Skip to content

Commit 45d9631

Browse files
pdabelf5pdabelf5
authored
update NGINX Plus to R34 and App Protect to 4.14 & 5.6 (#7597)
* update NGINX Plus to R34 and App Protect to 4.14 & 5.6 * Revert "temporarily disable builds failing for NAP WAF v4 on UBI (#7606)"
1 parent 24bf43c commit 45d9631

File tree

16 files changed

+56
-36
lines changed

16 files changed

+56
-36
lines changed

‎.github/config/config-gcr-retag

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
export TARGET_REGISTRY=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev
22
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips" "-mktpl")
3-
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-mktpl" "-alpine-fips")
3+
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-mktpl" "-alpine-fips")
44
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
55
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
6-
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-mktpl")
6+
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
77
declare -a ADDITIONAL_TAGS=()

‎.github/config/config-plus-gcr-release

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
export TARGET_REGISTRY=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release
22
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips" "-mktpl")
3-
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-alpine-fips" "-mktpl")
3+
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips" "-mktpl")
44
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips" "-ubi8")
55
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
6-
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-mktpl")
6+
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl")
77
declare -a ADDITIONAL_TAGS=("latest" "${ADDITIONAL_TAG}")
88
export PUBLISH_OSS=false

‎.github/config/config-plus-nginx

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
export TARGET_REGISTRY=docker-mgmt.nginx.com
22
export TARGET_NAP_WAF_DOS_IMAGE_PREFIX="nginx-ic-nap-dos/nginx-plus-ingress"
33
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips")
4-
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-alpine-fips")
4+
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
55
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-ubi8" "-alpine-fips")
66
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi")
7-
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("")
7+
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi")
88
export PUBLISH_OSS=false

‎.github/data/matrix-images-nap.json

+18
Original file line numberDiff line numberDiff line change
@@ -15,18 +15,36 @@
1515
"waf,dos"
1616
],
1717
"include": [
18+
{
19+
"image": "ubi-8-plus-nap",
20+
"target": "goreleaser",
21+
"platforms": "linux/amd64",
22+
"nap_modules": "waf"
23+
},
1824
{
1925
"image": "ubi-8-plus-nap-v5",
2026
"target": "goreleaser",
2127
"platforms": "linux/amd64",
2228
"nap_modules": "waf"
2329
},
30+
{
31+
"image": "ubi-9-plus-nap",
32+
"target": "goreleaser",
33+
"platforms": "linux/amd64",
34+
"nap_modules": "waf"
35+
},
2436
{
2537
"image": "ubi-9-plus-nap",
2638
"target": "goreleaser",
2739
"platforms": "linux/amd64",
2840
"nap_modules": "dos"
2941
},
42+
{
43+
"image": "ubi-9-plus-nap",
44+
"target": "goreleaser",
45+
"platforms": "linux/amd64",
46+
"nap_modules": "waf,dos"
47+
},
3048
{
3149
"image": "alpine-plus-nap-fips",
3250
"target": "goreleaser",

‎.github/data/matrix-smoke-nap.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
"images": [
33
{
44
"label": "AP_WAF 1/4",
5-
"image": "debian-plus-nap",
5+
"image": "ubi-8-plus-nap",
66
"type": "plus",
77
"nap_modules": "waf",
88
"marker": "appprotect_waf_policies_allow",
99
"platforms": "linux/amd64"
1010
},
1111
{
1212
"label": "AP_WAF 2/4",
13-
"image": "debian-plus-nap",
13+
"image": "ubi-9-plus-nap",
1414
"type": "plus",
1515
"nap_modules": "waf",
1616
"marker": "'appprotect_waf_policies and not appprotect_waf_policies_allow and not appprotect_waf_policies_vsr'",

‎.github/workflows/regression.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ jobs:
265265
266266
- name: Generate WAF v5 tgz from JSON
267267
run: |
268-
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.5.0 -p /data/wafv5.json -o /data/wafv5.tgz
268+
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.6.0 -p /data/wafv5.json -o /data/wafv5.tgz
269269
if: ${{ contains(matrix.images.image, 'nap-v5')}}
270270

271271
- name: Run Regression Tests

‎.github/workflows/setup-smoke.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ jobs:
149149

