Skip to content

Commit f832c0e

Browse files
ciarams87ciarams87
authored
Bump NGINX Plus to R28 in r-2.4 (#3321)
* Bump NGINX Plus to R28 * Fix CVEs and NAP WAF UBI builds
1 parent 7911be5 commit f832c0e

File tree

3 files changed

+19
-15
lines changed

3 files changed

+19
-15
lines changed

‎Makefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,15 +110,15 @@ debian-image-plus: build ## Create Docker image for Ingress Controller (Debian w
110110

111111
.PHONY: debian-image-nap-plus
112112
debian-image-nap-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and App Protect WAF)
113-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg DEBIAN_VERSION=buster-slim --build-arg NAP_MODULES=waf
113+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf
114114

115115
.PHONY: debian-image-dos-plus
116116
debian-image-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and App Protect DoS)
117117
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=dos
118118

119119
.PHONY: debian-image-nap-dos-plus
120120
debian-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus, App Protect WAF and DoS)
121-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg DEBIAN_VERSION=buster-slim --build-arg NAP_MODULES=waf,dos
121+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos
122122

123123
.PHONY: ubi-image
124124
ubi-image: build ## Create Docker image for Ingress Controller (UBI)

‎build/Dockerfile

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
# syntax=docker/dockerfile:1.4
22
ARG BUILD_OS=debian
3-
ARG NGINX_PLUS_VERSION=R27
3+
ARG NGINX_PLUS_VERSION=R28
44
ARG DOWNLOAD_TAG=edge
5-
ARG DEBIAN_VERSION=bullseye-slim
65

76

87
############################################# Base images containing libs for Opentracing #############################################
@@ -16,6 +15,8 @@ FROM nginx:1.23.2 AS debian
1615
RUN --mount=type=bind,from=opentracing-lib,target=/tmp/ot/ \
1716
apt-get update \
1817
&& apt-get install --no-install-recommends --no-install-suggests -y libcap2-bin \
18+
# temp fix for CVE-2022-42898
19+
&& apt-get install -y libgssapi-krb5-2 libk5crypto3 libkrb5-3 libkrb5support0 \
1920
&& rm -rf /var/lib/apt/lists/* \
2021
&& cp -av /tmp/ot/usr/local/lib/libopentracing.so* /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
2122
&& cp -av /tmp/ot/usr/lib/nginx/modules/ngx_http_opentracing_module.so /usr/lib/nginx/modules/ \
@@ -50,7 +51,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/apk/cert.pem,mode=0644 \
5051

5152

5253
############################################# Base image for Debian with NGINX Plus #############################################
53-
FROM debian:${DEBIAN_VERSION} AS debian-plus
54+
FROM debian:11-slim AS debian-plus
5455
ARG IC_VERSION
5556
ARG NGINX_PLUS_VERSION
5657
ARG BUILD_OS
@@ -61,6 +62,8 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
6162
--mount=type=bind,from=opentracing-lib,target=/tmp/ot/ \
6263
apt-get update \
6364
&& apt-get install --no-install-recommends --no-install-suggests -y ca-certificates gnupg curl apt-transport-https libcap2-bin \
65+
# temp fix for CVE-2022-42898
66+
&& apt-get install -y libgssapi-krb5-2 libk5crypto3 libkrb5-3 libkrb5support0 \
6467
&& curl -fsSL https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor > /etc/apt/trusted.gpg.d/nginx_signing.gpg \
6568
&& curl -fsSL -o /etc/apt/apt.conf.d/90pkgs-nginx https://cs.nginx.com/static/files/90pkgs-nginx \
6669
&& DEBIAN_VERSION=$(awk -F '=' '/^VERSION_CODENAME=/ {print $2}' /etc/os-release) \
@@ -95,7 +98,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
9598
&& apt-get purge --auto-remove -y curl; \
9699
fi \
97100
&& if [ -z "${NAP_MODULES##*dos*}" ]; then \
98-
printf "%s\n" "deb https://pkgs.nginx.com/app-protect-dos/${NGINX_PLUS_VERSION}/debian ${DEBIAN_VERSION} nginx-plus" > /etc/apt/sources.list.d/nginx-app-protect-dos.list \
101+
printf "%s\n" "deb https://pkgs.nginx.com/app-protect-dos/debian ${DEBIAN_VERSION} nginx-plus" > /etc/apt/sources.list.d/nginx-app-protect-dos.list \
99102
&& apt-get update \
100103
&& apt-get install --no-install-recommends --no-install-suggests -y app-protect-dos; \
101104
fi \
@@ -109,7 +112,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
109112

110113

111114
############################################# Base image for UBI #############################################
112-
FROM redhat/ubi8 AS ubi-base
115+
FROM redhat/ubi8:8.6-990 AS ubi-base
113116
ARG IC_VERSION
114117

115118
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -124,6 +127,8 @@ LABEL name="NGINX Ingress Controller" \
124127
io.openshift.tags="nginx,ingress-controller,ingress,controller,kubernetes,openshift"
125128

126129
RUN dnf --nodocs install -y shadow-utils ca-certificates \
130+
# temp fix for CVE-2022-1304 CVE-2016-3709 and CVE-2022-42898
131+
&& dnf --nodocs install -y libcom_err libxml2 python3-libxml2 krb5-libs \
127132
&& groupadd --system --gid 101 nginx \
128133
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx
129134

@@ -176,7 +181,6 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
176181
fi \
177182
&& if [ -z "${NAP_MODULES##*dos*}" ]; then \
178183
curl -fsSL https://cs.nginx.com/static/files/app-protect-dos-8.repo > /etc/yum.repos.d/app-protect-dos-8.repo; \
179-
sed -i "0,/centos/s;;${NGINX_PLUS_VERSION}/centos;" /etc/yum.repos.d/app-protect-dos-8.repo; \
180184
dnf --nodocs install -y app-protect-dos; \
181185
fi \
182186
&& rm /etc/yum.repos.d/app-protect*.repo \

