Skip to content

Commit 698b58e

Browse files
fabriziofioruccilucacome
fabriziofiorucci
and
lucacome
authored
Added nginx-agent-docker on debian-bullseye (#81)
* Added nginx-agent-docker * Changed base image to Debian bullseye * Update nginx-agent-docker/Dockerfile Thank you Co-authored-by: Luca Comellini <[email protected]> Signed-off-by: 65397 <[email protected]> * Update nginx-agent-docker/Dockerfile Co-authored-by: Luca Comellini <[email protected]> Signed-off-by: 65397 <[email protected]> * Update nginx-agent-docker/Dockerfile Co-authored-by: Luca Comellini <[email protected]> Signed-off-by: 65397 <[email protected]> * Update nginx-agent-docker/Dockerfile Co-authored-by: Luca Comellini <[email protected]> Signed-off-by: 65397 <[email protected]> --------- Signed-off-by: 65397 <[email protected]> Co-authored-by: Luca Comellini <[email protected]>
1 parent e30f55d commit 698b58e

File tree

7 files changed

+383
-0
lines changed

7 files changed

+383
-0
lines changed

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ utilizing *fleet* and *etcd*.
1717

1818
* **mysql-galera-demo**: This demo uses NGINX Plus as a TCP load balancer for a MySQL Galera cluster consisting of two mysqld servers. It does round-robin load balancing between the 2 mysqld servers and also does active health checks using an xinetd script running on port 9200 inside each mysqld container.
1919

20+
* **nginx-agent-docker**: This demo helps building a docker image to deploy NGINX Plus and NGINX Agent for NGINX Management Suite, with optional support for NGINX App Protect WAF and NGINX Developer Portal for API Connectivity Manager
21+
2022
* **nginx-hello**: NGINX running as webserver in a docker container that serves a simple page containing the container's hostname, IP address and port
2123

2224
* **nginx-hello-nonroot**: NGINX running as webserver with non root privilege in a docker container that serves a simple page containing the container's hostname, IP address and port

‎nginx-agent-docker/Dockerfile

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
FROM debian:bullseye-slim
2+
3+
ARG NMS_URL
4+
ARG DEVPORTAL=false
5+
ARG NAP_WAF=false
6+
7+
# Initial packages setup
8+
RUN apt-get -y update \
9+
&& apt-get -y install -y apt-transport-https lsb-release ca-certificates wget gnupg2 curl \
10+
# NGINX Instance Manager agent setup
11+
&& mkdir -p /deployment /etc/ssl/nginx \
12+
# Agent installation
13+
&& bash -c 'curl -k $NMS_URL/install/nginx-agent | sh' && echo "Agent installed from NMS"
14+
15+
# Startup script
16+
COPY ./container/start.sh /deployment/
17+
18+
# Download certificate and key from the customer portal (https://account.f5.com)
19+
# and copy to the build context
20+
RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
21+
--mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
22+
set -x \
23+
# Startup script
24+
&& chmod +x /deployment/start.sh && touch /.dockerenv \
25+
# Install prerequisite packages:
26+
&& apt-get -y update \
27+
&& apt-get -y install debian-archive-keyring \
28+
&& wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \
29+
&& printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nginx-plus.list \
30+
&& wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \
31+
&& apt-get -y update \
32+
&& apt-get -y install nginx-plus nginx-plus-module-njs nginx-plus-module-prometheus \
33+
34+
# Optional NGINX App Protect WAF
35+
&& if [ "$NAP_WAF" = "true" ] ; then \
36+
wget -qO - https://cs.nginx.com/static/keys/app-protect-security-updates.key | gpg --dearmor | tee /usr/share/keyrings/app-protect-security-updates.gpg >/dev/null \
37+
&& printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/debian `lsb_release -cs` nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect.list \
38+
&& printf "deb [signed-by=/usr/share/keyrings/app-protect-security-updates.gpg] https://pkgs.nginx.com/app-protect-security-updates/debian `lsb_release -cs` nginx-plus\n" >> /etc/apt/sources.list.d/nginx-app-protect.list \
39+
&& apt-get -y update \
40+
&& apt-get -y install app-protect app-protect-attack-signatures; fi \
41+
42+
# Optional API Connectivity Manager DevPortal
43+
# https://docs.nginx.com/nginx-management-suite/admin-guides/installation/on-prem/install-guide/
44+
&& if [ "$DEVPORTAL" = "true" ] ; then \
45+
printf "deb https://pkgs.nginx.com/nms/debian `lsb_release -cs` nginx-plus\n" | tee /etc/apt/sources.list.d/nms.list \
46+
&& apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ABF5BD827BD9BF62 \
47+
&& apt-get -y update \
48+
&& apt-get -y install nginx-devportal nginx-devportal-ui \
49+
&& echo 'DB_TYPE="sqlite"' | tee -a /etc/nginx-devportal/devportal.conf \
50+
&& echo 'DB_PATH="/var/lib/nginx-devportal"' | tee -a /etc/nginx-devportal/devportal.conf; fi \
51+
52+
# Forward request logs to Docker log collector
53+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
54+
&& ln -sf /dev/stderr /var/log/nginx/error.log
55+
56+
EXPOSE 80
57+
STOPSIGNAL SIGTERM
58+
59+
CMD /deployment/start.sh

