Skip to content

Commit 944b50b

Browse files
fabriziofioruccifabriziofiorucci
authored
Dockerfile and container start updated (#131)
* Added API Connectivity Manager 1.5.0 support * Ownership fix * Startup script fix * NGINX App Protect WAF updates * Tested with NGINX Instance Manager 2.9.1 * Added docker-compose support * Tested with NGINX Instance Manager 2.10.0 and Security Monitoring 1.4.0 * Tested with NGINX Instance Manager 2.10.0 and API Connectivity Manager 1.5.0 * Tested with API Connectivity Manager 1.6.0 * Tested with API Connectivity Manager 1.6.0 * README updated * Added support for NGINX Instance Manager 2.10.1 and App Delivery Manager 4.0.0 * Fixed NGINX App Protect detection bug for NGINX Instance Manager 2.10.0+ * Fixed agent syslog receiver bug * README updated * Tested with NGINX Instance Manager 2.11.0 and Security Monitoring 1.5.0 * Tested with NGINX Instance Manager 2.11.0 * Tested with NGINX API Connectivity Manager 1.7.0 * Tested with NGINX Instance Manager 2.12.0 and Security Monitoring 1.6.0 * Tested with API Connectivity Manager 1.8.0 * Tested with API Connectivity Manager 1.8.0 * Tested with NGINX Instance Manager 2.12.0 * Dockerfile updated * Support for NGINX Instance Manager 2.13 * Tested with NGINX Instance Manager 2.13 * Tested with NIM 2.14.0 and SM 1.7.0 * Tested with NIM 2.14.0 and SM 1.7.0 * Tested with NGINX Instance Manager 2.14.0 * Tested with NGINX Instance Manager 2.14.0 * Tested with NGINX App Protect compiler v4.583.0 * Start script updated * Advanced metrics support added * Advanced metrics support added * Removed Application Delivery Manger, tested with NGINX Instance Manager 2.15.0 * Removed devportal, tested with NGINX Instance Manager 2.15.0 * Removed API Connectivity Manager * Dockerfile and container start updated --------- Signed-off-by: 65397 <[email protected]>
1 parent 2f76f46 commit 944b50b

File tree

3 files changed

+36
-47
lines changed

3 files changed

+36
-47
lines changed

‎nginx-agent-docker/Dockerfile

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,9 @@ RUN apt-get -y update \
88
&& apt-get -y install apt-transport-https lsb-release ca-certificates wget gnupg2 curl debian-archive-keyring iproute2 \
99
&& mkdir -p /deployment /etc/ssl/nginx \
1010
&& addgroup --system --gid 20983 nginx \
11-
&& adduser --system --disabled-login --ingroup nginx --no-create-home --home /nonexistent --gecos "nginx user" --shell /bin/false --uid 20983 nginx
11+
&& adduser --system --disabled-login --ingroup nginx --no-create-home --home /nonexistent --gecos "nginx user" --shell /bin/false --uid 20983 nginx \
12+
&& wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq \
13+
&& chmod +x /usr/bin/yq
1214

1315
# Use certificate and key from kubernetes secret
1416
RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
@@ -38,7 +40,9 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644
3840
&& usermod nginx -G nginx-agent \
3941

4042
# NGINX Instance Manager agent installation
41-
&& bash -c 'curl -k $NMS_URL/install/nginx-agent | sh' && echo "Agent installed from NMS"
43+
&& if [ `curl -o /dev/null -sk -w "%{http_code}\n" $NMS_URL/install/nginx-agent` = 200 ] ; then \
44+
bash -c 'curl -k $NMS_URL/install/nginx-agent | sh' && echo "NGINX Agent installed"; else \
45+
bash -c 'export DATAPLANE_KEY="placeholder" && curl -k $NMS_URL/nginx-agent/install | sh || :' && echo "NGINX Agent installed"; fi
4246

4347
# Startup script
4448
COPY ./container/start.sh /deployment/

‎nginx-agent-docker/container/start.sh

Lines changed: 28 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -27,24 +27,25 @@ if [[ ! -z "$NIM_TAGS" ]]; then
2727
PARM="${PARM} --tags $NIM_TAGS"
2828
fi
2929

