Skip to content

Commit 2a273f8

Browse files
authored
Merge branch 'main' into mrajagopal-issue-4837
Signed-off-by: Madhu Rajagopal <[email protected]>
2 parents 61f3a2c + 8752533 commit 2a273f8

File tree

169 files changed

+6065
-2877
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

169 files changed

+6065
-2877
lines changed

.github/actions/install-skopeo/action.yml

Lines changed: 0 additions & 33 deletions
This file was deleted.

.github/actions/smoke-tests/action.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,8 @@ runs:
6262
--name test-runner-${{ github.run_id }} \
6363
--network=kind \
6464
-v ${{ github.workspace }}/tests:/workspace/tests \
65+
-v ${{ github.workspace }}/deployments:/workspace/deployments \
66+
-v ${{ github.workspace }}/config:/workspace/config \
6567
-v ~/.kube/kind/config:/root/.kube/config ${{ inputs.test-image }} \
6668
--context=kind-${{ github.run_id }} \
6769
--image=${{ inputs.image-name }}:${{ inputs.tag }} \

.github/config/config-plus-gcr-release

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
export TARGET_REGISTRY=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release
22
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips" "-mktpl" "-alpine-mktpl" "-alpine-mktpl-fips")
33
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl" "-ubi-mktpl" "-alpine-fips")
4+
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips")
45
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl" "-ubi-mktpl")
56
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi" "-mktpl" "-ubi-mktpl")
67
declare -a ADDITIONAL_TAGS=("latest" "${ADDITIONAL_TAG}")

.github/config/config-plus-nginx

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ export TARGET_REGISTRY=docker-mgmt.nginx.com
22
export TARGET_NAP_WAF_DOS_IMAGE_PREFIX="nginx-ic-nap-dos/nginx-plus-ingress"
33
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips")
44
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips")
5+
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips")
56
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi")
67
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi")
78
declare -a ADDITIONAL_TAGS=("latest" "${ADDITIONAL_TAG}")

.github/data/matrix-regression.json

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,14 @@
55
"label": "regression",
66
"image": "debian",
77
"type": "oss",
8+
"marker": "'not upgrade'",
89
"platforms": "linux/arm, linux/arm64, linux/amd64, linux/ppc64le, linux/s390x"
910
},
1011
{
1112
"label": "regression",
1213
"image": "debian-plus",
1314
"type": "plus",
15+
"marker": "'not upgrade'",
1416
"platforms": "linux/arm64, linux/amd64"
1517
}
1618
]

.github/scripts/copy-images.sh

Lines changed: 48 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,14 @@
22

33
set -eo pipefail
44

5+
# shellcheck disable=SC2155
6+
export ROOTDIR=$(git rev-parse --show-toplevel || echo ".")
7+
8+
SKOPEO_BIN=skopeo
9+
if [ -n "$CI" ]; then
10+
SKOPEO_BIN="docker run --rm -v $HOME/.docker/config.json:/tmp/auth.json $(grep skopeo "${ROOTDIR}/tests/Dockerfile" | grep FROM | cut -d ' ' -f 2)"
11+
fi
12+
513
## Setup inputs
614

715
SOURCE_TAG=${SOURCE_TAG:-stable}
@@ -28,17 +36,20 @@ TARGET_OSS_IMAGE_PREFIX=${TARGET_OSS_IMAGE_PREFIX:-"nginx-ic/nginx-ingress"}
2836

2937
SOURCE_PLUS_IMAGE_PREFIX=${SOURCE_PLUS_IMAGE_PREFIX:-"nginx-ic/nginx-plus-ingress"}
3038
SOURCE_NAP_WAF_IMAGE_PREFIX=${SOURCE_NAP_WAF_IMAGE_PREFIX:-"nginx-ic-nap/nginx-plus-ingress"}
39+
SOURCE_NAP_WAFV5_IMAGE_PREFIX=${SOURCE_NAP_WAFV5_IMAGE_PREFIX:-"nginx-ic-nap-v5/nginx-plus-ingress"}
3140
SOURCE_NAP_DOS_IMAGE_PREFIX=${SOURCE_NAP_DOS_IMAGE_PREFIX:-"nginx-ic-dos/nginx-plus-ingress"}
3241
SOURCE_NAP_WAF_DOS_IMAGE_PREFIX=${SOURCE_NAP_WAF_DOS_IMAGE_PREFIX:-"nginx-ic-dos-nap/nginx-plus-ingress"}
3342

