Skip to content

Commit 3a8c115

Browse files
miledxzmiledxz
authored
Merge branch 'nginxinc:main' into test/add-runtime-manager-tests
2 parents 99997c4 + e291269 commit 3a8c115

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+922
-87
lines changed

‎.github/workflows/build.yml

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ jobs:
8787
images: |
8888
name=ghcr.io/nginxinc/nginx-gateway-fabric,enable=${{ inputs.image == 'ngf' && github.event_name != 'pull_request' }}
8989
name=ghcr.io/nginxinc/nginx-gateway-fabric/nginx,enable=${{ inputs.image == 'nginx' && github.event_name != 'pull_request' }}
90-
name=docker-mgmt.nginx.com/nginx-gateway-fabric/nginx-plus,enable=${{ inputs.image == 'nginx-plus' && github.event_name != 'pull_request' }}
90+
name=docker-mgmt.nginx.com/nginx-gateway-fabric/nginx-plus,enable=${{ inputs.image == 'plus' && github.event_name != 'pull_request' }}
9191
name=localhost:5000/nginx-gateway-fabric/${{ inputs.image }}
9292
flavor: |
9393
latest=${{ (inputs.tag != '' && 'true') || 'auto' }}
@@ -100,13 +100,21 @@ jobs:
100100
labels: |
101101
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
102102
org.opencontainers.image.vendor=NGINX Inc <[email protected]>
103+
annotations: |
104+
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
105+
org.opencontainers.image.vendor=NGINX Inc <[email protected]>
106+
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/nginxinc/nginx-gateway-fabric/main/README.md
107+
io.artifacthub.package.logo-url=https://docs.nginx.com/nginx-gateway-fabric/images/icons/NGINX-product-icon.svg
108+
io.artifacthub.package.maintainers=[{"name":"NGINX Inc","email":"[email protected]"}]
109+
io.artifacthub.package.license=Apache-2.0
110+
io.artifacthub.package.keywords=kubernetes,gateway,nginx
103111
env:
104112
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
105113

106114
- name: Build Docker Image
107115
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
108116
with:
109-
file: build/Dockerfile${{ inputs.image == 'nginx' && '.nginx' || '' }}${{ inputs.image == 'nginx-plus' && '.nginxplus' || '' }}
117+
file: build/Dockerfile${{ inputs.image == 'nginx' && '.nginx' || '' }}${{ inputs.image == 'plus' && '.nginxplus' || '' }}
110118
context: "."
111119
target: ${{ inputs.image == 'ngf' && 'goreleaser' || '' }}
112120
tags: ${{ steps.meta.outputs.tags }}
@@ -119,7 +127,7 @@ jobs:
119127
pull: true
120128
no-cache: ${{ github.event_name != 'pull_request' }}
121129
sbom: true
122-
provenance: true
130+
provenance: mode=max
123131
build-args: |
124132
NJS_DIR=internal/mode/static/nginx/modules/src
125133
NGINX_CONF_DIR=internal/mode/static/nginx/conf
@@ -128,9 +136,10 @@ jobs:
128136
${{ contains(inputs.image, 'plus') && format('"nginx-repo.crt={0}"', secrets.NGINX_CRT) || '' }}
129137
${{ contains(inputs.image, 'plus') && format('"nginx-repo.key={0}"', secrets.NGINX_KEY) || '' }}
130138
131-
- name: Inspect SBOM
139+
- name: Inspect SBOM and output manifest
132140
run: |
133141
docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/${{ inputs.image }}:${{ steps.meta.outputs.version }} --format '{{ json (index .SBOM "linux/amd64").SPDX }}' > sbom-${{ inputs.image }}.json
142+
docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/${{ inputs.image }}:${{ steps.meta.outputs.version }} --raw
134143
135144
- name: Scan SBOM
136145
id: scan
@@ -145,11 +154,15 @@ jobs:
145154
continue-on-error: true
146155
with:
147156
sarif_file: ${{ steps.scan.outputs.sarif }}
157+
if: always()
148158

