Skip to content

Commit f423ef0

Browse files
ciarams87ciarams87
committed
Review feedback
1 parent 7ea76a7 commit f423ef0

File tree

9 files changed

+45
-30
lines changed

9 files changed

+45
-30
lines changed

‎Makefile‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ HELM_SCHEMA_VERSION = 0.18.1
4545
PREFIX ?= nginx-gateway-fabric## The name of the NGF image. For example, nginx-gateway-fabric
4646
NGINX_PREFIX ?= $(PREFIX)/nginx## The name of the nginx image. For example: nginx-gateway-fabric/nginx
4747
NGINX_PLUS_PREFIX ?= $(PREFIX)/nginx-plus## The name of the nginx plus image. For example: nginx-gateway-fabric/nginx-plus
48-
NGINX_PLUS_WAF_PREFIX ?= $(PREFIX)/nginx-plus-waf## The name of the nginx plus image with NAP WAF. For example: nginx-gateway-fabric/nginx-plus-waf
4948
TAG ?= $(VERSION:v%=%)## The tag of the image. For example, 1.1.0
5049
TARGET ?= local## The target of the build. Possible values: local and container
5150
OUT_DIR ?= build/out## The folder where the binary will be stored
@@ -110,7 +109,7 @@ build-nginx-plus-image-with-nap-waf: check-for-docker ## Build the custom nginx
110109
@if [ $(GOARCH) = "arm64" ]; then \
111110
echo "\033[0;31mIMPORTANT:\033[0m The nginx-plus-waf image cannot be built for arm64 architecture and will be built for amd64."; \
112111
fi
113-
docker build --platform linux/amd64 $(strip $(NGINX_DOCKER_BUILD_OPTIONS)) $(strip $(NGINX_DOCKER_BUILD_PLUS_ARGS)) $(strip $(NGINX_DOCKER_BUILD_NAP_WAF_ARGS)) -f $(SELF_DIR)build/Dockerfile.nginxplus -t $(strip $(NGINX_PLUS_WAF_PREFIX)):$(strip $(TAG)) $(strip $(SELF_DIR))
112+
docker build --platform linux/amd64 $(strip $(NGINX_DOCKER_BUILD_OPTIONS)) $(strip $(NGINX_DOCKER_BUILD_PLUS_ARGS)) $(strip $(NGINX_DOCKER_BUILD_NAP_WAF_ARGS)) -f $(SELF_DIR)build/Dockerfile.nginxplus -t $(strip $(NGINX_PLU_PREFIX)):$(strip $(TAG)) $(strip $(SELF_DIR))
114113

115114
.PHONY: check-for-docker
116115
check-for-docker: ## Check if Docker is installed

‎apis/v1alpha2/nginxproxy_types.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,10 @@ type NginxProxySpec struct {
7575
// WAF enables NGINX App Protect WAF functionality.
7676
// When enabled, NGINX Gateway Fabric will deploy additional WAF containers
7777
// (waf-enforcer and waf-config-mgr) alongside the main NGINX container.
78-
// Default is "Disabled".
78+
// Default is "disabled".
7979
//
8080
// +optional
81-
// +kubebuilder:default:=Disabled
81+
// +kubebuilder:default:=disabled
8282
WAF *WAFState `json:"waf,omitempty"`
8383
// Kubernetes contains the configuration for the NGINX Deployment and Service Kubernetes objects.
8484
//
@@ -88,17 +88,17 @@ type NginxProxySpec struct {
8888

8989
// WAFState defines the state of WAF functionality.
9090
//
91-
// +kubebuilder:validation:Enum=Enabled;Disabled
91+
// +kubebuilder:validation:Enum=enabled;disabled
9292
type WAFState string
9393

9494
const (
9595
// WAFEnabled enables NGINX App Protect WAF functionality.
9696
// This will deploy additional containers for WAF enforcement and configuration management.
97-
WAFEnabled WAFState = "Enabled"
97+
WAFEnabled WAFState = "enabled"
9898

9999
// WAFDisabled disables NGINX App Protect WAF functionality.
100100
// Only the standard NGINX container will be deployed.
101-
WAFDisabled WAFState = "Disabled"
101+
WAFDisabled WAFState = "disabled"
102102
)
103103

104104
// Telemetry specifies the OpenTelemetry configuration.

‎charts/nginx-gateway-fabric/values.schema.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -272,8 +272,8 @@
272272
"waf": {
273273
"description": "WAF enables NGINX App Protect WAF functionality.",
274274
"enum": [
275-
"Enabled",
276-
"Disabled"
275+
"enabled",
276+
"disabled"
277277
],
278278
"required": [],
279279
"type": "string"

‎charts/nginx-gateway-fabric/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -371,8 +371,8 @@ nginx:
371371
# type: string
372372
# description: WAF enables NGINX App Protect WAF functionality.
373373
# enum:
374-
# - Enabled
375-
# - Disabled
374+
# - enabled
375+
# - disabled
376376
# @schema
377377
# -- The configuration for the data plane that is contained in the NginxProxy resource. This is applied globally to all Gateways
378378
# managed by this instance of NGINX Gateway Fabric.

