Skip to content

Allow easier updates to Agent versions on NAP images #8303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 12 commits into
base: main
Choose a base branch
from
+30 −20
Open

Allow easier updates to Agent versions on NAP images #8303

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
ccc3655
Allow easier updates to Agent versions on NAP images
AlexFenlon Sep 29, 2025
d5b584d
Merge branch 'main' into chore/allow-easier-nap-agent-updates
AlexFenlon Sep 29, 2025
7dec558
fix alpine
AlexFenlon Sep 29, 2025
c646ca9
Merge branch 'main' into chore/allow-easier-nap-agent-updates
AlexFenlon Sep 30, 2025
43c02bc
Merge remote-tracking branch 'origin/main' into chore/allow-easier-na…
AlexFenlon Sep 30, 2025
67cd0df
add restriction based off comment
AlexFenlon Oct 1, 2025
5f8cc7f
Merge branch 'main' into chore/allow-easier-nap-agent-updates
AlexFenlon Oct 1, 2025
a520c6e
fix alpine
AlexFenlon Oct 1, 2025
3fd23ff
Merge branch 'main' into chore/allow-easier-nap-agent-updates
AlexFenlon Oct 1, 2025
8a1247e
fix alpine
AlexFenlon Oct 1, 2025
63b4e62
Merge branch 'main' into chore/allow-easier-nap-agent-updates
AlexFenlon Oct 1, 2025
4b1b962
Merge branch 'main' into chore/allow-easier-nap-agent-updates
AlexFenlon Oct 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 11 additions & 10 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ NGINX_PLUS_VERSION ?= R35
NAP_WAF_VERSION ?= 35+5.498
NAP_WAF_COMMON_VERSION ?= 11.533
NAP_WAF_PLUGIN_VERSION ?= 6.20.0
NAP_AGENT_VERSION ?= 2
NGINX_AGENT_VERSION ?= 3.3
PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key

Expand Down Expand Up @@ -158,12 +159,12 @@ alpine-image-plus-fips: build ## Create Docker image for Ingress Controller (Alp

.PHONY: alpine-image-nap-plus-fips
alpine-image-nap-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAF and FIPS)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)

.PHONY: alpine-image-nap-v5-plus-fips
alpine-image-nap-v5-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAFv5 and FIPS)
$(DOCKER_CMD) $(PLUS_ARGS) \
--build-arg BUILD_OS=alpine-plus-nap-v5-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
--build-arg BUILD_OS=alpine-plus-nap-v5-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)

.PHONY: debian-image-plus
debian-image-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus)
Expand All @@ -173,12 +174,12 @@ debian-image-plus: build ## Create Docker image for Ingress Controller (Debian w
debian-image-nap-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAF)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf \
--build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) \
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION)
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)

.PHONY: debian-image-nap-v5-plus
debian-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAFv5)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) \
--build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION)
--build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)

.PHONY: debian-image-dos-plus
debian-image-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect DoS)
Expand All @@ -188,7 +189,7 @@ debian-image-dos-plus: build ## Create Docker image for Ingress Controller (Debi
debian-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus, NGINX App Protect WAF and DoS)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos \
--build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) \
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION)
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)

.PHONY: ubi-image
ubi-image: build ## Create Docker image for Ingress Controller (UBI)
Expand All @@ -201,22 +202,22 @@ ubi-image-plus: build ## Create Docker image for Ingress Controller (UBI with NG
.PHONY: ubi-image-nap-plus
ubi-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)

.PHONY: ubi8-image-nap-plus
ubi8-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-8-plus-nap \
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)

.PHONY: ubi-image-nap-v5-plus
ubi-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
--build-arg BUILD_OS=ubi-9-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
--build-arg BUILD_OS=ubi-9-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)

.PHONY: ubi8-image-nap-v5-plus
ubi8-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
--build-arg BUILD_OS=ubi-8-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
--build-arg BUILD_OS=ubi-8-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)

.PHONY: ubi-image-dos-plus
ubi-image-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect DoS)
Expand All @@ -226,7 +227,7 @@ ubi-image-dos-plus: build ## Create Docker image for Ingress Controller (UBI wit
.PHONY: ubi-image-nap-dos-plus
ubi-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus, NGINX App Protect WAF and DoS)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
--build-arg NAP_MODULES=waf,dos --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
--build-arg NAP_MODULES=waf,dos --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_AGENT_VERSION=$(NAP_AGENT_VERSION)

