8000 Add Alpine image with FIPS inside (#4031) · nginx/kubernetes-ingress@5092001 · GitHub
[go: up one dir, main page]
Skip to content

Commit 5092001

Browse files
lucacomelucacome
authored
Add Alpine image with FIPS inside (#4031)
Adds a new image with FIPS module and necessary configuration. The nginx-plus-module-fips-check was added to the base images. This lightweight module adds a line to the nginx output log printing whether FIPS mode is enabled or not.
1 parent 93e086b commit 5092001

File tree

5 files changed

+21
-6
lines changed

5 files changed

+21
-6
lines changed

‎.github/workflows/build-plus.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ jobs:
9090
name=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic${{ contains(inputs.nap_modules, 'dos') && '-dos' || '' }}${{ contains(inputs.nap_modules, 'waf') && '-nap' || '' }}/nginx-plus-ingress,enable=${{ startsWith(github.ref, 'refs/tags/') }}
9191
name=709825985650.dkr.ecr.us-east-1.amazonaws.com/nginx/nginx-plus-ingress${{ contains(inputs.nap_modules, 'dos') && '-dos' || '' }}${{ contains(inputs.nap_modules, 'waf') && '-nap' || '' }},enable=${{ startsWith(github.ref, 'refs/tags/') && contains(inputs.target, 'aws') }}
9292
flavor: |
93-
suffix=${{ contains(inputs.image, 'ubi') && '-ubi' || '' }}${{ contains(inputs.image, 'alpine') && '-alpine' || '' }}${{ contains(inputs.target, 'aws') && '-mktpl' || '' }},onlatest=true
93+
suffix=${{ contains(inputs.image, 'ubi') && '-ubi' || '' }}${{ contains(inputs.image, 'alpine') && '-alpine' || '' }}${{ contains(inputs.target, 'aws') && '-mktpl' || '' }}${{ contains(inputs.image, 'fips') && '-fips' || ''}},onlatest=true
9494
latest=${{ contains(inputs.target, 'aws') && 'false' || 'auto' }}
9595
tags: |
9696
type=edge

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -327,7 +327,7 @@ jobs:
327327
strategy:
328328
fail-fast: false
329329
matrix:
330-
image: [debian-plus, alpine-plus]
330+
image: [debian-plus, alpine-plus, alpine-plus-fips]
331331
platforms: ["linux/arm64, linux/amd64"]
332332
target: [goreleaser, aws]
333333
include:

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,10 @@ alpine-image: build ## Create Docker image for Ingress Controller (Alpine)
107107
alpine-image-plus: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus)
108108
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus
109109

110+
.PHONY: alpine-image-plus-fips
111+
alpine-image-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus and FIPS)
112+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-fips
113+
110114
.PHONY: debian-image-plus
111115
debian-image-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus)
112116
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus

‎build/Dockerfile‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,21 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/apk/cert.pem,mode=0644 \
4242
--mount=type=bind,from=alpine-opentracing-lib,target=/tmp/ot/ \
4343
wget -nv -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub \
4444
&& printf "%s\n" "https://pkgs.nginx.com/plus/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
45-
&& apk add --no-cache nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing libcap libcurl \
45+
&& apk add --no-cache nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing nginx-plus-module-fips-check libcap libcurl \
4646
&& cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
4747
&& ldconfig /usr/local/lib/
4848

4949

50+
############################################# Base image for Alpine with NGINX Plus and FIPS #############################################
51+
FROM alpine-plus as alpine-plus-fips
52+
53+
RUN --mount=type=bind,from=ghcr.io/nginxinc/alpine-fips:0.1.0-alpine3.17,target=/tmp/fips/ \
54+
mkdir -p /usr/ssl \
55+
&& cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \
56+
&& cp -av /tmp/fips/usr/ssl/fipsmodule.cnf /usr/ssl/fipsmodule.cnf \
57+
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf
58+
59+
5060
############################################# Base image for Debian with NGINX Plus #############################################
5161
FROM debian:11-slim AS debian-plus
5262
ARG IC_VERSION
@@ -65,7 +75,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
6575
&& printf "%s\n" "Acquire::https::pkgs.nginx.com::User-Agent \"k8s-ic-$IC_VERSION${BUILD_OS##debian-plus}-apt\";" >> /etc/apt/apt.conf.d/90pkgs-nginx \
6676
&& printf "%s\n" "deb https://pkgs.nginx.com/plus/${NGINX_PLUS_VERSION}/debian ${DEBIAN_VERSION} nginx-plus" > /etc/apt/sources.list.d/nginx-plus.list \
6777
&& apt-get update \
68-
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing libcap2-bin libcurl4 \
78+
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing nginx-plus-module-fips-check libcap2-bin libcurl4 \
6979
&& apt-get purge --auto-remove -y apt-transport-https gnupg curl \
7080
&& cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
7181
&& ldconfig \
@@ -133,7 +143,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
133143
&& rpm --import https://cs.nginx.com/static/keys/nginx_signing.key \
134144
&& curl -fsSL "https://cs.nginx.com/static/files/plus-$(grep -E -o '[0-9]+\.[0-9]+' /etc/redhat-release | cut -d"." -f1).repo" | tr 0 1 > /etc/yum.repos.d/nginx-plus.repo \
135145
&& sed -i "0,/centos/s;;${NGINX_PLUS_VERSION}/centos;" /etc/yum.repos.d/nginx-plus.repo \
136-
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs \
146+
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check \
137147
&& microdnf remove -y shadow-utils \
138148
&& microdnf clean all
139149

@@ -154,7 +164,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
154164
&& rpm --import https://cs.nginx.com/static/keys/nginx_signing.key \
155165
&& curl -fsSL "https://cs.nginx.com/static/files/nginx-plus-$(grep -E -o '[0-9]+\.[0-9]+' /etc/redhat-release | cut -d"." -f1).repo" | tr 0 1 > /etc/yum.repos.d/nginx-plus.repo \
156166
&& sed -i "0,/centos/s;;${NGINX_PLUS_VERSION}/centos;" /etc/yum.repos.d/nginx-plus.repo \
157-
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs \
167+
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check \
158168
# temp fix for CVE-2023-24329
159169
&& dnf upgrade -y platform-python \
160170
## end of duplicated code

‎internal/configs/version1/nginx-plus.tmpl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ load_module modules/ngx_http_app_protect_module.so;
2121
{{- if .AppProtectDosLoadModule}}
2222
load_module modules/ngx_http_app_protect_dos_module.so;
2323
{{- end}}
24+
load_module modules/ngx_fips_check_module.so;
2425
{{- if .MainSnippets}}
2526
{{range $value := .MainSnippets}}
2627
{{$value}}{{end}}

0 commit comments

Comments
 (0)
0