Allow easier updates to Agent versions on NAP images #8303
+30
−20
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,6 +6,7 @@ | |
| ARG NAP_WAF_COMMON_VERSION=11.533 | ||
| ARG NAP_WAF_PLUGIN_VERSION=6.20.0 | ||
| ARG NGINX_AGENT_VERSION=3.3 | ||
| ARG NAP_AGENT_VERSION=2 | ||
| ARG DOWNLOAD_TAG=edge | ||
| ARG DEBIAN_FRONTEND=noninteractive | ||
| ARG PREBUILT_BASE_IMG=nginx/nginx-ingress:${DOWNLOAD_TAG} | ||
|
|
@@ -212,6 +213,7 @@ | |
| ARG NGINX_PLUS_VERSION | ||
| ARG NAP_WAF_VERSION | ||
| ARG PACKAGE_REPO | ||
| ARG NAP_AGENT_VERSION | ||
|
|
||
| ENV NGINX_VERSION=${NGINX_PLUS_VERSION} | ||
|
|
||
|
|
@@ -228,7 +230,7 @@ | |
| && printf "%s\n" "https://pkgs.nginx.com/app-protect-security-updates/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \ | ||
| && printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \ | ||
| && apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \ | ||
| && apk add --no-cache nginx-agent~${NAP_AGENT_VERSION} \ | ||
| && mkdir -p /usr/ssl \ | ||
| && cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \ | ||
| && cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \ | ||
|
|
@@ -244,8 +246,9 @@ | |
| ############################################# Base image for Alpine with NGINX Plus, App Protect WAFv5 and FIPS ############################################# | ||
| FROM alpine:3.19@sha256:3be987e6cde1d07e873c012bf6cfe941e6e85d16ca5fc5b8bedc675451d2de67 AS alpine-plus-nap-v5-fips | ||
| ARG NGINX_PLUS_VERSION | ||
| ARG PACKAGE_REPO | ||
| ARG NAP_WAF_VERSION | ||
| ARG NAP_AGENT_VERSION | ||
|
|
||
| ENV NGINX_VERSION=${NGINX_PLUS_VERSION} | ||
|
|
||
|
|
@@ -260,7 +263,7 @@ | |
| && printf "%s\n" "https://${PACKAGE_REPO}/app-protect-x-plus/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \ | ||
| && printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \ | ||
| && apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \ | ||
| && apk add --no-cache nginx-agent~${NAP_AGENT_VERSION} \ | ||
| && mkdir -p /usr/ssl \ | ||
| && cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \ | ||
| && cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \ | ||
|
|
@@ -329,6 +332,7 @@ | |
| ARG NAP_WAF_VERSION | ||
| ARG NAP_WAF_COMMON_VERSION | ||
| ARG NAP_WAF_PLUGIN_VERSION | ||
| ARG NAP_AGENT_VERSION | ||
|
|
||
| ENV NGINX_VERSION=${NGINX_PLUS_VERSION} | ||
|
|
||
|
|
@@ -353,7 +357,7 @@ | |
| app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \ | ||
| app-protect-attack-signatures \ | ||
| app-protect-threat-campaigns \ | ||
| nginx-agent=${NAP_AGENT_VERSION}* \ | ||
| && rm -f /etc/apt/sources.list.d/app-protect.sources /etc/apt/sources.list.d/nginx-agent.sources \ | ||
| && nap-waf.sh \ | ||
| && agent.sh; \ | ||
|
|
@@ -372,6 +376,7 @@ | |
| ARG NGINX_PLUS_VERSION | ||
| ARG NAP_WAF_VERSION | ||
| ARG NAP_WAF_PLUGIN_VERSION | ||
| ARG NAP_AGENT_VERSION | ||
|
|
||
| ENV NGINX_VERSION=${NGINX_PLUS_VERSION} | ||
|
|
||
|
|
@@ -383,7 +388,7 @@ | |
| --mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \ | ||
| --mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/etc/apt/sources.list.d/nginx-agent.sources \ | ||
| apt-get update \ | ||
| && apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=${NAP_AGENT_VERSION}* app-protect-module-plus=${NAP_WAF_VERSION}* nginx-plus-module-appprotect=${NAP_WAF_VERSION}* app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \ | ||