150150
- name: Generate WAF v5 tgz from JSON
151151
run: |
152-
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.5.0 -p /data/wafv5.json -o /data/wafv5.tgz
152+
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.6.0 -p /data/wafv5.json -o /data/wafv5.tgz
153153
if: ${{ contains(inputs.image, 'nap-v5')}}
154154

155155
- name: Run Smoke Tests

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
VER = $(shell grep IC_VERSION .github/data/version.txt | cut -d '=' -f 2)
33
GIT_TAG = $(shell git describe --exact-match --tags || echo untagged)
44
VERSION = $(VER)-SNAPSHOT
5-
NGINX_PLUS_VERSION ?= R33
5+
NGINX_PLUS_VERSION ?= R34
66
PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key
77

88
# Variables that can be overridden

‎build/Dockerfile

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# syntax=docker/dockerfile:1.6
22
ARG BUILD_OS=debian
3-
ARG NGINX_PLUS_VERSION=R33
3+
ARG NGINX_PLUS_VERSION=R34
44
ARG DOWNLOAD_TAG=edge
55
ARG DEBIAN_FRONTEND=noninteractive
66
ARG PREBUILT_BASE_IMG=nginx/nginx-ingress:${DOWNLOAD_TAG}
@@ -206,7 +206,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
206206
&& mkdir -p /etc/nginx/reporting/ \
207207
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
208208
&& ldconfig /usr/local/lib/ \
209-
&& apk add --no-cache app-protect-module-plus~=33.5.264 \
209+
&& apk add --no-cache app-protect-module-plus~=34.5.342 \
210210
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
211211
&& nap-waf.sh \
212212
&& if [ "${NGINX_AGENT}" = "true" ]; then \
@@ -312,7 +312,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
312312
&& apt-get update \
313313
&& if [ "${NGINX_AGENT}" = "true" ]; then apt-get install --no-install-recommends --no-install-suggests -y nginx-agent; fi \
314314
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
315-
apt-get install --no-install-recommends --no-install-suggests -y app-protect-module-plus=33+5.264* nginx-plus-module-appprotect=33+5.264* app-protect-plugin=6.9.0*; \
315+
apt-get install --no-install-recommends --no-install-suggests -y app-protect-module-plus=34+5.342* nginx-plus-module-appprotect=34+5.342* app-protect-plugin=6.12.0*; \
316316
rm -f /etc/apt/sources.list.d/app-protect.sources; \
317317
nap-waf.sh; \
318318
fi \
@@ -448,7 +448,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
448448
&& if [ "${NGINX_AGENT}" = "true" ]; then microdnf --nodocs install -y nginx-agent; fi \
449449
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
450450
cp /tmp/app-protect-9.repo /etc/yum.repos.d/app-protect-9.repo \
451-
&& microdnf --nodocs install -y app-protect-module-plus-33+5.264* \
451+
&& microdnf --nodocs install -y app-protect-module-plus-34+5.342* \
452452
&& nap-waf.sh \
453453
&& rm -f /etc/yum.repos.d/app-protect-9.repo; \
454454
fi \
@@ -539,7 +539,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
539539
&& dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \
540540
&& dnf --nodocs install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
541541
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
542-
dnf --nodocs install -y app-protect-module-plus-33+5.264*; \
542+
dnf --nodocs install -y app-protect-module-plus-34+5.342*; \
543543
fi \
544544
&& subscription-manager unregister \
545545
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \

‎charts/nginx-ingress/values.schema.json

+10-10
Original file line numberDiff line numberDiff line change
@@ -327,10 +327,10 @@
327327
},
328328
"tag": {
329329
"type": "string",
330-
"default": "5.5.0",
330+
"default": "5.6.0",
331331
"title": "The tag of the App Protect WAF v5 Enforcer image",
332332
"examples": [
333-
"5.5.0"
333+
"5.6.0"
334334
]
335335
},
336336
"digest": {
@@ -367,7 +367,7 @@
367367
"examples": [
368368
{
369369
"repository": "private-registry.nginx.com/nap/waf-enforcer",
370-
"tag": "5.5.0",
370+
"tag": "5.6.0",
371371
"pullPolicy": "IfNotPresent"
372372
}
373373
]
@@ -401,10 +401,10 @@
401401
},
402402
"tag": {
403403
"type": "string",
404-
"default": "5.5.0",
404+
"default": "5.6.0",
405405
"title": "The tag of the App Protect WAF v5 Config Manager image",
406406
"examples": [
407-
"5.5.0"
407+
"5.6.0"
408408
]
409409
},
410410
"digest": {
@@ -441,7 +441,7 @@
441441
"examples": [
442442
{
443443
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
444-
"tag": "5.5.0",
444+
"tag": "5.6.0",
445445
"pullPolicy": "IfNotPresent"
446446
}
447447
]
@@ -1837,15 +1837,15 @@
18371837
"port": 50000,
18381838
"image": {
18391839
"repository": "private-registry.nginx.com/nap/waf-enforcer",
1840-
"tag": "5.5.0",
1840+
"tag": "5.6.0",
18411841
"pullPolicy": "IfNotPresent"
18421842
},
18431843
"securityContext": {}
18441844
},
18451845
"configManager": {
18461846
"image": {
18471847
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
1848-
"tag": "5.5.0",
1848+
"tag": "5.6.0",
18491849
"pullPolicy": "IfNotPresent"
18501850
},
18511851
"securityContext": {
@@ -2451,15 +2451,15 @@
24512451
"port": 50000,
24522452
"image": {
24532453
"repository": "private-registry.nginx.com/nap/waf-enforcer",
2454-
"tag": "5.5.0",
2454+
"tag": "5.6.0",
24552455
"pullPolicy": "IfNotPresent"
24562456
},
24572457
"securityContext": {}
24582458
},
24592459
"configManager": {
24602460
"image": {
24612461
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
2462-
"tag": "5.5.0",
2462+
"tag": "5.6.0",
24632463
"pullPolicy": "IfNotPresent"
24642464
},
24652465
"securityContext": {

‎charts/nginx-ingress/values.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ controller:
8282
repository: private-registry.nginx.com/nap/waf-enforcer
8383

8484
## The tag of the App Protect WAF v5 Enforcer image.
85-
tag: "5.5.0"
85+
tag: "5.6.0"
8686
## The digest of the App Protect WAF v5 Enforcer image.
8787
## If digest is specified it has precedence over tag and will be used instead
8888
# digest: "sha256:CHANGEME"
@@ -98,7 +98,7 @@ controller:
9898
repository: private-registry.nginx.com/nap/waf-config-mgr
9999

100100
## The tag of the App Protect WAF v5 Configuration Manager image.
101-
tag: "5.5.0"
101+
tag: "5.6.0"
102102
## The digest of the App Protect WAF v5 Configuration Manager image.
103103
## If digest is specified it has precedence over tag and will be used instead
104104
# digest: "sha256:CHANGEME"

‎charts/tests/__snapshots__/helmunit_test.snap

+2-2
Original file line numberDiff line numberDiff line change
@@ -1472,7 +1472,7 @@ spec:
14721472
- -weight-changes-dynamic-reload=false
14731473

14741474
- name: waf-enforcer
1475-
image: my.private.reg/nap/waf-enforcer:5.5.0
1475+
image: my.private.reg/nap/waf-enforcer:5.6.0
14761476
imagePullPolicy: "IfNotPresent"
14771477
env:
14781478
- name: ENFORCER_PORT
@@ -1483,7 +1483,7 @@ spec:
14831483
- name: app-protect-bd-config
14841484
mountPath: /opt/app_protect/bd_config
14851485
- name: waf-config-mgr
1486-
image: my.private.reg/nap/waf-config-mgr:5.5.0
1486+
image: my.private.reg/nap/waf-config-mgr:5.6.0
14871487
imagePullPolicy: "IfNotPresent"
14881488
securityContext:
14891489

