Skip to content

Commit 0481348

Browse files
fabriziofioruccifabriziofiorucci
authored
NGINX Plus + Agent - Dockerfile and start script updates (#139)
* Added API Connectivity Manager 1.5.0 support * Ownership fix * Startup script fix * NGINX App Protect WAF updates * Tested with NGINX Instance Manager 2.9.1 * Added docker-compose support * Tested with NGINX Instance Manager 2.10.0 and Security Monitoring 1.4.0 * Tested with NGINX Instance Manager 2.10.0 and API Connectivity Manager 1.5.0 * Tested with API Connectivity Manager 1.6.0 * Tested with API Connectivity Manager 1.6.0 * README updated * Added support for NGINX Instance Manager 2.10.1 and App Delivery Manager 4.0.0 * Fixed NGINX App Protect detection bug for NGINX Instance Manager 2.10.0+ * Fixed agent syslog receiver bug * README updated * Tested with NGINX Instance Manager 2.11.0 and Security Monitoring 1.5.0 * Tested with NGINX Instance Manager 2.11.0 * Tested with NGINX API Connectivity Manager 1.7.0 * Tested with NGINX Instance Manager 2.12.0 and Security Monitoring 1.6.0 * Tested with API Connectivity Manager 1.8.0 * Tested with API Connectivity Manager 1.8.0 * Tested with NGINX Instance Manager 2.12.0 * Dockerfile updated * Support for NGINX Instance Manager 2.13 * Tested with NGINX Instance Manager 2.13 * Tested with NIM 2.14.0 and SM 1.7.0 * Tested with NIM 2.14.0 and SM 1.7.0 * Tested with NGINX Instance Manager 2.14.0 * Tested with NGINX Instance Manager 2.14.0 * Tested with NGINX App Protect compiler v4.583.0 * Start script updated * Advanced metrics support added * Advanced metrics support added * Removed Application Delivery Manger, tested with NGINX Instance Manager 2.15.0 * Removed devportal, tested with NGINX Instance Manager 2.15.0 * Removed API Connectivity Manager * Dockerfile and container start updated * Dockerfile and container start updated * README updated * Tested with NGINX Instance Manager 2.15.1 * NGINX Agent updates * Manifest fix * NGINX Agent updates --------- Signed-off-by: 65397 <[email protected]>
1 parent 225b8d7 commit 0481348

File tree

4 files changed

+40
-56
lines changed

4 files changed

+40
-56
lines changed

‎nginx-agent-docker/Dockerfile

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,27 +22,24 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644
2222
&& wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \
2323
&& apt-get -y update \
2424
&& apt-get -y install nginx-plus nginx-plus-module-njs nginx-plus-module-prometheus \
25-
2625
# Optional NGINX App Protect WAF
2726
&& if [ "$NAP_WAF" = "true" ] ; then \
2827
wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor > /usr/share/keyrings/app-protect-security-updates.gpg \
2928
&& printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/debian `lsb_release -cs` nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect.list \
3029
&& printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] https://pkgs.nginx.com/app-protect-security-updates/debian `lsb_release -cs` nginx-plus\n" >> /etc/apt/sources.list.d/nginx-app-protect.list \
3130
&& apt-get -y update \
3231
&& apt-get -y install app-protect app-protect-attack-signatures; fi \
33-
3432
# Forward request logs to Docker log collector
3533
&& ln -sf /dev/stdout /var/log/nginx/access.log \
3634
&& ln -sf /dev/stderr /var/log/nginx/error.log \
37-
35+
# User and group
3836
&& groupadd -g 1001 nginx-agent \
3937
&& usermod root -G nginx-agent \
4038
&& usermod nginx -G nginx-agent \
41-
4239
# NGINX Instance Manager agent installation
4340
&& if [ `curl -o /dev/null -sk -w "%{http_code}\n" $NMS_URL/install/nginx-agent` = 200 ] ; then \
44-
bash -c 'curl -k $NMS_URL/install/nginx-agent | sh' && echo "NGINX Agent installed"; else \
45-
bash -c 'export DATAPLANE_KEY="placeholder" && curl -k $NMS_URL/nginx-agent/install | sh || :' && echo "NGINX Agent installed"; fi
41+
bash -c 'export DATA_PLANE_KEY="placeholder" && curl -k $NMS_URL/install/nginx-agent | sh' && echo "NGINX Agent installed"; else \
42+
bash -c 'export DATA_PLANE_KEY="placeholder" && curl -k $NMS_URL/nginx-agent/install | sh || :' && echo "NGINX Agent installed"; fi
4643