30+
if [[ ! -z "$NIM_TOKEN" ]]; then
31+
yq -i '
32+
.server.token=strenv(NIM_TOKEN)
33+
' /etc/nginx-agent/nginx-agent.conf
34+
fi
35+
3036
if [[ "$NIM_ADVANCED_METRICS" == "true" ]]; then
3137
if [ $OLD_AGENT == "false" ]
3238
then
33-
EXTRA_EXTENSIONS="- advanced-metrics"
34-
35-
cat - << __EOT__ >> /etc/nginx-agent/nginx-agent.conf
36-
37-
# Advanced metrics
38-
advanced_metrics:
39-
socket_path: /var/run/nginx-agent/advanced-metrics.sock
40-
aggregation_period: 1s
41-
publishing_period: 3s
42-
table_sizes_limits:
43-
staging_table_max_size: 1000
44-
staging_table_threshold: 1000
45-
priority_table_max_size: 1000
46-
priority_table_threshold: 1000
47-
__EOT__
39+
yq -i '
40+
.advanced_metrics.socket_path="/var/run/nginx-agent/advanced-metrics.sock" |
41+
.advanced_metrics.aggregation_period="1s" |
42+
.advanced_metrics.publishing_period="3s" |
43+
.advanced_metrics.table_sizes_limits.staging_table_max_size=1000 |
44+
.advanced_metrics.table_sizes_limits.staging_table_threshold=1000 |
45+
.advanced_metrics.table_sizes_limits.priority_table_max_size=1000 |
46+
.advanced_metrics.table_sizes_limits.priority_table_threshold= 1000 |
47+
.extensions += ["advanced-metrics"]
48+
' /etc/nginx-agent/nginx-agent.conf
4849
fi
4950
fi
5051

@@ -53,21 +54,15 @@ if [[ "$NAP_WAF" == "true" ]]; then
5354
then
5455
PARM="${PARM} --nginx-app-protect-report-interval 15s --nap-monitoring-collector-buffer-size 50000 --nap-monitoring-processor-buffer-size 50000 --nap-monitoring-syslog-ip 127.0.0.1 --nap-monitoring-syslog-port 514"
5556
else
56-
EXTRA_EXTENSIONS=$EXTRA_EXTENSIONS"\n- nginx-app-protect\n- nap-monitoring"
57-
58-
cat - << __EOT__ >> /etc/nginx-agent/nginx-agent.conf
59-
60-
# NGINX App Protect Monitoring config
61-
nap_monitoring:
62-
# Buffer size for collector. Will contain log lines and parsed log lines
63-
collector_buffer_size: 50000
64-
# Buffer size for processor. Will contain log lines and parsed log lines
65-
processor_buffer_size: 50000
66-
# Syslog server IP address the collector will be listening to
67-
syslog_ip: "127.0.0.1"
68-
# Syslog server port the collector will be listening to
69-
syslog_port: 514
70-
__EOT__
57+
export FQDN=127.0.0.1
58+
59+
yq -i '
60+
.nap_monitoring.collector_buffer_size=50000 |
61+
.nap_monitoring.processor_buffer_size=50000 |
62+
.nap_monitoring.syslog_ip=strenv(FQDN) |
63+
.nap_monitoring.syslog_port=514 |
64+
.extensions += ["nginx-app-protect","nap-monitoring"]
65+
' /etc/nginx-agent/nginx-agent.conf
7166
fi
7267

7368
su - nginx -s /bin/bash -c "/opt/app_protect/bin/bd_agent &"
@@ -85,24 +80,12 @@ if [[ "$NAP_WAF_PRECOMPILED_POLICIES" == "true" ]]; then
8580
then
8681
PARM="${PARM} --nginx-app-protect-precompiled-publication"
8782
else
88-
cat - << __EOT__ >> /etc/nginx-agent/nginx-agent.conf
89-
90-
# Enable NGINX App Protect WAF precompiled policies
91-
nginx_app_protect:
92-
precompiled_publication: true
93-
__EOT__
83+
yq -i '
84+
.nginx_app_protect.precompiled_publication=true
85+
' /etc/nginx-agent/nginx-agent.conf
9486
fi
9587
fi
9688

9789
fi
9890

99-
if [[ "$EXTRA_EXTENSIONS" != "" ]]; then
100-
cat - << __EOT__ >> /etc/nginx-agent/nginx-agent.conf
101-
102-
# Enable extensions
103-
extensions:
104-
`echo -e $EXTRA_EXTENSIONS | sed "s/^/\ \ /g"`
105-
__EOT__
106-
fi
107-
10891
sg nginx-agent "/usr/bin/nginx-agent $PARM"

‎nginx-agent-docker/manifests/1.nginx-with-agent.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ spec:
2828
value: "nginx-nim2.nginx-nim2"
2929
- name: NIM_GRPC_PORT
3030
value: "443"
31+
- name: NIM_TOKEN
32+
value: "XYZ"
3133
- name: NIM_INSTANCEGROUP
3234
value: "lab"
3335
- name: NIM_TAGS

0 commit comments

Comments
 (0)