Skip to content

Pin all NAP WAF package versions #8317

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 30, 2025
Merged

Pin all NAP WAF package versions #8317

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 23 additions & 11 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ GIT_TAG = $(shell git describe --exact-match --tags || echo untagged)
VERSION = $(VER)-SNAPSHOT
NGINX_OSS_VERSION ?= 1.29
NGINX_PLUS_VERSION ?= R35
NAP_WAF_VERSION ?= 35+5.498
NAP_WAF_COMMON_VERSION ?= 11.533
NAP_WAF_PLUGIN_VERSION ?= 6.20.0
NGINX_AGENT_VERSION ?= 3.3
PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key

Expand Down Expand Up @@ -155,32 +158,37 @@ alpine-image-plus-fips: build ## Create Docker image for Ingress Controller (Alp

.PHONY: alpine-image-nap-plus-fips
alpine-image-nap-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAF and FIPS)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)

.PHONY: alpine-image-nap-v5-plus-fips
alpine-image-nap-v5-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAFv5 and FIPS)
$(DOCKER_CMD) $(PLUS_ARGS) \
--build-arg BUILD_OS=alpine-plus-nap-v5-fips
--build-arg BUILD_OS=alpine-plus-nap-v5-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)

.PHONY: debian-image-plus
debian-image-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus --build-arg NGINX_AGENT_VERSION=$(NGINX_AGENT_VERSION)

.PHONY: debian-image-nap-plus
debian-image-nap-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAF)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf \
--build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) \
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION)

.PHONY: debian-image-nap-v5-plus
debian-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAFv5)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap-v5
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) \
--build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION)

.PHONY: debian-image-dos-plus
debian-image-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect DoS)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=dos

.PHONY: debian-image-nap-dos-plus
debian-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus, NGINX App Protect WAF and DoS)
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos \
--build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) \
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION)

.PHONY: ubi-image
ubi-image: build ## Create Docker image for Ingress Controller (UBI)
Expand All @@ -192,29 +200,33 @@ ubi-image-plus: build ## Create Docker image for Ingress Controller (UBI with NG

.PHONY: ubi-image-nap-plus
ubi-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=waf
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)

.PHONY: ubi8-image-nap-plus
ubi8-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-8-plus-nap --build-arg NAP_MODULES=waf
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-8-plus-nap \
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)

.PHONY: ubi-image-nap-v5-plus
ubi-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
--build-arg BUILD_OS=ubi-9-plus-nap-v5
--build-arg BUILD_OS=ubi-9-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)

.PHONY: ubi8-image-nap-v5-plus
ubi8-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
--build-arg BUILD_OS=ubi-8-plus-nap-v5
--build-arg BUILD_OS=ubi-8-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)

.PHONY: ubi-image-dos-plus
ubi-image-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect DoS)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=dos
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
--build-arg NAP_MODULES=dos

.PHONY: ubi-image-nap-dos-plus
ubi-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus, NGINX App Protect WAF and DoS)
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=waf,dos
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
--build-arg NAP_MODULES=waf,dos --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)

.PHONY: all-images ## Create all the Docker images for Ingress Controller
all-images: alpine-image alpine-image-plus alpine-image-plus-fips alpine-image-nap-plus-fips debian-image debian-image-plus debian-image-nap-plus debian-image-dos-plus debian-image-nap-dos-plus ubi-image ubi-image-plus ubi-image-nap-plus ubi-image-dos-plus ubi-image-nap-dos-plus
Expand Down
44 changes: 36 additions & 8 deletions build/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@
ARG BUILD_OS=debian
ARG NGINX_OSS_VERSION=1.29
ARG NGINX_PLUS_VERSION=R35
ARG NAP_WAF_VERSION=35+5.498
ARG NAP_WAF_COMMON_VERSION=11.533
ARG NAP_WAF_PLUGIN_VERSION=6.20.0
ARG NGINX_AGENT_VERSION=3.3
ARG DOWNLOAD_TAG=edge
ARG DEBIAN_FRONTEND=noninteractive
Expand Down Expand Up @@ -207,6 +210,7 @@
############################################# Base image for Alpine with NGINX Plus, App Protect WAF and FIPS #############################################
FROM alpine:3.19@sha256:3be987e6cde1d07e873c012bf6cfe941e6e85d16ca5fc5b8bedc675451d2de67 AS alpine-plus-nap-fips
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG PACKAGE_REPO

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
Expand All @@ -231,7 +235,7 @@
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
&& mkdir -p /etc/nginx/reporting/ \
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
&& apk add --no-cache app-protect app-protect-attack-signatures app-protect-threat-campaigns \
&& apk add --no-cache app-protect~=${NAP_WAF_VERSION/+/.} app-protect-attack-signatures app-protect-threat-campaigns \
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
&& nap-waf.sh \
agent.sh
Expand All @@ -240,6 +244,7 @@
############################################# Base image for Alpine with NGINX Plus, App Protect WAFv5 and FIPS #############################################
FROM alpine:3.19@sha256:3be987e6cde1d07e873c012bf6cfe941e6e85d16ca5fc5b8bedc675451d2de67 AS alpine-plus-nap-v5-fips
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG PACKAGE_REPO