4744
# Startup script
4845
COPY ./container/start.sh /deployment/

‎nginx-agent-docker/README.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,19 @@ This repository can be used to build a docker image with NGINX Plus and NGINX In
66

77
## Tested releases
88

9-
This repository has been tested with NGINX agent for:
9+
This repository has been tested with: NGINX agent for:
1010

11-
- NGINX Instance Manager 2.4.0, 2.5.0, 2.5.1, 2.6.0, 2.7.0, 2.8.0, 2.9.0, 2.10.0, 2.10.1, 2.11.0, 2.12.0, 2.13.0, 2.13.1, 2.14.0, 2.14.1, 2.15.0
11+
- NGINX Agent 2.14+
12+
- NGINX Instance Manager 2.15+
1213
- NGINX App Protect WAF 4.100.1+
14+
- NGINX One Cloud Console
1315

1416
## Prerequisites
1517

1618
- Linux host running Docker to build the image
1719
- NGINX Plus license
18-
- One of
19-
- [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager/)
20+
- One of
21+
- [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager/)
2022
- [NGINX One Cloud Console](https://docs.nginx.com/nginx-one/)
2123
- Openshift/Kubernetes cluster
2224

‎nginx-agent-docker/container/start.sh

Lines changed: 24 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,12 @@ AGENT_VERSION_MINOR=`echo $AGENT_VERSION | awk -F\. '{print $2}'`
1010

1111
echo "=> NGINX Agent version $AGENT_VERSION"
1212

13-
OLD_AGENT=false
14-
if ([ $AGENT_VERSION_MAJOR -le 2 ] && [ $AGENT_VERSION_MINOR -lt 24 ])
15-
then
16-
echo "=> Pre-v2.24 NGINX Agent detected"
17-
OLD_AGENT=true
18-
fi
13+
PARM=""
1914

20-
PARM="--server-grpcport $NIM_GRPC_PORT --server-host $NIM_HOST"
15+
yq -i '
16+
.server.host=strenv(NIM_HOST) |
17+
.server.grpcPort=strenv(NIM_GRPC_PORT)
18+
' /etc/nginx-agent/nginx-agent.conf
2119

2220
if [[ ! -z "$NIM_INSTANCEGROUP" ]]; then
2321
PARM="${PARM} --instance-group $NIM_INSTANCEGROUP"
@@ -34,9 +32,7 @@ if [[ ! -z "$NIM_TOKEN" ]]; then
3432
fi
3533

3634
if [[ "$NIM_ADVANCED_METRICS" == "true" ]]; then
37-
if [ $OLD_AGENT == "false" ]
38-
then
39-
yq -i '
35+
yq -i '
4036
.advanced_metrics.socket_path="/var/run/nginx-agent/advanced-metrics.sock" |
4137
.advanced_metrics.aggregation_period="1s" |
4238
.advanced_metrics.publishing_period="3s" |
@@ -46,44 +42,33 @@ if [[ "$NIM_ADVANCED_METRICS" == "true" ]]; then
4642
.advanced_metrics.table_sizes_limits.priority_table_threshold= 1000 |
4743
.extensions += ["advanced-metrics"]
4844
' /etc/nginx-agent/nginx-agent.conf
49-
fi
5045
fi
5146

5247
if [[ "$NAP_WAF" == "true" ]]; then
53-
if [ $OLD_AGENT == "true" ]
54-
then
55-
PARM="${PARM} --nginx-app-protect-report-interval 15s --nap-monitoring-collector-buffer-size 50000 --nap-monitoring-processor-buffer-size 50000 --nap-monitoring-syslog-ip 127.0.0.1 --nap-monitoring-syslog-port 514"
56-
else
57-
export FQDN=127.0.0.1
48+
export FQDN=127.0.0.1
5849

