Skip to content

Update WAF to 5.9.0 #8339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 13 commits into from
Oct 3, 2025
Merged

Update WAF to 5.9.0 #8339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
2cfb5ad
Pin NAP v4
AlexFenlon Oct 2, 2025
f41fee4
Merge branch 'main' into chore/fix-nap-v4
AlexFenlon Oct 2, 2025
85c3a54
update NAP to 5.9.0
AlexFenlon Oct 2, 2025
d2ed43a
Merge branch 'main' into chore/fix-nap-v4
AlexFenlon Oct 2, 2025
4687b54
Merge remote-tracking branch 'origin/chore/fix-nap-v4' into chore/fix…
AlexFenlon Oct 2, 2025
91492c4
update data.json
AlexFenlon Oct 2, 2025
9563a6c
Fix data.json and add flag to pytest
AlexFenlon Oct 3, 2025
544c920
change v5 check to check if file exists
AlexFenlon Oct 3, 2025
b631f2d
Merge branch 'main' into chore/fix-nap-v4
AlexFenlon Oct 3, 2025
dfaea89
update snaps
AlexFenlon Oct 3, 2025
7d8c8fc
Merge branch 'main' into chore/fix-nap-v4
AlexFenlon Oct 3, 2025
2105e27
address comments
AlexFenlon Oct 3, 2025
85fe433
Merge branch 'main' into chore/fix-nap-v4
AlexFenlon Oct 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/regression.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,7 +275,7 @@ jobs:

- name: Generate WAF v5 tgz from JSON
run: |
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.8.0 -p /data/wafv5.json -o /data/wafv5.tgz
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.9.0 -p /data/wafv5.json -o /data/wafv5.tgz
if: ${{ contains(matrix.images.image, 'nap-v5')}}

- name: Run Regression Tests
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/setup-smoke.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ jobs:

- name: Generate WAF v5 tgz from JSON
run: |
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.8.0 -p /data/wafv5.json -o /data/wafv5.tgz
docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.9.0 -p /data/wafv5.json -o /data/wafv5.tgz
if: ${{ contains(inputs.image, 'nap-v5')}}

- name: Run Smoke Tests
Expand Down
6 changes: 3 additions & 3 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,9 @@ GIT_TAG = $(shell git describe --exact-match --tags || echo untagged)
VERSION = $(VER)-SNAPSHOT
NGINX_OSS_VERSION ?= 1.29
NGINX_PLUS_VERSION ?= R35
NAP_WAF_VERSION ?= 35+5.498
NAP_WAF_COMMON_VERSION ?= 11.533
NAP_WAF_PLUGIN_VERSION ?= 6.20.0
NAP_WAF_VERSION ?= 35+5.527
NAP_WAF_COMMON_VERSION ?= 11.559
NAP_WAF_PLUGIN_VERSION ?= 6.23.0
NGINX_AGENT_VERSION ?= 3.3
PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key

Expand Down
6 changes: 3 additions & 3 deletions build/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@
ARG BUILD_OS=debian
ARG NGINX_OSS_VERSION=1.29
ARG NGINX_PLUS_VERSION=R35
ARG NAP_WAF_VERSION=35+5.498
ARG NAP_WAF_COMMON_VERSION=11.533
ARG NAP_WAF_PLUGIN_VERSION=6.20.0
ARG NAP_WAF_VERSION=35+5.527
ARG NAP_WAF_COMMON_VERSION=11.559
ARG NAP_WAF_PLUGIN_VERSION=6.23.0
ARG NGINX_AGENT_VERSION=3.3
ARG DOWNLOAD_TAG=edge
ARG DEBIAN_FRONTEND=noninteractive
Expand Down Expand Up @@ -595,7 +595,7 @@
# 101 is nginx
USER 101

