{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
508508
| NIC Version | App Protect WAFv5 Version | Config Manager | Enforcer |
509509
| --- | --- | --- | --- |
510-
| {{< nic-version >}} | 33_5.210 | 5.4.0 | 5.4.0 |
510+
| {{< nic-version >}} | 33_5.264 | 5.5.0 | 5.5.0 |
511511
| 3.7.2 | 32_5.144 | 5.3.0 | 5.3.0 |
512512
| 3.6.2 | 32_5.48 | 5.2.0 | 5.2.0 |
513513
{{% /bootstrap-table %}}

‎tests/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,4 +33,4 @@
3333
# Nginx registry address to pull waf components from
3434
NGX_REG = "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr"
3535
# WAF component version to pull from above registry
36-
WAF_V5_VERSION = "5.4.0"
36+
WAF_V5_VERSION = "5.5.0"

0 commit comments

Comments
 (0)