149159
- name: Upload Scan Results
150160
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
151161
continue-on-error: true
152162
with:
153-
name: scan-results-${{ inputs.image }}.sarif
154-
path: ${{ steps.scan.outputs.sarif }}
163+
name: scan-results-${{ inputs.image }}
164+
path: |
165+
${{ steps.scan.outputs.sarif }}
166+
*.json
167+
!sbom-plus.json
155168
if: always()

‎.github/workflows/ci.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ jobs:
108108
go-version: stable
109109

110110
- name: Create/Update Draft
111-
uses: lucacome/draft-release@52f02d1a69b61568e54ab5cf86ce91503bac4066 # v1.0.2
111+
uses: lucacome/draft-release@a98777f0bae0a6815cc1df77ebe48ca70e7cb970 # v1.0.3
112112
with:
113113
minor-label: "enhancement"
114114
major-label: "change"
@@ -246,7 +246,7 @@ jobs:
246246
strategy:
247247
fail-fast: false
248248
matrix:
249-
image: [ngf, nginx, nginx-plus]
249+
image: [ngf, nginx, plus]
250250
platforms: ["linux/arm64, linux/amd64"]
251251
uses: ./.github/workflows/build.yml
252252
with:

‎.github/workflows/lint.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
go-version: stable
2828

2929
- name: Lint Code
30-
uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
30+
uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
3131
with:
3232
args: --timeout 10m0s
3333

‎.pre-commit-config.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ repos:
3636
- javascript
3737

3838
- repo: https://github.com/golangci/golangci-lint
39-
rev: v1.55.2
39+
rev: v1.56.1
4040
hooks:
4141
- id: golangci-lint-full
4242

@@ -50,7 +50,7 @@ repos:
5050
# Rules are in .yamllint.yaml file
5151
# See https://yamllint.readthedocs.io/en/stable/rules.html# for rule descriptions
5252
- repo: https://github.com/adrienverge/yamllint.git
53-
rev: v1.33.0
53+
rev: v1.34.0
5454
hooks:
5555
- id: yamllint
5656

‎Makefile

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,14 +81,18 @@ generate-crds: ## Generate CRDs and Go types using kubebuilder
8181
go run sigs.k8s.io/controller-tools/cmd/controller-gen object paths=./apis/...
8282

8383
.PHONY: generate-manifests
84-
generate-manifests: ## Generate manifests using Helm.
84+
generate-manifests: generate-manifests-plus ## Generate manifests using Helm.
8585
cp $(CHART_DIR)/crds/* $(MANIFEST_DIR)/crds/
8686
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-gateway.yaml
8787
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) --set metrics.enable=false -n nginx-gateway -s templates/deployment.yaml > conformance/provisioner/static-deployment.yaml
8888
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) -n nginx-gateway -s templates/service.yaml > $(strip $(MANIFEST_DIR))/service/loadbalancer.yaml
8989
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) --set service.annotations.'service\.beta\.kubernetes\.io\/aws-load-balancer-type'="nlb" -n nginx-gateway -s templates/service.yaml > $(strip $(MANIFEST_DIR))/service/loadbalancer-aws-nlb.yaml
9090
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) --set service.type=NodePort --set service.externalTrafficPolicy="" -n nginx-gateway -s templates/service.yaml > $(strip $(MANIFEST_DIR))/service/nodeport.yaml
9191

92+
.PHONY: generate-manifests-plus
93+
generate-manifests-plus: ## Generate manifests using Helm for NGINX Plus.
94+
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) --set nginx.plus=true --set nginx.image.repository=$(NGINX_PLUS_PREFIX) -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-plus-gateway.yaml
95+
9296
.PHONY: crds-release-file
9397
crds-release-file: ## Generate combined crds file for releases
9498
scripts/combine-crds.sh

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Learn about our [design principles](/docs/developer/design-principles.md) and [a
1818

1919
1. [Quick Start on a kind cluster](https://docs.nginx.com/nginx-gateway-fabric/installation/running-on-kind/).
2020
2. [Install](https://docs.nginx.com/nginx-gateway-fabric/installation/) NGINX Gateway Fabric.
21-
3. [Build](https://docs.nginx.com/nginx-gateway-fabric/installation/building-the-images/) an NGINX Gateway Fabric container image from source or use a pre-built image
21+
3. [Build](https://docs.nginx.com/nginx-gateway-fabric/installation/ngf-images/building-the-images/) an NGINX Gateway Fabric container image from source or use a pre-built image
2222
available
2323
on [GitHub Container Registry](https://github.com/nginxinc/nginx-gateway-fabric/pkgs/container/nginx-gateway-fabric).
2424
4. Deploy various [examples](examples).