3443
TARGET_PLUS_IMAGE_PREFIX=${TARGET_PLUS_IMAGE_PREFIX:-"nginx-ic/nginx-plus-ingress"}
3544
TARGET_NAP_WAF_IMAGE_PREFIX=${TARGET_NAP_WAF_IMAGE_PREFIX:-"nginx-ic-nap/nginx-plus-ingress"}
45+
TARGET_NAP_WAFV5_IMAGE_PREFIX=${TARGET_NAP_WAFV5_IMAGE_PREFIX:-"nginx-ic-nap/nginx-plus-ingress"}
3646
TARGET_NAP_DOS_IMAGE_PREFIX=${TARGET_NAP_DOS_IMAGE_PREFIX:-"nginx-ic-dos/nginx-plus-ingress"}
3747
TARGET_NAP_WAF_DOS_IMAGE_PREFIX=${TARGET_NAP_WAF_DOS_IMAGE_PREFIX:-"nginx-ic-dos-nap/nginx-plus-ingress"}
3848

3949
declare -a OSS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine")
4050
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips")
4151
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips")
52+
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips")
4253
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi")
4354
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi")
4455
declare -a ADDITIONAL_TAGS=("latest" "${ADDITIONAL_TAG}")
@@ -83,7 +94,7 @@ if $PUBLISH_OSS; then
8394
new_tag=${TARGET_REGISTRY}/${TARGET_OSS_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
8495
echo " Pushing image OSS ${new_tag}..."
8596
if ! $DRY_RUN; then
86-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
97+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
8798
fi
8899
for tag in "${ADDITIONAL_TAGS[@]}"; do
89100
if [ -z "${tag}" ]; then
@@ -92,7 +103,7 @@ if $PUBLISH_OSS; then
92103
additional_tag=${TARGET_REGISTRY}/${TARGET_OSS_IMAGE_PREFIX}:${tag}${postfix}
93104
echo " Pushing image OSS ${additional_tag}..."
94105
if ! $DRY_RUN; then
95-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
106+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
96107
fi
97108
done
98109
done
@@ -105,12 +116,12 @@ if $PUBLISH_PLUS; then
105116
image=${SOURCE_REGISTRY}/${SOURCE_PLUS_IMAGE_PREFIX}:${SOURCE_TAG}${postfix}
106117
echo "Processing image ${image}"
107118
new_tag=${TARGET_REGISTRY}/${TARGET_PLUS_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
108-
if $IS_IMMUTABLE && skopeo --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
119+
if $IS_IMMUTABLE && ${SKOPEO_BIN} --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
109120
echo " ECR is immutable & tag ${new_tag} already exists, skipping."
110121
else
111122
echo " Pushing image Plus ${new_tag}..."
112123
if ! $DRY_RUN; then
113-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
124+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
114125
fi
115126
for tag in "${ADDITIONAL_TAGS[@]}"; do
116127
if [ -z "${tag}" ]; then
@@ -119,7 +130,7 @@ if $PUBLISH_PLUS; then
119130
additional_tag=${TARGET_REGISTRY}/${TARGET_PLUS_IMAGE_PREFIX}:${tag}${postfix}
120131
echo " Pushing image Plus ${additional_tag}..."
121132
if ! $DRY_RUN; then
122-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
133+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
123134
fi
124135
done
125136
fi
@@ -133,12 +144,12 @@ if $PUBLISH_WAF; then
133144
image=${SOURCE_REGISTRY}/${SOURCE_NAP_WAF_IMAGE_PREFIX}:${SOURCE_TAG}${postfix}
134145
echo "Processing image ${image}"
135146
new_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAF_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
136-
if $IS_IMMUTABLE && skopeo --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
147+
if $IS_IMMUTABLE && ${SKOPEO_BIN} --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
137148
echo " ECR is immutable & tag ${new_tag} already exists, skipping."
138149
else
139150
echo " Pushing image NAP WAF ${new_tag}..."
140151
if ! $DRY_RUN; then
141-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
152+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
142153
fi
143154
for tag in "${ADDITIONAL_TAGS[@]}"; do
144155
if [ -z "${tag}" ]; then
@@ -147,7 +158,30 @@ if $PUBLISH_WAF; then
147158
additional_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAF_IMAGE_PREFIX}:${tag}${postfix}
148159
echo " Pushing image NAP WAF ${additional_tag}..."
149160
if ! $DRY_RUN; then
150-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
161+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
162+
fi
163+
done
164+
fi
165+
done
166+
for postfix in "${NAP_WAFV5_TAG_POSTFIX_LIST[@]}"; do
167+
image=${SOURCE_REGISTRY}/${SOURCE_NAP_WAFV5_IMAGE_PREFIX}:${SOURCE_TAG}${postfix}
168+
echo "Processing image ${image}"
169+
new_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAFV5_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
170+
if $IS_IMMUTABLE && ${SKOPEO_BIN} --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
171+
echo " ECR is immutable & tag ${new_tag} already exists, skipping."
