Merge branch 'main' into feat/7781-oidc-front-channel-logout

Author: javorszky

.github/actions/smoke-tests/action.yaml

@@ -52,7 +52,7 @@ runs:
     - name: Deploy Kubernetes
       id: k8s
       run: |
-        make -f tests/Makefile create-kind-cluster K8S_CLUSTER_NAME=${{ github.run_id }} K8S_CLUSTER_VERSION=${{ inputs.k8s-version }} K8S_TIMEOUT=${{ inputs.k8s-timeout }}
+        make -f tests/Makefile create-kind-cluster K8S_CLUSTER_NAME=${{ github.run_id }} K8S_CLUSTER_VERSION=v${{ inputs.k8s-version }} K8S_TIMEOUT=${{ inputs.k8s-timeout }}
         make -f tests/Makefile image-load REGISTRY="" PREFIX=${{ inputs.image-name }} TAG=${{ inputs.tag }} K8S_CLUSTER_NAME=${{ github.run_id }}
         label="${{ inputs.label }}"
         nospaces="${label// /_}"

.github/workflows/regression.yml

@@ -275,7 +275,7 @@ jobs:
 
       - name: Generate WAF v5 tgz from JSON
         run: |
-          docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.8.0 -p /data/wafv5.json -o /data/wafv5.tgz
+          docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.9.0 -p /data/wafv5.json -o /data/wafv5.tgz
         if: ${{ contains(matrix.images.image, 'nap-v5')}}
 
       - name: Run Regression Tests

.github/workflows/setup-smoke.yml

@@ -152,7 +152,7 @@ jobs:
 
       - name: Generate WAF v5 tgz from JSON
         run: |
-          docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.8.0 -p /data/wafv5.json -o /data/wafv5.tgz
+          docker run --rm --user root -v /var/run/docker.sock:/var/run/docker.sock -v ${{ github.workspace }}/tests/data/ap-waf-v5:/data gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/nap/waf-compiler:5.9.0 -p /data/wafv5.json -o /data/wafv5.tgz
         if: ${{ contains(inputs.image, 'nap-v5')}}
 
       - name: Run Smoke Tests

Makefile

@@ -4,9 +4,9 @@ GIT_TAG = $(shell git describe --exact-match --tags || echo untagged)
 VERSION = $(VER)-SNAPSHOT
 NGINX_OSS_VERSION             ?= 1.29
 NGINX_PLUS_VERSION            ?= R35
-NAP_WAF_VERSION               ?= 35+5.498
-NAP_WAF_COMMON_VERSION        ?= 11.533
-NAP_WAF_PLUGIN_VERSION        ?= 6.20.0
+NAP_WAF_VERSION               ?= 35+5.527
+NAP_WAF_COMMON_VERSION        ?= 11.559
+NAP_WAF_PLUGIN_VERSION        ?= 6.23.0
 NGINX_AGENT_VERSION           ?= 3.3
 PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key
 

build/Dockerfile

@@ -2,9 +2,9 @@
 ARG BUILD_OS=debian
 ARG NGINX_OSS_VERSION=1.29
 ARG NGINX_PLUS_VERSION=R35
-ARG NAP_WAF_VERSION=35+5.498
-ARG NAP_WAF_COMMON_VERSION=11.533
-ARG NAP_WAF_PLUGIN_VERSION=6.20.0
+ARG NAP_WAF_VERSION=35+5.527
+ARG NAP_WAF_COMMON_VERSION=11.559
+ARG NAP_WAF_PLUGIN_VERSION=6.23.0
 ARG NGINX_AGENT_VERSION=3.3
 ARG DOWNLOAD_TAG=edge
 ARG DEBIAN_FRONTEND=noninteractive

charts/nginx-ingress/values.schema.json

@@ -350,10 +350,10 @@
                     },
                     "tag": {
                       "type": "string",
-                      "default": "5.8.0",
+                      "default": "5.9.0",
                       "title": "The tag of the  App Protect WAF v5 Enforcer image",
                       "examples": [
-                        "5.8.0"
+                        "5.9.0"
                       ]
                     },
                     "digest": {
@@ -389,7 +389,7 @@
                   "examples": [
                     {
                       "repository": "private-registry.nginx.com/nap/waf-enforcer",
-                      "tag": "5.8.0",
+                      "tag": "5.9.0",
                       "pullPolicy": "IfNotPresent"
                     }
                   ]
@@ -422,10 +422,10 @@
                     },
                     "tag": {
                       "type": "string",
-                      "default": "5.8.0",
+                      "default": "5.9.0",
                       "title": "The tag of the  App Protect WAF v5 Config Manager image",
                       "examples": [
-                        "5.8.0"
+                        "5.9.0"
                       ]
                     },
                     "digest": {
@@ -461,7 +461,7 @@
                   "examples": [
                     {
                       "repository": "private-registry.nginx.com/nap/waf-config-mgr",
-                      "tag": "5.8.0",
+                      "tag": "5.9.0",
                       "pullPolicy": "IfNotPresent"
                     }
                   ]
@@ -2020,15 +2020,15 @@
               "port": 50000,
               "image": {
                 "repository": "private-registry.nginx.com/nap/waf-enforcer",
-                "tag": "5.8.0",
+                "tag": "5.9.0",
                 "pullPolicy": "IfNotPresent"
               },
               "securityContext": {}
             },
             "configManager": {
               "image": {
                 "repository": "private-registry.nginx.com/nap/waf-config-mgr",
-                "tag": "5.8.0",
+                "tag": "5.9.0",
                 "pullPolicy": "IfNotPresent"
               },
               "securityContext": {
@@ -2660,15 +2660,15 @@
             "port": 50000,
             "image": {
               "repository": "private-registry.nginx.com/nap/waf-enforcer",
-              "tag": "5.8.0",
+              "tag": "5.9.0",
               "pullPolicy": "IfNotPresent"
             },
             "securityContext": {}
           },
           "configManager": {
             "image": {
               "repository": "private-registry.nginx.com/nap/waf-config-mgr",
-              "tag": "5.8.0",
+              "tag": "5.9.0",
               "pullPolicy": "IfNotPresent"
             },
             "securityContext": {