‎nginx-agent-docker/README.md

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# NGINX Plus and NGINX Agent - Docker image builder
2+
3+
## Description
4+
5+
This repository can be used to build a docker image with NGINX Plus and NGINX Instance Manager Agent (https://docs.nginx.com/nginx-instance-manager/).
6+
7+
## Tested releases
8+
9+
This repository has been tested with NGINX agent for:
10+
11+
- NGINX Instance Manager 2.4.0, 2.5.0, 2.5.1, 2.6.0, 2.7.0, 2.8.0
12+
- API Connectivity Manager 1.4.0
13+
- NGINX App Protect WAF 4.100.1+
14+
15+
## Prerequisites
16+
17+
- Linux host running Docker to build the image
18+
- NGINX Plus license
19+
- A running [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager/) instance
20+
- [API Connectivity Manager](https://docs.nginx.com/nginx-management-suite/acm/about/architecture/) if building with support for Developer Portal
21+
- Openshift/Kubernetes cluster
22+
23+
## Building the docker image
24+
25+
The install script can be used to build the Docker image using automated or manual agent install:
26+
27+
```
28+
$ ./scripts/build.sh
29+
NGINX Plus & NGINX Instance Manager agent Docker image builder
30+
31+
This tool builds a Docker image to run NGINX Plus and NGINX Instance Manager agent
32+
33+
=== Usage:
34+
35+
./scripts/build.sh [options]
36+
37+
=== Options:
38+
39+
-h - This help
40+
-t [target image] - The Docker image to be created
41+
-C [file.crt] - Certificate to pull packages from the official NGINX repository
42+
-K [file.key] - Key to pull packages from the official NGINX repository
43+
-n [URL] - NGINX Instance Manager URL to fetch the agent
44+
-d - Build support for NGINX API Gateway Developer Portal
45+
-w - Add NGINX App Protect WAF
46+
47+
=== Examples:
48+
49+
NGINX Plus and NGINX Agent image:
50+
./scripts/build.sh -C nginx-repo.crt -K nginx-repo.key -t registry.ff.lan:31005/nginx-with-agent:2.7.0 -n https://nim.f5.ff.lan
51+
52+
NGINX Plus, NGINX App Protect WAF and NGINX Agent image:
53+
./scripts/build.sh -C nginx-repo.crt -K nginx-repo.key -t registry.ff.lan:31005/nginx-with-agent:2.7.0 -w -n https://nim.f5.ff.lan
54+
55+
NGINX Plus, Developer Portal support and NGINX Agent image:
56+
./scripts/build.sh -C nginx-repo.crt -K nginx-repo.key -t registry.ff.lan:31005/nginx-with-agent:2.7.0-devportal -d -n https://nim.f5.ff.lan
57+
```
58+
59+
1. Clone this repository
60+
2. Get your license certificate and key to fetch NGINX Management Suite packages from NGINX repository
61+
3. [Install](https://docs.nginx.com/nginx-management-suite/) and start NGINX Management Suite / NGINX Instance Manager
62+
4. Build the Docker image using:
63+
64+
```
65+
$ ./scripts/build.sh -C nginx-repo.crt -K nginx-repo.key -t registry.ff.lan:31005/nginx-with-agent:automated -n https://ubuntu.ff.lan
66+
```
67+
68+
the build script will push the image to your private registry once build is complete.
69+
70+
- the `-d` flag can be used to build a Docker image to run NGINX Plus in [Developer Portal](https://docs.nginx.com/nginx-management-suite/admin-guides/installation/on-prem/install-guide/#install-developer-portal) mode for [API Connectivity Manager](https://docs.nginx.com/nginx-management-suite/acm/about/architecture/)
71+
- the `-w` flag can be used to include NGINX App Protect WAF support in the docker image
72+
73+
### Running the docker image
74+
75+
1. Edit `manifests/1.nginx-nim.yaml` and specify the correct image by modifying the `image:` line, and set the following environment variables. Default values for `NIM_HOST` and `NIM_GRPC_PORT` can be used if NGINX Instance Manager is deployed using https://github.com/nginxinc/NGINX-Demos/tree/master/nginx-nms-docker
76+
- `NIM_HOST` - NGINX Instance Manager hostname/IP address
77+
- `NIM_GRPC_PORT` - NGINX Instance Manager gRPC port.
78+
- `NIM_INSTANCEGROUP` - instance group for the NGINX Kubernetes Deployment
79+
- `NIM_TAGS` - comma separated list of tags for the NGINX Kubernetes Deployment
80+
- `NAP_WAF` - set to `"true"` to enable NGINX App Protect WAF (docker image built using `-w`)
81+
- `NAP_WAF_PRECOMPILED_POLICIES` - set to `"true"` to enable NGINX App Protect WAF precompiled policies (docker image built using `-w`)
82+
83+
2. Start and stop using
84+
85+
```
86+
$ ./scripts/nginxWithAgentStart.sh start
87+
$ ./scripts/nginxWithAgentStart.sh stop
88+
```
89+
90+
3. After startup NGINX Plus instances will register to NGINX Instance Manager and will be displayed on the "instances" dashboard