‎docs/content/technical-specifications.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ All images include NGINX 1.23.2.
4747
|Name | Base image | Third-party modules | DockerHub image | Architectures |
4848
| ---| ---| ---| --- | --- |
4949
|Alpine-based image | ``nginx:1.23.2-alpine``, which is based on ``alpine:3.16`` | NGINX OpenTracing module, OpenTracing library, OpenTracing tracers for Jaeger, Zipkin and Datadog | ``nginx/nginx-ingress:2.4.1-alpine`` | arm/v7, arm64, amd64, ppc64le, s390x |
50-
|Debian-based image | ``nginx:1.23.2``, which is based on ``debian:bullseye-slim`` | NGINX OpenTracing module, OpenTracing library, OpenTracing tracers for Jaeger, Zipkin and Datadog | ``nginx/nginx-ingress:2.4.1`` | arm/v7, arm64, amd64, ppc64le, s390x |
50+
|Debian-based image | ``nginx:1.23.2``, which is based on ``debian:11-slim`` | NGINX OpenTracing module, OpenTracing library, OpenTracing tracers for Jaeger, Zipkin and Datadog | ``nginx/nginx-ingress:2.4.1`` | arm/v7, arm64, amd64, ppc64le, s390x |
5151
|Ubi-based image | ``redhat/ubi8`` | | ``nginx/nginx-ingress:2.4.1-ubi`` | arm64, amd64, s390x |
5252
{{% /table %}}
5353

@@ -61,10 +61,10 @@ NGINX Plus images are available through the F5 Container registry `private-regis
6161
|Name | Base image | Third-party modules | F5 Container Registry Image | Architectures |
6262
| ---| ---| --- | --- | --- |
6363
|Alpine-based image | ``alpine:3.16`` | NGINX Plus JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic/nginx-plus-ingress:2.4.1-alpine` | arm64, amd64 |
64-
|Debian-based image | ``debian:bullseye-slim`` | NGINX Plus JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic/nginx-plus-ingress:2.4.1` | arm64, amd64 |
65-
|Debian-based image with App Protect WAF | ``debian:buster-slim`` | NGINX Plus App Protect WAF, JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic-nap/nginx-plus-ingress:2.4.1` | amd64 |
66-
|Debian-based image with App Protect DoS | ``debian:bullseye-slim`` | NGINX Plus App Protect DoS, JavaScript module and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic-dos/nginx-plus-ingress:2.4.1` | amd64 |
67-
|Debian-based image with App Protect WAF and DoS | ``debian:buster-slim`` | NGINX Plus App Protect WAF, DoS, JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic-nap-dos/nginx-plus-ingress:2.4.1` | amd64 |
64+
|Debian-based image | ``debian:11-slim`` | NGINX Plus JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic/nginx-plus-ingress:2.4.1` | arm64, amd64 |
65+
|Debian-based image with App Protect WAF | ``debian:11-slim`` | NGINX Plus App Protect WAF, JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic-nap/nginx-plus-ingress:2.4.1` | amd64 |
66+
|Debian-based image with App Protect DoS | ``debian:11-slim`` | NGINX Plus App Protect DoS, JavaScript module and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic-dos/nginx-plus-ingress:2.4.1` | amd64 |
67+
|Debian-based image with App Protect WAF and DoS | ``debian:11-slim`` | NGINX Plus App Protect WAF, DoS, JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic-nap-dos/nginx-plus-ingress:2.4.1` | amd64 |
6868
|Ubi-based image | ``redhat/ubi8`` | NGINX Plus JavaScript module | `nginx-ic/nginx-plus-ingress:2.4.1-ubi` | arm64, amd64, s390x |
6969
|Ubi-based image with App Protect WAF | ``redhat/ubi8`` | NGINX Plus App Protect WAF and JavaScript modules | `nginx-ic-nap/nginx-plus-ingress:2.4.1-ubi` | amd64 |
7070
|Ubi-based image with App Protect DoS | ``redhat/ubi8`` | NGINX Plus App Protect DoS and JavaScript modules | `nginx-ic-dos/nginx-plus-ingress:2.4.1-ubi` | amd64 |
@@ -76,8 +76,8 @@ We also provide NGINX Plus images through the AWS Marketplace. Please see [Using
7676
{{% table %}}
7777
|Name | Base image | Third-party modules | AWS Marketplace Link |
7878
| ---| ---| --- | --- |
79-
|Debian-based image | ``debian:bullseye-slim`` | NGINX Plus JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | [NGINX Ingress Controller](https://aws.amazon.com/marketplace/pp/prodview-fx3faxl7zqeau) |
80-
|Debian-based image with App Protect | ``debian:buster-slim`` | NGINX Plus App Protect, JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | [NGINX Ingress Controller with NGINX App Protect](https://aws.amazon.com/marketplace/pp/prodview-vnrnxbf6u3nra) |
79+
|Debian-based image | ``debian:11-slim`` | NGINX Plus JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | [NGINX Ingress Controller](https://aws.amazon.com/marketplace/pp/prodview-fx3faxl7zqeau) |
80+
|Debian-based image with App Protect | ``debian:11-slim`` | NGINX Plus App Protect, JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | [NGINX Ingress Controller with NGINX App Protect](https://aws.amazon.com/marketplace/pp/prodview-vnrnxbf6u3nra) |
8181
{{% /table %}}
8282

8383
### Custom Images

0 commit comments

Comments
 (0)