172+
else
173+
echo " Pushing image NAP WAFV5 ${new_tag}..."
174+
if ! $DRY_RUN; then
175+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
176+
fi
177+
for tag in "${ADDITIONAL_TAGS[@]}"; do
178+
if [ -z "${tag}" ]; then
179+
continue
180+
fi
181+
additional_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAFV5_IMAGE_PREFIX}:${tag}${postfix}
182+
echo " Pushing image NAP WAFV5 ${additional_tag}..."
183+
if ! $DRY_RUN; then
184+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
151185
fi
152186
done
153187
fi
@@ -161,12 +195,12 @@ if $PUBLISH_DOS; then
161195
image=${SOURCE_REGISTRY}/${SOURCE_NAP_DOS_IMAGE_PREFIX}:${SOURCE_TAG}${postfix}
162196
echo "Processing image ${image}"
163197
new_tag=${TARGET_REGISTRY}/${TARGET_NAP_DOS_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
164-
if $IS_IMMUTABLE && skopeo --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
198+
if $IS_IMMUTABLE && ${SKOPEO_BIN} --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
165199
echo " ECR is immutable & tag ${new_tag} already exists, skipping."
166200
else
167201
echo " Pushing image NAP DOS ${new_tag}..."
168202
if ! $DRY_RUN; then
169-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
203+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
170204
fi
171205
for tag in "${ADDITIONAL_TAGS[@]}"; do
172206
if [ -z "${tag}" ]; then
@@ -175,7 +209,7 @@ if $PUBLISH_DOS; then
175209
additional_tag=${TARGET_REGISTRY}/${TARGET_NAP_DOS_IMAGE_PREFIX}:${tag}${postfix}
176210
echo " Pushing image NAP DOS ${additional_tag}..."
177211
if ! $DRY_RUN; then
178-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
212+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
179213
fi
180214
done
181215
fi
@@ -189,12 +223,12 @@ if $PUBLISH_WAF_DOS; then
189223
image=${SOURCE_REGISTRY}/${SOURCE_NAP_WAF_DOS_IMAGE_PREFIX}:${SOURCE_TAG}${postfix}
190224
echo "Processing image ${image}"
191225
new_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAF_DOS_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
192-
if $IS_IMMUTABLE && skopeo --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
226+
if $IS_IMMUTABLE && ${SKOPEO_BIN} --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
193227
echo " ECR is immutable & tag ${new_tag} already exists, skipping."
194228
else
195229
echo " Pushing image NAP WAF/DOS ${new_tag}..."
196230
if ! $DRY_RUN; then
197-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
231+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
198232
fi
199233
for tag in "${ADDITIONAL_TAGS[@]}"; do
200234
if [ -z "${tag}" ]; then
@@ -203,7 +237,7 @@ if $PUBLISH_WAF_DOS; then
203237
additional_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAF_DOS_IMAGE_PREFIX}:${tag}${postfix}
204238
echo " Pushing image NAP WAF/DOS ${additional_tag}..."
205239
if ! $DRY_RUN; then
206-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
240+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
207241
fi
208242
done
209243
fi
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/usr/bin/env bash
2+
3+
set -e
4+
5+
directory=$1
6+
version=$2
7+
tarball_dir=${TARBALL_DIR:-tarballs}
8+
releases=$(find "${directory}" -mindepth 1 -type d)
9+
syft_binary=${SYFT_BIN:-"syft"}
10+
cosign_binary=${COSIGN_BIN:-"cosign"}
11+
12+
if [ ! -d "${tarball_dir}" ]; then
13+
mkdir "${tarball_dir}"
14+
fi
15+
16+
for i in ${releases}; do
17+
# fix for v1 in kubernetes-ingress_linux_amd64_v1
18+
if [[ ${i} =~ v1 ]]; then
19+
mv "${i}" "${i%*_v1}"
20+
i=${i%*_v1}
21+
fi
22+
23+
if [[ ${i} =~ aws ]]; then
24+
continue
25+
fi
26+
product_name=$(basename "${i}" | cut -d '_' -f 1)
27+
product_arch=$(echo "${i}" | cut -d '_' -f 2-)
28+
product_release="${product_name}_${version}_${product_arch}"
29+
# shellcheck disable=SC2086
30+
tarball_name="${tarball_dir}/${product_release}.tar.gz"
31+
cp -r "${i}" "${directory}/${product_release}"
32+
cp README.md LICENSE CHANGELOG.md "${directory}/${product_release}"
33+
34+
tar -czf "${tarball_name}" "${directory}/${product_release}"
35+
${syft_binary} scan file:"${directory}/${product_release}/nginx-ingress" -o spdx-json > "${tarball_name}.spdx.json"
36+
pushd "${tarball_dir}"
37+
sha256sum "${product_release}.tar.gz" >> "${product_name}_${version}_checksums.txt"
38+
sha256sum "${product_release}.tar.gz.spdx.json" >> "${product_name}_${version}_checksums.txt"
39+
popd
40+
done
41+
42+
checksum_file=$(ls "${tarball_dir}"/*_checksums.txt )
43+
${cosign_binary} sign-blob "${checksum_file}" --output-signature="${checksum_file}.sig" --output-certificate="${checksum_file}.pem" -y