‎site/content/installation/installing-nic/installation-with-helm.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -423,12 +423,12 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
423423
| **controller.appprotect.enforcer.host** | Host that the App Protect WAF v5 Enforcer runs on. | "127.0.0.1" |
424424
| **controller.appprotect.enforcer.port** | Port that the App Protect WAF v5 Enforcer runs on. | 50000 |
425425
| **controller.appprotect.enforcer.image.repository** | The image repository of the App Protect WAF v5 Enforcer. | private-registry.nginx.com/nap/waf-enforcer |
426-
| **controller.appprotect.enforcer.image.tag** | The tag of the App Protect WAF v5 Enforcer. | "5.5.0" |
426+
| **controller.appprotect.enforcer.image.tag** | The tag of the App Protect WAF v5 Enforcer. | "5.6.0" |
427427
| **controller.appprotect.enforcer.image.digest** | The digest of the App Protect WAF v5 Enforcer. Takes precedence over tag if set. | "" |
428428
| **controller.appprotect.enforcer.image.pullPolicy** | The pull policy for the App Protect WAF v5 Enforcer image. | IfNotPresent |
429429
| **controller.appprotect.enforcer.securityContext** | The security context for App Protect WAF v5 Enforcer container. | {} |
430430
| **controller.appprotect.configManager.image.repository** | The image repository of the App Protect WAF v5 Configuration Manager. | private-registry.nginx.com/nap/waf-config-mgr |
431-
| **controller.appprotect.configManager.image.tag** | The tag of the App Protect WAF v5 Configuration Manager. | "5.5.0" |
431+
| **controller.appprotect.configManager.image.tag** | The tag of the App Protect WAF v5 Configuration Manager. | "5.6.0" |
432432
| **controller.appprotect.configManager.image.digest** | The digest of the App Protect WAF v5 Configuration Manager. Takes precedence over tag if set. | "" |
433433
| **controller.appprotect.configManager.image.pullPolicy** | The pull policy for the App Protect WAF v5 Configuration Manager image. | IfNotPresent |
434434
| **controller.appprotect.configManager.securityContext** | The security context for App Protect WAF v5 Configuration Manager container. | {"allowPrivilegeEscalation":false,"runAsUser":101,"runAsNonRoot":true,"capabilities":{"drop":["all"]}} |

‎site/content/installation/integrations/app-protect-waf-v5/installation.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -507,7 +507,8 @@ If you prefer not to build your own NGINX Ingress Controller image, you can use
507507
{{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
508508
| NIC Version | App Protect WAFv5 Version | Config Manager | Enforcer |
509509
| --- | --- | --- | --- |
510-
| {{< nic-version >}} | 33_5.264 | 5.5.0 | 5.5.0 |
510+
| {{< nic-version >}} | 33_5.342 | 5.6.0 | 5.6.0 |
511+
| 4.0.1 | 33_5.264 | 5.5.0 | 5.5.0 |
511512
| 3.7.2 | 32_5.144 | 5.3.0 | 5.3.0 |
512513
| 3.6.2 | 32_5.48 | 5.2.0 | 5.2.0 |
513514
{{% /bootstrap-table %}}

‎site/content/technical-specifications.md

+3-2
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ We test NGINX Ingress Controller on a range of Kubernetes platforms for each rel
2828
{{< bootstrap-table "table table-bordered table-striped table-responsive" >}}
2929
| NIC Version | Supported Kubernetes Version | NIC Helm Chart Version | NIC Operator Version | NGINX / NGINX Plus version |
3030
| --- | --- | --- | --- | --- |
31-
| {{< nic-version >}} | 1.25 - 1.32 | {{< nic-helm-version >}} | {{< nic-operator-version >}} | 1.27.4 / R33 P2 |
31+
| {{< nic-version >}} | 1.25 - 1.32 | {{< nic-helm-version >}} | {{< nic-operator-version >}} | 1.27.4 / R34 |
32+
| 4.0.1 | 1.25 - 1.32 | 2.0.1 | 3.0.1 | 1.27.4 / R33 P2 |
3233
| 3.7.2 | 1.25 - 1.31 | 1.4.2 | 2.4.2 | 1.27.2 / R32 P1 |
3334
| 3.6.2 | 1.25 - 1.31 | 1.3.2 | 2.3.2 | 1.27.1 / R32 P1 |
3435
| 3.5.2 | 1.23 - 1.30 | 1.2.2 | 2.2.2 | 1.27.0 / R32 |
@@ -61,7 +62,7 @@ _All images include NGINX 1.27.4._
6162

6263
### Images with NGINX Plus
6364

64-
_NGINX Plus images include NGINX Plus R33._
65+
_NGINX Plus images include NGINX Plus R34._
6566

6667
---
6768

‎tests/settings.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,4 +33,4 @@
3333
# Nginx registry address to pull waf components from
3434
NGX_REG = "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr"
3535
# WAF component version to pull from above registry
36-
WAF_V5_VERSION = "5.5.0"
36+
WAF_V5_VERSION = "5.6.0"

0 commit comments

Comments
 (0)