Skip to content

Commit 4ad1350

Browse files
AlexFenlonAlexFenlon
authored
add license secret and mgmt config map for r33 (nginx#6903)
1 parent b7e7567 commit 4ad1350

39 files changed

+889
-261
lines changed

‎.github/actions/smoke-tests/action.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,9 @@ inputs:
3434
registry-token:
3535
description: JWT token for accessing container registry
3636
required: false
37+
plus-jwt:
38+
description: JWT for NGINX Plus
39+
required: false
3740

3841
outputs:
3942
test-results-name:
@@ -101,6 +104,7 @@ runs:
101104
--durations=10 \
102105
--show-ic-logs=yes \
103106
--ad-secret=${{ inputs.azure-ad-secret }} \
107+
--plus-jwt=${{ inputs.plus-jwt }} \
104108
-m ${{ inputs.marker != '' && inputs.marker || '""' }}
105109
working-directory: ./tests
106110
shell: bash

‎.github/data/matrix-images-plus.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
},
1919
{
2020
"image": "ubi-9-plus",
21-
"platforms": "linux/arm64, linux/amd64, linux/s390x",
21+
"platforms": "linux/arm64, linux/amd64",
2222
"target": "goreleaser"
2323
}
2424
]

‎.github/workflows/ci.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -467,6 +467,10 @@ jobs:
467467
kind load docker-image "${{ matrix.image }}:${{ matrix.tag }}" --name ${{ github.run_id }}
468468
if: ${{ steps.stable_exists.outputs.exists != 'true' && needs.checks.outputs.docs_only == 'false' }}
469469

470+
- name: Create Plus Secret
471+
run: kubectl create secret generic license-token --from-literal=license.jwt="${{ secrets.PLUS_JWT }}" --type="nginx.com/license"
472+
if: ${{ matrix.type == 'plus' && steps.stable_exists.outputs.exists != 'true' && needs.checks.outputs.docs_only == 'false' }}
473+
470474
- name: Install Chart
471475
run: >
472476
helm install

‎.github/workflows/regression.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ jobs:
262262
263263
- name: Generate WAF v5 tgz from JSON
264264
run: |
265-
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.3.0 -p /data/wafv5.json -o /data/wafv5.tgz
265+
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.4.0 -p /data/wafv5.json -o /data/wafv5.tgz
266266
if: ${{ contains(matrix.images.image, 'nap-v5')}}
267267

268268
- name: Run Regression Tests
@@ -278,6 +278,7 @@ jobs:
278278
azure-ad-secret: ${{ secrets.AZURE_AD_AUTOMATION }}
279279
registry-token: ${{ steps.auth.outputs.access_token }}
280280
test-image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/test-runner:${{ hashFiles('./tests/requirements.txt', './tests/Dockerfile') || 'latest' }}"
281+
plus-jwt: ${{ secrets.PLUS_JWT }}
281282

282283
- name: Upload Test Results
283284
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3

‎.github/workflows/setup-smoke.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ jobs:
149149

150150
- name: Generate WAF v5 tgz from JSON
151151
run: |
152-
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.3.0 -p /data/wafv5.json -o /data/wafv5.tgz
152+
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.4.0 -p /data/wafv5.json -o /data/wafv5.tgz
153153
if: ${{ contains(inputs.image, 'nap-v5')}}
154154

155155
- name: Run Smoke Tests
@@ -165,6 +165,7 @@ jobs:
165165
azure-ad-secret: ${{ secrets.AZURE_AD_AUTOMATION }}
166166
registry-token: ${{ steps.auth.outputs.access_token }}
167167
test-image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/test-runner:${{ hashFiles('./tests/requirements.txt', './tests/Dockerfile') || 'latest' }}"
168+
plus-jwt: ${{ secrets.PLUS_JWT }}
168169
if: ${{ steps.stable_exists.outputs.exists != 'true' }}
169170

