Update WAF to 5.9.0

.github/workflows/regression.yml

@@ -275,7 +275,7 @@ jobs:
 
       - name: Generate WAF v5 tgz from JSON
         run: |
-          docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.8.0 -p /data/wafv5.json -o /data/wafv5.tgz
+          docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.9.0 -p /data/wafv5.json -o /data/wafv5.tgz
         if: ${{ contains(matrix.images.image, 'nap-v5')}}
 
       - name: Run Regression Tests

.github/workflows/setup-smoke.yml

@@ -152,7 +152,7 @@ jobs:
 
       - name: Generate WAF v5 tgz from JSON
         run: |
-          docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.8.0 -p /data/wafv5.json -o /data/wafv5.tgz
+          docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.9.0 -p /data/wafv5.json -o /data/wafv5.tgz
         if: ${{ contains(inputs.image, 'nap-v5')}}
 
       - name: Run Smoke Tests

Makefile

@@ -4,9 +4,9 @@ GIT_TAG = $(shell git describe --exact-match --tags || echo untagged)
 VERSION = $(VER)-SNAPSHOT
 NGINX_OSS_VERSION             ?= 1.29
 NGINX_PLUS_VERSION            ?= R35
-NAP_WAF_VERSION               ?= 35+5.498
-NAP_WAF_COMMON_VERSION        ?= 11.533
-NAP_WAF_PLUGIN_VERSION        ?= 6.20.0
+NAP_WAF_VERSION               ?= 35+5.527
+NAP_WAF_COMMON_VERSION        ?= 11.559
+NAP_WAF_PLUGIN_VERSION        ?= 6.23.0
 NGINX_AGENT_VERSION           ?= 3.3
 PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key
 

build/Dockerfile

@@ -2,9 +2,9 @@
 ARG BUILD_OS=debian
 ARG NGINX_OSS_VERSION=1.29
 ARG NGINX_PLUS_VERSION=R35
-ARG NAP_WAF_VERSION=35+5.498
-ARG NAP_WAF_COMMON_VERSION=11.533
-ARG NAP_WAF_PLUGIN_VERSION=6.20.0
+ARG NAP_WAF_VERSION=35+5.527
+ARG NAP_WAF_COMMON_VERSION=11.559
+ARG NAP_WAF_PLUGIN_VERSION=6.23.0
 ARG NGINX_AGENT_VERSION=3.3
 ARG DOWNLOAD_TAG=edge
 ARG DEBIAN_FRONTEND=noninteractive
@@ -595,7 +595,7 @@
 # 101 is nginx
 USER 101
 
 LABEL org.opencontainers.image.version="${IC_VERSION}" \
 	org.opencontainers.image.documentation=https://docs.nginx.com/nginx-ingress-controller \
 	org.opencontainers.image.vendor="NGINX Inc <[email protected]>" \
 	org.nginx.kic.image.build.target="${TARGETPLATFORM}" \

charts/nginx-ingress/values.schema.json

@@ -350,10 +350,10 @@
                     },
                     "tag": {
                       "type": "string",
-                      "default": "5.8.0",
+                      "default": "5.9.0",
                       "title": "The tag of the  App Protect WAF v5 Enforcer image",
                       "examples": [
-                        "5.8.0"
+                        "5.9.0"
                       ]
                     },
                     "digest": {
@@ -389,7 +389,7 @@
                   "examples": [
                     {
                       "repository": "private-registry.nginx.com/nap/waf-enforcer",
-                      "tag": "5.8.0",
+                      "tag": "5.9.0",
                       "pullPolicy": "IfNotPresent"
                     }
                   ]
@@ -422,10 +422,10 @@
                     },
                     "tag": {
                       "type": "string",
-                      "default": "5.8.0",
+                      "default": "5.9.0",
                       "title": "The tag of the  App Protect WAF v5 Config Manager image",
                       "examples": [
-                        "5.8.0"
+                        "5.9.0"
                       ]
                     },
                     "digest": {
@@ -461,7 +461,7 @@
                   "examples": [
                     {
                       "repository": "private-registry.nginx.com/nap/waf-config-mgr",
-                      "tag": "5.8.0",
+                      "tag": "5.9.0",
                       "pullPolicy": "IfNotPresent"
                     }
                   ]
@@ -2020,15 +2020,15 @@
               "port": 50000,
               "image": {
                 "repository": "private-registry.nginx.com/nap/waf-enforcer",
-                "tag": "5.8.0",
+                "tag": "5.9.0",
                 "pullPolicy": "IfNotPresent"
               },
               "securityContext": {}
             },
             "configManager": {
               "image": {
                 "repository": "private-registry.nginx.com/nap/waf-config-mgr",
-                "tag": "5.8.0",
+                "tag": "5.9.0",
                 "pullPolicy": "IfNotPresent"
               },
               "securityContext": {
@@ -2660,15 +2660,15 @@
             "port": 50000,
             "image": {
               "repository": "private-registry.nginx.com/nap/waf-enforcer",
-              "tag": "5.8.0",
+              "tag": "5.9.0",
               "pullPolicy": "IfNotPresent"
             },
             "securityContext": {}
           },
           "configManager": {
             "image": {
               "repository": "private-registry.nginx.com/nap/waf-config-mgr",
-              "tag": "5.8.0",
+              "tag": "5.9.0",
               "pullPolicy": "IfNotPresent"
             },
             "securityContext": {

charts/nginx-ingress/values.yaml

@@ -84,7 +84,7 @@ controller:
         repository: private-registry.nginx.com/nap/waf-enforcer
 
         ## The tag of the App Protect WAF v5 Enforcer image.
-        tag: "5.8.0"
+        tag: "5.9.0"
         ## The digest of the App Protect WAF v5 Enforcer image.
         ## If digest is specified it has precedence over tag and will be used instead
         # digest: "sha256:CHANGEME"
@@ -100,7 +100,7 @@ controller:
         repository: private-registry.nginx.com/nap/waf-config-mgr
 
         ## The tag of the App Protect WAF v5 Configuration Manager image.
-        tag: "5.8.0"
+        tag: "5.9.0"
         ## The digest of the App Protect WAF v5 Configuration Manager image.
         ## If digest is specified it has precedence over tag and will be used instead
         # digest: "sha256:CHANGEME"

cmd/nginx-ingress/main.go

@@ -12,7 +12,6 @@ import (
 	"os/signal"
 	"path/filepath"
 	"reflect"
-	"regexp"
 	"runtime"
 	"strings"
 	"syscall"
@@ -146,10 +145,12 @@ func main() {
 	if *appProtect {
 		appProtectVersion = getAppProtectVersionInfo(ctx)
 
-		r := regexp.MustCompile("^5.*")
-		if r.MatchString(appProtectVersion) {
-			appProtectV5 = true
-			appProtectBundlePath = appProtectv5BundleFolder
+		for _, flag := range parsedFlags {
+			if strings.Contains(flag, "app-protect-enforcer-address") {
+				appProtectV5 = true
+				appProtectBundlePath = appProtectv5BundleFolder
+				break
+			}
 		}
 	}
 

tests/settings.py

@@ -33,4 +33,4 @@
 # Nginx registry address to pull waf components from
 NGX_REG = "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr"
 # WAF component version to pull from above registry
-WAF_V5_VERSION = "5.8.0"
+WAF_V5_VERSION = "5.9.0"