8000 Merge branch 'main' into chore/update-schema-ref · nginx/kubernetes-ingress@02a9d82 · GitHub
[go: up one dir, main page]
Skip to content

Commit 02a9d82

Browse files
lucacomelucacome
authored
Merge branch 'main' into chore/update-schema-ref
2 parents be5facc + 876a0f6 commit 02a9d82

File tree

10 files changed

+481
-28
lines changed

10 files changed

+481
-28
lines changed

‎.github/workflows/build-oss.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ jobs:
147147
ignore-unfixed: 'true'
148148

149149
- name: Upload Trivy scan results to GitHub Security tab
150-
uses: github/codeql-action/upload-sarif@39d8d7e78f59cf6b40ac3b9fbebef0c753d7c9e5 # v2.2.2
150+
uses: github/codeql-action/upload-sarif@8775e868027fa230df8586bdf502bbd9b618a477 # v2.2.3
151151
continue-on-error: true
152152
with:
153153
sarif_file: 'trivy-results-${{ inputs.image }}.sarif'

‎.github/workflows/build-plus.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ jobs:
153153
ignore-unfixed: 'true'
154154

155155
- name: Upload Trivy scan results to GitHub Security tab
156-
uses: github/codeql-action/upload-sarif@39d8d7e78f59cf6b40ac3b9fbebef0c753d7c9e5 # v2.2.2
156+
uses: github/codeql-action/upload-sarif@8775e868027fa230df8586bdf502bbd9b618a477 # v2.2.3
157157
continue-on-error: true
158158
with:
159159
sarif_file: 'trivy-results-${{ inputs.image }}.sarif'

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636

3737
# Initializes the CodeQL tools for scanning.
3838
- name: Initialize CodeQL
39-
uses: github/codeql-action/init@39d8d7e78f59cf6b40ac3b9fbebef0c753d7c9e5 # v2.2.2
39+
uses: github/codeql-action/init@8775e868027fa230df8586bdf502bbd9b618a477 # v2.2.3
4040
with:
4141
languages: ${{ matrix.language }}
4242
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -47,7 +47,7 @@ jobs:
4747
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
4848
# If this step fails, then you should remove it and run the build manually (see below)
4949
- name: Autobuild
50-
uses: github/codeql-action/autobuild@39d8d7e78f59cf6b40ac3b9fbebef0c753d7c9e5 # v2.2.2
50+
uses: github/codeql-action/autobuild@8775e868027fa230df8586bdf502bbd9b618a477 # v2.2.3
5151

5252
# ℹ️ Command-line programs to run using the OS shell.
5353
# 📚 https://git.io/JvXDl
@@ -61,4 +61,4 @@ jobs:
6161
# make release
6262

6363
- name: Perform CodeQL Analysis
64-
uses: github/codeql-action/analyze@39d8d7e78f59cf6b40ac3b9fbebef0c753d7c9e5 # v2.2.2
64+
uses: github/codeql-action/analyze@8775e868027fa230df8586bdf502bbd9b618a477 # v2.2.3

‎.github/workflows/scorecards.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@ jobs:
5353

5454
# Upload the results to GitHub's code scanning dashboard.
5555
- name: "Upload to code-scanning"
56-
uses: github/codeql-action/upload-sarif@39d8d7e78f59cf6b40ac3b9fbebef0c753d7c9e5 # v2.2.2
56+
uses: github/codeql-action/upload-sarif@8775e868027fa230df8586bdf502bbd9b618a477 # v2.2.3
5757
with:
5858
sarif_file: results.sarif

‎build/Dockerfile‎

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ FROM nginx:1.23.3-alpine AS alpine
2626