170171
- name: Upload Test Results

‎.github/workflows/single-image-regression.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,3 +109,4 @@ jobs:
109109
azure-ad-secret: ${{ secrets.AZURE_AD_AUTOMATION }}
110110
registry-token: ${{ steps.auth.outputs.access_token }}
111111
test-image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/test-runner:${{ inputs.test-image-tag }}"
112+
plus-jwt: ${{ secrets.PLUS_JWT }}

‎build/Dockerfile

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# syntax=docker/dockerfile:1.6
22
ARG BUILD_OS=debian
3-
ARG NGINX_PLUS_VERSION=R32
3+
ARG NGINX_PLUS_VERSION=R33
44
ARG DOWNLOAD_TAG=edge
55
ARG DEBIAN_FRONTEND=noninteractive
66
ARG PREBUILT_BASE_IMG=nginx/nginx-ingress:${DOWNLOAD_TAG}
@@ -198,7 +198,7 @@ RUN --mount=type=bind,from=alpine-fips-3.17,target=/tmp/fips/ \
198198
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
199199
&& cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
200200
&& ldconfig /usr/local/lib/ \
201-
&& apk add --no-cache app-protect-module-plus~=32.5.144 \
201+
&& apk add --no-cache app-protect-module-plus~=33.5.210 \
202202
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
203203
&& nap-waf.sh \
204204
&& if [ "${NGINX_AGENT}" = "true" ]; then \
@@ -279,7 +279,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
279279
&& if [ "${NGINX_AGENT}" = "true" ]; then agent.sh; fi \
280280
&& if [ -z "${NAP_MODULES##*dos*}" ]; then nap-dos.sh; fi
281281

282-
############################################# Base image for Debian with NGINX Plus and App Protect WAFv5/DoS #############################################
282+
############################################# Base image for Debian with NGINX Plus and App Protect WAFv5 #############################################
283283
FROM debian-plus AS debian-plus-nap-v5
284284
ARG NAP_MODULES
285285
ARG NGINX_AGENT
@@ -300,7 +300,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
300300
&& apt-get update \
301301
&& if [ "${NGINX_AGENT}" = "true" ]; then apt-get install --no-install-recommends --no-install-suggests -y nginx-agent; fi \
302302
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
303-
apt-get install --no-install-recommends --no-install-suggests -y app-protect-plugin=6.3.0* app-protect-module-plus=32+5.144* nginx-plus-module-appprotect=32+5.144*; \
303+
apt-get install --no-install-recommends --no-install-suggests -y app-protect-module-plus=33+5.210*; \
304304
rm -f /etc/apt/sources.list.d/app-protect.sources; \
305305
nap-waf.sh; \
306306
fi \
@@ -430,7 +430,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
430430
&& if [ "${NGINX_AGENT}" = "true" ]; then microdnf --nodocs install -y nginx-agent; fi \
431431
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
432432
cp /tmp/app-protect-9.repo /etc/yum.repos.d/app-protect-9.repo \
433-
&& microdnf --nodocs install -y app-protect-module-plus-32+5.144* \
433+
&& microdnf --nodocs install -y app-protect-module-plus-33+5.210* \
434434
&& nap-waf.sh \
435435
&& rm -f /etc/yum.repos.d/app-protect-9.repo; \
436436
fi \
@@ -517,7 +517,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
517517
&& dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \
518518
&& dnf --nodocs install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
519519
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \
520-
dnf --nodocs install -y app-protect-module-plus-32+5.144*; \
520+
dnf --nodocs install -y app-protect-module-plus-33+5.210*; \
521521
fi \
522522
&& subscription-manager unregister \
523523
&& if [ -z "${NAP_MODULES##*waf*}" ]; then \

‎charts/nginx-ingress/templates/_helpers.tpl

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,24 @@ Expand the name of the configmap used for NGINX Agent.
112112
{{- end -}}
113113
{{- end -}}
114114