‎build/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# syntax=docker/dockerfile:1.6
2-
FROM golang:1.21 as builder
2+
FROM golang:1.22 as builder
33

44
WORKDIR /go/src/github.com/nginxinc/nginx-gateway-fabric
55

‎build/Dockerfile.nginx

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,12 @@ ARG NJS_DIR
55
ARG NGINX_CONF_DIR
66
ARG BUILD_AGENT
77

8-
RUN apk update && apk upgrade && apk add --no-cache libcap \
8+
RUN apk add --no-cache libcap \
99
&& mkdir -p /var/lib/nginx /usr/lib/nginx/modules \
1010
&& setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx \
1111
&& setcap -v 'cap_net_bind_service=+ep' /usr/sbin/nginx \
12+
# Update packages for CVE-2023-52425
13+
&& apk --no-cache upgrade libexpat \
1214
&& apk del libcap
1315

1416
COPY ${NJS_DIR}/httpmatches.js /usr/lib/nginx/modules/njs/httpmatches.js

‎cmd/gateway/commands.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ func createRootCommand() *cobra.Command {
3333
Use: "gateway",
3434
SilenceUsage: true,
3535
SilenceErrors: true,
36-
RunE: func(cmd *cobra.Command, args []string) error {
36+
RunE: func(cmd *cobra.Command, _ []string) error {
3737
return cmd.Help()
3838
},
3939
}
@@ -100,7 +100,7 @@ func createStaticModeCommand() *cobra.Command {
100100
cmd := &cobra.Command{
101101
Use: "static-mode",
102102
Short: "Configure NGINX in the scope of a single Gateway resource",
103-
RunE: func(cmd *cobra.Command, args []string) error {
103+
RunE: func(cmd *cobra.Command, _ []string) error {
104104
atom := zap.NewAtomicLevel()
105105

106106
logger := ctlrZap.New(ctlrZap.Level(atom))
@@ -153,6 +153,7 @@ func createStaticModeCommand() *cobra.Command {
153153
PodIP: podIP,
154154
ServiceName: serviceName.value,
155155
Namespace: namespace,
156+
Name: podName,
156157
},
157158
HealthConfig: config.HealthConfig{
158159
Enabled: !disableHealth,
@@ -301,7 +302,7 @@ func createProvisionerModeCommand() *cobra.Command {
301302
Use: "provisioner-mode",
302303
Short: "Provision a static-mode NGINX Gateway Fabric Deployment per Gateway resource",
303304
Hidden: true,
304-
RunE: func(cmd *cobra.Command, args []string) error {
305+
RunE: func(_ *cobra.Command, _ []string) error {
305306
logger := ctlrZap.New()
306307
logger.Info(
307308
"Starting NGINX Gateway Fabric Provisioner",
@@ -348,7 +349,7 @@ func createSleepCommand() *cobra.Command {
348349
cmd := &cobra.Command{
349350
Use: "sleep",
350351
Short: "Sleep for specified duration and exit",
351-
Run: func(cmd *cobra.Command, args []string) {
352+
Run: func(_ *cobra.Command, _ []string) {
352353
// It is expected that this command is run from lifecycle hook.
353354
// Because logs from hooks are not visible in the container logs, we don't log here at all.
354355
time.Sleep(duration)

‎cmd/gateway/commands_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ func testFlag(t *testing.T, cmd *cobra.Command, test flagTestCase) {
2222
cmd.SetErr(io.Discard)
2323

2424
// override RunE to avoid executing the command
25-
cmd.RunE = func(cmd *cobra.Command, args []string) error {
25+
cmd.RunE = func(_ *cobra.Command, _ []string) error {
2626
return nil
2727
}
2828