.PHONY: all-images ## Create all the Docker images for Ingress Controller
all-images: alpine-image alpine-image-plus alpine-image-plus-fips alpine-image-nap-plus-fips debian-image debian-image-plus debian-image-nap-plus debian-image-dos-plus debian-image-nap-dos-plus ubi-image ubi-image-plus ubi-image-nap-plus ubi-image-dos-plus ubi-image-nap-dos-plus
Expand Down
29 changes: 19 additions & 10 deletions build/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
ARG NAP_WAF_COMMON_VERSION=11.533
ARG NAP_WAF_PLUGIN_VERSION=6.20.0
ARG NGINX_AGENT_VERSION=3.3
ARG NAP_AGENT_VERSION=2
ARG DOWNLOAD_TAG=edge
ARG DEBIAN_FRONTEND=noninteractive
ARG PREBUILT_BASE_IMG=nginx/nginx-ingress:${DOWNLOAD_TAG}
Expand Down Expand Up @@ -212,6 +213,7 @@
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG PACKAGE_REPO
ARG NAP_AGENT_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -228,7 +230,7 @@
&& printf "%s\n" "https://pkgs.nginx.com/app-protect-security-updates/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
&& apk add --no-cache nginx-agent~2 \
&& apk add --no-cache nginx-agent~${NAP_AGENT_VERSION} \
&& mkdir -p /usr/ssl \
&& cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \
&& cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \
Expand All @@ -244,8 +246,9 @@
############################################# Base image for Alpine with NGINX Plus, App Protect WAFv5 and FIPS #############################################
FROM alpine:3.19@sha256:3be987e6cde1d07e873c012bf6cfe941e6e85d16ca5fc5b8bedc675451d2de67 AS alpine-plus-nap-v5-fips
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG PACKAGE_REPO
ARG NAP_WAF_VERSION
ARG NAP_AGENT_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -260,7 +263,7 @@
&& printf "%s\n" "https://${PACKAGE_REPO}/app-protect-x-plus/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
&& apk add --no-cache nginx-agent~2 \
&& apk add --no-cache nginx-agent~${NAP_AGENT_VERSION} \
&& mkdir -p /usr/ssl \
&& cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \
&& cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \
Expand Down Expand Up @@ -329,6 +332,7 @@
ARG NAP_WAF_VERSION
ARG NAP_WAF_COMMON_VERSION
ARG NAP_WAF_PLUGIN_VERSION
ARG NAP_AGENT_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -353,7 +357,7 @@
app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
app-protect-attack-signatures \
app-protect-threat-campaigns \
nginx-agent=2.* \
nginx-agent=${NAP_AGENT_VERSION}.* \
&& rm -f /etc/apt/sources.list.d/app-protect.sources /etc/apt/sources.list.d/nginx-agent.sources \
&& nap-waf.sh \
&& agent.sh; \
Expand All @@ -372,6 +376,7 @@
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG NAP_WAF_PLUGIN_VERSION
ARG NAP_AGENT_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -383,7 +388,7 @@
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
--mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/etc/apt/sources.list.d/nginx-agent.sources \
apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=2.* app-protect-module-plus=${NAP_WAF_VERSION}* nginx-plus-module-appprotect=${NAP_WAF_VERSION}* app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=${NAP_AGENT_VERSION}.* app-protect-module-plus=${NAP_WAF_VERSION}* nginx-plus-module-appprotect=${NAP_WAF_VERSION}* app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
&& nap-waf.sh \
&& agent.sh

Expand All @@ -409,7 +414,7 @@
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
&& ubi-setup.sh \
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NGINX_AGENT_VERSION}* \
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NGINX_AGENT_VERSION}.* \
&& agent.sh \
&& ubi-clean.sh

Expand All @@ -420,6 +425,7 @@
ARG BUILD_OS
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG NAP_AGENT_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -442,7 +448,7 @@
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
&& ubi-setup.sh \
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check nginx-plus-module-otel nginx-agent-2.* \
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check nginx-plus-module-otel nginx-agent-${NAP_AGENT_VERSION}.* \
&& source /tmp/rhel_license \
&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
Expand Down Expand Up @@ -471,6 +477,7 @@
FROM ubi-minimal AS ubi-9-plus-nap-v5
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG NAP_AGENT_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -494,7 +501,7 @@
&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-2.* app-protect-module-plus-${NAP_WAF_VERSION}* \
&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-${NAP_AGENT_VERSION}.* app-protect-module-plus-${NAP_WAF_VERSION}* \
&& nap-waf.sh \
&& ubi-clean.sh \
&& agent.sh
Expand All @@ -505,6 +512,7 @@
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG BUILD_OS
ARG NAP_AGENT_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -527,7 +535,7 @@
&& rpm --import /tmp/nginx_signing.key \
&& rpm --import /tmp/app-protect-security-updates.key \
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-2.* \
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NAP_AGENT_VERSION}.* \
&& sed -i 's/\(def in_container():\)/\1\n return False/g' /usr/lib64/python*/*-packages/rhsm/config.py \
&& subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} --name ${BUILD_OS}-$(uname -m) || true \
&& subscription-manager attach \
Expand All @@ -544,6 +552,7 @@
FROM redhat/ubi8@sha256:534c2c0efa4150ede18e3f9d7480d3b9ec2a52e62bc91cd54e08ee7336819619 AS ubi-8-plus-nap-v5
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG NAP_AGENT_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -565,7 +574,7 @@
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
&& rpm --import /tmp/nginx_signing.key \
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-2.* \
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-${NAP_AGENT_VERSION}.* \
&& dnf --nodocs install -y app-protect-module-plus-${NAP_WAF_VERSION}* \
&& nap-waf.sh \
&& agent.sh \
Expand Down Expand Up @@ -595,7 +604,7 @@
# 101 is nginx
USER 101

LABEL org.opencontainers.image.version="${IC_VERSION}" \

Check warning on line 607 in build/Dockerfile

View workflow job for this annotation

GitHub Actions / Build Artifacts / Build Docker OSS (ubi, linux/arm64, linux/amd64) / OSS ubi linux/arm64, linux/amd64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$NGINX_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-ingress-controller \
org.opencontainers.image.vendor="NGINX Inc <[email protected]>" \
org.nginx.kic.image.build.target="${TARGETPLATFORM}" \
Expand Down
Loading