115+
{{/*
116+
Expand the name of the mgmt configmap.
117+
*/}}
118+
{{- define "nginx-ingress.mgmtConfigName" -}}
119+
{{- if .Values.controller.mgmt.customConfigMap -}}
120+
{{ .Values.controller.mgmt.customConfigMap }}
121+
{{- else -}}
122+
{{- default (printf "%s-mgmt" (include "nginx-ingress.fullname" .)) -}}
123+
{{- end -}}
124+
{{- end -}}
125+
126+
{{/*
127+
Expand license token secret name.
128+
*/}}
129+
{{- define "nginx-ingress.licenseTokenSecretName" -}}
130+
{{- .Values.controller.mgmt.licenseTokenSecretName -}}
131+
{{- end -}}
132+
115133
{{/*
116134
Expand leader election lock name.
117135
*/}}
@@ -226,6 +244,9 @@ Build the args for the service binary.
226244
- -app-protect-dos-memory={{ .Values.controller.appprotectdos.memory }}
227245
{{ end }}
228246
- -nginx-configmaps=$(POD_NAMESPACE)/{{ include "nginx-ingress.configName" . }}
247+
{{- if .Values.controller.nginxplus }}
248+
- -mgmt-configmap=$(POD_NAMESPACE)/{{ include "nginx-ingress.mgmtConfigName" . }}
249+
{{- end }}
229250
{{- if .Values.controller.defaultTLS.secret }}
230251
- -default-server-tls-secret={{ .Values.controller.defaultTLS.secret }}
231252
{{ else if and (.Values.controller.defaultTLS.cert) (.Values.controller.defaultTLS.key) }}
@@ -423,6 +444,8 @@ volumeMounts:
423444
env:
424445
- name: ENFORCER_PORT
425446
value: "{{ .Values.controller.appprotect.enforcer.port | default 50000 }}"
447+
- name: ENFORCER_CONFIG_TIMEOUT
448+
value: "0"
426449
volumeMounts:
427450
- name: app-protect-bd-config
428451
mountPath: /opt/app_protect/bd_config

‎charts/nginx-ingress/templates/controller-configmap.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,22 @@ data:
3030
nginx-agent.conf: |-
3131
{{ include "nginx-ingress.agentConfiguration" . | indent 4 }}
3232
{{- end }}
33+
---
34+
{{- if and .Values.controller.nginxplus (eq (.Values.controller.mgmt.customConfigMap | default "") "") }}
35+
apiVersion: v1
36+
kind: ConfigMap
37+
metadata:
38+
name: {{ include "nginx-ingress.mgmtConfigName" . }}
39+
namespace: {{ .Release.Namespace }}
40+
labels:
41+
{{- include "nginx-ingress.labels" . | nindent 4 }}
42+
{{- if .Values.controller.config.annotations }}
43+
annotations:
44+
{{ toYaml .Values.controller.config.annotations | indent 4 }}
45+
{{- end }}
46+
data:
47+
license-token-secret-name: {{ include "nginx-ingress.licenseTokenSecretName" . }}
48+
{{- if hasKey .Values.controller.mgmt "enforceInitialReport" }}
49+
enforce-initial-report: {{ quote .Values.controller.mgmt.enforceInitialReport }}
50+
{{- end }}
51+
{{- end }}