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
Expand All @@ -262,7 +267,7 @@
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
&& mkdir -p /etc/nginx/reporting/ \
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
&& apk add --no-cache app-protect-module-plus~=35.5.498 \
&& apk add --no-cache app-protect-module-plus~=${NAP_WAF_VERSION/+/.} \
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
&& nap-waf.sh \
agent.sh
Expand Down Expand Up @@ -321,6 +326,9 @@
FROM debian-plus-only AS debian-plus-nap
ARG NAP_MODULES
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG NAP_WAF_COMMON_VERSION
ARG NAP_WAF_PLUGIN_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -337,7 +345,15 @@
cp /tmp/app-protect.sources /etc/apt/sources.list.d/app-protect.sources \
&& cp /tmp/nginx-agent.sources /etc/apt/sources.list.d/nginx-agent.sources \
&& apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y app-protect app-protect-attack-signatures app-protect-threat-campaigns nginx-agent=2.* \
&& apt-get install --no-install-recommends --no-install-suggests -y app-protect=${NAP_WAF_VERSION}* \
nginx-plus-module-appprotect=${NAP_WAF_VERSION}* \
app-protect-engine=${NAP_WAF_COMMON_VERSION}* \
app-protect-common=${NAP_WAF_COMMON_VERSION}* \
app-protect-compiler=${NAP_WAF_COMMON_VERSION}* \
app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
app-protect-attack-signatures \
app-protect-threat-campaigns \
nginx-agent=2.* \
&& rm -f /etc/apt/sources.list.d/app-protect.sources /etc/apt/sources.list.d/nginx-agent.sources \
&& nap-waf.sh \
&& agent.sh; \
Expand All @@ -354,6 +370,8 @@
############################################# Base image for Debian with NGINX Plus and App Protect WAFv5 #############################################
FROM debian-plus-only AS debian-plus-nap-v5
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG NAP_WAF_PLUGIN_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -365,7 +383,7 @@
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
--mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/etc/apt/sources.list.d/nginx-agent.sources \
apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=2.* app-protect-module-plus=35+5.498* nginx-plus-module-appprotect=35+5.498* app-protect-plugin=6.20.0* \
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=2.* app-protect-module-plus=${NAP_WAF_VERSION}* nginx-plus-module-appprotect=${NAP_WAF_VERSION}* app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
&& nap-waf.sh \
&& agent.sh

Expand Down Expand Up @@ -400,6 +418,10 @@
FROM ubi-minimal AS ubi-9-plus-nap
ARG NAP_MODULES
ARG BUILD_OS
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
Expand Down Expand Up @@ -430,7 +452,7 @@
rpm --import /tmp/app-protect-security-updates.key \
&& cp /tmp/app-protect-9.repo /etc/yum.repos.d/app-protect-9.repo \
&& microdnf --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms --nodocs install -y \
app-protect app-protect-attack-signatures app-protect-threat-campaigns \
app-protect-${NAP_WAF_VERSION}* app-protect-attack-signatures app-protect-threat-campaigns \
&& rm -f /etc/yum.repos.d/app-protect-9.repo \
&& nap-waf.sh \
&& agent.sh; \
Expand All @@ -447,6 +469,10 @@

############################################# Base image for UBI with NGINX Plus and App Protect WAFv5 #############################################
FROM ubi-minimal AS ubi-9-plus-nap-v5
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
Expand All @@ -468,7 +494,7 @@
&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-2.* app-protect-module-plus-35+5.498* \
&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-2.* app-protect-module-plus-${NAP_WAF_VERSION}* \
&& nap-waf.sh \
&& ubi-clean.sh \
&& agent.sh
Expand All @@ -477,6 +503,7 @@
############################################# Base image for UBI8 with NGINX Plus and App Protect WAF #############################################
FROM redhat/ubi8@sha256:534c2c0efa4150ede18e3f9d7480d3b9ec2a52e62bc91cd54e08ee7336819619 AS ubi-8-plus-nap
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION
ARG BUILD_OS

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
Expand Down Expand Up @@ -506,7 +533,7 @@
&& subscription-manager attach \
&& dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \
&& dnf --nodocs install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
&& dnf --nodocs install -y app-protect app-protect-attack-signatures app-protect-threat-campaigns \
&& dnf --nodocs install -y app-protect-${NAP_WAF_VERSION}* app-protect-attack-signatures app-protect-threat-campaigns \
&& subscription-manager unregister \
&& nap-waf.sh \
&& agent.sh \
Expand All @@ -516,6 +543,7 @@
############################################# Base image for UBI8 with NGINX Plus and App Protect WAFv5 #############################################
FROM redhat/ubi8@sha256:534c2c0efa4150ede18e3f9d7480d3b9ec2a52e62bc91cd54e08ee7336819619 AS ubi-8-plus-nap-v5
ARG NGINX_PLUS_VERSION
ARG NAP_WAF_VERSION

ENV NGINX_VERSION=${NGINX_PLUS_VERSION}

Expand All @@ -538,7 +566,7 @@
&& rpm --import /tmp/nginx_signing.key \
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-2.* \
&& dnf --nodocs install -y app-protect-module-plus-35+5.498* \
&& dnf --nodocs install -y app-protect-module-plus-${NAP_WAF_VERSION}* \
&& nap-waf.sh \
&& agent.sh \
&& dnf clean all
Expand Down Expand Up @@ -567,7 +595,7 @@
# 101 is nginx
USER 101

LABEL org.opencontainers.image.version="${IC_VERSION}" \

Check warning on line 598 in build/Dockerfile

View workflow job for this annotation

GitHub Actions / Build Artifacts / Build Docker OSS (ubi, linux/arm64, linux/amd64) / OSS ubi linux/arm64, linux/amd64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$NGINX_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-ingress-controller \
org.opencontainers.image.vendor="NGINX Inc <kubernetes@nginx.com>" \
org.nginx.kic.image.build.target="${TARGETPLATFORM}" \
Expand Down
Loading