LABEL org.opencontainers.image.version="${IC_VERSION}" \

Check warning on line 598 in build/Dockerfile

View workflow job for this annotation

GitHub Actions / Build Artifacts / Build Docker OSS (ubi, linux/arm64, linux/amd64) / OSS ubi linux/arm64, linux/amd64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$NGINX_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-ingress-controller \
org.opencontainers.image.vendor="NGINX Inc <kubernetes@nginx.com>" \
org.nginx.kic.image.build.target="${TARGETPLATFORM}" \
Expand Down
20 changes: 10 additions & 10 deletions charts/nginx-ingress/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,10 +350,10 @@
},
"tag": {
"type": "string",
"default": "5.8.0",
"default": "5.9.0",
"title": "The tag of the App Protect WAF v5 Enforcer image",
"examples": [
"5.8.0"
"5.9.0"
]
},
"digest": {
Expand Down Expand Up @@ -389,7 +389,7 @@
"examples": [
{
"repository": "private-registry.nginx.com/nap/waf-enforcer",
"tag": "5.8.0",
"tag": "5.9.0",
"pullPolicy": "IfNotPresent"
}
]
Expand Down Expand Up @@ -422,10 +422,10 @@
},
"tag": {
"type": "string",
"default": "5.8.0",
"default": "5.9.0",
"title": "The tag of the App Protect WAF v5 Config Manager image",
"examples": [
"5.8.0"
"5.9.0"
]
},
"digest": {
Expand Down Expand Up @@ -461,7 +461,7 @@
"examples": [
{
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
"tag": "5.8.0",
"tag": "5.9.0",
"pullPolicy": "IfNotPresent"
}
]
Expand Down Expand Up @@ -2020,15 +2020,15 @@
"port": 50000,
"image": {
"repository": "private-registry.nginx.com/nap/waf-enforcer",
"tag": "5.8.0",
"tag": "5.9.0",
"pullPolicy": "IfNotPresent"
},
"securityContext": {}
},
"configManager": {
"image": {
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
"tag": "5.8.0",
"tag": "5.9.0",
"pullPolicy": "IfNotPresent"
},
"securityContext": {
Expand Down Expand Up @@ -2660,15 +2660,15 @@
"port": 50000,
"image": {
"repository": "private-registry.nginx.com/nap/waf-enforcer",
"tag": "5.8.0",
"tag": "5.9.0",
"pullPolicy": "IfNotPresent"
},
"securityContext": {}
},
"configManager": {
"image": {
"repository": "private-registry.nginx.com/nap/waf-config-mgr",
"tag": "5.8.0",
"tag": "5.9.0",
"pullPolicy": "IfNotPresent"
},
"securityContext": {
Expand Down
4 changes: 2 additions & 2 deletions charts/nginx-ingress/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ controller:
repository: private-registry.nginx.com/nap/waf-enforcer

## The tag of the App Protect WAF v5 Enforcer image.
tag: "5.8.0"
tag: "5.9.0"
## The digest of the App Protect WAF v5 Enforcer image.
## If digest is specified it has precedence over tag and will be used instead
# digest: "sha256:CHANGEME"
Expand All @@ -100,7 +100,7 @@ controller:
repository: private-registry.nginx.com/nap/waf-config-mgr

## The tag of the App Protect WAF v5 Configuration Manager image.
tag: "5.8.0"
tag: "5.9.0"
## The digest of the App Protect WAF v5 Configuration Manager image.
## If digest is specified it has precedence over tag and will be used instead
# digest: "sha256:CHANGEME"
Expand Down
8 changes: 4 additions & 4 deletions charts/tests/__snapshots__/helmunit_test.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1936,7 +1936,7 @@ spec:
- -weight-changes-dynamic-reload=false

- name: waf-enforcer
image: my.private.reg/nap/waf-enforcer:5.8.0
image: my.private.reg/nap/waf-enforcer:5.9.0
imagePullPolicy: "IfNotPresent"
env:
- name: ENFORCER_PORT
Expand All @@ -1947,7 +1947,7 @@ spec:
- name: app-protect-bd-config
mountPath: /opt/app_protect/bd_config
- name: waf-config-mgr
image: my.private.reg/nap/waf-config-mgr:5.8.0
image: my.private.reg/nap/waf-config-mgr:5.9.0
imagePullPolicy: "IfNotPresent"
securityContext:

Expand Down Expand Up @@ -2519,7 +2519,7 @@ spec:
- -agent-instance-group=app-protect-wafv5-agentv2-nginx-ingress-controller