.github/scripts/docker-updater.sh

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#!/usr/bin/env bash
2+
3+
set -o pipefail
4+
5+
SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
6+
DOCKER_FILE=${SCRIPT_ROOT}/build/Dockerfile
7+
exclude_strings=""
8+
9+
# Parse command line arguments
10+
while [[ $# -gt 0 ]]; do
11+
key="$1"
12+
case $key in
13+
--exclude)
14+
exclude_strings="$2"
15+
shift
16+
shift
17+
;;
18+
*)
19+
DOCKER_FILE="$1"
20+
shift
21+
;;
22+
esac
23+
done
24+
25+
# Check if the file exists
26+
if [ ! -f "$DOCKER_FILE" ]; then
27+
echo "File $DOCKER_FILE does not exist."
28+
exit 1
29+
fi
30+
31+
function contains_excluded() {
32+
local line="$1"
33+
local exclude="$2"
34+
local IFS=','
35+
local excluded=($exclude)
36+
for word in "${excluded[@]}"; do
37+
if [[ "$line" == *"$word"* ]]; then
38+
return 0
39+
fi
40+
done
41+
return 1
42+
}
43+
44+
function check_sha() {
45+
image_sha="$1"
46+
image=$(echo "$image_sha" | cut -d '@' -f1)
47+
tag_sha=$(echo "$image_sha" | cut -d '@' -f2)
48+
49+
docker pull -q "$image" > /dev/null
50+
latest_digest=$(docker inspect --format='{{index .RepoDigests 0}}' "$image")
51+
latest_sha=$(echo "$latest_digest" | cut -d '@' -f2)
52+
53+
if [ "$tag_sha" = "$latest_sha" ]; then
54+
echo "The provided SHA256 hash is the latest for $image"
55+
else
56+
echo "> A newer version of $image is available:"
57+
echo "> - $image@$tag_sha"
58+
echo "> + $image@$latest_sha"
59+
echo "> updating $DOCKER_FILE"
60+
sed -i -e "s/$tag_sha/$latest_sha/g" "$DOCKER_FILE"
61+
fi
62+
}
63+
if [ -n "$exclude_strings" ]; then
64+
echo "excluding images containing one of: '$exclude_strings'"
65+
fi
66+
while IFS= read -r line; do
67+
if [[ $line =~ ^FROM\ (.+@.+) ]]; then
68+
image=$(echo "${BASH_REMATCH[1]}" | awk '{print $1}')
69+
if [ -n "$exclude_strings" ] && contains_excluded "$line" "$exclude_strings"; then
70+
echo "Skipping $image"
71+
continue
72+
fi
73+
check_sha "$image"
74+
fi
75+
done < "$DOCKER_FILE"

0 commit comments

Comments
 (0)