‎charts/nginx-ingress/values.schema.json

Lines changed: 41 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,37 @@
9494
}
9595
]
9696
},
97+
"mgmt": {
98+
"type": "object",
99+
"default": {},
100+
"title": "The mgmt block Schema",
101+
"properties": {
102+
"licenseTokenSecretName": {
103+
"type": "string",
104+
"default": "",
105+
"title": "The licenseTokenSecretName Schema",
106+
"examples": [
107+
"nginx-plus-secret",
108+
"license-token",
109+
"license"
110+
]
111+
},
112+
"enforceInitialReport": {
113+
"type": "boolean",
114+
"default": false,
115+
"title": "The enforceInitialReport Schema",
116+
"examples": [
117+
true,
118+
false
119+
]
120+
}
121+
},
122+
"examples": [
123+
{
124+
"licenseTokenSecretName": "license-token"
125+
}
126+
]
127+
},
97128
"nginxReloadTimeout": {
98129
"type": "integer",
99130
"default": 0,
@@ -208,10 +239,10 @@
208239
},
209240
"tag": {
210241
"type": "string",
211-
"default": "5.3.0",
242+
"default": "5.4.0",
212243
"title": "The tag of the App Protect WAF v5 Enforcer image",
213244
"examples": [
214-
"5.3.0"
245+
"5.4.0"
215246
]
216247
},
217248
"digest": {
@@ -248,7 +279,7 @@
248279
"examples": [
249280
{
250281
"repository": "private-registry.nginx.com/nap/waf-enforcer",
251-
"tag": "5.3.0",
282+
"tag": "5.4.0",
252283
"pullPolicy": "IfNotPresent"
253284
}
254285
]
@@ -282,10 +313,10 @@
282313
},
283314
"tag": {
284315
"type": "string",
285-
"default": "5.3.0",
316+
"default": "5.4.0",
286317
"title": "The tag of the App Protect WAF v5 Config Manager image",
287318
"examples": [
288-
"5.3.0"
319+
"5.4.0"
289320
]
290321
},
291322
"digest": {
@@ -322,7 +353,7 @@
322353
"examples": [
323354
{
324355
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
325-
"tag": "5.3.0",
356+
"tag": "5.4.0",
326357
"pullPolicy": "IfNotPresent"
327358
}
328359
]
@@ -1698,15 +1729,15 @@
16981729
"port": 50000,
16991730
"image": {
17001731
"repository": "private-registry.nginx.com/nap/waf-enforcer",
1701-
"tag": "5.3.0",
1732+
"tag": "5.4.0",
17021733
"pullPolicy": "IfNotPresent"
17031734
},
17041735
"securityContext": {}
17051736
},
17061737
"configManager": {
17071738
"image": {
17081739
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
1709-
"tag": "5.3.0",
1740+
"tag": "5.4.0",
17101741
"pullPolicy": "IfNotPresent"
17111742
},
17121743
"securityContext": {
@@ -2312,15 +2343,15 @@
23122343
"port": 50000,
23132344
"image": {
23142345
"repository": "private-registry.nginx.com/nap/waf-enforcer",
2315-
"tag": "5.3.0",
2346+
"tag": "5.4.0",
23162347
"pullPolicy": "IfNotPresent"
23172348
},
23182349
"securityContext": {}
23192350
},
23202351
"configManager": {
23212352
"image": {
23222353
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
2323-
"tag": "5.3.0",
2354+
"tag": "5.4.0",
23242355
"pullPolicy": "IfNotPresent"
23252356
},
23262357
"securityContext": {

‎charts/nginx-ingress/values.yaml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,14 @@ controller:
1414
## Deploys the Ingress Controller for NGINX Plus.
1515
nginxplus: false
1616

17+
## Configures NGINX mgmt block for NGINX Plus
18+
mgmt:
19+
## Secret name of license token for NGINX Plus
20+
licenseTokenSecretName: "license-token" # required for NGINX Plus
21+
22+
## Enables the 180-day grace period for sending the initial usage report
23+
# enforceInitialReport: false
24+
1725
## Timeout in milliseconds which the Ingress Controller will wait for a successful NGINX reload after a change or at the initial start.
1826
nginxReloadTimeout: 60000
1927

@@ -49,7 +57,7 @@ controller:
4957
repository: private-registry.nginx.com/nap/waf-enforcer
5058

5159
## The tag of the App Protect WAF v5 Enforcer image.
52-
tag: "5.3.0"
60+
tag: "5.4.0"
5361
## The digest of the App Protect WAF v5 Enforcer image.
5462
## If digest is specified it has precedence over tag and will be used instead
5563
# digest: "sha256:CHANGEME"
@@ -65,7 +73,7 @@ controller:
6573
repository: private-registry.nginx.com/nap/waf-config-mgr
6674

6775
## The tag of the App Protect WAF v5 Configuration Manager image.
68-
tag: "5.3.0"
76+
tag: "5.4.0"
6977
## The digest of the App Protect WAF v5 Configuration Manager image.
7078
## If digest is specified it has precedence over tag and will be used instead
7179
# digest: "sha256:CHANGEME"

0 commit comments

Comments
 (0)