‎config/crd/bases/gateway.nginx.org_nginxproxies.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7771,15 +7771,15 @@ spec:
77717771
x-kubernetes-list-type: map
77727772
type: object
77737773
waf:
7774-
default: Disabled
7774+
default: disabled
77757775
description: |-
77767776
WAF enables NGINX App Protect WAF functionality.
77777777
When enabled, NGINX Gateway Fabric will deploy additional WAF containers
77787778
(waf-enforcer and waf-config-mgr) alongside the main NGINX container.
7779-
Default is "Disabled".
7779+
Default is "disabled".
77807780
enum:
7781-
- Enabled
7782-
- Disabled
7781+
- enabled
7782+
- disabled
77837783
type: string
77847784
type: object
77857785
required:

‎deploy/crds.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8356,15 +8356,15 @@ spec:
83568356
x-kubernetes-list-type: map
83578357
type: object
83588358
waf:
8359-
default: Disabled
8359+
default: disabled
83608360
description: |-
83618361
WAF enables NGINX App Protect WAF functionality.
83628362
When enabled, NGINX Gateway Fabric will deploy additional WAF containers
83638363
(waf-enforcer and waf-config-mgr) alongside the main NGINX container.
8364-
Default is "Disabled".
8364+
Default is "disabled".
83658365
enum:
8366-
- Enabled
8367-
- Disabled
8366+
- enabled
8367+
- disabled
83688368
type: string
83698369
type: object
83708370
required:

‎internal/controller/provisioner/objects.go‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,8 @@ const (
3333
defaultServiceType = corev1.ServiceTypeLoadBalancer
3434
defaultServicePolicy = corev1.ServiceExternalTrafficPolicyLocal
3535

36-
defaultNginxImagePath = "ghcr.io/nginx/nginx-gateway-fabric/nginx"
37-
defaultNginxPlusImagePath = "private-registry.nginx.com/nginx-gateway-fabric/nginx-plus"
38-
defaultNginxPlusWafImagePath = "private-registry.nginx.com/nginx-gateway-fabric/nginx-plus-waf"
39-
defaultImagePullPolicy = corev1.PullIfNotPresent
36+
defaultNginxImagePath = "ghcr.io/nginx/nginx-gateway-fabric/nginx"
37+
defaultImagePullPolicy = corev1.PullIfNotPresent
4038

4139
// WAF container defaults.
4240
defaultWAFEnforcerImagePath = "private-registry.nginx.com/nap/waf-enforcer"
@@ -914,7 +912,8 @@ func (p *NginxProvisioner) configureNginxPlus(
914912
initCmd = append(initCmd,
915913
"--source", "/includes/mgmt.conf",
916914
"--destination", "/etc/nginx/main-includes",
917-
"--nginx-plus")
915+
"--nginx-plus",
916+
)
918917
spec.Spec.InitContainers[0].Command = initCmd
919918

920919
// Add NGINX Plus volumes and volume mounts
@@ -984,10 +983,6 @@ func (p *NginxProvisioner) buildImage(nProxyCfg *graph.EffectiveNginxProxy) (str
984983
tag := p.cfg.GatewayPodConfig.Version
985984
pullPolicy := defaultImagePullPolicy
986985

987-
if graph.WAFEnabledForNginxProxy(nProxyCfg) {
988-
image = defaultNginxPlusWafImagePath
989-
}
990-
991986
getImageAndPullPolicy := func(container ngfAPIv1alpha2.ContainerSpec) (string, string, corev1.PullPolicy) {
992987
if container.Image != nil {
993988
if container.Image.Repository != nil {
@@ -1114,7 +1109,12 @@ func (p *NginxProvisioner) buildWAFEnforcerContainer(
11141109
Image: image,
11151110
ImagePullPolicy: defaultImagePullPolicy,
11161111
SecurityContext: &corev1.SecurityContext{
1117-
RunAsUser: helpers.GetPointer[int64](101),
1112+
RunAsUser: helpers.GetPointer[int64](101),
1113+
AllowPrivilegeEscalation: helpers.GetPointer(false),
1114+
RunAsNonRoot: helpers.GetPointer(false),
1115+
Capabilities: &corev1.Capabilities{
1116+
Drop: []corev1.Capability{"all"},
1117+
},
11181118
},
11191119
Env: []corev1.EnvVar{
11201120
{Name: "ENFORCER_PORT", Value: "50000"},

‎internal/controller/provisioner/objects_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1114,7 +1114,7 @@ func TestBuildNginxResourceObjects_WAF(t *testing.T) {
11141114
// Validate NGINX container (first container)
11151115
nginxContainer := template.Spec.Containers[0]
11161116
g.Expect(nginxContainer.Name).To(Equal("nginx"))
1117-
g.Expect(nginxContainer.Image).To(Equal(fmt.Sprintf("%s:1.0.0", defaultNginxPlusWafImagePath)))
1117+
g.Expect(nginxContainer.Image).To(Equal(fmt.Sprintf("%s:1.0.0", defaultNginxImagePath)))
11181118

11191119
// Check NGINX container has WAF volume mounts
11201120
wafVolumeMountNames := []string{

‎internal/controller/state/graph/nginxproxy_test.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -536,6 +536,22 @@ func TestBuildEffectiveNginxProxy_WAF(t *testing.T) {
536536
WAF: helpers.GetPointer(ngfAPIv1alpha2.WAFDisabled),
537537
},
538538
},
539+
{
540+
name: "both have WAF unset",
541+
gcNp: &NginxProxy{
542+
Valid: true,
543+
Source: &ngfAPIv1alpha2.NginxProxy{
544+
Spec: ngfAPIv1alpha2.NginxProxySpec{},
545+
},
546+
},
547+
gwNp: &NginxProxy{
548+
Valid: true,
549+
Source: &ngfAPIv1alpha2.NginxProxy{
550+
Spec: ngfAPIv1alpha2.NginxProxySpec{},
551+
},
552+
},
553+
exp: &EffectiveNginxProxy{},
554+
},
539555
}
540556

541557
for _, test := range tests {

0 commit comments

Comments
 (0)