charts/nginx-ingress/values.yaml

@@ -84,7 +84,7 @@ controller:
         repository: private-registry.nginx.com/nap/waf-enforcer
 
         ## The tag of the App Protect WAF v5 Enforcer image.
-        tag: "5.8.0"
+        tag: "5.9.0"
         ## The digest of the App Protect WAF v5 Enforcer image.
         ## If digest is specified it has precedence over tag and will be used instead
         # digest: "sha256:CHANGEME"
@@ -100,7 +100,7 @@ controller:
         repository: private-registry.nginx.com/nap/waf-config-mgr
 
         ## The tag of the App Protect WAF v5 Configuration Manager image.
-        tag: "5.8.0"
+        tag: "5.9.0"
         ## The digest of the App Protect WAF v5 Configuration Manager image.
         ## If digest is specified it has precedence over tag and will be used instead
         # digest: "sha256:CHANGEME"

charts/tests/__snapshots__/helmunit_test.snap

@@ -1936,7 +1936,7 @@ spec:
           - -weight-changes-dynamic-reload=false
 
       - name: waf-enforcer
-        image: my.private.reg/nap/waf-enforcer:5.8.0
+        image: my.private.reg/nap/waf-enforcer:5.9.0
         imagePullPolicy: "IfNotPresent"
         env:
           - name: ENFORCER_PORT
@@ -1947,7 +1947,7 @@ spec:
           - name: app-protect-bd-config
             mountPath: /opt/app_protect/bd_config
       - name: waf-config-mgr
-        image: my.private.reg/nap/waf-config-mgr:5.8.0
+        image: my.private.reg/nap/waf-config-mgr:5.9.0
         imagePullPolicy: "IfNotPresent"
         securityContext:
 
@@ -2519,7 +2519,7 @@ spec:
           - -agent-instance-group=app-protect-wafv5-agentv2-nginx-ingress-controller
 
       - name: waf-enforcer
-        image: my.private.reg/nap/waf-enforcer:5.8.0
+        image: my.private.reg/nap/waf-enforcer:5.9.0
         imagePullPolicy: "IfNotPresent"
         env:
           - name: ENFORCER_PORT
@@ -2530,7 +2530,7 @@ spec:
           - name: app-protect-bd-config
             mountPath: /opt/app_protect/bd_config
       - name: waf-config-mgr
-        image: my.private.reg/nap/waf-config-mgr:5.8.0
+        image: my.private.reg/nap/waf-config-mgr:5.9.0
         imagePullPolicy: "IfNotPresent"
         securityContext:
 

cmd/nginx-ingress/main.go

@@ -12,7 +12,6 @@ import (
 	"os/signal"
 	"path/filepath"
 	"reflect"
-	"regexp"
 	"runtime"
 	"strings"
 	"syscall"
@@ -146,8 +145,7 @@ func main() {
 	if *appProtect {
 		appProtectVersion = getAppProtectVersionInfo(ctx)
 
-		r := regexp.MustCompile("^5.*")
-		if r.MatchString(appProtectVersion) {
+		if _, err := os.Stat("/opt/app_protect/VERSION.common"); os.IsNotExist(err) {
 			appProtectV5 = true
 			appProtectBundlePath = appProtectv5BundleFolder
 		}

tests/Makefile

@@ -123,7 +123,7 @@ run-tests-in-kind: ## Run tests in Kind
 create-kind-cluster: $(KIND_KUBE_CONFIG_FOLDER) ## Create a Kind K8S cluster
 	@kind create cluster \
 		--name $(K8S_CLUSTER_NAME) \
-		--image=kindest/node:v$(K8S_CLUSTER_VERSION) \
+		--image=kindest/node:$(K8S_CLUSTER_VERSION) \
 		--config=<(sed 's/dual/${IP_FAMILY}/' $(ROOT_DIR)/tests/ci-files/ci-kind-config.yaml) \
 		--wait $(K8S_TIMEOUT)
 	@kind get kubeconfig --name $(K8S_CLUSTER_NAME) --internal > $(KIND_KUBE_CONFIG_FOLDER)/config
@@ -164,7 +164,7 @@ run-tests-in-minikube: ## Run tests in Minikube
 
 .PHONY: create-mini-cluster
 create-mini-cluster: $(MINIKUBE_KUBE_CONFIG_FOLDER) ## Create a Minikube K8S cluster
-	@minikube start --kubernetes-version=v$(K8S_CLUSTER_VERSION) \
+	@minikube start --kubernetes-version=$(K8S_CLUSTER_VERSION) \
 	&& KUBECONFIG=$(MINIKUBE_KUBE_CONFIG_FOLDER)/config minikube update-context \
 	&& KUBECONFIG=$(MINIKUBE_KUBE_CONFIG_FOLDER)/config kubectl config set-cluster minikube --server=https://minikube:8443