‎nginx-agent-docker/container/start.sh

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
3+
nginx
4+
sleep 2
5+
6+
PARM="--server-grpcport $NIM_GRPC_PORT --server-host $NIM_HOST"
7+
8+
if [[ ! -z "$NIM_INSTANCEGROUP" ]]; then
9+
PARM="${PARM} --instance-group $NIM_INSTANCEGROUP"
10+
fi
11+
12+
if [[ ! -z "$NIM_TAGS" ]]; then
13+
PARM="${PARM} --tags $NIM_TAGS"
14+
fi
15+
16+
if [[ "$NAP_WAF" == "true" ]]; then
17+
PARM="${PARM} --nginx-app-protect-report-interval 15s --nap-monitoring-collector-buffer-size 50000 --nap-monitoring-processor-buffer-size 50000 --nap-monitoring-syslog-ip 127.0.0.1 --nap-monitoring-syslog-port 514"
18+
fi
19+
20+
if [[ "$NAP_WAF_PRECOMPILED_POLICIES" == "true" ]]; then
21+
PARM="${PARM} --nginx-app-protect-precompiled-publication"
22+
fi
23+
24+
if [[ "$ACM_DEVPORTAL" == "true" ]]; then
25+
nginx-devportal server &
26+
fi
27+
28+
nginx-agent $PARM

‎nginx-agent-docker/manifests/1.nginx-with-agent.yaml

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: nginx-nim
5+
namespace: nim-test
6+
labels:
7+
app: nginx-nim
8+
spec:
9+
selector:
10+
matchLabels:
11+
app: nginx-nim
12+
replicas: 2
13+
template:
14+
metadata:
15+
labels:
16+
app: nginx-nim
17+
spec:
18+
containers:
19+
- name: nginx-nim
20+
image: your.registry.tld/nginx-with-nim2-agent:tag
21+
imagePullPolicy: Always
22+
ports:
23+
- name: http
24+
containerPort: 80
25+
env:
26+
- name: NIM_HOST
27+
# Default value to use if NGINX Instance Manager is installed using https://github.com/nginxinc/NGINX-Demos/tree/master/nginx-nms-docker or https://github.com/fabriziofiorucci/NGINX-NMS-Docker
28+
value: "nginx-nim2.nginx-nim2"
29+
- name: NIM_GRPC_PORT
30+
value: "443"
31+
- name: NIM_INSTANCEGROUP
32+
value: "lab"
33+
- name: NIM_TAGS
34+
value: "preprod,devops"
35+
36+
# Optional if NGINX App Protect WAF is available in the docker image - set to "true" to enable
37+
#- name: NAP_WAF
38+
# value: "true"
39+
#- name: NAP_WAF_PRECOMPILED_POLICIES
40+
# value: "true"
41+
42+
# Optional if API Connectivity Manager Developer Portal is available in the docker image - set to "true" to enable
43+
#- name: ACM_DEVPORTAL
44+
# value: "true"
45+
46+
---
47+
apiVersion: v1
48+
kind: Service
49+
metadata:
50+
name: nginx-nim
51+
namespace: nim-test
52+
labels:
53+
app: nginx-nim
54+
spec:
55+
ports:
56+
- name: http
57+
port: 80
58+
- name: api
59+
port: 8080
60+
selector:
61+
app: nginx
62+
type: ClusterIP
63+
64+
---
65+
apiVersion: networking.k8s.io/v1
66+
kind: Ingress
67+
metadata:
68+
name: nginx-nim
69+
namespace: nim-test
70+
annotations:
71+
nginx.org/proxy-connect-timeout: "30s"
72+
nginx.org/proxy-read-timeout: "20s"
73+
nginx.org/client-max-body-size: "4m"
74+
nginx.com/health-checks: "true"
75+
labels:
76+
app: nginx-nim
77+
spec:
78+
ingressClassName: nginx
79+
rules:
80+
- host: nim-test-nim.f5.ff.lan
81+
http:
82+
paths:
83+
- path: /
84+
pathType: Prefix
85+
backend:
86+
service:
87+
name: nginx
88+
port:
89+
number: 80