- name: waf-enforcer
image: my.private.reg/nap/waf-enforcer:5.8.0
image: my.private.reg/nap/waf-enforcer:5.9.0
imagePullPolicy: "IfNotPresent"
env:
- name: ENFORCER_PORT
Expand All @@ -2530,7 +2530,7 @@ spec:
- name: app-protect-bd-config
mountPath: /opt/app_protect/bd_config
- name: waf-config-mgr
image: my.private.reg/nap/waf-config-mgr:5.8.0
image: my.private.reg/nap/waf-config-mgr:5.9.0
imagePullPolicy: "IfNotPresent"
securityContext:

Expand Down
4 changes: 1 addition & 3 deletions cmd/nginx-ingress/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ import (
"os/signal"
"path/filepath"
"reflect"
"regexp"
"runtime"
"strings"
"syscall"
Expand Down Expand Up @@ -146,8 +145,7 @@ func main() {
if *appProtect {
appProtectVersion = getAppProtectVersionInfo(ctx)

r := regexp.MustCompile("^5.*")
if r.MatchString(appProtectVersion) {
if _, err := os.Stat("/opt/app_protect/VERSION.common"); os.IsNotExist(err) {
appProtectV5 = true
appProtectBundlePath = appProtectv5BundleFolder
}
Expand Down
48 changes: 24 additions & 24 deletions tests/data/modules/data.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,11 +80,11 @@
},
{
"name": "nginx-plus-module-appprotect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-attack-signatures",
Expand Down Expand Up @@ -126,15 +126,15 @@
},
{
"name": "nginx-plus-module-appprotect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-module-plus",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-plugin",
"version": "6.20.0"
"version": "6.23.0"
},
{
"name": "nginx-agent",
Expand Down Expand Up @@ -202,11 +202,11 @@
},
{
"name": "nginx-plus-module-appprotect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-attack-signatures",
Expand Down Expand Up @@ -349,11 +349,11 @@
},
{
"name": "nginx-plus-module-appprotect",
"version": "35.5.498"
"version": "35.5.527"
},
{
"name": "app-protect",
"version": "35.5.498"
"version": "35.5.527"
},
{
"name": "app-protect-attack-signatures",
Expand Down Expand Up @@ -395,15 +395,15 @@
},
{
"name": "nginx-plus-module-appprotect",
"version": "35.5.498"
"version": "35.5.527"
},
{
"name": "app-protect-module-plus",
"version": "35.5.498"
"version": "35.5.527"
},
{
"name": "app-protect-plugin",
"version": "6.20.0"
"version": "6.23.0"
}
],
"system": "alpine",
Expand Down Expand Up @@ -495,11 +495,11 @@
},
{
"name": "nginx-plus-module-appprotect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-attack-signatures",
Expand Down Expand Up @@ -541,15 +541,15 @@
},
{
"name": "nginx-plus-module-appprotect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-module-plus",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-plugin",
"version": "6.20.0"
"version": "6.23.0"
}
],
"system": "ubi",
Expand Down Expand Up @@ -583,11 +583,11 @@
},
{
"name": "nginx-plus-module-appprotect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-attack-signatures",
Expand Down Expand Up @@ -629,15 +629,15 @@
},
{
"name": "nginx-plus-module-appprotect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-module-plus",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-plugin",
"version": "6.20.0"
"version": "6.23.0"
}
],
"system": "ubi",
Expand Down Expand Up @@ -701,7 +701,7 @@
},
{
"name": "nginx-plus-module-appprotect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "nginx-plus-module-appprotectdos",
Expand All @@ -713,7 +713,7 @@
},
{
"name": "app-protect",
"version": "35+5.498"
"version": "35+5.527"
},
{
"name": "app-protect-attack-signatures",
Expand Down
2 changes: 1 addition & 1 deletion tests/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,4 +33,4 @@
# Nginx registry address to pull waf components from
NGX_REG = "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr"
# WAF component version to pull from above registry
WAF_V5_VERSION = "5.8.0"
WAF_V5_VERSION = "5.9.0"
Loading