2727
RUN --mount=type=bind,from=alpine-opentracing-lib,target=/tmp/ot/ \
2828
apk add --no-cache libcap libstdc++ \
29-
# temp fix for CVE-2022-44617
30-
&& apk upgrade --no-cache libxpm \
29+
# temp fix for CVE-2022-44617 and CVE-2023-0286
30+
&& apk upgrade --no-cache libxpm libssl3 libcrypto3 \
3131
&& cp -av /tmp/ot/usr/local/lib/libopentracing.so* /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
3232
&& cp -av /tmp/ot/usr/lib/nginx/modules/ngx_http_opentracing_module.so /usr/lib/nginx/modules/ \
3333
&& ldconfig /usr/local/lib/
@@ -43,6 +43,8 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/apk/cert.pem,mode=0644 \
4343
wget -nv -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub \
4444
&& printf "%s\n" "https://pkgs.nginx.com/plus/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
4545
&& apk add --no-cache libcap nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing libcurl \
46+
# temp fix for CVE-2023-0286
47+
&& apk upgrade --no-cache libssl3 libcrypto3 \
4648
&& cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
4749
&& ldconfig /usr/local/lib/
4850

@@ -122,32 +124,42 @@ COPY --link --chown=101:0 LICENSE /licenses/
122124

123125

124126
############################################# Base image for UBI with NGINX Plus #############################################
125-
FROM redhat/ubi8:8.6 AS ubi-plus
127+
FROM redhat/ubi9-minimal AS ubi-plus
126128
ARG NGINX_PLUS_VERSION
127129

128130
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
129131
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
130132
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
131-
dnf --nodocs install -y shadow-utils ca-certificates \
132-
# temp fix for CVE-2022-1304 CVE-2016-3709, CVE-2022-42898, CVE-2022-42010, CVE-2022-43680, CVE-2022-3821, CVE-2021-46848 and CVE-2022-35737
133-
&& dnf --nodocs upgrade -y libcom_err libxml2 krb5-libs dbus expat systemd libtasn1 sqlite-libs \
133+
microdnf --nodocs install -y shadow-utils \
134134
&& groupadd --system --gid 101 nginx \
135135
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
136136
&& rpm --import https://cs.nginx.com/static/keys/nginx_signing.key \
137-
&& curl -fsSL "https://cs.nginx.com/static/files/nginx-plus-$(grep -E -o '[0-9]+\.[0-9]+' /etc/redhat-release | cut -d"." -f1).repo" | tr 0 1 > /etc/yum.repos.d/nginx-plus.repo \
137+
&& curl -fsSL "https://cs.nginx.com/static/files/plus-$(grep -E -o '[0-9]+\.[0-9]+' /etc/redhat-release | cut -d"." -f1).repo" | tr 0 1 > /etc/yum.repos.d/nginx-plus.repo \
138138
&& sed -i "0,/centos/s;;${NGINX_PLUS_VERSION}/centos;" /etc/yum.repos.d/nginx-plus.repo \
139-
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs
140-
139+
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs \
140+
&& microdnf remove -y shadow-utils \
141+
&& microdnf clean all
141142

142143
############################################# Base image for UBI with NGINX Plus and App Protect WAF/DoS #############################################
143-
FROM ubi-plus as ubi-plus-nap
144+
FROM redhat/ubi8:8.6 as ubi-plus-nap
144145
ARG NGINX_PLUS_VERSION
145146
ARG NAP_MODULES
146147

147148
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
148149
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
149150
--mount=type=secret,id=rhel_license,dst=/tmp/rhel_license,mode=0644 \
150151
source /tmp/rhel_license \
152+
## the code below is duplicated from the ubi-plus image because NAP doesn't support UBI versions newer than 8.6
153+
dnf --nodocs install -y shadow-utils ca-certificates \
154+
# temp fix for CVE-2022-1304 CVE-2016-3709, CVE-2022-42898, CVE-2022-42010, CVE-2022-43680, CVE-2022-3821, CVE-2021-46848, CVE-2022-35737 and CVE-2022-47629
155+
&& dnf --nodocs upgrade -y libcom_err libxml2 krb5-libs dbus expat systemd libtasn1 sqlite-libs libksba \
156+
&& groupadd --system --gid 101 nginx \
157+
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
158+
&& rpm --import https://cs.nginx.com/static/keys/nginx_signing.key \
159+
&& curl -fsSL "https://cs.nginx.com/static/files/nginx-plus-$(grep -E -o '[0-9]+\.[0-9]+' /etc/redhat-release | cut -d"." -f1).repo" | tr 0 1 > /etc/yum.repos.d/nginx-plus.repo \
160+
&& sed -i "0,/centos/s;;${NGINX_PLUS_VERSION}/centos;" /etc/yum.repos.d/nginx-plus.repo \
161+
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs \
162+
## end of duplicated code
151163
&& subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} || true \
152164
&& subscription-manager attach \
153165
&& dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \

‎docs/content/technical-specifications.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ NGINX Plus images are available through the F5 Container registry `private-regis
6767
|Debian-based image with App Protect WAF | ``debian:11-slim`` | NGINX Plus App Protect WAF, JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic-nap/nginx-plus-ingress:3.0.1` | amd64 |
6868
|Debian-based image with App Protect DoS | ``debian:11-slim`` | NGINX Plus App Protect DoS, JavaScript module and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic-dos/nginx-plus-ingress:3.0.1` | amd64 |
6969
|Debian-based image with App Protect WAF and DoS | ``debian:11-slim`` | NGINX Plus App Protect WAF, DoS, JavaScript and OpenTracing modules, OpenTracing tracers for Jaeger, Zipkin and Datadog | `nginx-ic-nap-dos/nginx-plus-ingress:3.0.1` | amd64 |
70-
|Ubi-based image | ``redhat/ubi8`` | NGINX Plus JavaScript module | `nginx-ic/nginx-plus-ingress:3.0.1-ubi` | arm64, amd64, s390x |
70+
|Ubi-based image | ``redhat/ubi9-minimal`` | NGINX Plus JavaScript module | `nginx-ic/nginx-plus-ingress:3.0.1-ubi` | arm64, amd64, s390x |
7171
|Ubi-based image with App Protect WAF | ``redhat/ubi8`` | NGINX Plus App Protect WAF and JavaScript modules | `nginx-ic-nap/nginx-plus-ingress:3.0.1-ubi` | amd64 |
7272
|Ubi-based image with App Protect DoS | ``redhat/ubi8`` | NGINX Plus App Protect DoS and JavaScript modules | `nginx-ic-dos/nginx-plus-ingress:3.0.1-ubi` | amd64 |
7373
|Ubi-based image with App P 6D38 rotect WAF and DoS | ``redhat/ubi8`` | NGINX Plus App Protect WAF, DoS and JavaScript modules | `nginx-ic-nap-dos/nginx-plus-ingress:3.0.1-ubi` | amd64 |

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.20
44

55
require (
66
github.com/aws/aws-sdk-go-v2/config v1.18.12
7-
github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.14.1
7+
github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.14.2
88
github.com/cert-manager/cert-manager v1.11.0
99
github.com/go-chi/chi/v5 v5.0.8
1010
github.com/golang-jwt/jwt/v4 v4.4.3