‎conformance/tests/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# this is here so we can grab the latest version of kind and have dependabot keep it up to date
33
FROM kindest/node:v1.29.1
44

5-
FROM golang:1.21
5+
FROM golang:1.22
66

77
WORKDIR /go/src/github.com/nginxinc/nginx-gateway-fabric/conformance/tests/
88

‎deploy/helm-chart/templates/rbac.yaml

Lines changed: 31 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,17 @@ metadata:
77
{{- include "nginx-gateway.labels" . | nindent 4 }}
88
annotations:
99
{{- toYaml .Values.serviceAccount.annotations | nindent 4 }}
10+
{{- if or .Values.serviceAccount.imagePullSecret .Values.serviceAccount.imagePullSecrets }}
11+
imagePullSecrets:
12+
{{- if .Values.serviceAccount.imagePullSecret }}
13+
- name: {{ .Values.serviceAccount.imagePullSecret}}
14+
{{- end }}
15+
{{- if .Values.serviceAccount.imagePullSecrets }}
16+
{{- range .Values.serviceAccount.imagePullSecrets }}
17+
- name: {{ . }}
18+
{{- end }}
19+
{{- end }}
20+
{{- end }}
1021
---
1122
apiVersion: rbac.authorization.k8s.io/v1
1223
kind: ClusterRole
@@ -21,19 +32,36 @@ rules:
2132
- namespaces
2233
- services
2334
- secrets
24-
# FIXME(bjee19): make nodes permission dependent on telemetry being enabled.
25-
# https://github.com/nginxinc/nginx-gateway-fabric/issues/1317.
26-
- nodes
2735
verbs:
2836
- list
2937
- watch
38+
# FIXME(bjee19): make nodes, pods, replicasets permission dependent on telemetry being enabled.
39+
# https://github.com/nginxinc/nginx-gateway-fabric/issues/1317.
40+
- apiGroups:
41+
- ""
42+
resources:
43+
- pods
44+
verbs:
45+
- get
46+
- apiGroups:
47+
- ""
48+
resources:
49+
- nodes
50+
verbs:
51+
- list
3052
- apiGroups:
3153
- ""
3254
resources:
3355
- events
3456
verbs:
3557
- create
3658
- patch
59+
- apiGroups:
60+
- apps
61+
resources:
62+
- replicasets
63+
verbs:
64+
- get
3765
- apiGroups:
3866
- discovery.k8s.io
3967
resources:

‎deploy/helm-chart/values.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,14 @@ serviceAccount:
8585
## Autogenerated if not set or set to "".
8686
# name: nginx-gateway
8787

88+
## The name of the secret containing docker registry credentials.
89+
## Secret must exist in the same namespace as the helm release.
90+
imagePullSecret: ""
91+
92+
## A list of secret names containing docker registry credentials.
93+
## Secrets must exist in the same namespace as the helm release.
94+
imagePullSecrets: []
95+
8896
service:
8997
## Creates a service to expose the NGINX Gateway Fabric pods.
9098
create: true

‎deploy/manifests/nginx-gateway.yaml

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,19 +32,36 @@ rules:
3232
- namespaces
3333
- services
3434
- secrets
35-
# FIXME(bjee19): make nodes permission dependent on telemetry being enabled.
36-
# https://github.com/nginxinc/nginx-gateway-fabric/issues/1317.
37-
- nodes
3835
verbs:
3936
- list
4037
- watch
38+
# FIXME(bjee19): make nodes, pods, replicasets permission dependent on telemetry being enabled.
39+
# https://github.com/nginxinc/nginx-gateway-fabric/issues/1317.
40+
- apiGroups:
41+
- ""
42+
resources:
43+
- pods
44+
verbs:
45+
- get
46+
- apiGroups:
47+
- ""
48+
resources:
49+
- nodes
50+
verbs:
51+
- list
4152
- apiGroups:
4253
- ""
4354
resources:
4455
- events
4556
verbs:
4657
- create
4758
- patch
59+
- apiGroups:
60+
- apps
61+
resources:
62+
- replicasets
63+
verbs:
64+
- get
4865
- apiGroups:
4966
- discovery.k8s.io
5067
resources:

0 commit comments

Comments
 (0)