| && nap-waf.sh \ | ||
| && agent.sh | ||
|
|
||
|
|
@@ -420,6 +425,7 @@ | |
| ARG BUILD_OS | ||
| ARG NGINX_PLUS_VERSION | ||
| ARG NAP_WAF_VERSION | ||
| ARG NAP_AGENT_VERSION | ||
|
|
||
| ENV NGINX_VERSION=${NGINX_PLUS_VERSION} | ||
|
|
||
|
|
@@ -442,7 +448,7 @@ | |
| mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \ | ||
| && ubi-setup.sh \ | ||
| && rpm -Uvh /ubi-bin/c-ares-*.rpm \ | ||
| && microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check nginx-plus-module-otel nginx-agent-${NAP_AGENT_VERSION}* \ | ||
| && source /tmp/rhel_license \ | ||
| && microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \ | ||
| && rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \ | ||
|
|
@@ -471,6 +477,7 @@ | |
| FROM ubi-minimal AS ubi-9-plus-nap-v5 | ||
| ARG NGINX_PLUS_VERSION | ||
| ARG NAP_WAF_VERSION | ||
| ARG NAP_AGENT_VERSION | ||
|
|
||
| ENV NGINX_VERSION=${NGINX_PLUS_VERSION} | ||
|
|
||
|
|
@@ -494,7 +501,7 @@ | |
| && rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \ | ||
| && rpm -Uvh /ubi-bin/c-ares-*.rpm \ | ||
| && microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \ | ||
| && microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-${NAP_AGENT_VERSION}* app-protect-module-plus-${NAP_WAF_VERSION}* \ | ||
| && nap-waf.sh \ | ||
| && ubi-clean.sh \ | ||
| && agent.sh | ||
|
|
@@ -505,6 +512,7 @@ | |
| ARG NGINX_PLUS_VERSION | ||
| ARG NAP_WAF_VERSION | ||
| ARG BUILD_OS | ||
| ARG NAP_AGENT_VERSION | ||
|
|
||
| ENV NGINX_VERSION=${NGINX_PLUS_VERSION} | ||
|
|
||
|
|
@@ -527,7 +535,7 @@ | |
| && rpm --import /tmp/nginx_signing.key \ | ||
| && rpm --import /tmp/app-protect-security-updates.key \ | ||
| && rpm -Uvh /ubi-bin/c-ares-*.rpm \ | ||
| && dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NAP_AGENT_VERSION}* \ | ||
| && sed -i 's/\(def in_container():\)/\1\n return False/g' /usr/lib64/python*/*-packages/rhsm/config.py \ | ||
| && subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} --name ${BUILD_OS}-$(uname -m) || true \ | ||
| && subscription-manager attach \ | ||
|
|
@@ -544,6 +552,7 @@ | |
| FROM redhat/ubi8@sha256:534c2c0efa4150ede18e3f9d7480d3b9ec2a52e62bc91cd54e08ee7336819619 AS ubi-8-plus-nap-v5 | ||
| ARG NGINX_PLUS_VERSION | ||
| ARG NAP_WAF_VERSION | ||
| ARG NAP_AGENT_VERSION | ||
|
|
||
| ENV NGINX_VERSION=${NGINX_PLUS_VERSION} | ||
|
|
||
|
|
@@ -565,7 +574,7 @@ | |
| && useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ | ||
| && rpm --import /tmp/nginx_signing.key \ | ||
| && rpm -Uvh /ubi-bin/c-ares-*.rpm \ | ||
| && dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NAP_AGENT_VERSION}* \ | ||
| && dnf --nodocs install -y app-protect-module-plus-${NAP_WAF_VERSION}* \ | ||
| && nap-waf.sh \ | ||
| && agent.sh \ | ||
|
|
@@ -595,7 +604,7 @@ | |
| # 101 is nginx | ||
| USER 101 | ||
|
|
||
| LABEL org.opencontainers.image.version="${IC_VERSION}" \ | ||
|
Check warning on line 607 in build/Dockerfile
|
||
| org.opencontainers.image.documentation=https://docs.nginx.com/nginx-ingress-controller \ | ||
| org.opencontainers.image.vendor="NGINX Inc <[email protected]>" \ | ||
| org.nginx.kic.image.build.target="${TARGETPLATFORM}" \ | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.