59-
yq -i '
60-
.nap_monitoring.collector_buffer_size=50000 |
61-
.nap_monitoring.processor_buffer_size=50000 |
62-
.nap_monitoring.syslog_ip=strenv(FQDN) |
63-
.nap_monitoring.syslog_port=514 |
64-
.extensions += ["nginx-app-protect","nap-monitoring"]
65-
' /etc/nginx-agent/nginx-agent.conf
66-
fi
50+
yq -i '
51+
.nap_monitoring.collector_buffer_size=50000 |
52+
.nap_monitoring.processor_buffer_size=50000 |
53+
.nap_monitoring.syslog_ip=strenv(FQDN) |
54+
.nap_monitoring.syslog_port=514 |
55+
.extensions += ["nginx-app-protect","nap-monitoring"]
56+
' /etc/nginx-agent/nginx-agent.conf
6757

68-
su - nginx -s /bin/bash -c "/opt/app_protect/bin/bd_agent &"
69-
su - nginx -s /bin/bash -c "/usr/share/ts/bin/bd-socket-plugin tmm_count 4 proc_cpuinfo_cpu_mhz 2000000 total_xml_memory 471859200 total_umu_max_size 3129344 sys_max_account_id 1024 no_static_config &"
58+
su - nginx -s /bin/bash -c "/opt/app_protect/bin/bd_agent &"
59+
su - nginx -s /bin/bash -c "/usr/share/ts/bin/bd-socket-plugin tmm_count 4 proc_cpuinfo_cpu_mhz 2000000 total_xml_memory 471859200 total_umu_max_size 3129344 sys_max_account_id 1024 no_static_config &"
7060

71-
while ([ ! -e /opt/app_protect/pipe/app_protect_plugin_socket ] || [ ! -e /opt/app_protect/pipe/ts_agent_pipe ])
72-
do
73-
sleep 1
74-
done
61+
while ([ ! -e /opt/app_protect/pipe/app_protect_plugin_socket ] || [ ! -e /opt/app_protect/pipe/ts_agent_pipe ])
62+
do
63+
sleep 1
64+
done
7565

76-
chown nginx:nginx /opt/app_protect/pipe/*
66+
chown nginx:nginx /opt/app_protect/pipe/*
7767

7868
if [[ "$NAP_WAF_PRECOMPILED_POLICIES" == "true" ]]; then
79-
if [ $OLD_AGENT == "true" ]
80-
then
81-
PARM="${PARM} --nginx-app-protect-precompiled-publication"
82-
else
83-
yq -i '
84-
.nginx_app_protect.precompiled_publication=true
85-
' /etc/nginx-agent/nginx-agent.conf
86-
fi
69+
yq -i '
70+
.nginx_app_protect.precompiled_publication=true
71+
' /etc/nginx-agent/nginx-agent.conf
8772
fi
8873

8974
fi

‎nginx-agent-docker/manifests/1.nginx-with-agent.yaml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ spec:
2424
containerPort: 80
2525
env:
2626
- name: NIM_HOST
27-
# Default value to use if NGINX Instance Manager is installed using https://github.com/nginxinc/NGINX-Demos/tree/master/nginx-nms-docker or https://github.com/fabriziofiorucci/NGINX-NMS-Docker
27+
# NGINX Instance Manager hostname or IP address
2828
value: "nginx-nim2.nginx-nim2"
2929
- name: NIM_GRPC_PORT
3030
value: "443"
@@ -35,16 +35,16 @@ spec:
3535
- name: NIM_TAGS
3636
value: "preprod,devops"
3737

38+
# Optional to enable advanced metrics collection - set to "true" to enable
39+
- name: NIM_ADVANCED_METRICS
40+
value: "true"
41+
3842
# Optional if NGINX App Protect WAF is available in the docker image - set to "true" to enable
3943
#- name: NAP_WAF
4044
# value: "true"
4145
#- name: NAP_WAF_PRECOMPILED_POLICIES
4246
# value: "true"
4347

44-
# Optional if API Connectivity Manager Developer Portal is available in the docker image - set to "true" to enable
45-
#- name: ACM_DEVPORTAL
46-
# value: "true"
47-
4848
---
4949
apiVersion: v1
5050
kind: Service
@@ -60,7 +60,7 @@ spec:
6060
- name: api
6161
port: 8080
6262
selector:
63-
app: nginx
63+
app: nginx-nim
6464
type: ClusterIP
6565

6666
---
@@ -86,6 +86,6 @@ spec:
8686
pathType: Prefix
8787
backend:
8888
service:
89-
name: nginx
89+
name: nginx-nim
9090
port:
9191
number: 80

0 commit comments

Comments
 (0)