‎nginx-agent-docker/scripts/build.sh

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
#!/bin/bash
2+
3+
# https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-docker/#docker_plus
4+
5+
BANNER="NGINX Plus & NGINX Instance Manager agent Docker image builder\n\n
6+
This tool builds a Docker image to run NGINX Plus and NGINX Instance Manager agent\n\n
7+
=== Usage:\n\n
8+
$0 [options]\n\n
9+
=== Options:\n\n
10+
-h\t\t\t- This help\n
11+
-t [target image]\t- The Docker image to be created\n
12+
-C [file.crt]\t\t- Certificate to pull packages from the official NGINX repository\n
13+
-K [file.key]\t\t- Key to pull packages from the official NGINX repository\n
14+
-n [URL]\t\t- NGINX Instance Manager URL to fetch the agent\n
15+
-d\t\t\t- Build support for NGINX API Gateway Developer Portal\n
16+
-w\t\t\t- Add NGINX App Protect WAF\n\n
17+
=== Examples:\n\n
18+
NGINX Plus and NGINX Agent image:\n
19+
$0 -C nginx-repo.crt -K nginx-repo.key -t registry.ff.lan:31005/nginx-with-agent:2.7.0 -n https://nim.f5.ff.lan\n\n
20+
NGINX Plus, NGINX App Protect WAF and NGINX Agent image:\n
21+
$0 -C nginx-repo.crt -K nginx-repo.key -t registry.ff.lan:31005/nginx-with-agent:2.7.0 -w -n https://nim.f5.ff.lan\n\n
22+
NGINX Plus, Developer Portal support and NGINX Agent image:\n
23+
$0 -C nginx-repo.crt -K nginx-repo.key -t registry.ff.lan:31005/nginx-with-agent:2.7.0-devportal -d -n https://nim.f5.ff.lan
24+
\n"
25+
26+
while getopts 'ht:C:K:a:n:dw' OPTION
27+
do
28+
case "$OPTION" in
29+
h)
30+
echo -e $BANNER
31+
exit
32+
;;
33+
t)
34+
IMAGENAME=$OPTARG
35+
;;
36+
C)
37+
NGINX_CERT=$OPTARG
38+
;;
39+
K)
40+
NGINX_KEY=$OPTARG
41+
;;
42+
n)
43+
NMSURL=$OPTARG
44+
;;
45+
d)
46+
DEVPORTAL=true
47+
;;
48+
w)
49+
NAP_WAF=true
50+
;;
51+
esac
52+
done
53+
54+
if [ -z "$1" ]
55+
then
56+
echo -e $BANNER
57+
exit
58+
fi
59+
60+
if [ -z "${IMAGENAME}" ]
61+
then
62+
echo "Docker image name is required"
63+
exit
64+
fi
65+
66+
if [ -z "${NMSURL}" ]
67+
then
68+
echo "NGINX Instance Manager URL is required"
69+
exit
70+
fi
71+
72+
if ([ -z "${NGINX_CERT}" ] || [ -z "${NGINX_KEY}" ])
73+
then
74+
echo "NGINX certificate and key are required for automated installation"
75+
exit
76+
fi
77+
78+
echo "=> Target docker image is $IMAGENAME"
79+
80+
if [ ! -z "${DEVPORTAL}" ]
81+
then
82+
echo "=> Building with Developer Portal support"
83+
fi
84+
85+
if [ ! -z "${NAP_WAF}" ]
86+
then
87+
echo "=> Building with NGINX App Protect WAF support"
88+
fi
89+
90+
DOCKER_BUILDKIT=1 docker build --no-cache -f Dockerfile \
91+
--secret id=nginx-key,src=$NGINX_KEY --secret id=nginx-crt,src=$NGINX_CERT \
92+
--build-arg NMS_URL=$NMSURL --build-arg DEVPORTAL=$DEVPORTAL --build-arg NAP_WAF=$NAP_WAF -t $IMAGENAME .
93+
94+
echo "=> Build complete for $IMAGENAME"
95+
docker push $IMAGENAME

‎nginx-agent-docker/scripts/nginxWithAgentStart.sh

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
NAMESPACE=nim-test
4+
5+
case $1 in
6+
'start')
7+
kubectl create namespace $NAMESPACE
8+
9+
pushd manifests/
10+
kubectl apply -n $NAMESPACE -f .
11+
popd
12+
;;
13+
'stop')
14+
kubectl delete namespace $NAMESPACE
15+
;;
16+
*)
17+
echo "$0 [start|stop]"
18+
exit
19+
;;
20+
esac

0 commit comments

Comments
 (0)