‎go.sum‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@ github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRF
4747
github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
4848
github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
4949
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
50-
github.com/aws/aws-sdk-go-v2 v1.17.3/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
5150
github.com/aws/aws-sdk-go-v2 v1.17.4 h1:wyC6p9Yfq6V2y98wfDsj6OnNQa4w2BLGCLIxzNhwOGY=
5251
github.com/aws/aws-sdk-go-v2 v1.17.4/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
5352
github.com/aws/aws-sdk-go-v2/config v1.18.12 h1:fKs/I4wccmfrNRO9rdrbMO1NgLxct6H9rNMiPdBxHWw=
@@ -56,18 +55,16 @@ github.com/aws/aws-sdk-go-v2/credentials v1.13.12 h1:Cb+HhuEnV19zHRaYYVglwvdHGMJ
5655
github.com/aws/aws-sdk-go-v2/credentials v1.13.12/go.mod h1:37HG2MBroXK3jXfxVGtbM2J48ra2+Ltu+tmwr/jO0KA=
5756
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.22 h1:3aMfcTmoXtTZnaT86QlVaYh+BRMbvrrmZwIQ5jWqCZQ=
5857
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.22/go.mod h1:YGSIJyQ6D6FjKMQh16hVFSIUD54L4F7zTGePqYMYYJU=
59-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.27/go.mod h1:a1/UpzeyBBerajpnP5nGZa9mGzsBn5cOKxm6NWQsvoI=
6058
github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.28 h1:r+XwaCLpIvCKjBIYy/HVZujQS9tsz5ohHG3ZIe0wKoE=
6159
github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.28/go.mod h1:3lwChorpIM/BhImY/hy+Z6jekmN92cXGPI1QJasVPYY=
62-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.21/go.mod h1:+Gxn8jYn5k9ebfHEqlhrMirFjSW0v0C9fI+KN5vk2kE=
6360
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.22 h1:7AwGYXDdqRQYsluvKFmWoqpcOQJ4bH634SkYf3FNj/A=
6461
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.22/go.mod h1:EqK7gVrIGAHyZItrD1D8B0ilgwMD1GiWAmbU4u/JHNk=
6562
github.com/aws/aws-sdk-go-v2/internal/ini v1.3.29 h1:J4xhFd6zHhdF9jPP0FQJ6WknzBboGMBNjKOv4iTuw4A=
6663
github.com/aws/aws-sdk-go-v2/internal/ini v1.3.29/go.mod h1:TwuqRBGzxjQJIwH16/fOZodwXt2Zxa9/cwJC5ke4j7s=
6764
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.22 h1:LjFQf8hFuMO22HkV5VWGLBvmCLBCLPivUAmpdpnp4Vs=
6865
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.22/go.mod h1:xt0Au8yPIwYXf/GYPy/vl4K3CgwhfQMYbrH7DlUUIws=
69-
github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.14.1 h1:IOjpqwEHMYPVfiqnH/auHvhz69/SGHYo/tFBkax5O0o=
70-
github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.14.1/go.mod h1:DSuypbY6jb7WZSxrLuCgd7ouB5uRQ+Hg5wbt0GmgRcc=
66+
github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.14.2 h1:7vuSkPqVqwBwSV0OJD71qqWOEFr3Hh1K0e2yOQ/JWwQ=
67+
github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.14.2/go.mod h1:vrZVsmrC7QRNBK/W8nplI0tfJDvMl6DZAUT/pkFJiws=
7168
github.com/aws/aws-sdk-go-v2/service/sso v1.12.1 h1:lQKN/LNa3qqu2cDOQZybP7oL4nMGGiFqob0jZJaR8/4=
7269
github.com/aws/aws-sdk-go-v2/service/sso v1.12.1/go.mod h1:IgV8l3sj22nQDd5qcAGY0WenwCzCphqdbFOpfktZPrI=
7370
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.1 h1:0bLhH6DRAqox+g0LatcjGKjjhU6Eudyys6HB6DJVPj8=

‎internal/k8s/controller.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3567,6 +3567,9 @@ func getEndpointsFromEndpointSlicesForSubselectedPods(targetPort int32, pods []*
35673567
continue
35683568
}
35693569
for _, endpoint := range endpointSlice.Endpoints {
3570+
if !*endpoint.Conditions.Ready {
3571+
continue
3572+
}
35703573
for _, address := range endpoint.Addresses {
35713574
if pod.Status.PodIP == address {
35723575
addr := ipv6SafeAddrPort(pod.Status.PodIP, targetPort)
@@ -3718,6 +3721,9 @@ func (lbc *LoadBalancerController) getEndpointsForPortFromEndpointSlices(endpoin
37183721
for _, endpointSlicePort := range endpointSlice.Ports {
37193722
if *endpointSlicePort.Port == targetPort {
37203723
for _, endpoint := range endpointSlice.Endpoints {
3724+
if !*endpoint.Conditions.Ready {
3725+
continue
3726+
}
37213727
for _, endpointAddress := range endpoint.Addresses {
37223728
address := ipv6SafeAddrPort(endpointAddress, *endpointSlicePort.Port)
37233729
podEndpoint := podEndpoint{

0 commit comments

Comments
 (0)
0